diun/README.md

Diun

Diun checks container images used by Kubernetes Pods and sends notifications when registry images change. It runs in its own diun namespace using the upstream crazymax/diun:4.33.0 image. The Kubernetes provider reads Pods across namespaces by default.

Add this annotation to a Pod template to exclude an application:

spec:
  template:
    metadata:
      annotations:
        diun.enable: "false"

Diun sends Matrix notices to !ckpLXMvXlZJtuvQBIJ:brunner.ninja as @diun:brunner.ninja. It calls the Shoutrrr CLI through Diun's script notifier. An init container downloads the Shoutrrr v0.14.0 release, checks its SHA-256, and makes the binary available to Diun. Version 0.14.0 is pinned because 0.14.1 sends duplicate Matrix authentication data that this Synapse rejects. The Matrix access token is stored in the diun-matrix-token Secret. A separate diun-registry-credentials Secret grants read access to private Quay images. Synapse password login remains disabled.

Container images here use readable version tags. Do not add @sha256: image digests; use latest only when no version tag is available.

Install

Run ./install.sh to create the namespace and Diun resources, then wait for the Deployment and data PVC. Both Secrets must already exist in the namespace. The persistent volume stores Diun's database. ./test.sh performs local manifest and script checks without contacting the cluster.

Gitea deployment

Bootstrap the CI identity once using an administrator kubeconfig:

./create-ci-kubeconfig.sh

Create the feedc0de/diun Gitea repository and push this directory's main branch, then save the script output as the repository Actions secret KUBE_CONFIG_BASE64. CI may only read and update the named Diun ConfigMap and Deployment in the diun namespace; it cannot read Secrets or modify RBAC, the PVC, or other resources. The Diun runtime ServiceAccount separately receives read-only access to Pods across namespaces as required by the upstream Kubernetes provider.

Diun has no web UI. It notices newly seen image references and changed image digests on scheduled scans; a first sighting is not proof that an image is outdated. For Uptime Kuma later, create a separate Matrix account and token and configure its built-in Matrix notification with the same room ID.