@underpostnet/cyberia 3.2.90 → 3.3.73

package/hardhat/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "cyberia-hardhat",
-  "version": "1.0.0",
+  "version": "3.3.73",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cyberia-hardhat",
-      "version": "1.0.0",
+      "version": "3.3.73",
       "dependencies": {
         "@openzeppelin/contracts": "~5.6.1",
         "dotenv": "~17.4.2",
@@ -15,7 +15,7 @@
       "devDependencies": {
         "@nomicfoundation/hardhat-toolbox-viem": "^5.0.7",
         "chai": "^6.2.2",
-        "hardhat": "~3.12.0"
+        "hardhat": "~3.15.0"
       },
       "engines": {
         "node": ">=22.0.0"
@@ -1022,90 +1022,151 @@
       }
     },
     "node_modules/@nomicfoundation/edr": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr/-/edr-0.15.0.tgz",
-      "integrity": "sha512-RcBnQ0MYsrjhLsN+Kcu7q5mnRmBlxmv+Y0lxgrCsST6YTDH/l5RH3nG88J8sDEGmXyjVzX2HsXQBy9NxFJHFuw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr/-/edr-0.19.0.tgz",
+      "integrity": "sha512-wzuyAylm4XWIahFjy1pFDQfHny4Xsx73T98d8KJAkGG/Rpgp0M36rqS4lzjbGQ1tXDrWEBG0WRr0v1jrQhQ0xg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@nomicfoundation/edr-darwin-arm64": "0.15.0",
-        "@nomicfoundation/edr-darwin-x64": "0.15.0",
-        "@nomicfoundation/edr-linux-arm64-gnu": "0.15.0",
-        "@nomicfoundation/edr-linux-arm64-musl": "0.15.0",
-        "@nomicfoundation/edr-linux-x64-gnu": "0.15.0",
-        "@nomicfoundation/edr-linux-x64-musl": "0.15.0",
-        "@nomicfoundation/edr-win32-x64-msvc": "0.15.0"
-      },
       "engines": {
         "node": ">= 22"
+      },
+      "optionalDependencies": {
+        "@nomicfoundation/edr-darwin-arm64": "0.19.0",
+        "@nomicfoundation/edr-darwin-x64": "0.19.0",
+        "@nomicfoundation/edr-linux-arm64-gnu": "0.19.0",
+        "@nomicfoundation/edr-linux-arm64-musl": "0.19.0",
+        "@nomicfoundation/edr-linux-x64-gnu": "0.19.0",
+        "@nomicfoundation/edr-linux-x64-musl": "0.19.0",
+        "@nomicfoundation/edr-win32-x64-msvc": "0.19.0"
       }
     },
     "node_modules/@nomicfoundation/edr-darwin-arm64": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-arm64/-/edr-darwin-arm64-0.15.0.tgz",
-      "integrity": "sha512-kFgoiou9yfzojAki3yOnOlFZfkC0oQeS8G3i/8lXaTnjEjQ2C1lLDgRQt8Q0kjSdVOs5daiC+eQx+8to4R5/ug==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-arm64/-/edr-darwin-arm64-0.19.0.tgz",
+      "integrity": "sha512-Yo2MkZoM85zkasUPJDj8l8QezPdrMzqQUJhp78TUQDq8FQXhdJTZ39k3Jax5OQ3hqjMhMkrGbctn9w9h6mEusg==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-darwin-x64": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-x64/-/edr-darwin-x64-0.15.0.tgz",
-      "integrity": "sha512-vnFHCj2oxd7N8Eg760yY5gPAHz6tL7NB9Pt1nrP8/+XIutEdUJjpIDGadG0jsTHNmq303EvHh4nkpuO3zBCSZw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-x64/-/edr-darwin-x64-0.19.0.tgz",
+      "integrity": "sha512-RC7RVX1iATg9SlJTnKD57A8jRBIBiUKmAdi8maBN4zhmK5Z7aAeiwdQX6VjPOum3c2Mdpp2Q7JfooJxxF6bCvw==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-arm64-gnu": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-gnu/-/edr-linux-arm64-gnu-0.15.0.tgz",
