Partly implemented (updated 2026-09-28). Helm charts are pinned (verified live); container
images are pinned only for the apps that carry argocd-image-updater digest tracking. OS patching
still relies on unattended-upgrades with no auto-reboot. See §2.3 and §17 S11 of the architecture
review (kept private, not published).
| Component | Cadence | Mechanism |
|---|---|---|
| OS security patches | Automatic, no auto-reboot | unattended-upgrades (already on); a monthly reboot window is scheduled by the owner, alerted on via reboot-required |
| k3s minor version | Quarterly | Ansible, with a Hetzner snapshot + etcd snapshot taken first; rollback = restore the previous /etc/rancher/k3s/config.yaml + restart, or full snapshot restore |
| Helm charts / container images | Pinned, bumped by PR | No floating tags (:latest, 7.*, v1.*) reach prod outside an explicit version bump — see the known gap in the current state below |
| ArgoCD | v2.14 → v3.x is its own tracked change | Snapshot first, treated as a standalone migration, not bundled with routine maintenance |
Charts — done. All four Helm chart sources are pinned to explicit versions (cert-manager was removed 2026-09-28, so it is no longer among them):
| Application | Chart | Pinned |
|---|---|---|
argocd |
argo-cd |
7.9.1 (ArgoCD v2.14.x) |
argocd-image-updater |
argocd-image-updater |
0.14.0 |
keda |
keda |
2.21.0 |
keda-add-ons-http |
keda-add-ons-http |
0.16.0 |
Images — done, Blocker 1 resolved.
argocd-image-updater: meghmitra, mochi, adhigrahan-radar,
status-page, and the vcap v1 apps. Retired apps are no longer tracked.Could not get tags from registry: … denied because its registries.conf pointed at
pullsecret:argocd/ghcr-creds, whose PAT was dead. The owner refreshed the gh token (adding
write:packages); it now backs the pull-secrets and argocd/ghcr-creds, and image-updater is back
at errors=0. Rotating this token again means updating the CLI’s token, re-applying the four
Secrets, and deleting argocd-image-updater’s pod.cas-api,
dj-html-nodejs-web, learning-docker, learning-qwik, learning-react, smart-home-system-api,
kodesphere, and status-page still use newTag: latest.
They were ApplicationSet-generated by git directory generators, whose templates cannot carry a
per-app image-list annotation, which is why meghmitra, mochi, adhigrahan-radar, and
status-page each have an explicit Application. The annotation half of this is now addressed: the
de/sg split was consolidated into one apps ApplicationSet with a list generator whose
elements carry each app’s image list (imageList/alias0/kustomize0).
Pin the remaining apps to explicit versions when they are next touched.This already broke once: MinIO’s :latest tag stopped being pullable upstream, see
storage.md and disaster-recovery.md.
maintenance.md — ownership model and routine host maintenance