fix(lidarr): scan ghcr.io directly instead of lscr.io

lscr.io 302-redirects the tag-list request to ghcr.io and the
image-reflector's follow-up arrives unauthenticated (UNAUTHORIZED),
leaving ImageRepository/lidarr not Ready since 2026-10-29T18:56Z.
ghcr.io/linuxserver/lidarr is the same repository (identical digest
for 3.1.6.5079-ls46) and scans anonymously. Workload refs follow so
the imagepolicy setter keeps matching.

Closes #1527

ci/images/kuma-sync/api/v1alpha1/kumamonitor_types.go

@@ -97,10 +97,6 @@ type KumaMonitorSpec struct {
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:default=0
 	MaxRetries int32 `json:"maxRetries,omitempty"`
-	// Consecutive DOWN heartbeats after which Kuma sends the DOWN notification
-	// again, not minutes; 0 sends it once per outage.
-	// +kubebuilder:validation:Minimum=0
-	ResendInterval int32 `json:"resendInterval,omitempty"`
 	// Seconds.
 	// +kubebuilder:validation:Minimum=1
 	Timeout     *int32 `json:"timeout,omitempty"`

ci/images/kuma-sync/api/v1alpha1/validation_test.go

@@ -131,15 +131,6 @@ func TestNegativeMaxRetriesRejected(t *testing.T) {
 	expectInvalid(t, m, "spec.maxRetries")
 }
 
-func TestNegativeResendIntervalRejected(t *testing.T) {
-	m := monitor("neg-resend", KumaMonitorSpec{
-		Type:           "group",
-		DisplayName:    "g",
-		ResendInterval: -1,
-	})
-	expectInvalid(t, m, "spec.resendInterval")
-}
-
 func TestJSONQueryBadOperator(t *testing.T) {
 	m := monitor("jq-bad-op", KumaMonitorSpec{
 		Type:        "json-query",

ci/images/kuma-sync/cmd/kuma-sync/config.go

@@ -3,25 +3,19 @@ package main
 import (
 	"errors"
 	"fmt"
-	"strings"
-
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/util/validation"
 )
 
 type config struct {
 	URL      string
 	Username string
 	Password string
-	// RootGroup is the zero value when KUMA_ROOT_GROUP is unset.
-	RootGroup types.NamespacedName
 }
 
 // loadConfig reads the Kuma connection settings from the environment. It
-// names every missing or invalid variable.
+// names every missing variable.
 func loadConfig(getenv func(string) string) (config, error) {
 	var cfg config
-	var errs []error
+	var missing []error
 	for _, v := range []struct {
 		name string
 		dst  *string
@@ -31,30 +25,8 @@ func loadConfig(getenv func(string) string) (config, error) {
 		{"KUMA_PASSWORD", &cfg.Password},
 	} {
 		if *v.dst = getenv(v.name); *v.dst == "" {
-			errs = append(errs, fmt.Errorf("missing required environment variable %s", v.name))
+			missing = append(missing, fmt.Errorf("missing required environment variable %s", v.name))
 		}
 	}
-	if raw := getenv("KUMA_ROOT_GROUP"); raw != "" {
-		root, err := parseRootGroup(raw)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("KUMA_ROOT_GROUP: %w", err))
-		}
-		cfg.RootGroup = root
-	}
-	return cfg, errors.Join(errs...)
-}
-
-// parseRootGroup parses namespace/name of a KumaMonitor.
-func parseRootGroup(raw string) (types.NamespacedName, error) {
-	ns, name, ok := strings.Cut(raw, "/")
-	if !ok || strings.Contains(name, "/") {
-		return types.NamespacedName{}, fmt.Errorf("%q is not namespace/name", raw)
-	}
-	if msgs := validation.IsDNS1123Label(ns); len(msgs) > 0 {
-		return types.NamespacedName{}, fmt.Errorf("namespace %q: %s", ns, strings.Join(msgs, "; "))
-	}
-	if msgs := validation.IsDNS1123Subdomain(name); len(msgs) > 0 {
-		return types.NamespacedName{}, fmt.Errorf("name %q: %s", name, strings.Join(msgs, "; "))
-	}
-	return types.NamespacedName{Namespace: ns, Name: name}, nil
+	return cfg, errors.Join(missing...)
 }

