apps/code-server/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       initContainers:
       - name: init-chmod-data
-        image: busybox:1.36
+        image: busybox:1.36@sha256:5eef5ed34e1e1ff0a4ae850395cbf665c4de6b4b83a32a0bc7bcb998e24e7bbb
         imagePullPolicy: IfNotPresent
         command:
           - sh
@@ -30,7 +30,7 @@ spec:
         - name: data
           mountPath: /home/coder
       containers:
-      - image: codercom/code-server:4.20.0
+      - image: codercom/code-server:4.89.1-ubuntu@sha256:d7faf97bc59933b398d5df5c5aec786637a9e40ae8c842bb8d23ca20e0946739
         imagePullPolicy: IfNotPresent
         name: code-server
         args:

apps/dev-container/deployment.yaml

@@ -19,7 +19,7 @@ spec:
         fsGroup: 1000
       containers:
       - name: dev-container
-        image: git.namesny.com/mathis/dev-container:2024-04-25
+        image: git.namesny.com/mathis/dev-container:2024-04-25@sha256:54e0a338fec52e4f124bb8b9030892bbb85b61717f237107377a2ad1d1db567c
         imagePullPolicy: Always
         ports:
         - containerPort: 7681

apps/gitea/gitea-values.yaml

@@ -5,7 +5,10 @@ postgresql-ha:
 postgresql:
   enabled: true
   image:
+    registry: docker.io
+    repository: bitnami/postgresql
     tag: 15.3.0-debian-11-r24
+    digest: sha256:fff6086d557d962422c6d751b6723877642170bbcc25d6f23e5c2c2f079987d5
   primary:
     persistence:
       storageClass: retain-local-path

apps/gitea/restic/cronjob.yaml

@@ -26,7 +26,7 @@ spec:
 
           initContainers:
           - name: postgres-dump-init
-            image: bitnami/postgresql:15.3.0-debian-11-r24
+            image: bitnami/postgresql:15.3.0-debian-11-r24@sha256:fff6086d557d962422c6d751b6723877642170bbcc25d6f23e5c2c2f079987d5
             command: ["/bin/sh", "-c"]
             args: ["pg_dump -h gitea-postgresql -p 5432 -U gitea gitea -Fc > /backup/postgres_backup.dump"]
             env:
@@ -41,7 +41,7 @@ spec:
 
           containers:
           - name: restic-container
-            image: git.namesny.com/cluster/restic:latest
+            image: git.namesny.com/cluster/restic:latest@sha256:8efb9776d9b3250012d17bbfff865420e5ffa0688010d006448c4ff358b0ee32
             imagePullPolicy: Always
             command: ["/bin/sh", "/app/backup.sh"]
             envFrom:

apps/gitea/runner-deployment.yaml

@@ -26,7 +26,7 @@ spec:
         fsGroup: 1001
       initContainers:
       - name: wait-for-gitea
-        image: busybox:1.28
+        image: busybox:1.36@sha256:5eef5ed34e1e1ff0a4ae850395cbf665c4de6b4b83a32a0bc7bcb998e24e7bbb
         command: ['sh', '-c', "until wget https://git.namesny.com 2>/dev/null; do echo waiting for gitea; sleep 2; done"]
       containers:
       - name: runner

apps/mlflow/kustomization.yaml

@@ -18,7 +18,7 @@ generators:
 helmCharts:
 - name: postgresql
   releaseName: postgresql
-  version: 15.4.2
+  version: 15.5.0
   repo: oci://registry-1.docker.io/bitnamicharts
   namespace: mlflow
   valuesInline:

apps/mlflow/minio-deployment.yaml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: minio
-        image: quay.io/minio/minio:RELEASE.2023-12-09T18-17-51Z
+        image: quay.io/minio/minio:RELEASE.2023-12-09T18-17-51Z@sha256:a9cec9ed5bda5b4e1b2153823e01b309965b9de7ed6eb7f098d45592eecdfc78
         command:
         - /bin/bash
         - -c

apps/mlflow/mlflow-deployment.yaml

@@ -31,7 +31,7 @@ spec:
         - secretRef:
             name: minio-user-secret
       - name: init-db-upgrade
-        image: git.namesny.com/cluster/mlflow:latest
+        image: git.namesny.com/cluster/mlflow:latest@sha256:9d935268bc318d6cadbfe8d480744ce898cdfb906be5ba7125ab87c555894798
         envFrom:
         - secretRef:
             name: mlflow-secret
@@ -41,7 +41,7 @@ spec:
             exit 0;
       containers:
       - name: mlflow
-        image: git.namesny.com/cluster/mlflow:latest
+        image: git.namesny.com/cluster/mlflow:latest@sha256:9d935268bc318d6cadbfe8d480744ce898cdfb906be5ba7125ab87c555894798
         imagePullPolicy: Always
         args:
         - --host=0.0.0.0

apps/namesny-com/deployment.yaml

@@ -19,6 +19,6 @@ spec:
       - name: gitea-regcred
       containers:
       - name: namesny-com
-        image: git.namesny.com/mathis/namesny-com:2024-04-22
+        image: git.namesny.com/mathis/namesny-com:2024-04-22@sha256:df51fff0dcc4e252b13f3c61debf2b3e2335e4c8e2d7441174457d9e7709a6ea
         ports:
         - containerPort: 80

infra/k9s/deployment.yaml

@@ -18,6 +18,6 @@ spec:
       serviceAccountName: k9s-sa
       containers:
       - name: k9s
-        image: ghcr.io/lordmathis/k9s-web:latest
+        image: ghcr.io/lordmathis/k9s-web:latest@sha256:d3dbde4715750509bbad451a2b4dbe40d1d91fefc25e3bc3fc9b48a5d5f733e5
         ports:
         - containerPort: 7681

renovate.json

@@ -14,5 +14,8 @@
   },
   "digest": {
     "automerge": true
+  },
+  "kubernetes": {
+    "fileMatch": ["\\.yaml$"]
   }
 }