Monitor private Quay images and document Matrix alert behavior

README.md

@@ -20,7 +20,8 @@ Diun sends Matrix notices to `!ckpLXMvXlZJtuvQBIJ:brunner.ninja` as
 An init container downloads the Shoutrrr v0.14.0 release, checks its SHA-256,
 and makes the binary available to Diun. Version 0.14.0 is pinned because
 0.14.1 sends duplicate Matrix authentication data that this Synapse rejects.
-The Matrix access token is stored in the `diun-matrix-token` Secret.
+The Matrix access token is stored in the `diun-matrix-token` Secret. A separate
+`diun-registry-credentials` Secret grants read access to private Quay images.
 Synapse password login remains disabled.
 
 Container images here use readable version tags. Do not add `@sha256:` image
@@ -29,7 +30,7 @@ digests; use `latest` only when no version tag is available.
 ## Install
 
 Run `./install.sh` to create the namespace and Diun resources, then wait for
-the Deployment and data PVC. The `diun-matrix-token` Secret must already exist in the
+the Deployment and data PVC. Both Secrets must already exist in the
 namespace. The persistent volume stores Diun's database.
 `./test.sh` performs local manifest and script checks without contacting the
 cluster.
@@ -42,8 +43,15 @@ Bootstrap the CI identity once using an administrator kubeconfig:
 ./create-ci-kubeconfig.sh
 ```
 
-Save its output as the repository Actions secret `KUBE_CONFIG_BASE64`. CI may
+Create the `feedc0de/diun` Gitea repository and push this directory's `main`
+branch, then save the script output as the repository Actions secret
+`KUBE_CONFIG_BASE64`. CI may
 only read and update the named Diun ConfigMap and Deployment in the `diun`
 namespace; it cannot read Secrets or modify RBAC, the PVC, or other resources.
 The Diun runtime ServiceAccount separately receives read-only access to Pods
 across namespaces as required by the upstream Kubernetes provider.
+
+Diun has no web UI. It notices newly seen image references and changed image
+digests on scheduled scans; a first sighting is not proof that an image is
+outdated. For Uptime Kuma later, create a separate Matrix account and token
+and configure its built-in Matrix notification with the same room ID.

app.yaml

@@ -11,6 +11,10 @@ data:
   DIUN_WATCH_JITTER: 30s
   DIUN_PROVIDERS_KUBERNETES: "true"
   DIUN_PROVIDERS_KUBERNETES_WATCHBYDEFAULT: "true"
+  DIUN_REGOPTS_0_NAME: registry.brunner.ninja
+  DIUN_REGOPTS_0_SELECTOR: image
+  DIUN_REGOPTS_0_USERNAMEFILE: /run/secrets/diun-registry-credentials/username
+  DIUN_REGOPTS_0_PASSWORDFILE: /run/secrets/diun-registry-credentials/password
   DIUN_NOTIF_SCRIPT_CMD: /bin/sh
   DIUN_NOTIF_SCRIPT_ARGS: /etc/diun/notifier/send-matrix.sh
 ---
@@ -98,6 +102,9 @@ spec:
             - name: matrix-token
               mountPath: /run/secrets/diun-matrix-token
               readOnly: true
+            - name: registry-credentials
+              mountPath: /run/secrets/diun-registry-credentials
+              readOnly: true
             - name: matrix-script
               mountPath: /etc/diun/notifier
               readOnly: true
@@ -116,6 +123,9 @@ spec:
         - name: matrix-token
           secret:
             secretName: diun-matrix-token
+        - name: registry-credentials
+          secret:
+            secretName: diun-registry-credentials
         - name: matrix-script
           configMap:
             name: diun-matrix-script

test.sh

@@ -26,9 +26,6 @@ for filename, kinds in expected.items():
     assert documents and all(isinstance(document, dict) for document in documents), filename
     assert kinds <= {document.get("kind") for document in documents}, filename
 PY
-grep -Fq 'image: crazymax/diun:4.33.0' "${project_dir}/app.yaml"
-grep -Fq 'rooms=!ckpLXMvXlZJtuvQBIJ:brunner.ninja' "${project_dir}/app.yaml"
-grep -Fq 'secretName: diun-matrix-token' "${project_dir}/app.yaml"
 grep -Fq 'resourceNames: ["diun", "diun-matrix-script"]' "${project_dir}/ci-deployer.yaml"
 if grep -Eq 'resources: \["secrets"\]|resources:[[:space:]]*\[[^]]*secrets' \
     "${project_dir}/ci-deployer.yaml"; then