ci/images/kuma-sync/cmd/kuma-sync/config_test.go

@@ -3,8 +3,6 @@ package main
 import (
 	"strings"
 	"testing"
-
-	"k8s.io/apimachinery/pkg/types"
 )
 
 func TestLoadConfig(t *testing.T) {
@@ -38,21 +36,3 @@ func TestLoadConfig(t *testing.T) {
 		}
 	}
 }
-
-func TestLoadConfigRootGroup(t *testing.T) {
-	env := func(root string) func(string) string {
-		m := map[string]string{"KUMA_URL": "http://kuma", "KUMA_USERNAME": "u", "KUMA_PASSWORD": "p", "KUMA_ROOT_GROUP": root}
-		return func(k string) string { return m[k] }
-	}
-
-	cfg, err := loadConfig(env("kuma-sync/renner-uno"))
-	if err != nil || cfg.RootGroup != (types.NamespacedName{Namespace: "kuma-sync", Name: "renner-uno"}) {
-		t.Fatalf("cfg=%+v err=%v", cfg, err)
-	}
-
-	for _, bad := range []string{"renner-uno", "/renner-uno", "kuma-sync/", "a/b/c", "Kuma/x", "ns/UPPER", " ns/x"} {
-		if _, err := loadConfig(env(bad)); err == nil || !strings.Contains(err.Error(), "KUMA_ROOT_GROUP") {
-			t.Errorf("%q: err = %v, want KUMA_ROOT_GROUP rejected", bad, err)
-		}
-	}
-}

ci/images/kuma-sync/cmd/kuma-sync/main.go

@@ -48,7 +48,6 @@ func run() error {
 		GCInterval:  5 * time.Minute,
 		OrphanGrace: time.Hour,
 		Resync:      5 * time.Minute,
-		RootGroup:   cfg.RootGroup,
 	})
 	if err != nil {
 		return err

ci/images/kuma-sync/config/crd/uptime.renner.uno_kumamonitors.yaml

@@ -222,13 +222,6 @@ spec:
                 - hostname
                 - port
                 type: object
-              resendInterval:
-                description: |-
-                  Consecutive DOWN heartbeats after which Kuma sends the DOWN notification
-                  again, not minutes; 0 sends it once per outage.
-                format: int32
-                minimum: 0
-                type: integer
               retryInterval:
                 default: 60
                 description: Seconds.

ci/images/kuma-sync/internal/app/manager.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
 	"k8s.io/utils/ptr"
@@ -42,9 +41,6 @@ type Options struct {
 	// Resync is how often a healthy resource is reconciled again, which is
 	// what repairs drift made in Kuma; 0 means 5 minutes.
 	Resync time.Duration
-	// RootGroup is the group KumaMonitor that monitors without a parentRef are
-	// placed under; the zero value leaves them at the top level.
-	RootGroup types.NamespacedName
 
 	// SkipNameValidation allows several managers in one process, as in tests
 	// that restart the manager.
@@ -76,9 +72,7 @@ func NewManager(o Options) (manager.Manager, error) {
 		return nil, fmt.Errorf("create manager: %w", err)
 	}
 
-	if err := (&controller.Reconciler{
-		Client: mgr.GetClient(), Kuma: o.Kuma, Resync: o.Resync, RootGroup: o.RootGroup,
-	}).SetupWithManager(mgr); err != nil {
+	if err := (&controller.Reconciler{Client: mgr.GetClient(), Kuma: o.Kuma, Resync: o.Resync}).SetupWithManager(mgr); err != nil {
 		return nil, fmt.Errorf("set up reconciler: %w", err)
 	}
 	if err := (&controller.StatusPageReconciler{Client: mgr.GetClient(), Kuma: o.Kuma, Resync: o.Resync}).SetupWithManager(mgr); err != nil {

ci/images/kuma-sync/internal/controller/kumamonitor_controller.go

@@ -58,15 +58,6 @@ type Reconciler struct {
 	// Resync is how often a healthy resource is reconciled again, which repairs
 	// drift made in Kuma. 0 means 5 minutes.
 	Resync time.Duration
-	// RootGroup is the group KumaMonitor every monitor without a parentRef is
-	// placed under in Kuma; the zero value places them at the top level.
-	RootGroup types.NamespacedName
-}
-
-func (r *Reconciler) hasRoot() bool { return r.RootGroup.Name != "" }
-
-func (r *Reconciler) isRoot(o client.Object) bool {
-	return r.hasRoot() && o.GetNamespace() == r.RootGroup.Namespace && o.GetName() == r.RootGroup.Name
 }
 
