- Shipped
- 4 Agosti 2026, 22:49 UTC
- Author
- Kamo
- Commit
- d51aa3c
Auditing what a full reconcile would apply turned up two manifests that had drifted far enough from the cluster that re-applying them would have caused an outage: Docs/deployment.yaml - image pointed at k0m1:5000, a registry that is permanently retired. Applying it would have put Docs into ImagePullBackOff. Live (and now this file) uses the k1m1 registry at 192.168.4.22:5000. - aliasgroup1 was pinned to the single host https://api.kamocrm.com:443. coolwsd treats that value as a regex and WOPISrc is https://api.<tenant-domain>, so pinning it breaks every white-label tenant with "unauthorized WOPI host". Restored to the live regex https://api\..* - strategy was Recreate, which drops every in-flight editing session on deploy; live is RollingUpdate maxSurge=1 maxUnavailable=0. - cpu limit was 1 vs the live 4. traefik/serverstransport.yaml - missing insecureSkipVerify: true, which is set live. Applying without it re-enables backend cert verification on the media websocket transport. Both files now match the live objects, so applying them is a no-op. Also noted in Docs/deployment.yaml that it is one of three copies of that Deployment across repos, since whichever CI runs last wins.