chore(deps): update helm release external-secrets to v2.7.0 (#285 )

chore(deps): update helm release cert-manager to v1.20.3 (#284 )
chore(deps): update cloudamqp/lavinmq docker tag to v2.9.0 (#283 )
2026-06-29 14:07:00 +00:00 · 2026-06-28 15:06:23 +00:00 · 2026-06-28 10:06:49 +00:00 · 2026-06-27 15:08:37 +00:00 · 2026-06-19 16:36:53 +00:00 · 2026-06-18 03:06:25 +00:00
12 changed files with 182 additions and 195 deletions
@@ -1,2 +1,3 @@
 data
 charts
+.claude/settings.local.json
@@ -24,9 +24,9 @@ kind: Ingress
 metadata:
  name: frontend
  annotations:
-    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:3300"
+    traefik.ingress.kubernetes.io/router.middlewares: default-frontend-host@kubernetescrd
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
  tls:
    - hosts:
        - staging-shiny.unbound.se
@@ -59,9 +59,9 @@ kind: Ingress
 metadata:
  name: api
  annotations:
-    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:4444"
+    traefik.ingress.kubernetes.io/router.middlewares: default-api-host@kubernetescrd
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
  tls:
    - hosts:
        - staging-shiny-api.unbound.se
@@ -77,3 +77,21 @@ spec:
                name: api-external
                port:
                  number: 4444
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: frontend-host
+spec:
+  headers:
+    customRequestHeaders:
+      Host: "localhost:3300"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: api-host
+spec:
+  headers:
+    customRequestHeaders:
+      Host: "localhost:4444"
@@ -33,6 +33,6 @@ spec:
      - key: "rds/postgres/prod-psql"
        value: '{"POSTGRES_URL": "postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable", "DB_HOST": "postgres", "DB_NAME": "postgres", "DB_PASSWORD": "postgres", "DB_PORT": "5432", "DB_USERNAME": "postgres"}'
      - key: "mq/rabbit/prod"
-        value: '{"AMQP_URL": "amqp://user:password@rabbitmq:5672/"}'
+        value: '{"AMQP_URL": "amqp://guest:guest@lavinmq:5672/"}'
      - key: "services/schemas"
        value: '{"ISSUER": "auth0", "STRICT_SSL": "false"}'
@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - postgres.yaml
- rabbitmq.yaml
+- lavinmq.yaml
 - namespaces.yaml
 helmCharts:
 - name: external-secrets
@@ -10,13 +10,13 @@ helmCharts:
  includeCRDs: true
  releaseName: external-secrets
  repo: https://charts.external-secrets.io
-  version: 1.2.1
+  version: 2.7.0
 - name: cert-manager
  namespace: cert-manager
  includeCRDs: true
  releaseName: cert-manager
  repo: https://charts.jetstack.io
-  version: v1.19.2
+  version: v1.20.3
  valuesInline:
    crds:
      enabled: true
@@ -0,0 +1,100 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: lavinmq
+stringData:
+  AMQP_URL: "amqp://guest:guest@lavinmq:5672/"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: lavinmq
+    release: lavinmq
+  name: lavinmq
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: lavinmq
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: lavinmq
+    spec:
+      containers:
+      - image: cloudamqp/lavinmq:2.9.0@sha256:fe85633d8af4f19cb2cedfd69f2f2a771139150406ef751ccdbc5e3c33c2874f
+        imagePullPolicy: Always
+        livenessProbe:
+          tcpSocket:
+            port: 5672
+          failureThreshold: 6
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: lavinmq
+        ports:
+        - containerPort: 5672
+          name: amqp
+          protocol: TCP
+        - containerPort: 15672
+          name: stats
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            port: 15672
+            path: /api/whoami
+            httpHeaders:
+            - name: "Authorization"
+              value: "Basic Z3Vlc3Q6Z3Vlc3Q="
+          failureThreshold: 3
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          successThreshold: 1
+          timeoutSeconds: 3
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/lavinmq
+      volumes:
+      - name: data
+        hostPath:
+          path: /data/lavinmq
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: lavinmq
+    release: lavinmq
+  name: lavinmq
+spec:
+  externalTrafficPolicy: Cluster
+  ports:
+  - name: amqp
+    nodePort: 5672
+    port: 5672
+    protocol: TCP
+    targetPort: amqp
+  - name: stats
+    nodePort: 15672
+    port: 15672
+    protocol: TCP
+    targetPort: stats
+  selector:
+    app.kubernetes.io/name: lavinmq
+  sessionAffinity: None
+  type: NodePort
@@ -23,6 +23,7 @@ data:
    	CREATE DATABASE authz WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE company WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE consumer WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE document WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE employee WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE invoice WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE notification WITH OWNER postgres ENCODING utf8;
@@ -52,7 +53,7 @@ spec:
    spec:
      containers:
      - name: postgres
-        image: postgres:18.1-alpine@sha256:b40d931bd0e7ce6eecc59a5a6ac3b3c04a01e559750e73e7086b6dbd7f8bf545
+        image: postgres:18.4-alpine@sha256:1b1689b20d16a014a3d195653381cf2caa75a41a92d93b255a9d6ea29fd353aa
        args:
        - -c