 func (r *Reconciler) resync() time.Duration {
@@ -79,18 +70,14 @@ func (r *Reconciler) resync() time.Duration {
 // SetupWithManager ignores status-only updates, which keeps failure backoff
 // intact. Deletion still reconciles: setting deletionTimestamp bumps
 // metadata.generation. A KumaNotification whose ID changes enqueues the
-// monitors referencing it; a change to the root group enqueues the monitors
-// without a parentRef.
+// monitors referencing it.
 func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
-	b := ctrl.NewControllerManagedBy(mgr).
+	return ctrl.NewControllerManagedBy(mgr).
 		For(&v1.KumaMonitor{}, builder.WithPredicates(predicate.GenerationChangedPredicate{})).
 		Watches(&v1.KumaNotification{}, handler.EnqueueRequestsFromMapFunc(r.referencingMonitors),
-			builder.WithPredicates(predicate.Funcs{UpdateFunc: notificationIDChanged}))
-	if r.hasRoot() {
-		b = b.Watches(&v1.KumaMonitor{}, handler.EnqueueRequestsFromMapFunc(r.rootChildren),
-			builder.WithPredicates(r.rootPredicate()))
-	}
-	return b.Named("kumamonitor").Complete(r)
+			builder.WithPredicates(predicate.Funcs{UpdateFunc: notificationIDChanged})).
+		Named("kumamonitor").
+		Complete(r)
 }
 
 // failure is a Ready=False outcome. The message is fixed per reason; the cause
@@ -112,9 +99,6 @@ const (
 	msgParentNotGroup      = "parent must be of type group"
 	msgParentCycle         = "parentRef forms a cycle"
 	msgParentTooDeep       = "parentRef chain is too deep"
-	msgRootPending         = "root group has no monitor ID yet"
-	msgRootNotGroup        = "root group must be of type group"
-	msgRootHasParent       = "root group must not have a parentRef"
 	msgNotificationPending = "a referenced notification has no notification ID yet"
 	msgSynced              = "monitor in sync"
 	msgNotOwned            = "previous monitor exists without our ownership tag; restore the tag or delete it in Kuma"
@@ -135,24 +119,17 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	}
 
 	desired := Desired(km)
-	var p parentOutcome
-	var err error
-	switch {
-	case km.Spec.ParentRef != nil:
-		p, err = r.resolveParent(ctx, km)
-	case r.hasRoot() && !r.isRoot(km):
-		p, err = r.resolveRoot(ctx)
-	}
-	if err != nil {
-		return ctrl.Result{}, err
-	}
-	if p.reason != "" {
-		if err := r.setReady(ctx, km, metav1.ConditionFalse, p.reason, p.message, nil); err != nil {
+	if km.Spec.ParentRef != nil {
+		p, err := r.resolveParent(ctx, km)
+		if err != nil {
 			return ctrl.Result{}, err
 		}
-		return ctrl.Result{RequeueAfter: p.requeue}, nil
-	}
-	if p.id != 0 {
+		if p.reason != "" {
+			if err := r.setReady(ctx, km, metav1.ConditionFalse, p.reason, p.message, nil); err != nil {
+				return ctrl.Result{}, err
+			}
+			return ctrl.Result{RequeueAfter: p.requeue}, nil
+		}
 		desired.Parent = &p.id
 	}
 