-      "integrity": "sha512-klBqsMWl19NVok/9BOcX/PeV7M7DrTM4C7eSOQyc6wglZZRwKSm8tDtwQVh/bJkOCqqgVMO6IOi+IQ4xQbsgog==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-gnu/-/edr-linux-arm64-gnu-0.19.0.tgz",
+      "integrity": "sha512-vhEKPUomGwM0Lsjpwd5q/Jc6yE2hpspJBCRYFkCghzCmwgZHtoYn/2nd1nOLsTt7jqMlvAKJSaLCrhz1HCTCTA==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-arm64-musl": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-musl/-/edr-linux-arm64-musl-0.15.0.tgz",
-      "integrity": "sha512-PQ6oqCCOjQaGCyDA1XFDWbpGrXGKZ8Fr3JQrd7cCCqVvIBshg68WrJ7gqlf4DdeidppIi3m9CNRsWsRfj9Y17w==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-musl/-/edr-linux-arm64-musl-0.19.0.tgz",
+      "integrity": "sha512-mlkpVUolkSpMIriZyiJeTbgx/m4Ngm9lQtah2BG92H+dgtwMIMze6Q6OQfZG6oi6wMrhDgu8WEyAy3XgIwlcRg==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-x64-gnu": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-gnu/-/edr-linux-x64-gnu-0.15.0.tgz",
-      "integrity": "sha512-j89Ywivbs78xWjoSFcZLp+pUqe0p0p3vqiG1utGFj/fJ7zEgTQBcC+DUiyddFpYB3TE79TZMUoaAnEVdxTi4Xw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-gnu/-/edr-linux-x64-gnu-0.19.0.tgz",
+      "integrity": "sha512-d0Z+WVbX5mm6s9ozc5TXrCRjQykdN81tGI+eaM4hQcD/S5VSY9rwKuCXyLJ/GkgeI5S8HEHsyVdXEsDJznPyhA==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-x64-musl": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-musl/-/edr-linux-x64-musl-0.15.0.tgz",
-      "integrity": "sha512-bJuCPxihvSFyoGAxmYL5CyN9id5mqncyikywTa7+/+g7ge2Pnz+w7GHbim+tvHeMA9XQv1vSy4QgNkkZXGBzLg==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-musl/-/edr-linux-x64-musl-0.19.0.tgz",
+      "integrity": "sha512-UIrlNqYj9lbUXpBy++WwHeC0xZqyFw9TXy06/8+0PLffI7Si4kiTKfXqdITGQhP6Vf/JuJ8y+jos8oy6bL8jFQ==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-win32-x64-msvc": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-win32-x64-msvc/-/edr-win32-x64-msvc-0.15.0.tgz",
-      "integrity": "sha512-pnUdVgZ4VwqbZu9XTAxJeuGavAY1w3txd/HkpqiOuu43Yrt0nnsRO5gAdj4smXJmQ5Bzy2x2GJ0/68rP4T1Pgw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-win32-x64-msvc/-/edr-win32-x64-msvc-0.19.0.tgz",
+      "integrity": "sha512-pIyEJBiS8l09Yndz+aE/JmkD39FCqtyiRO+wlx6tX426o4290acRfJ0r7GwTBmqqZD5G4pLOOB0uLIMRyDrY+g==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
         "node": ">= 22"
       }
@@ -2004,13 +2065,13 @@
       "license": "ISC"
     },
     "node_modules/hardhat": {
-      "version": "3.12.0",
-      "resolved": "https://registry.npmjs.org/hardhat/-/hardhat-3.12.0.tgz",
-      "integrity": "sha512-HY1BPWJ+Pq/RvGDcK8M0gwawNiJqrjfF0LOdHM+pYa9EDybG8O9hX1RP7fWchNLrA49D7A1Ax8LlRkQglWozzg==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/hardhat/-/hardhat-3.15.0.tgz",
+      "integrity": "sha512-41S+2ZCRRKfIcHLnfrpvGdBCaUf468U+YYqAeBSFZFivB7cY3qqDtOxOiLuLaJ7dw75yA/K3VHKZ2QF8nAd+iA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@nomicfoundation/edr": "0.15.0",
+        "@nomicfoundation/edr": "0.19.0",
         "@nomicfoundation/hardhat-errors": "^3.0.17",
         "@nomicfoundation/hardhat-utils": "^4.1.6",
         "@nomicfoundation/hardhat-vendored": "^3.0.4",
@@ -2704,9 +2765,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "dev": true,
       "license": "MIT",
       "engines": {