        - shared_buffers=384MB
@@ -62,8 +63,6 @@ spec:
        resources:
          requests:
            memory: 400Mi
-          limits:
-            memory: 600Mi
        ports:
        - containerPort: 5432
        env:
@@ -1,166 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: shared-rabbitmq
-data:
-  RABBITMQ_SERVERS: rabbitmq
-  RABBITMQ_VHOST: /
-  RABBITMQ_USERNAME: user
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: rabbitmq-env-config
-data:
-  memory.conf: |-
-    total_memory_available_override_value = 1GB
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: rabbitmq
-stringData:
-  AMQP_URL: "amqp://user:password@rabbitmq:5672/"
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/name: rabbitmq
-    release: rabbitmq
-  name: rabbitmq
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: rabbitmq
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: rabbitmq
-    spec:
-      securityContext:
-        fsGroup: 999
-        runAsUser: 999
-        runAsGroup: 999
-      containers:
-      - env:
-        - name: RABBITMQ_DEFAULT_USER
-          value: user
-        - name: RABBITMQ_DEFAULT_PASS
-          value: password
-        - name: RABBITMQ_NODE_PORT_NUMBER
-          value: "5672"
-        - name: RABBITMQ_NODE_TYPE
-          value: stats
-        - name: RABBITMQ_NODENAME
-          value: rabbit@localhost
-        - name: RABBITMQ_CLUSTER_NODE_NAME
-        - name: RABBITMQ_DEFAULT_VHOST
-          value: /
-        - name: RABBITMQ_MANAGER_PORT_NUMBER
-          value: "15672"
-        - name: RABBITMQ_DISK_FREE_LIMIT
-          value: '"8GiB"'
-        - name: RABBITMQ_CONFIG_FILES
-          value: /etc/rabbitmq/conf.d
-        image: rabbitmq:4.2.2-management@sha256:5b38b93d6f8cecc6263c0b774b31acd60849bf4d06b2e61169f0c28c1c55c232
-        imagePullPolicy: Always
-        livenessProbe:
-          exec:
-            command:
-            - rabbitmqctl
-            - status
-          failureThreshold: 6
-          initialDelaySeconds: 120
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 5
-        name: rabbitmq
-        ports:
-        - containerPort: 4369
-          name: epmd
-          protocol: TCP
-        - containerPort: 5672
-          name: amqp
-          protocol: TCP
-        - containerPort: 25672
-          name: dist
-          protocol: TCP
-        - containerPort: 15672
-          name: stats
-          protocol: TCP
-        readinessProbe:
-          httpGet:
-            port: 15672
-            path: /api/aliveness-test/%2F
-            httpHeaders:
-            - name: "Authorization"
-              value: "Basic dXNlcjpwYXNzd29yZA=="
-          failureThreshold: 3
-          initialDelaySeconds: 10
-          periodSeconds: 5
-          successThreshold: 1
-          timeoutSeconds: 3
-        resources:
-          requests:
-            cpu: 100m
-            memory: 256Mi
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - name: data
-          mountPath: /var/lib/rabbitmq
-        - name: config
-          mountPath: /etc/rabbitmq/conf.d/20-memory.conf
-          subPath: memory.conf
-          readOnly: true
-      volumes:
-      - name: data
-        hostPath:
-          path: /data/rabbitmq
-      - name: config
-        configMap:
-          name: rabbitmq-env-config
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/name: rabbitmq
-    release: rabbitmq
-  name: rabbitmq
-spec:
-  externalTrafficPolicy: Cluster
-  ports:
-  - name: epmd
-    nodePort: 31799
-    port: 4369
-    protocol: TCP
-    targetPort: epmd
-  - name: amqp
-    nodePort: 5672
-    port: 5672
-    protocol: TCP
-    targetPort: amqp
-  - name: dist
-    nodePort: 32687
-    port: 25672
-    protocol: TCP
-    targetPort: dist
-  - name: stats
-    nodePort: 15672
-    port: 15672
-    protocol: TCP
-    targetPort: stats
-  selector:
-    app.kubernetes.io/name: rabbitmq
-  sessionAffinity: None
-  type: NodePort
@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- namespaces.yaml
-helmCharts:
- name: ingress-nginx
-  namespace: ingress-nginx
-  includeCRDs: true
-  releaseName: ingress-nginx
-  repo: https://kubernetes.github.io/ingress-nginx
-  version: 4.14.1
-  valuesFile: https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/hack/manifest-templates/provider/kind/values.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- namespaces.yaml
+helmCharts:
+- name: traefik
+  namespace: traefik
+  includeCRDs: true
+  releaseName: traefik
+  repo: https://traefik.github.io/charts
+  version: 41.0.0
+  valuesFile: values.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
@@ -0,0 +1,31 @@
+deployment:
+  kind: DaemonSet
+
+ports:
+  web:
+    hostPort: 80
+  websecure:
+    hostPort: 443
+
+tolerations:
+  - key: "node-role.kubernetes.io/master"
+    operator: "Equal"
+    effect: "NoSchedule"
+  - key: "node-role.kubernetes.io/control-plane"
+    operator: "Equal"
+    effect: "NoSchedule"
+
+nodeSelector:
+  ingress-ready: "true"
+
+providers:
+  kubernetesIngress:
+    publishedService:
+      enabled: false
+
+service:
+  type: ClusterIP
+
+ingressClass:
+  enabled: true
+  isDefaultClass: true
@@ -12,20 +12,20 @@ kubectl create secret docker-registry gitlab \

 kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "gitlab"}]}'

-kustomized="$(mktemp -t unboundnginx.yaml.XXXXXX)"
+kustomized="$(mktemp -t unboundtraefik.yaml.XXXXXX)"

-kubectl kustomize --enable-helm "k8s/nginx" >> "${kustomized}"
+kubectl kustomize --enable-helm "k8s/traefik" >> "${kustomized}"
 kubectl apply -f "${kustomized}" --server-side || true

-printf "\nWait for pod app.kubernetes.io/component=controller to be created."
+printf "\nWait for pod app.kubernetes.io/name=traefik to be created."
 while :; do
  sleep 2
-  [ -n "$(kubectl -n ingress-nginx get pod --selector=app.kubernetes.io/component=controller 2>/dev/null)" ] && printf "\n\n" && break
+  [ -n "$(kubectl -n traefik get pod --selector=app.kubernetes.io/name=traefik 2>/dev/null)" ] && printf "\n\n" && break
  printf "."
 done

-echo "Wait for nginx to be available."
-until [[ $(kubectl -n ingress-nginx get endpointslices -l 'kubernetes.io/service-name=ingress-nginx-controller' -o=jsonpath='{.items[*].endpoints[*].addresses[*]}') ]]; do sleep 5; done
+echo "Wait for traefik to be available."
+until [[ $(kubectl -n traefik get endpointslices -l 'kubernetes.io/service-name=traefik' -o=jsonpath='{.items[*].endpoints[*].addresses[*]}') ]]; do sleep 5; done

 kustomized="$(mktemp -t unboundinfra.yaml.XXXXXX)"