@@ -346,75 +323,8 @@ type parentOutcome struct {
 	requeue time.Duration
 }
 
-// rootChanged reports changes to the root group that alter what the monitors
-// without a parentRef resolve to.
-func rootChanged(e event.UpdateEvent) bool {
-	o, ok1 := e.ObjectOld.(*v1.KumaMonitor)
-	n, ok2 := e.ObjectNew.(*v1.KumaMonitor)
-	if !ok1 || !ok2 {
-		return true
-	}
-	return o.Status.MonitorID != n.Status.MonitorID ||
-		o.Spec.Type != n.Spec.Type ||
-		(o.Spec.ParentRef == nil) != (n.Spec.ParentRef == nil) ||
-		o.DeletionTimestamp.IsZero() != n.DeletionTimestamp.IsZero()
-}
-
-// rootPredicate passes events of the root group only.
-func (r *Reconciler) rootPredicate() predicate.Funcs {
-	return predicate.Funcs{
-		CreateFunc:  func(e event.CreateEvent) bool { return r.isRoot(e.Object) },
-		DeleteFunc:  func(e event.DeleteEvent) bool { return r.isRoot(e.Object) },
-		GenericFunc: func(e event.GenericEvent) bool { return r.isRoot(e.Object) },
-		UpdateFunc:  func(e event.UpdateEvent) bool { return r.isRoot(e.ObjectNew) && rootChanged(e) },
-	}
-}
-
-// rootChildren enqueues the KumaMonitors of all namespaces that have no
-// parentRef, except the root group itself.
-func (r *Reconciler) rootChildren(ctx context.Context, _ client.Object) []reconcile.Request {
-	var list v1.KumaMonitorList
-	if err := r.Client.List(ctx, &list); err != nil {
-		log.FromContext(ctx).Error(err, "list KumaMonitors to enqueue")
-		return nil
-	}
-	var reqs []reconcile.Request
-	for i := range list.Items {
-		km := &list.Items[i]
-		if km.Spec.ParentRef == nil && !r.isRoot(km) {
-			reqs = append(reqs, reconcile.Request{NamespacedName: types.NamespacedName{Namespace: km.Namespace, Name: km.Name}})
-		}
-	}
-	return reqs
-}
-
-// resolveRoot returns the Kuma ID of the root group for a monitor without a
-// parentRef. The root must be a group without a parentRef: under one of its
-// own ancestors it would close a cycle in Kuma.
-func (r *Reconciler) resolveRoot(ctx context.Context) (parentOutcome, error) {
-	pending := parentOutcome{reason: ReasonParentPending, message: msgRootPending, requeue: parentRetry}
-	root := &v1.KumaMonitor{}
-	err := r.Client.Get(ctx, r.RootGroup, root)
-	if apierrors.IsNotFound(err) {
-		return pending, nil
-	}
-	if err != nil {
-		return parentOutcome{}, err
-	}
-	switch {
-	case root.Spec.Type != "group":
-		return parentOutcome{reason: ReasonInvalidParent, message: msgRootNotGroup, requeue: r.resync()}, nil
-	case root.Spec.ParentRef != nil:
-		return parentOutcome{reason: ReasonInvalidParent, message: msgRootHasParent, requeue: r.resync()}, nil
-	case root.Status.MonitorID == 0 || !root.DeletionTimestamp.IsZero():
-		return pending, nil
-	}
-	return parentOutcome{id: root.Status.MonitorID}, nil
-}
-
 // resolveParent checks the whole parentRef chain: every ancestor must exist
-// and be a group, without cycles or more than maxParentDepth levels. The root
-// group, which the topmost ancestor is placed under, counts as a level.
+// and be a group, without cycles or more than maxParentDepth levels.
 func (r *Reconciler) resolveParent(ctx context.Context, km *v1.KumaMonitor) (parentOutcome, error) {
 	invalid := func(msg string) (parentOutcome, error) {
 		return parentOutcome{reason: ReasonInvalidParent, message: msg, requeue: r.resync()}, nil
@@ -424,8 +334,7 @@ func (r *Reconciler) resolveParent(ctx context.Context, km *v1.KumaMonitor) (par
 	visited := map[string]bool{km.Name: true}
 	cur := km
 	var directID int64
-	depth := 0
-	for ; cur.Spec.ParentRef != nil; depth++ {
+	for depth := 0; cur.Spec.ParentRef != nil; depth++ {
 		if depth >= maxParentDepth {
 			return invalid(msgParentTooDeep)
 		}
@@ -450,9 +359,6 @@ func (r *Reconciler) resolveParent(ctx context.Context, km *v1.KumaMonitor) (par
 		}
 		cur = parent
 	}
-	if r.hasRoot() && !r.isRoot(cur) && depth >= maxParentDepth {
-		return invalid(msgParentTooDeep)
-	}
 	if directID == 0 {
 		return pending, nil
 	}

