+1 -1

k8s/charts/audiobookshelf/templates/deployment.yaml

Reviewed

··· 79 79 periodSeconds: 5 80 80 failureThreshold: 3 81 81 - name: rclone 82 82 - image: rclone/rclone:1.74@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb 82 82 + image: {{ .Values.global.images.rclone }} 83 83 imagePullPolicy: IfNotPresent 84 84 args: 85 85 - mount

+2 -2

k8s/charts/paperless/templates/deployment.yaml

Reviewed

··· 32 32 tolerationSeconds: 60 33 33 initContainers: 34 34 - name: wait-deps 35 35 - image: docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b 35 35 + image: {{ .Values.global.images.alpine }} 36 36 imagePullPolicy: IfNotPresent 37 37 securityContext: 38 38 runAsUser: 1000 ··· 154 154 timeoutSeconds: 10 155 155 failureThreshold: 3 156 156 - name: rclone 157 157 - image: rclone/rclone:1.74@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb 157 157 + image: {{ .Values.global.images.rclone }} 158 158 imagePullPolicy: IfNotPresent 159 159 args: 160 160 - mount

+1 -1

k8s/charts/plex/templates/deployment.yaml

Reviewed

··· 40 40 initContainers: 41 41 # Add custom plugins/scanners 42 42 - name: plugins 43 43 - image: {{ .Values.pluginImage }} 43 43 + image: {{ .Values.global.images.alpine }} 44 44 imagePullPolicy: IfNotPresent 45 45 securityContext: 46 46 runAsUser: 1000

+2 -3

k8s/charts/plex/values.yaml

Reviewed

··· 1 1 # Plex plugins/scanners are provisioned into the config volume by an initContainer 2 2 - # on every pod start, pinned to exact commits via GitHub archive tarballs 3 3 - pluginImage: docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b 4 4 - 2 2 + # on every pod start, pinned to exact commits via GitHub archive tarballs. 3 3 + # initContainer image comes from values/global.yaml → .Values.global.images.alpine 5 4 plugins: 6 5 # Cloned wholesale into "Plug-ins/<name>". 7 6 bundles:

+4

k8s/helmfile.yaml

Reviewed

··· 342 342 needs: 343 343 - default/cluster-tls 344 344 values: 345 345 + - values/global.yaml 345 346 - values/secrets/audiobookshelf.yaml 346 347 347 348 - name: watsup ··· 399 400 chart: ./charts/plex 400 401 needs: 401 402 - default/cluster-tls 403 403 + values: 404 404 + - values/global.yaml 402 405 403 406 - name: navidrome 404 407 namespace: default ··· 419 422 - default/tika 420 423 - default/gotenberg 421 424 values: 425 425 + - values/global.yaml 422 426 - values/secrets/paperless.yaml 423 427 424 428 - name: nextcloud

+7

k8s/values/global.yaml

Reviewed

··· 1 1 + # Shared OCI image pins used across charts. Bump a digest here once and 2 2 + # every initContainer / sidecar that references these values picks it up. 3 3 + # Goal: prevent pull churn by reusing the same pinned images everywhere. 4 4 + global: 5 5 + images: 6 6 + alpine: docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b 7 7 + rclone: rclone/rclone:1.74@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb