chore: version bumps:

cert-manager 1.11.1 -> 1.12.2
restic-kubernetes: 2.0.0 -> 2.2.0
docker: 23.0.1 -> 23.0.6
coder terraform: 0.5.2 -> 0.11.1 (pin version)
kubernetes terraform: 2.14 -> 2.22 (pin version)
coder: 0.23.0 -> 0.27.1
Keycloak chart: 14.4.1 -> 15.1.7
kube-prometheus-stack: 45.23.0 -> 48.1.2
nginx-ingress-controller chart: 4.6.0 -> 4.7.1
oauth2-proxy chart: 6.12.0 -> 6.16.1
pgadmin chart: 1.14.7 -> 1.15.4
google terraform: 4.53.0 -> 4.74.0
kubernetes: 1.26.x -> 1.27.x (google decides the patch version)
terraform 1.3.8 -> 1.5.3
kubectl: 1.25.6 -> 1.27.3
helm: 3.11.1 -> 3.12.2

Dockerfile

@@ -29,7 +29,8 @@ RUN set -e; \
   rm /tmp/requirements.txt
 
 
-ARG TERRAFORM_VERSION=1.3.8
+# https://github.com/hashicorp/terraform/releases
+ARG TERRAFORM_VERSION=1.5.3
 RUN set -e; \
   cd /tmp; \
   curl -Ss -o terraform.zip https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip; \
@@ -38,14 +39,16 @@ RUN set -e; \
   chmod +x /usr/local/bin/terraform; \
   rm terraform.zip
 
-ARG KUBECTL_VERSION=1.25.6
+# https://github.com/kubernetes/kubernetes/releases
+ARG KUBECTL_VERSION=1.27.3
 RUN set -e; \
     cd /tmp; \
     curl -sLO "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl"; \
     mv kubectl /usr/local/bin/; \
     chmod +x /usr/local/bin/kubectl
 
-ARG HELM_VERSION=3.11.1
+# https://github.com/helm/helm/releases
+ARG HELM_VERSION=3.12.2
 RUN set -e; \
   cd /tmp; \
   curl -Ss -o helm.tar.gz https://get.helm.sh/helm-v${HELM_VERSION}-${TARGETOS}-${TARGETARCH}.tar.gz; \
@@ -54,7 +57,8 @@ RUN set -e; \
   chmod +x /usr/local/bin/helm; \
   rm -rf ${TARGETOS}-${TARGETARCH} helm.tar.gz
 
-ARG CODER_VERSION=0.17.1
+# https://github.com/coder/coder/releases
+ARG CODER_VERSION=0.27.1
 RUN  set -e; \
   cd /tmp; \
   curl -sSL -o coder.deb -C - https://github.com/coder/coder/releases/download/v${CODER_VERSION}/coder_${CODER_VERSION}_${TARGETOS}_${TARGETARCH}.deb; \

automate/roles/cert_manager/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
 namespace: cert-manager
-cert_manager_version: v1.11.1
+# https://artifacthub.io/packages/helm/cert-manager/cert-manager
+cert_manager_version: v1.12.2
 cm_google_credentials_path: ""

automate/roles/coder/coder_templates/devbox/main.tf

@@ -245,7 +245,7 @@ resource "kubernetes_stateful_set" "main" {
           for_each = toset( var.backup_service ? ["1"] : [])
           content {
             name    = "restic-restore"
-            image   = "isi006/restic-kubernetes:2.0.0"
+            image   = "isi006/restic-kubernetes:2.2.0"
             env {
               name  = "RESTIC_RESTORE"
               value = "1"
@@ -372,7 +372,7 @@ resource "kubernetes_stateful_set" "main" {
           for_each = toset( var.docker_service ? ["1"] : [])
           content {
             name    = "docker-dind"
-            image   = "docker:23.0.1-dind"
+            image   = "docker:23.0.6-dind"
             args = [ "--mtu=1320" ]
             security_context {
               privileged = true
@@ -402,7 +402,7 @@ resource "kubernetes_stateful_set" "main" {
           for_each = toset( var.backup_service ? ["1"] : [])
           content {
             name    = "restic-backup"
-            image   = "isi006/restic-kubernetes:2.0.0"
+            image   = "isi006/restic-kubernetes:2.2.0"
             env {
               name  = "AWS_ACCESS_KEY_ID"
               value = var.aws_access_key
@@ -494,7 +494,7 @@ resource "kubernetes_stateful_set" "main" {
 
 resource "coder_app" "code-server" {
   agent_id = coder_agent.devbox.id
-  name     = "code-server"
+  slug     = "code-server"
   url      = "http://localhost:13337/?folder=/home/coder"
   icon     = "/icon/code.svg"
 }