ci/images/kuma-sync/internal/controller/mapping.go

@@ -24,15 +24,14 @@ func OwnerKey(km *v1.KumaMonitor) string {
 func Desired(km *v1.KumaMonitor) kumaclient.Monitor {
 	s := km.Spec
 	m := kumaclient.Monitor{
-		Type:           s.Type,
-		Name:           s.DisplayName,
-		Description:    s.Description,
-		Active:         !s.Paused,
-		Interval:       s.Interval,
-		RetryInterval:  s.RetryInterval,
-		MaxRetries:     s.MaxRetries,
-		ResendInterval: s.ResendInterval,
-		OwnerKey:       OwnerKey(km),
+		Type:          s.Type,
+		Name:          s.DisplayName,
+		Description:   s.Description,
+		Active:        !s.Paused,
+		Interval:      s.Interval,
+		RetryInterval: s.RetryInterval,
+		MaxRetries:    s.MaxRetries,
+		OwnerKey:      OwnerKey(km),
 	}
 	if s.Timeout != nil {
 		m.Timeout = *s.Timeout

ci/images/kuma-sync/internal/controller/mapping_test.go

@@ -57,8 +57,6 @@ func TestMappingAllTypes(t *testing.T) {
 	port.Port = &v1.PortSpec{Hostname: "p.com", Port: 443}
 	paused := base("group")
 	paused.Paused = true
-	resend := base("group")
-	resend.ResendInterval = 60
 
 	wantKW := withHTTP(common("keyword"))
 	wantKW.Keyword, wantKW.InvertKeyword = "ok", true
@@ -76,8 +74,6 @@ func TestMappingAllTypes(t *testing.T) {
 	wantPort.Hostname, wantPort.Port = "p.com", 443
 	wantPaused := common("group")
 	wantPaused.Active = false
-	wantResend := common("group")
-	wantResend.ResendInterval = 60
 
 	cases := []struct {
 		name string
@@ -92,7 +88,6 @@ func TestMappingAllTypes(t *testing.T) {
 		{"dns with conditions", dnsCond, wantDNSCond},
 		{"port", port, wantPort},
 		{"paused maps to inactive", paused, wantPaused},
-		{"resend interval", resend, wantResend},
 	}
 	for _, c := range cases {
 		got := Desired(mk(c.spec))

