Skip to content

Deploy releases/k8s-manifests b37417f - #185

Merged
themightychris merged 3 commits into
deploys/k8s-manifestsfrom
releases/k8s-manifests
Aug 25, 2026
Merged

Deploy releases/k8s-manifests b37417f#185
themightychris merged 3 commits into
deploys/k8s-manifestsfrom
releases/k8s-manifests

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 25, 2026

Copy link
Copy Markdown

kubectl diff reports that applying b37417f will change:

diff -uN /tmp/LIVE-2385828015/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen /tmp/MERGED-227935510/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen
--- /tmp/LIVE-2385828015/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen	2026-08-25 16:16:19.224835621 +0000
+++ /tmp/MERGED-227935510/batch.v1.Job.envoy-gateway-system.envoy-gateway-gateway-helm-certgen	2026-08-25 16:16:19.235835941 +0000
@@ -1 +1,69 @@
-{}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    helm.sh/hook: pre-install, pre-upgrade
+  labels:
+    app.kubernetes.io/instance: envoy-gateway
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: gateway-helm
+    app.kubernetes.io/version: v1.7.3
+    helm.sh/chart: gateway-helm-v1.7.3
+  name: envoy-gateway-gateway-helm-certgen
+  namespace: envoy-gateway-system
+spec:
+  backoffLimit: 1
+  completionMode: NonIndexed
+  completions: 1
+  manualSelector: false
+  parallelism: 1
+  podReplacementPolicy: TerminatingOrFailed
+  selector:
+    matchLabels:
+      batch.kubernetes.io/controller-uid: 55c38a85-067a-4ee1-8eef-443c8ea79ed3
+  suspend: false
+  template:
+    metadata:
+      labels:
+        app: certgen
+        batch.kubernetes.io/controller-uid: 55c38a85-067a-4ee1-8eef-443c8ea79ed3
+        batch.kubernetes.io/job-name: envoy-gateway-gateway-helm-certgen
+        controller-uid: 55c38a85-067a-4ee1-8eef-443c8ea79ed3
+        job-name: envoy-gateway-gateway-helm-certgen
+    spec:
+      containers:
+      - command:
+        - envoy-gateway
+        - certgen
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: KUBERNETES_CLUSTER_DOMAIN
+          value: cluster.local
+        image: docker.io/envoyproxy/gateway:v1.7.3
+        imagePullPolicy: IfNotPresent
+        name: envoy-gateway-certgen
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      schedulerName: default-scheduler
+      serviceAccount: envoy-gateway-gateway-helm-certgen
+      serviceAccountName: envoy-gateway-gateway-helm-certgen
+      terminationGracePeriodSeconds: 30
+  ttlSecondsAfterFinished: 30
diff -uN /tmp/LIVE-2274112739/apps.v1.Deployment.vaultwarden.vaultwarden /tmp/MERGED-504283207/apps.v1.Deployment.vaultwarden.vaultwarden
--- /tmp/LIVE-2274112739/apps.v1.Deployment.vaultwarden.vaultwarden	2026-08-25 16:16:26.399049534 +0000
+++ /tmp/MERGED-504283207/apps.v1.Deployment.vaultwarden.vaultwarden	2026-08-25 16:16:26.414050007 +0000
@@ -80,7 +80,7 @@
             secretKeyRef:
               key: smtp-password
               name: smtp-postmark
-        image: vaultwarden/server:1.36.0
+        image: vaultwarden/server:1.37.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

themightychris and others added 3 commits August 25, 2026 12:11
@themightychris @claude
chore(vaultwarden): bump app image to v1.37.2
c6f86f2 
Required for Bitwarden clients v2026.7.0+ (1.37.0) and v2026.8.0+
(1.37.2) — auto-updated browser extensions can no longer authenticate
against 1.36.0. See dani-garcia/vaultwarden#7615.

Also picks up eight medium-severity security fixes in 1.37.0 (SSRF via
icon endpoint, cross-org cipher access, org policy bypass on directory
import, Send access-count bypass, unauthenticated WebSocket flooding
DoS, cross-org secret sharing, org import authorization, org data
enumeration via Manager role).