automate/roles/coder/coder_templates/devbox/provider.tf

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     coder = {
       source  = "coder/coder"
-      version = "~> 0.5.2"
+      version = "0.11.1"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "~> 2.14"
+      version = "2.22"
     }
   }
 }

automate/roles/coder/defaults/main.yml

@@ -1,6 +1,7 @@
 ---
 namespace: coder
-coder_version: 0.23.0
+# https://github.com/coder/coder/releases
+coder_version: 0.27.1
 coder_chart_version: "{{ coder_version }}"
 
 coder_pg_dbname: coder

automate/roles/coder/tasks/devbox-workspace.yml

@@ -11,13 +11,13 @@
     mode: 0600
 
 - name: push template
-  command: "{{ bin_dir }}/coder template push '{{ item.name }}' --parameter-file '{{ role_path }}/tmp/params-{{ item.name }}.yml' -d {{ role_path }}/coder_templates/devbox -y"
+  command: "{{ bin_dir }}/coder template push '{{ item.name }}' --ignore-lockfile --variables-file '{{ role_path }}/tmp/params-{{ item.name }}.yml' -d {{ role_path }}/coder_templates/devbox -y"
   ignore_errors: true
   register: result
 
 - name: create template
   when: "result.rc != 0"
-  command: "{{ bin_dir }}/coder template create '{{ item.name }}' --default-ttl {{ item.max_ttl }} --parameter-file '{{ role_path }}/tmp/params-{{ item.name }}.yml' -d {{ role_path }}/coder_templates/devbox -y"
+  command: "{{ bin_dir }}/coder template create '{{ item.name }}' --default-ttl {{ item.max_ttl }} --ignore-lockfile --variables-file '{{ role_path }}/tmp/params-{{ item.name }}.yml' -d {{ role_path }}/coder_templates/devbox -y"
   register: result
   until: result.rc == 0
   delay: 5

automate/roles/keycloak/defaults/main/main.yml

@@ -1,5 +1,6 @@
 ---
-keycloak_chart_version: 14.4.1
+# https://artifacthub.io/packages/helm/bitnami/keycloak
+keycloak_chart_version: 15.1.7
 keycloak_db_hostname: "main-postgres-db.postgres"
 namespace: keycloak
 keycloak_hostname: keycloak.{{ cluster_public_domain }}

automate/roles/kube_prometheus_stack/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
 namespace: monitoring
-prometheus_stack_chart_version: 45.23.0
+# https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
+prometheus_stack_chart_version: 48.1.2
 prometheus_stack_release_name: main

automate/roles/nginx_ingress/defaults/main.yml

@@ -2,6 +2,7 @@
 namespace: nginx-ingress
 nginx_google_credentials_path: ""
 
-nginx_controller_chart_version: 4.6.0
+# https://github.com/kubernetes/ingress-nginx/tree/main/charts/ingress-nginx
+nginx_controller_chart_version: 4.7.1
 nginx_backup_remote_storage_provider: none
 nginx_backup_remote_storage_bucket: ""

automate/roles/oauth2_proxy/defaults/main/main.yml

@@ -1,3 +1,4 @@
 ---
-auth_chart_version: 6.12.0
+# https://artifacthub.io/packages/helm/oauth2-proxy/oauth2-proxy
+auth_chart_version: 6.16.1
 namespace: oauth2-proxy

automate/roles/pgadmin/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
 namespace: "pgadmin"
-pg_admin_chart_version: "1.14.7"
+# https://artifacthub.io/packages/helm/runix/pgadmin4
+pg_admin_chart_version: "1.15.4"
 pg_admin_chart_ref: "runix/pgadmin4"

infrastructure/google/provider.tf

@@ -10,9 +10,9 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "4.53.0"
+      version = "4.74.0"
     }
   }
 
-  required_version = ">= 1.2.6"
+  required_version = ">= 1.5.3"
 }

infrastructure/google/variables.tf

@@ -25,7 +25,7 @@ variable "domain_name" {
 
 variable "cluster_version_prefix" {
   description = "Version prefix of the cluster"
-  default     = "1.26."
+  default     = "1.27."
 }
 
 variable "system_name" {

run_infra.sh

@@ -10,6 +10,7 @@ ansible-playbook -i inventory ${SCRIPT_DIR}/automate/tf_vars.yml
 export GOOGLE_APPLICATION_CREDENTIALS=${SCRIPT_DIR}/config/google-coder-automation.json
 
 terraform -chdir=${SCRIPT_DIR}/infrastructure/google init \
+    -upgrade \
     -backend-config="bucket=${BUCKET_NAME}" \
     -backend-config="prefix=tf-state/${CLUSTER_NAME}" \