chore(veles): deploy 0.6.81

services/bstein-dev-home/oneoffs/portal-onboarding-e2e-test-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: portal-onboarding-e2e-test-27
   namespace: bstein-dev-home
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/comms/oneoffs/bstein-force-leave-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: bstein-leave-rooms-12
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/comms/oneoffs/mas-admin-client-secret-ensure-job.yaml

@@ -45,6 +45,7 @@ metadata:
   name: mas-admin-client-secret-ensure-11
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/comms/oneoffs/othrys-kick-numeric-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: othrys-kick-numeric-8
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/comms/oneoffs/synapse-seeder-admin-ensure-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: synapse-seeder-admin-ensure-9
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/comms/oneoffs/synapse-signingkey-ensure-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: othrys-synapse-signingkey-ensure-7
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml

@@ -8,7 +8,8 @@ metadata:
   name: veles-feedback-acl-ensure-4
   namespace: gitea
 spec:
-  suspend: false
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/agent-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/agent-oidc-secret-ensure-job.yaml
 # One-off job for sso/agent-oidc-secret-ensure-1.
 # Purpose: ensure the agent UI oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: agent-oidc-secret-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/ldap-federation-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-ldap-federation-12
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/keycloak/oneoffs/metis-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/metis-oidc-secret-ensure-job.yaml
 # One-off job for sso/metis-oidc-secret-ensure-2.
 # Purpose: ensure the Metis oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: metis-oidc-secret-ensure-3
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-admin-secret-ensure-5
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/keycloak/oneoffs/portal-e2e-client-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-client-8
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/keycloak/oneoffs/portal-e2e-execute-actions-email-test-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-execute-actions-email-14
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 3
   template:

services/keycloak/oneoffs/portal-e2e-target-client-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-target-7
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/keycloak/oneoffs/portal-e2e-token-exchange-permissions-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-token-exchange-permissions-11
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 6
   template:

services/keycloak/oneoffs/portal-groups-scope-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/portal-groups-scope-ensure-job.yaml
 # One-off job for sso/portal-groups-scope-ensure-1.
 # Purpose: allow bstein-dev-home to request the groups OIDC scope.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: portal-groups-scope-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/quality-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/quality-oidc-secret-ensure-job.yaml
 # One-off job for sso/quality-oidc-secret-ensure-1.
 # Purpose: ensure the SonarQube oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: quality-oidc-secret-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/realm-settings-job.yaml

@@ -9,7 +9,8 @@ metadata:
   name: keycloak-realm-settings-37
   namespace: sso
 spec:
-  suspend: false
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/soteria-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/soteria-oidc-secret-ensure-job.yaml
 # One-off job for sso/soteria-oidc-secret-ensure-1.
 # Purpose: ensure the Soteria oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: soteria-oidc-secret-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/user-overrides-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-user-overrides-9
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/mailu/oneoffs/mailu-sync-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: mailu-sync-9
   namespace: mailu-mailserver
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   template:
     metadata:

services/maintenance/oneoffs/k3s-traefik-cleanup-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: k3s-traefik-cleanup-2
   namespace: maintenance
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 1
   template:

services/monitoring/oneoffs/grafana-org-bootstrap.yaml

@@ -9,6 +9,7 @@ metadata:
   name: grafana-org-bootstrap-3
   namespace: monitoring
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/monitoring/oneoffs/grafana-user-dedupe-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: grafana-user-dedupe-api-v8
   namespace: monitoring
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 1
   template:

services/veles/backend-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       labels:
         app: veles-backend
       annotations:
-        veles.bstein.dev/redeploy: "2026-07-14-0.6.80-guide-generation-refresh"
+        veles.bstein.dev/redeploy: "2026-07-14-0.6.81-payoff-exposure-hardening"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/agent-init-first: "true"
         vault.hashicorp.com/agent-pre-populate-only: "true"
@@ -63,7 +63,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: database-init
-          image: registry.bstein.dev/veles/veles-backend:0.6.80 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.6.81 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: Always
           command: ["/bin/sh", "-c"]
           args:
@@ -85,7 +85,7 @@ spec:
               memory: 512Mi
       containers:
         - name: backend
-          image: registry.bstein.dev/veles/veles-backend:0.6.80 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.6.81 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: Always
           command: ["/bin/sh", "-c"]
           args:

services/veles/configmap.yaml

@@ -18,8 +18,8 @@ data:
   VELES_OIDC_REQUIRED_GROUPS: alpha,veles-tester,admin
   VELES_OIDC_ADMIN_GROUPS: admin
   VELES_NAMESPACE: veles
-  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.6.80 # {"$imagepolicy": "veles:veles-sim-worker"}
+  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.6.81 # {"$imagepolicy": "veles:veles-sim-worker"}
-  VELES_SIM_WORKER_VERSION: "0.6.80"
+  VELES_SIM_WORKER_VERSION: "0.6.81"
   VELES_SIM_SERVICE_ACCOUNT: veles-sim
   VELES_SIM_PRIORITY_CLASS: veles-sim
   VELES_SIM_NODE_SELECTOR: veles.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64

services/veles/frontend-deployment.yaml

@@ -48,7 +48,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: frontend
-          image: registry.bstein.dev/veles/veles-frontend:0.6.80 # {"$imagepolicy": "veles:veles-frontend"}
+          image: registry.bstein.dev/veles/veles-frontend:0.6.81 # {"$imagepolicy": "veles:veles-frontend"}
           imagePullPolicy: Always
           ports:
             - name: http

services/veles/retention-cronjob.yaml

@@ -37,7 +37,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: retention
-              image: registry.bstein.dev/veles/veles-backend:0.6.80 # {"$imagepolicy": "veles:veles-backend"}
+              image: registry.bstein.dev/veles/veles-backend:0.6.81 # {"$imagepolicy": "veles:veles-backend"}
               imagePullPolicy: IfNotPresent
               command: ["veles-hygiene"]
               args: ["--prune-artifacts"]