ci/images/kuma-sync/internal/controller/rootgroup_test.go

@@ -1,209 +0,0 @@
-package controller
-
-import (
-	"fmt"
-	"slices"
-	"testing"
-	"time"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/event"
-
-	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
-)
-
-const rootID = 7
-
-var rootName = types.NamespacedName{Namespace: "default", Name: "root"}
-
-func rootGroup() *v1.KumaMonitor {
-	g := group("root", "")
-	g.Status.MonitorID = rootID
-	return g
-}
-
-func newRootEnv(t *testing.T, objs ...client.Object) *env {
-	t.Helper()
-	e := newEnv(t, objs...)
-	e.r.RootGroup = rootName
-	return e
-}
-
-func (e *env) parentOf(t *testing.T, name string) *int64 {
-	t.Helper()
-	got := e.kuma.Get(e.get(t, name).Status.MonitorID)
-	if got == nil {
-		t.Fatalf("%s: no Kuma monitor", name)
-	}
-	return got.Parent
-}
-
-func TestRootGroupParentsParentless(t *testing.T) {
-	e := newRootEnv(t, rootGroup(), httpMonitor("a"))
-	if _, err := e.reconcile(t, "a"); err != nil {
-		t.Fatal(err)
-	}
-	if p := e.parentOf(t, "a"); p == nil || *p != rootID {
-		t.Errorf("parent = %v, want %d", p, rootID)
-	}
-}
-
-func TestRootGroupKeepsParentRef(t *testing.T) {
-	grp := group("grp", "")
-	grp.Status.MonitorID = 42
-	child := httpMonitor("child")
-	child.Spec.ParentRef = &v1.LocalRef{Name: "grp"}
-	e := newRootEnv(t, rootGroup(), grp, child)
-	if _, err := e.reconcile(t, "child"); err != nil {
-		t.Fatal(err)
-	}
-	if p := e.parentOf(t, "child"); p == nil || *p != 42 {
-		t.Errorf("parent = %v, want 42", p)
-	}
-}
-
-func TestRootGroupItselfHasNoParent(t *testing.T) {
-	root := rootGroup()
-	root.Status.MonitorID = 0
-	e := newRootEnv(t, root)
-	if _, err := e.reconcile(t, "root"); err != nil {
-		t.Fatal(err)
-	}
-	if p := e.parentOf(t, "root"); p != nil {
-		t.Errorf("parent = %d, want none", *p)
-	}
-}
-
-func TestRootGroupUnsetLeavesTopLevel(t *testing.T) {
-	e := newEnv(t, rootGroup(), httpMonitor("a"))
-	if _, err := e.reconcile(t, "a"); err != nil {
-		t.Fatal(err)
-	}
-	if p := e.parentOf(t, "a"); p != nil {
-		t.Errorf("parent = %d, want none", *p)
-	}
-}
-
-func TestRootGroupPending(t *testing.T) {
-	noID := rootGroup()
-	noID.Status.MonitorID = 0
-	deletingRoot := deleting(rootGroup())
-	cases := map[string][]client.Object{
-		"missing":   nil,
-		"no ID":     {noID},
-		"deleting":  {deletingRoot},
-		"not group": {func() *v1.KumaMonitor { m := httpMonitor("root"); m.Status.MonitorID = rootID; return m }()},
-		"has parent": {func() *v1.KumaMonitor {
-			m := rootGroup()
-			m.Spec.ParentRef = &v1.LocalRef{Name: "x"}
-			return m
-		}()},
-	}
-	want := map[string]struct {
-		reason  string
-		requeue time.Duration
-	}{
-		"missing":    {ReasonParentPending, 10 * time.Second},
-		"no ID":      {ReasonParentPending, 10 * time.Second},
-		"deleting":   {ReasonParentPending, 10 * time.Second},
-		"not group":  {ReasonInvalidParent, 5 * time.Minute},
-		"has parent": {ReasonInvalidParent, 5 * time.Minute},
-	}
-	for name, objs := range cases {
-		e := newRootEnv(t, append(objs, httpMonitor("a"))...)
-		res, err := e.reconcile(t, "a")
-		if err != nil {
-			t.Fatalf("%s: %v", name, err)
-		}
-		if res.RequeueAfter != want[name].requeue {
-			t.Errorf("%s: RequeueAfter = %v, want %v", name, res.RequeueAfter, want[name].requeue)
-		}
-		if c := ready(t, e.get(t, "a")); c.Status != metav1.ConditionFalse || c.Reason != want[name].reason {
-			t.Errorf("%s: Ready = %+v", name, c)
-		}
-		if e.cnt.creates != 0 {
-			t.Errorf("%s: creates = %d", name, e.cnt.creates)
-		}
-	}
-}
-
-// A chain of maxParentDepth groups is allowed on its own, but the root group
-// adds one more level above it.
-func TestRootGroupCountsTowardsDepth(t *testing.T) {
-	var objs []client.Object
-	for i := range maxParentDepth {
-		parent := ""
-		if i < maxParentDepth-1 {
-			parent = fmt.Sprintf("c%d", i+1)
-		}
-		objs = append(objs, group(fmt.Sprintf("c%d", i), parent))
-	}
-	deep := httpMonitor("deep")
-	deep.Spec.ParentRef = &v1.LocalRef{Name: "c0"}
-	objs = append(objs, deep)
-
-	if _, err := newEnv(t, objs...).reconcile(t, "deep"); err != nil {
-		t.Fatal(err)
-	}
-
-	e := newRootEnv(t, append(objs, rootGroup())...)
-	if _, err := e.reconcile(t, "deep"); err != nil {
-		t.Fatal(err)
-	}
-	if c := ready(t, e.get(t, "deep")); c.Reason != ReasonInvalidParent || c.Message != msgParentTooDeep {
-		t.Errorf("Ready = %+v", c)
-	}
-
-	// A chain ending in the root itself gets no extra level.
-	objs[maxParentDepth-1] = func() *v1.KumaMonitor { g := rootGroup(); g.Name = "c9"; return g }()
-	e = newEnv(t, objs...)
-	e.r.RootGroup = types.NamespacedName{Namespace: "default", Name: "c9"}
-	if _, err := e.reconcile(t, "deep"); err != nil {
-		t.Fatal(err)
-	}
-	if c := ready(t, e.get(t, "deep")); c.Status != metav1.ConditionTrue {
-		t.Errorf("chain ending in root: Ready = %+v", c)
-	}
-}
-
-func TestRootChildrenEnqueuesParentless(t *testing.T) {
-	child := httpMonitor("child")
-	child.Spec.ParentRef = &v1.LocalRef{Name: "grp"}
-	other := httpMonitor("other")
-	other.Namespace = "elsewhere"
-	e := newRootEnv(t, rootGroup(), group("grp", ""), child, httpMonitor("a"), other)
-
-	var got []string
-	for _, req := range e.r.rootChildren(t.Context(), rootGroup()) {
-		got = append(got, req.String())
-	}
-	slices.Sort(got)
-	want := []string{"default/a", "default/grp", "elsewhere/other"}
-	if !slices.Equal(got, want) {
-		t.Errorf("enqueued %v, want %v", got, want)
-	}
-}
-
-func TestRootPredicate(t *testing.T) {
-	r := &Reconciler{RootGroup: rootName}
-	p := r.rootPredicate()
-	old := rootGroup()
-	old.Status.MonitorID = 0
-	withID := rootGroup()
-	other := group("other", "")
-
-	if !p.Update(event.UpdateEvent{ObjectOld: old, ObjectNew: withID}) {
-		t.Error("root ID change must pass")
-	}
-	if p.Update(event.UpdateEvent{ObjectOld: withID, ObjectNew: withID.DeepCopy()}) {
-		t.Error("unchanged root must not pass")
-	}
-	if p.Update(event.UpdateEvent{ObjectOld: other, ObjectNew: other.DeepCopy()}) || p.Create(event.CreateEvent{Object: other}) {
-		t.Error("other monitors must not pass")
-	}
-	if !p.Create(event.CreateEvent{Object: withID}) || !p.Delete(event.DeleteEvent{Object: withID}) {
-		t.Error("root create and delete must pass")
-	}
-}