package/hardhat/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberia-hardhat",
-  "version": "1.0.0",
+  "version": "3.3.73",
   "type": "module",
   "description": "Hardhat project for Cyberia Online ObjectLayerToken (ERC-1155) on Hyperledger Besu",
   "private": true,
@@ -21,7 +21,7 @@
   "devDependencies": {
     "@nomicfoundation/hardhat-toolbox-viem": "^5.0.7",
     "chai": "^6.2.2",
-    "hardhat": "~3.12.0"
+    "hardhat": "~3.15.0"
   },
   "dependencies": {
     "@openzeppelin/contracts": "~5.6.1",
@@ -38,6 +38,6 @@
     "elliptic": ">=6.6.1",
     "lodash-es": "4.18.1",
     "ws": ">=8.21.0",
-    "undici": "6.27.0"
+    "undici": "6.28.0"
   }
 }

package/manifests/alertmanager/deployment.yaml

@@ -0,0 +1,81 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alertmanager
+  labels:
+    app: alertmanager
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: alertmanager
+  template:
+    metadata:
+      labels:
+        app: alertmanager
+    spec:
+      containers:
+        - name: alertmanager
+          image: prom/alertmanager:latest
+          args:
+            - '--config.file=/etc/alertmanager/alertmanager.yml'
+            - '--storage.path=/alertmanager'
+          ports:
+            - containerPort: 9093
+              name: web
+          volumeMounts:
+            - name: alertmanager-config
+              mountPath: /etc/alertmanager/
+            # The bearer token Alertmanager presents to the event dispatcher,
+            # written by the monitor CLI before this workload is applied. Marked
+            # optional so a missing Secret surfaces as a config-load error naming
+            # the file, rather than a pod stuck in ContainerCreating.
+            - name: alertmanager-webhook
+              mountPath: /etc/alertmanager/secret/
+              readOnly: true
+            - name: alertmanager-data
+              mountPath: /alertmanager
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 9093
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9093
+            initialDelaySeconds: 30
+            periodSeconds: 20
+          resources:
+            requests:
+              memory: '64Mi'
+              cpu: '50m'
+      volumes:
+        - name: alertmanager-config
+          configMap:
+            name: alertmanager-config
+        - name: alertmanager-webhook
+          secret:
+            secretName: alertmanager-webhook
+            optional: true
+        - name: alertmanager-data
+          emptyDir: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: alertmanager
+  labels:
+    app: alertmanager
+spec:
+  ports:
+    - port: 9093
+      targetPort: 9093
+      protocol: TCP
+      name: web
+  selector:
+    app: alertmanager
+  type: ClusterIP

package/manifests/blackbox-exporter/deployment.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: blackbox-exporter
+  labels:
+    app: blackbox-exporter
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: blackbox-exporter
+  template:
+    metadata:
+      labels:
+        app: blackbox-exporter
+    spec:
+      containers:
+        - name: blackbox-exporter
+          image: prom/blackbox-exporter:latest
+          args:
+            - '--config.file=/etc/blackbox_exporter/blackbox.yml'
+          ports:
+            - containerPort: 9115
+              name: http
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              # The icmp prober opens a raw socket. Without NET_RAW the module
+              # loads and every probe fails at send time, which reads as the
+              # target being down rather than as a misconfigured exporter.
+              add:
+                - NET_RAW
+          volumeMounts:
+            - name: blackbox-exporter-config
+              mountPath: /etc/blackbox_exporter/
+          readinessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9115
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9115
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              memory: '32Mi'
+              cpu: '25m'
+      volumes:
+        - name: blackbox-exporter-config
+          configMap:
+            name: blackbox-exporter-config
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: blackbox-exporter
+  labels:
+    app: blackbox-exporter
+spec:
+  ports:
+    - port: 9115
+      targetPort: 9115
+      protocol: TCP
+      name: http
+  selector:
+    app: blackbox-exporter
+  type: ClusterIP

