fix(container): update image ghcr.io/home-operations/charts/tuppr ( 0.0.52 ➔ 0.0.75 )

[mortyops]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/charts/tuppr	patch	0.0.52 → 0.0.75

---

Release Notes

home-operations/tuppr (ghcr.io/home-operations/charts/tuppr)

v0.0.75

Compare Source

What's Changed

• fix(crds): remove duplicated validation policy for job phase by @​eleboucher in #​140

Full Changelog: home-operations/tuppr@0.0.74...0.0.75

v0.0.74

Compare Source

What's Changed

• fix: harden e2e-test resources cleanup by @​bo0tzz in #​131
• feat(deps): update module github.com/netresearch/go-cron (v0.12.0 → v0.13.0) by @​sticky-gecko[bot] in #​132
• fix(deps): update module github.com/google/go-containerregistry (v0.21.0 → v0.21.1) by @​sticky-gecko[bot] in #​134
• fix(deps): update kubernetes packages (v0.35.1 → v0.35.2) by @​sticky-gecko[bot] in #​137
• ci(github-action)!: Update GitHub Artifact Actions (major) by @​sticky-gecko[bot] in #​136
• fix: retry with new cert when Talos client certificate expires by @​eleboucher in #​138
• fix: register cache index at startup for drain by @​Blamas in #​133
• fix: workaround for tofu cleanup state lock by @​bo0tzz in #​139

New Contributors

• @​Blamas made their first contribution in #​133

Full Changelog: home-operations/tuppr@0.0.73...0.0.74

v0.0.73

Compare Source

What's Changed

• fix: rebooting phase would never be activated by @​onedr0p in #​122
• feat(deps): update module github.com/netresearch/go-cron (v0.11.0 → v0.12.0) by @​sticky-gecko[bot] in #​123
• feat(deps): update module google.golang.org/grpc (v1.78.0 → v1.79.1) by @​sticky-gecko[bot] in #​124
• feat: e2e tests on hetzner cloud by @​bo0tzz in #​125
• feat: gha workflow for Hetzner e2e tests by @​bo0tzz in #​126
• feat(deps): update module github.com/google/go-containerregistry (v0.20.7 → v0.21.0) by @​sticky-gecko[bot] in #​127
• fix: error on talosctl version detection failure instead of falling back to latest by @​eleboucher in #​130

New Contributors

• @​bo0tzz made their first contribution in #​125

Full Changelog: home-operations/tuppr@0.0.72...0.0.73

v0.0.72

Compare Source

What's Changed

• feat: implement log level and update existing log messages by @​onedr0p in #​121

Full Changelog: home-operations/tuppr@0.0.71...0.0.72

v0.0.71

Compare Source

What's Changed

• chore: update readme with safe upgrade paths by @​onedr0p in #​118
• Add MaintenanceWindow phase by @​eleboucher in #​120

Full Changelog: home-operations/tuppr@0.0.70...0.0.71

v0.0.70

Compare Source

What's Changed

• chore: refactor coordinator rules by @​eleboucher in #​114
• fix: add healthchecking phase by @​onedr0p in #​117

Full Changelog: home-operations/tuppr@0.0.69...0.0.70

v0.0.69

Compare Source

What's Changed

• feat: add node labels during upgrades by @​bellorr in #​110
• fix: improve phases by @​onedr0p in #​115
• chore: reduce github action usage by improving starting event by @​eleboucher in #​116

New Contributors

• @​bellorr made their first contribution in #​110

Full Changelog: home-operations/tuppr@0.0.68...0.0.69

v0.0.68

Compare Source

What's Changed

• fix(talosupgrade): retry on transient errors by @​eleboucher in #​113

Full Changelog: home-operations/tuppr@0.0.67...0.0.68

v0.0.67

Compare Source

What's Changed

• feat: configure drain behavior by @​eleboucher in #​112

Full Changelog: home-operations/tuppr@0.0.66...0.0.67

v0.0.66

Compare Source

What's Changed

• refactor: split files structure by @​eleboucher in #​111

Full Changelog: home-operations/tuppr@0.0.65...0.0.66

v0.0.65

Compare Source

What's Changed

• fix(k8s-upgrade): reprocess partial update by @​eleboucher in #​109

Full Changelog: home-operations/tuppr@0.0.64...0.0.65

v0.0.64

Compare Source

What's Changed

• test: add integration testing to test upgrades by @​eleboucher in #​94
• nodeSelector belongs to TalosUpgrade by @​Kariton in #​107
• chore: requeue when waiting for node to be ready by @​eleboucher in #​106

New Contributors

• @​Kariton made their first contribution in #​107

Full Changelog: home-operations/tuppr@0.0.63...0.0.64

v0.0.63

Compare Source

What's Changed

• feat: Add node selector for talosupgrade by @​eleboucher in #​103
• chore(helm): support envs, volumes and volume mounts by @​ajgon in #​104