ci/images/kuma-sync/internal/kumaclient/breml.go

@@ -378,7 +378,7 @@ func (b *Breml) update(ctx context.Context, m Monitor) error {
 		return fmt.Errorf("update %d: monitor carries owner key %q, not %q: %w", m.ID, key, m.OwnerKey, ErrNotOwned)
 	}
 	// Start from the full current object, also across a type change, so
-	// fields we do not manage (proxy, upside down, auth)
+	// fields we do not manage (proxy, resend interval, upside down, auth)
 	// survive the overwrite.
 	wire, err := toWire(m, &cur)
 	if err != nil {
@@ -420,7 +420,6 @@ func toDomain(base monitor.Base, ownerKey string) (Monitor, error) {
 		Interval:        int32(base.Interval),
 		RetryInterval:   int32(base.RetryInterval),
 		MaxRetries:      int32(base.MaxRetries),
-		ResendInterval:  int32(base.ResendInterval),
 		NotificationIDs: slices.Clone(base.NotificationIDs),
 		OwnerKey:        ownerKey,
 	}
@@ -582,7 +581,6 @@ func writeBase(b *monitor.Base, m Monitor) {
 	b.Interval = int64(m.Interval)
 	b.RetryInterval = int64(m.RetryInterval)
 	b.MaxRetries = int64(m.MaxRetries)
-	b.ResendInterval = int64(m.ResendInterval)
 	b.IsActive = m.Active
 	b.NotificationIDs = slices.Clone(m.NotificationIDs)
 }

ci/images/kuma-sync/internal/kumaclient/breml_integration_test.go

@@ -127,7 +127,7 @@ func TestCreateFieldsIntact(t *testing.T) {
 
 	group := Monitor{
 		Type: "group", Name: "grp", Description: "a group", Active: true,
-		Interval: 60, RetryInterval: 60, MaxRetries: 0, ResendInterval: 60, OwnerKey: "default/grp",
+		Interval: 60, RetryInterval: 60, MaxRetries: 0, OwnerKey: "default/grp",
 	}
 	gid, err := b.Create(ctx, group)
 	if err != nil {
@@ -313,6 +313,7 @@ func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
 		t.Fatal(err)
 	}
 	kw.UpsideDown = true
+	kw.ResendInterval = 7
 	kw.NotificationIDs = []int64{nid}
 	if err := b.c.UpdateMonitor(ctx, &kw); err != nil {
 		t.Fatal(err)
@@ -327,8 +328,8 @@ func assertUnmanaged(t *testing.T, c *Breml, id int64, when string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !base.UpsideDown {
-		t.Errorf("%s: unmanaged state lost: upsideDown=%v", when, base.UpsideDown)
+	if !base.UpsideDown || base.ResendInterval != 7 {
+		t.Errorf("%s: unmanaged state lost: upsideDown=%v resend=%d", when, base.UpsideDown, base.ResendInterval)
 	}
 }
 