Notes:
- Schema migrations run on startup and are not reversible; rollback
  requires restoring the database from a restic snapshot. Verified
  snapshot f5440783 (2026-08-25 15:40 UTC) before this change.
- 1.37.0 adds per-IP rate limiting on unauthenticated endpoints. We
  route via Envoy Gateway, which sets x-forwarded-for rather than the
  x-real-ip that vaultwarden's IP_HEADER defaults to. Watch for
  client-IP warnings after rollout; may need IP_HEADER set.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MSNAVVDuF46SMHjnyfmxwU
@themightychris
Merge pull request #184 from CodeForPhilly/chore/vaultwarden-1.37.2
83e70b8 
chore(vaultwarden): bump app image to v1.37.2
@themightychris
☀ projected k8s-manifests-github from 83e70b8
b37417f 
Source-holobranch: k8s-manifests-github
Source-commit: 83e70b8
Source: 83e70b8
@themightychris
themightychris merged commit adbcd92 into deploys/k8s-manifests Aug 25, 2026
1 check passed
@github-actions

github-actions Bot commented Aug 25, 2026

Copy link
Copy Markdown
Author

kubectl apply output (excluding unchanged) for adbcd92 was:

customresourcedefinition.apiextensions.k8s.io/backends.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backendtlspolicies.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backendtrafficpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clienttrafficpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoyextensionpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoypatchpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoyproxies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/httproutefilters.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/listenersets.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/sealedsecrets.bitnami.com serverside-applied
customresourcedefinition.apiextensions.k8s.io/securitypolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/tlsroutes.gateway.networking.k8s.io serverside-applied
clusterrole.rbac.authorization.k8s.io/envoy-gateway-gateway-helm-envoy-gateway-role configured
clusterrole.rbac.authorization.k8s.io/grafana-clusterrole configured
clusterrole.rbac.authorization.k8s.io/prometheus-alertmanager configured
clusterrole.rbac.authorization.k8s.io/prometheus-pushgateway configured
clusterrolebinding.rbac.authorization.k8s.io/sealed-secrets configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/envoy-gateway-topology-injector.envoy-gateway-system configured
validatingadmissionpolicy.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io configured
validatingadmissionpolicybinding.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io configured
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
gateway.gateway.networking.k8s.io/balancer configured
httproute.gateway.networking.k8s.io/balancer configured
gateway.gateway.networking.k8s.io/chime configured
httproute.gateway.networking.k8s.io/chime configured
gateway.gateway.networking.k8s.io/choose-native-plants configured
httproute.gateway.networking.k8s.io/choose-native-plants configured
deployment.apps/code-for-philly configured
gateway.gateway.networking.k8s.io/code-for-philly configured
httproute.gateway.networking.k8s.io/code-for-philly configured
gateway.gateway.networking.k8s.io/echo-http configured
httproute.gateway.networking.k8s.io/echo-http configured
deployment.apps/envoy-gateway configured
httproute.gateway.networking.k8s.io/http-redirect configured
job.batch/envoy-gateway-gateway-helm-certgen created
configmap/grafana-dashboards-default configured
deployment.apps/grafana configured
gateway.gateway.networking.k8s.io/grafana configured
httproute.gateway.networking.k8s.io/grafana configured
deployment.apps/metrics-server configured
secret/promtail configured
statefulset.apps/loki configured
deployment.apps/prometheus-alertmanager configured
deployment.apps/prometheus-kube-state-metrics configured
deployment.apps/prometheus-pushgateway configured
deployment.apps/prometheus-server configured
serviceaccount/prometheus-kube-state-metrics configured
deployment.apps/sealed-secrets configured
gateway.gateway.networking.k8s.io/sealed-secrets configured
httproute.gateway.networking.k8s.io/sealed-secrets configured
rolebinding.rbac.authorization.k8s.io/sealed-secrets-key-admin configured
service/sealed-secrets configured
gateway.gateway.networking.k8s.io/third-places configured
httproute.gateway.networking.k8s.io/third-places configured
statefulset.apps/third-places-postgresql configured
deployment.apps/vaultwarden configured
gateway.gateway.networking.k8s.io/vaultwarden configured
httproute.gateway.networking.k8s.io/bitwarden-redirect configured
httproute.gateway.networking.k8s.io/vaultwarden configured
statefulset.apps/vaultwarden-postgresql configured

@themightychris themightychris mentioned this pull request Aug 25, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@themightychris