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -14,6 +14,10 @@ spec:
   failedJobsHistoryLimit: 1
   suspend: false
   jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-backup
+        managed-by: underpost
     spec:
       template:
         metadata:
@@ -23,26 +27,51 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.90
+              image: underpost/underpost-engine:v3.3.73
               command:
                 - /bin/sh
                 - -c
                 - >
                   cd /home/dd/engine &&
-                  node bin env dd-cron production &&
                   node bin cron dd-lampp,dd-cyberia,dd-core,dd-prototype,dd-test backup --git --kubeadm 
+              # Explicit, so the environment the pod runs is the one this manifest resolved:
+              # a container env entry wins over envFrom, whatever the projected Secret carries.
+              env:
+                - name: NODE_ENV
+                  value: production
+              envFrom:
+                - secretRef:
+                    name: underpost-cron-env
+                    optional: true
               volumeMounts:
                 - mountPath: /home/dd/engine
                   name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost
-                  name: underpost-share-env
+                - mountPath: /var/lib/node_exporter/textfile
+                  name: underpost-node-exporter-textfile
+                - mountPath: /etc/underpost/secrets/ssh
+                  name: underpost-ssh-key
+                  readOnly: true
           volumes:
+            # The engine mirror: a copy of the checkout kept outside every home tree, because
+            # `container_t` is denied every read under one. The job body runs this repository's CLI
+            # (`node bin ...`), so it needs the source tree, its node_modules and engine-private's
+            # deploy configuration — the mount cannot be narrowed below that. Refreshed and labeled
+            # by prepareCronHostStorage(); see src/server/ops/cron.js's module header.
             - hostPath:
-                path: /home/dd/engine
+                path: /opt/engine
                 type: Directory
               name: underpost-cron-container-volume
+            # Metrics the cluster cannot scrape for itself are written here and read by the
+            # node-exporter collector. Prepared and labeled by prepareCronHostStorage().
             - hostPath:
-                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
+                path: /var/lib/node_exporter/textfile
                 type: DirectoryOrCreate
-              name: underpost-share-env
+              name: underpost-node-exporter-textfile
+            # Optional for the same reason the credential Secret is: a cluster that has onboarded
+            # no key still schedules, and the job that needs one reports its own failure.
+            - secret:
+                secretName: underpost-ssh-key
+                optional: true
+                defaultMode: 0400
+              name: underpost-ssh-key
           restartPolicy: OnFailure

package/manifests/cronjobs/dd-cron/dd-cron-vultr.yaml

@@ -0,0 +1,77 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: dd-cron-vultr
+  namespace: default
+  labels:
+    app: dd-cron-vultr
+    managed-by: underpost
+spec:
+  schedule: "*/30 * * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 200
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  suspend: false
+  jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-vultr
+        managed-by: underpost
+    spec:
+      template:
+        metadata:
+          labels:
+            app: dd-cron-vultr
+            managed-by: underpost
+        spec:
+          containers:
+            - name: dd-cron-vultr
+              image: underpost/underpost-engine:v3.3.73
+              command:
+                - /bin/sh
+                - -c
+                - >
+                  cd /home/dd/engine &&
+                  node bin cron dd-cron vultr --git --kubeadm 
+              # Explicit, so the environment the pod runs is the one this manifest resolved:
+              # a container env entry wins over envFrom, whatever the projected Secret carries.
+              env:
+                - name: NODE_ENV
+                  value: production
+              envFrom:
+                - secretRef:
+                    name: underpost-cron-env
+                    optional: true
+              volumeMounts:
+                - mountPath: /home/dd/engine
+                  name: underpost-cron-container-volume
+                - mountPath: /var/lib/node_exporter/textfile
+                  name: underpost-node-exporter-textfile
+                - mountPath: /etc/underpost/secrets/ssh
+                  name: underpost-ssh-key
+                  readOnly: true
+          volumes:
+            # The engine mirror: a copy of the checkout kept outside every home tree, because
+            # `container_t` is denied every read under one. The job body runs this repository's CLI
+            # (`node bin ...`), so it needs the source tree, its node_modules and engine-private's
+            # deploy configuration — the mount cannot be narrowed below that. Refreshed and labeled
+            # by prepareCronHostStorage(); see src/server/ops/cron.js's module header.
+            - hostPath:
+                path: /opt/engine
+                type: Directory
+              name: underpost-cron-container-volume
+            # Metrics the cluster cannot scrape for itself are written here and read by the
+            # node-exporter collector. Prepared and labeled by prepareCronHostStorage().
+            - hostPath:
+                path: /var/lib/node_exporter/textfile
+                type: DirectoryOrCreate
+              name: underpost-node-exporter-textfile
+            # Optional for the same reason the credential Secret is: a cluster that has onboarded
+            # no key still schedules, and the job that needs one reports its own failure.
+            - secret:
+                secretName: underpost-ssh-key
+                optional: true
+                defaultMode: 0400
+              name: underpost-ssh-key
+          restartPolicy: OnFailure

package/manifests/deployment/dd-cyberia-development/deployment.yaml

@@ -20,11 +20,17 @@ spec:
     spec:
       containers:
         - name: dd-cyberia-development-blue
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.73
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
                 name: underpost-config
+            # The deployment's own environment, with its .env.<env>.oci overlay already
+            # applied by 'app apply'. Optional so a deployment predating that Secret still
+            # starts; the in-pod 'app load' resolves the same overlay as a second path.
+            - secretRef:
+                name: dd-cyberia-development-env
+                optional: true
           env:
             - name: UNDERPOST_INTERNAL_PORT
               value: "4004"
@@ -33,7 +39,6 @@ spec:
             - /bin/sh
             - -c
             - >
-              underpost secret underpost --create-from-env &&
               underpost start --build --run dd-cyberia development
           readinessProbe:
             {

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.73
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.73
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/manifests/grafana/deployment.yaml

@@ -6,6 +6,9 @@ metadata:
     app: grafana
   name: grafana
 spec:
+  # Never run two Grafana processes against the same local data directory.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: grafana
@@ -21,13 +24,11 @@ spec:
       containers:
         - name: grafana
           image: grafana/grafana:latest
-          env:
-            # - name: GF_SERVER_ROOT_URL
-            #   value: '{{GF_SERVER_ROOT_URL}}'
-            - name: GF_SERVER_ROOT_URL
-              value: '/grafana'
-            - name: GF_SERVER_SERVE_FROM_SUB_PATH
-              value: 'true'
+          # GF_SERVER_ROOT_URL and GF_SERVER_SERVE_FROM_SUB_PATH are deliberately
+          # absent: Grafana builds every asset link and redirect from them, so
+          # their value depends on how it is published. `monitor --observability`
+          # sets both from the resolved exposure, which is the one place that
+          # knows.
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 3000
@@ -58,7 +59,25 @@ spec:
           volumeMounts:
             - mountPath: /var/lib/grafana
               name: grafana-pv
+            - mountPath: /etc/grafana/provisioning/datasources
+              name: grafana-datasources
+              readOnly: true
+            - mountPath: /etc/grafana/provisioning/dashboards
+              name: grafana-dashboard-provider
+              readOnly: true
+            - mountPath: /var/lib/grafana/dashboards
+              name: grafana-dashboards
+              readOnly: true
       volumes:
         - name: grafana-pv
           persistentVolumeClaim:
             claimName: grafana-pvc
+        - name: grafana-datasources
+          configMap:
+            name: grafana-datasources
+        - name: grafana-dashboard-provider
+          configMap:
+            name: grafana-dashboard-provider
+        - name: grafana-dashboards
+          configMap:
+            name: grafana-dashboards

package/manifests/grafana/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - storage-class.yaml
   - pvc.yaml
   - service.yaml
+  - deployment.yaml