viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

upgrades: fix hourly gotenberg error + cap update notifications at weekly
All checks were successful
ci/woodpecker/push/default Pipeline was successful
Details

Browse source 
Viktor was getting upgrade-error Slack messages every hour and wants
update notifications at most weekly. Root cause of the errors: Keel kept
trying to roll gotenberg 8.25->8.25.1 in paperless-ngx but kyverno's
require-trusted-registries denied it — gotenberg/* (and apache/*, which
tika will hit next) were never allowlisted, and Keel's Slack notifier at
info level re-posted the identical failure to #general on every hourly
poll since Jun 28.

Changes: allowlist gotenberg/* + apache/* so the patch applies cleanly;
disable Keel's direct Slack notifier and replace failure visibility with
a KeelUpdateFailing Loki-ruler alert (alert-on-change: one notification
plus the daily digest, never an hourly drip); remove diun's Slack
notifier whose default message @channel-pinged #image-updates for every
new upstream tag every 6h (the n8n upgrade-agent webhook feed is
untouched). The k8s upgrade report is already weekly (Mon 06:07 UTC).
Paperless-ngx itself stays paused (keel policy=never, user-managed) while
the ingest runs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-07-02 07:16:50 +00:00
parent 5d5d9752cb
commit a64d2ba2b9
5 changed files with 39 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

18
stacks/diun/main.tf
View file

@ -9,7 +9,7 @@ resource "kubernetes_namespace" "diun" {
name = "diun"
labels = {
"istio-injection" : "disabled"
tier = local.tiers.aux
tier = local.tiers.aux
"keel.sh/enrolled" = "true"
}
}
@ -203,16 +203,10 @@ resource "kubernetes_deployment" "diun" {
name = "DIUN_NOTIF_WEBHOOK_HEADERS_CONTENT-TYPE"
value = "application/json"
}
# Slack notifier (independent notification channel)
env {
name = "DIUN_NOTIF_SLACK_WEBHOOKURL"
value_from {
secret_key_ref {
name = "diun-secrets"
key = "slack_url"
}
}
}
# Slack notifier REMOVED (2026-07-02): diun's default Slack message
# <!channel>-pinged #image-updates for every new upstream tag (every
# 6h watch cycle). The n8n webhook feed above remains the machine
# consumer; humans get the weekly upgrade report instead.
env {
name = "LOG_LEVEL"
value = "debug"
@ -242,7 +236,7 @@ resource "kubernetes_deployment" "diun" {
}
lifecycle {
ignore_changes = [
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE — Keel manages tag updates
metadata[0].annotations["keel.sh/policy"],
metadata[0].annotations["keel.sh/trigger"],