Deploy releases/k8s-manifests 487bb0d

[github-actions]

kubectl diff reports that applying 487bb0d will change:

diff -uN /tmp/LIVE-3396772614/apps.v1.Deployment.paws-data-pipeline.paws-dp-chart /tmp/MERGED-2159327694/apps.v1.Deployment.paws-data-pipeline.paws-dp-chart
--- /tmp/LIVE-3396772614/apps.v1.Deployment.paws-data-pipeline.paws-dp-chart	2025-11-17 03:44:39.383959933 +0000
+++ /tmp/MERGED-2159327694/apps.v1.Deployment.paws-data-pipeline.paws-dp-chart	2025-11-17 03:44:39.391959854 +0000
@@ -34,8 +34,8 @@
           value: paws
         envFrom:
         - secretRef:
-            name: db-pass
-        image: postgres:15.4-alpine
+            name: paws-secrets
+        image: postgres:15.14-alpine
         imagePullPolicy: IfNotPresent
         name: paws-datapipeline-db
         ports:
@@ -50,10 +50,10 @@
           subPath: postgresql-data
       - envFrom:
         - secretRef:
-            name: api-server-pws
+            name: paws-salesforce
         - secretRef:
-            name: db-pass
-        image: ghcr.io/codeforphilly/paws-data-pipeline/server:2.50
+            name: paws-secrets
+        image: ghcr.io/codeforphilly/paws-data-pipeline/server:2.63
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -83,7 +83,9 @@
         - mountPath: /var/lib/server/data
           name: paws-data-pipeline-server-data
           subPath: server-data
-      - image: ghcr.io/codeforphilly/paws-data-pipeline/client:2.50
+        - mountPath: /app/pem/
+          name: paws-data-pipeline-pem
+      - image: ghcr.io/codeforphilly/paws-data-pipeline/client:2.63
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -131,3 +133,10 @@
       - name: paws-data-pipeline-server-data
         persistentVolumeClaim:
           claimName: paws-data-pipeline-server-data
+      - name: paws-data-pipeline-pem
+        secret:
+          defaultMode: 420
+          items:
+          - key: PEM_FILE
+            path: connected-app-secrets.pem
+          secretName: paws-salesforce

Errors/Warnings

=== Directory: ./choose-native-plants ===
The PersistentVolumeClaim "choose-native-plants-mongo-data" is invalid: 
* spec: Forbidden: spec is immutable after creation except resources.requests and volumeAttributesClassName for bound claims
  core.PersistentVolumeClaimSpec{
  	... // 2 identical fields
  	Resources:        {Requests: {s"storage": {i: {...}, s: "10Gi", Format: "BinarySI"}}},
  	VolumeName:       "pvc-d080ddf5991a4cf4",
- 	StorageClassName: &"linode-block-storage-retain",
+ 	StorageClassName: nil,
  	VolumeMode:       &"Filesystem",
  	DataSource:       nil,
  	... // 2 identical fields
  }
* spec.resources.requests.storage: Forbidden: field can not be less than status.capacity

[github-actions]

kubectl apply output (excluding unchanged) for 7bcd6b4 was:

customresourcedefinition.apiextensions.k8s.io/sealedsecrets.bitnami.com configured
clusterrole.rbac.authorization.k8s.io/grafana-clusterrole configured
clusterrole.rbac.authorization.k8s.io/prometheus-alertmanager configured
clusterrole.rbac.authorization.k8s.io/prometheus-pushgateway configured
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews configured
clusterrolebinding.rbac.authorization.k8s.io/sealed-secrets configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission configured
configmap/cert-manager-webhook configured
configmap/cert-manager configured
rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving configured
configmap/app-config configured
deployment.apps/choose-native-plants configured
ingress.networking.k8s.io/choose-native-plants configured
service/choose-native-plants configured
statefulset.apps/data-warehouse-postgresql configured
configmap/grafana-dashboards-default configured
deployment.apps/grafana configured
deployment.apps/ingress-nginx-controller configured
deployment.apps/metrics-server configured
rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection configured
secret/promtail configured
statefulset.apps/loki configured
statefulset.apps/database configured
deployment.apps/paws-dp-chart configured
deployment.apps/prometheus-alertmanager configured
deployment.apps/prometheus-kube-state-metrics configured
deployment.apps/prometheus-pushgateway configured
deployment.apps/prometheus-server configured
serviceaccount/prometheus-kube-state-metrics configured
deployment.apps/sealed-secrets configured
rolebinding.rbac.authorization.k8s.io/sealed-secrets-key-admin configured
service/sealed-secrets configured

Errors/Warnings

=== Directory: ./choose-native-plants ===
The PersistentVolumeClaim "choose-native-plants-mongo-data" is invalid: 
* spec: Forbidden: spec is immutable after creation except resources.requests and volumeAttributesClassName for bound claims
  core.PersistentVolumeClaimSpec{
  	... // 2 identical fields
  	Resources:        {Requests: {s"storage": {i: {...}, s: "10Gi", Format: "BinarySI"}}},
  	VolumeName:       "pvc-d080ddf5991a4cf4",
- 	StorageClassName: &"linode-block-storage-retain",
+ 	StorageClassName: nil,
  	VolumeMode:       &"Filesystem",
  	DataSource:       nil,
  	... // 2 identical fields
  }
* spec.resources.requests.storage: Forbidden: field can not be less than status.capacity