apps pinned to exact version numbers

clusters/base/apps/authelia/helmrelease.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: authelia/authelia
-              tag: latest
+              tag: v4.39.20
             probes:
               liveness:
                 enabled: true

clusters/base/apps/davical/helmrelease-postgres.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: postgres
-              tag: "16-alpine"
+              tag: "16.14-alpine"
             env:
               TZ: Europe/Moscow
               POSTGRES_PASSWORD:

clusters/base/apps/fava/helmrelease.yaml

@@ -29,7 +29,7 @@ spec:
           app:
             image:
               repository: yegle/fava
-              tag: latest
+              tag: "1.30.4"
             env:
               TZ: Europe/Moscow
               BEANCOUNT_FILE: /documents/main.beancount

clusters/base/apps/immich/helmrelease-redis.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: docker.io/valkey/valkey
-              tag: "9"
+              tag: "9.1.1"
             resources:
               requests:
                 cpu: 20m

clusters/base/apps/immich/helmrelease-server.yaml

@@ -21,6 +21,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             command:
               - sh
               - -c

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: ghcr.io/pvliesdonk/markdown-vault-mcp
-              tag: latest
+              tag: "3.1.0"
             env:
               MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
               MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db

clusters/base/apps/mosquitto/chart/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: eclipse-mosquitto
-  tag: "2"
+  tag: "2.1.2"
   pullPolicy: IfNotPresent
 
 # not really needed, as StatefulSet has hardcoded "replicas: 1"

clusters/base/apps/mosquitto/helmrelease.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       repository: eclipse-mosquitto
-      tag: "2"
+      tag: "2.1.2"
       pullPolicy: IfNotPresent
 
     replicaCount: 1

clusters/base/apps/nfs-ganesha/helmrelease.yaml

@@ -21,6 +21,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             command:
               - sh
               - -c
@@ -29,6 +31,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             command:
               - sh
               - -c
@@ -38,6 +42,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             securityContext:
               readOnlyRootFilesystem: true
               capabilities:

clusters/base/apps/webdav/helmrelease.yaml

@@ -24,7 +24,7 @@ spec:
           app:
             image:
               repository: ghcr.io/hacdias/webdav
-              tag: latest
+              tag: v5.14.2
             args:
               - "-c"
               - "/config.yml"