New Contributors

• @​ajgon made their first contribution in #​104

Full Changelog: home-operations/tuppr@0.0.62...0.0.63

v0.0.62

Compare Source

What's Changed

• feat: Allow overriding talos schematic and version through node annotations by @​eleboucher in #​102

Full Changelog: home-operations/tuppr@0.0.61...0.0.62

v0.0.61

Compare Source

What's Changed

• feat: Check image availability before creating a new job by @​eleboucher in #​100
• fix: keep k8s update waiting in case a talos update is pending by @​eleboucher in #​101

Full Changelog: home-operations/tuppr@0.0.60...0.0.61

v0.0.60

Compare Source

What's Changed

• feat(deps): update module sigs.k8s.io/controller-runtime (v0.22.4 → v0.23.1) by @​sticky-gecko[bot] in #​76
• refactor: make webhook validation logic DRY by @​eleboucher in #​98
• fix: single node clusters would fail to upgrade talos by @​onedr0p in #​99

Full Changelog: home-operations/tuppr@0.0.59...0.0.60

v0.0.59

Compare Source

What's Changed

• feat: add maintenance window support by @​eleboucher in #​91

Full Changelog: home-operations/tuppr@0.0.58...0.0.59

v0.0.58

Compare Source

What's Changed

• fix: allow repo without tags but not the other way around by @​eleboucher in #​97

Full Changelog: home-operations/tuppr@0.0.57...0.0.58

v0.0.57

Compare Source

What's Changed

• fix: correctly handle cert creation by @​eleboucher in #​95

Full Changelog: home-operations/tuppr@0.0.56...0.0.57

v0.0.56

Compare Source

What's Changed

• fix: handle missing cert during startup by @​eleboucher in #​93

Full Changelog: home-operations/tuppr@0.0.55...0.0.56

v0.0.55

Compare Source

What's Changed

• feat: use self-signed cert to remove cert-manager deps by @​eleboucher in #​92

Full Changelog: home-operations/tuppr@0.0.54...0.0.55

v0.0.54

Compare Source

What's Changed

• feat(deps): update module github.com/cosi-project/runtime (v1.13.0 → v1.14.0) by @​sticky-gecko[bot] in #​86
• fix(deps): update module github.com/siderolabs/talos/pkg/machinery (v1.12.3 → v1.12.4) by @​sticky-gecko[bot] in #​87
• test: add comprehensive test suite for controllers by @​eleboucher in #​88
• test: add comprehensive test suite for the webhooks by @​eleboucher in #​90
• feat(container): update image golang (1.25 → 1.26) by @​sticky-gecko[bot] in #​84

New Contributors

• @​eleboucher made their first contribution in #​88

Full Changelog: home-operations/tuppr@0.0.53...0.0.54

v0.0.53

Compare Source

What's Changed

• fix(README): fix talos upgrade troubleshooting command by @​chrede88 in #​79
• fix(deps): update module github.com/siderolabs/talos/pkg/machinery (v1.12.1 → v1.12.3) by @​sticky-gecko[bot] in #​77
• fix(deps): update module github.com/onsi/gomega (v1.39.0 → v1.39.1) by @​sticky-gecko[bot] in #​80
• fix(deps): update module github.com/onsi/ginkgo/v2 (v2.28.0 → v2.28.1) by @​sticky-gecko[bot] in #​82
• chore(deps): update k8s.io/utils digest (914a6e7 → b8788ab) by @​sticky-gecko[bot] in #​83
• fix(deps): update kubernetes packages (v0.35.0 → v0.35.1) by @​sticky-gecko[bot] in #​85
• feat(deps): update module github.com/google/cel-go (v0.26.1 → v0.27.0) by @​sticky-gecko[bot] in #​81

New Contributors

• @​chrede88 made their first contribution in #​79

Full Changelog: home-operations/tuppr@0.0.52...0.0.53

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[mortyops]

--- HelmRelease: system-upgrade/tuppr ClusterRole: system-upgrade/tuppr-manager-role

+++ HelmRelease: system-upgrade/tuppr ClusterRole: system-upgrade/tuppr-manager-role

@@ -23,14 +23,45 @@

   verbs:
   - create
   - patch
 - apiGroups:
   - ''
   resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - delete
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+- apiGroups:
+  - ''
+  resources:
+  - pods/eviction
+  verbs:
+  - create
+- apiGroups:
+  - ''
+  resources:
   - nodes
-  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - patch
+  - update
+- apiGroups:
+  - ''
+  resources:
   - secrets
   verbs:
   - get
   - list
   - watch
 - apiGroups:
@@ -71,7 +102,28 @@

   - kubernetesupgrades/status
   - talosupgrades/status
   verbs:
   - get
   - patch
   - update
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - create
+  - update
+  - patch
+  - get
+  - list
+  - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  verbs:
+  - get
+  - list
+  - watch
+  - patch
+  - update
 
--- HelmRelease: system-upgrade/tuppr Deployment: system-upgrade/tuppr

+++ HelmRelease: system-upgrade/tuppr Deployment: system-upgrade/tuppr

@@ -35,22 +35,27 @@

           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 65532
-        image: ghcr.io/home-operations/tuppr:0.0.52
+        image: ghcr.io/home-operations/tuppr:0.0.75
         imagePullPolicy: IfNotPresent
         command:
         - /manager
         args:
+        - --log-level=debug
         - --leader-elect=true
         - --metrics-bind-address=:8080
         - --health-probe-bind-address=:8081
         - --talosconfig-secret=tuppr-talosconfig
         - --metrics-secure=false
+        - --metrics-service-name=tuppr-metrics-service
+        - --webhook-config-name=tuppr-validating-webhook
+        - --webhook-service-name=tuppr-webhook-service
+        - --webhook-secret-name=tuppr-webhook-server-cert
         env:
         - name: CONTROLLER_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         ports:
@@ -76,13 +81,12 @@

           initialDelaySeconds: 5
           periodSeconds: 10
         resources: {}
         volumeMounts:
         - mountPath: /tmp/k8s-webhook-server/serving-certs
           name: cert
-          readOnly: true
         - name: talosconfig
           mountPath: /var/run/secrets/talos.dev
           readOnly: true
       volumes:
       - name: cert
         secret:
--- HelmRelease: system-upgrade/tuppr Certificate: system-upgrade/tuppr-serving-cert

+++ HelmRelease: system-upgrade/tuppr Certificate: system-upgrade/tuppr-serving-cert

@@ -1,23 +0,0 @@

----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: tuppr-serving-cert
-  namespace: system-upgrade
-  labels:
-    app.kubernetes.io/name: tuppr
-    app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/managed-by: Helm
-spec:
-  dnsNames:
-  - tuppr-webhook-service.system-upgrade.svc
-  - tuppr-webhook-service.system-upgrade.svc.cluster.local
-  issuerRef:
-    kind: Issuer
-    name: tuppr-selfsigned-issuer
-  secretName: tuppr-webhook-server-cert
-  privateKey:
-    rotationPolicy: Always
-  duration: 8760h
-  renewBefore: 720h
-
--- HelmRelease: system-upgrade/tuppr Issuer: system-upgrade/tuppr-selfsigned-issuer

+++ HelmRelease: system-upgrade/tuppr Issuer: system-upgrade/tuppr-selfsigned-issuer

@@ -1,13 +0,0 @@

----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: tuppr-selfsigned-issuer
-  namespace: system-upgrade
-  labels:
-    app.kubernetes.io/name: tuppr
-    app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/managed-by: Helm
-spec:
-  selfSigned: {}
-
--- HelmRelease: system-upgrade/tuppr ValidatingWebhookConfiguration: system-upgrade/tuppr-validating-webhook

+++ HelmRelease: system-upgrade/tuppr ValidatingWebhookConfiguration: system-upgrade/tuppr-validating-webhook

@@ -0,0 +1,51 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: tuppr-validating-webhook
+  labels:
+    app.kubernetes.io/name: tuppr
+    app.kubernetes.io/instance: tuppr
+    app.kubernetes.io/managed-by: Helm
+webhooks:
+- name: vkubernetesupgrade.kb.io
+  admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tuppr-webhook-service
+      namespace: system-upgrade
+      path: /validate-tuppr-home-operations-com-v1alpha1-kubernetesupgrade
+  failurePolicy: Fail
+  sideEffects: None
+  rules:
+  - apiGroups:
+    - tuppr.home-operations.com
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - kubernetesupgrades
+- name: vtalosupgrade.kb.io
+  admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: tuppr-webhook-service
+      namespace: system-upgrade
+      path: /validate-tuppr-home-operations-com-v1alpha1-talosupgrade
+  failurePolicy: Fail
+  sideEffects: None
+  rules:
+  - apiGroups:
+    - tuppr.home-operations.com
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - talosupgrades
+

[mortyops]

--- kubernetes/apps/system-upgrade/tuppr/app Kustomization: system-upgrade/tuppr OCIRepository: system-upgrade/tuppr

+++ kubernetes/apps/system-upgrade/tuppr/app Kustomization: system-upgrade/tuppr OCIRepository: system-upgrade/tuppr

@@ -10,9 +10,9 @@

 spec:
   interval: 15m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.0.52
+    tag: 0.0.75
   url: oci://ghcr.io/home-operations/charts/tuppr