Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-30 14:51:01

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/firefly-iii/data-importer-ingress.yaml

@@ -1,53 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: firefly-data-importer-auth
-spec:
-  forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: firefly-data-importer
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    # OAuth callback is intentionally public. Data Importer validates both the
-    # state parameter and its browser session before exchanging the code.
-    - match: Host(`import.hexor.cy`) && Path(`/eb-callback`)
-      kind: Rule
-      priority: 200
-      services:
-        - name: firefly-data-importer
-          port: 80
-    # Everything else requires a valid auth-proxy session and group.
-    - match: Host(`import.hexor.cy`)
-      kind: Rule
-      priority: 100
-      middlewares:
-        - name: firefly-data-importer-auth
-      services:
-        - name: firefly-data-importer
-          port: 80
-  tls:
-    secretName: firefly-data-importer-tls
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: firefly-data-importer-tls
-spec:
-  secretName: firefly-data-importer-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - import.hexor.cy
-

k8s/apps/firefly-iii/data-importer.yaml

@@ -103,3 +103,26 @@ spec:
       port: 80
       targetPort: http
       protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: firefly-data-importer
+  labels:
+    app.kubernetes.io/name: firefly-data-importer
+    firefly.hexor.cy/private-ai: "true"
+  annotations:
+    kubernetes.io/ingress.class: traefik-ai
+spec:
+  rules:
+    - host: import.ff.lan
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: firefly-data-importer
+                port:
+                  number: 80
+

k8s/apps/firefly-iii/external-secrets.yaml

@@ -63,9 +63,7 @@ spec:
         ENABLE_BANKING_APP_ID: |-
           {{ .app_id }}
         ENABLE_BANKING_PRIVATE_KEY: |-
-          -----BEGIN PRIVATE KEY-----
-          {{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
-          -----END PRIVATE KEY-----
+          {{ .private_key }}
   data:
     - secretKey: app_id
       sourceRef:

k8s/apps/firefly-iii/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
   - app.yaml
   - data-importer.yaml
-  - data-importer-ingress.yaml
   - external-secrets.yaml
   - postgres.yaml
   - storage.yaml
@@ -51,15 +50,6 @@ patches:
       kind: CronJob
       name: firefly-iii-cron
     patch: |-
-      - op: add
-        path: /spec/concurrencyPolicy
-        value: Forbid
-      - op: add
-        path: /spec/jobTemplate/spec/backoffLimit
-        value: 1
-      - op: add
-        path: /spec/jobTemplate/spec/activeDeadlineSeconds
-        value: 600
       - op: add
         path: /spec/jobTemplate/spec/template/spec/nodeSelector
         value:
@@ -71,16 +61,6 @@ patches:
             operator: Equal
             value: ai
             effect: NoSchedule
-      - op: replace
-        path: /spec/jobTemplate/spec/template/spec/containers/0/command
-        value:
-          - /bin/sh
-          - -ec
-          - >-
-            curl --fail --silent --show-error
-            --retry 30 --retry-delay 10 --retry-all-errors
-            --connect-timeout 5 --max-time 30
-            "http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
   # A second independent filter in addition to ingressClassName.
   - target:
       group: networking.k8s.io

k8s/apps/firefly-iii/network-policy.yaml

@@ -19,9 +19,6 @@ spec:
             matchLabels:
               app.kubernetes.io/instance: firefly-iii
               app.kubernetes.io/name: firefly-iii
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: firefly-data-importer
         # hostNetwork traffic is seen as node traffic rather than Pod traffic.
         - ipBlock:
             cidr: 192.168.1.117/32
@@ -76,18 +73,7 @@ spec:
   policyTypes:
     - Ingress
   ingress:
-    # Shared Traefik serves the public HTTPS importer.
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
-      ports:
-        - protocol: TCP
-          port: 8080
-    # Keep node traffic allowed for probes and local diagnostics.
+    # traefik-ai uses hostNetwork and is therefore seen as node traffic.
     - from:
         - ipBlock:
             cidr: 192.168.1.117/32