Merge branch 'main' of https://github.com/mitchross/talos-argocd-proxmox

Author: mitchross

infrastructure/controllers/kyverno/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
 - policies/volsync-nfs-inject.yaml
 - policies/volsync-orphan-cleanup.yaml
 - policies/image-pull-policy.yaml
+- policies/reloader-annotation-inject.yaml
 helmCharts:
 - name: kyverno
   repo: https://kyverno.github.io/kyverno

infrastructure/controllers/kyverno/policies/reloader-annotation-inject.yaml

@@ -0,0 +1,30 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: reloader-annotation-inject
+  namespace: kyverno
+spec:
+  validationFailureAction: audit
+  background: true
+  rules:
+  - name: inject-reloader-annotation
+    match:
+      resources:
+        kinds:
+        - Deployment
+        - StatefulSet
+        - DaemonSet
+      excludeResources:
+        namespaceSelector:
+          matchLabels:
+            # Exclude system namespaces
+            exclude-reloader-annotation: "true"
+        selector:
+          matchLabels:
+            # Allow opt-out via label
+            reloader-annotation: "disabled"
+    mutate:
+      patchStrategicMerge:
+        metadata:
+          annotations:
+            reloader.stakater.com/match: "true"

my-apps/ai/llama-cpp/deployment.yaml

@@ -5,8 +5,6 @@ metadata:
   namespace: llama-cpp
   labels:
     app: llama-cpp-server
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   strategy:
     type: Recreate

my-apps/ai/ollama/deployment.yaml

@@ -6,8 +6,6 @@ metadata:
   labels:
     app.kubernetes.io/name: ollama
     app.kubernetes.io/component: llm-server
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   strategy:
     type: Recreate

my-apps/ai/open-webui/deployment.yaml

@@ -3,8 +3,6 @@ kind: Deployment
 metadata:
   name: open-webui
   namespace: open-webui
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   strategy:
     type: Recreate

my-apps/ai/open-webui/mcp-kiwix.yaml

@@ -7,8 +7,6 @@ metadata:
   namespace: open-webui
   labels:
     app: mcpo-kiwix
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   replicas: 1
   selector:

my-apps/development/dvwa/deployment.yaml

@@ -5,7 +5,6 @@ metadata:
   namespace: dvwa
   labels:
     app: dvwa
-  annotations:
     description: "DVWA - Damn Vulnerable Web Application for penetration testing"
 spec:
   replicas: 1

my-apps/home/frigate/deployment.yaml

@@ -3,8 +3,6 @@ kind: Deployment
 metadata:
   name: frigate
   namespace: frigate
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   replicas: 0
   selector:

my-apps/home/home-assistant/deployment.yaml

@@ -8,8 +8,6 @@ metadata:
     app.kubernetes.io/component: home-automation
     app.kubernetes.io/part-of: smart-home
     app.kubernetes.io/version: stable
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   replicas: 1
   strategy:

my-apps/home/paperless-ngx/deployment.yaml

@@ -3,8 +3,6 @@ kind: Deployment
 metadata:
   name: paperless-ngx
   namespace: paperless-ngx
-  annotations:
-    reloader.stakater.com/auto: "true"
 spec:
   strategy:
     type: Recreate