fix(authentik): turn off error reporting

error_reporting.enabled has been true since the first deploy. The server
hands the Sentry DSN (authentik.error-reporting.a7k.io) to every outpost
through /api/v3/root/config/, and the RADIUS and LDAP outposts then try
to send reports there; egress policy drops all of it. Reporting to a
third party was never intended to work here.

S28-43

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/authentik/helmrelease.yaml

@@ -113,8 +113,10 @@ spec:
           value: "10.244.0.0/16,fd10:244::/48,127.0.0.0/8,::1/128"
     authentik:
       log_level: info
+      # Off: reports would go to authentik.error-reporting.a7k.io (Sentry),
+      # which egress policy denies. The outposts take this from the server.
       error_reporting:
-        enabled: true
+        enabled: false
       postgresql:
         host: "ak-pg-rw.authentik.svc.cluster.local"
         name: "authentik"

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -64,7 +64,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-1918 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-2052 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/influxdb/helmrelease.yaml

@@ -100,6 +100,9 @@ spec:
       # Keep tokens unhashed; enable hashing later as its own change.
       - name: INFLUXD_USE_HASHED_TOKENS
         value: "false"
+      # No usage telemetry to telemetry.influxdata.com (egress is denied).
+      - name: INFLUXD_REPORTING_DISABLED
+        value: "true"
     # The chart defaults to liveness/readiness with initialDelaySeconds=0,
     # so after a crash restart the kubelet kills the pod before shards
     # finish opening. Give it 10 minutes to come up cleanly.

kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml

@@ -54,6 +54,9 @@ spec:
       # non-RFC-framed payload). Scoped to this single-purpose receiver
       # only — the pod-log Alloy DaemonSet stays at default stability.
       stabilityLevel: experimental
+      # No usage reporting to stats.grafana.org (egress is denied anyway).
+      extraArgs:
+        - --disable-reporting
       resources:
         requests:
           cpu: 20m

kubernetes/apps/monitoring/helmrelease-loki.yaml

@@ -116,6 +116,9 @@ spec:
       retries: 3
   values:
     alloy:
+      # No usage reporting to stats.grafana.org (egress is denied anyway).
+      extraArgs:
+        - --disable-reporting
       configMap:
         content: |
           // Discover and collect K8s pod logs

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -467,7 +467,8 @@ spec:
             - port: "443"
               protocol: TCP
 ---
-# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket.
+# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket, and the OTA index and
+# firmware images (Koenkk/zigbee-OTA) on raw.githubusercontent.com.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -498,6 +499,47 @@ spec:
         - ports:
             - port: "6638"
               protocol: TCP
+    - toFQDNs:
+        - matchName: "raw.githubusercontent.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# matter-server: the CSA DCL (PAA root certificates, vendor names, OTA
+# metadata) and the development PAA certificates of project-chip on GitHub.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: matter-server-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: matter-server
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "on.dcl.csa-iot.org"
+        - matchName: "api.github.com"
+        - matchName: "raw.githubusercontent.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
 ---
 # mqtt-account-controller: credential delivery to deliver.esp32 targets in mqtt-accounts.yaml.
 apiVersion: cilium.io/v2