@@ -343,7 +344,7 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 	}
 	orig := Monitor{
 		Type: "keyword", Name: "kw", Active: true, Parent: &gid,
-		Interval: 60, RetryInterval: 60, ResendInterval: 7, URL: "https://example.com",
+		Interval: 60, RetryInterval: 60, URL: "https://example.com",
 		Headers: map[string]string{"A": "1"}, Keyword: "up", OwnerKey: "default/kw",
 	}
 	id, err := b.Create(ctx, orig)
@@ -359,7 +360,6 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 	cleared.Headers = nil
 	cleared.Keyword = ""
 	cleared.Interval = 90
-	cleared.ResendInterval = 0
 	if err := b.Update(ctx, cleared); err != nil {
 		t.Fatal(err)
 	}
@@ -369,7 +369,7 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 		t.Fatal(err)
 	}
 	m := byID(got)[id]
-	if m.Parent != nil || m.Headers != nil || m.Keyword != "" || m.Interval != 90 || m.ResendInterval != 0 || m.NotificationIDs != nil {
+	if m.Parent != nil || m.Headers != nil || m.Keyword != "" || m.Interval != 90 || m.NotificationIDs != nil {
 		t.Errorf("managed fields not cleared: %+v", m)
 	}
 	assertUnmanaged(t, fresh, id, "after plain update")

ci/images/kuma-sync/internal/kumaclient/client.go

@@ -141,9 +141,6 @@ type Monitor struct {
 	Interval      int32
 	RetryInterval int32
 	MaxRetries    int32
-	// ResendInterval counts consecutive DOWN heartbeats between repeated DOWN
-	// notifications; 0 disables resending.
-	ResendInterval int32
 	// Timeout is in seconds and only applies to http, keyword and json-query.
 	// 0 is written as round(0.8*Interval), because Kuma treats a stored 0 as a
 	// huge request timeout. For other types it is ignored and reads back as 0.

ci/images/kuma-sync/internal/kumaclient/resend_test.go

@@ -1,61 +0,0 @@
-package kumaclient
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/breml/go-uptime-kuma-client/monitor"
-)
-
-// resendOnWire writes m over existing (nil for a create) and returns the wire
-// resendInterval and the value read back from it.
-func resendOnWire(t *testing.T, m Monitor, existing *monitor.Base) (wire, back int64) {
-	t.Helper()
-	w, err := toWire(m, existing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := json.Marshal(w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var f struct {
-		ResendInterval int64 `json:"resendInterval"`
-	}
-	if err := json.Unmarshal(raw, &f); err != nil {
-		t.Fatal(err)
-	}
-	var base monitor.Base
-	if err := json.Unmarshal(raw, &base); err != nil {
-		t.Fatal(err)
-	}
-	got, err := toDomain(base, m.OwnerKey)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return f.ResendInterval, int64(got.ResendInterval)
-}
-
-func TestResendIntervalRoundTrip(t *testing.T) {
-	for _, m := range []Monitor{
-		{ID: 1, Type: "group", Name: "g", Active: true, Interval: 60, RetryInterval: 60, ResendInterval: 60, OwnerKey: "ns/g"},
-		{ID: 2, Type: "http", Name: "h", Active: true, Interval: 60, RetryInterval: 60, ResendInterval: 3, URL: "https://e.com", OwnerKey: "ns/h"},
-	} {
-		wire, back := resendOnWire(t, m, nil)
-		if wire != int64(m.ResendInterval) || back != int64(m.ResendInterval) {
-			t.Errorf("%s: wire=%d read back=%d, want %d", m.Type, wire, back, m.ResendInterval)
-		}
-	}
-}
-
-// 0 must overwrite a resend interval stored in Kuma, not keep it.
-func TestResendIntervalClearedOnUpdate(t *testing.T) {
-	var existing monitor.Base
-	if err := json.Unmarshal([]byte(`{"id":1,"type":"group","name":"g","resendInterval":7}`), &existing); err != nil {
-		t.Fatal(err)
-	}
-	m := Monitor{ID: 1, Type: "group", Name: "g", Active: true, Interval: 60, RetryInterval: 60, OwnerKey: "ns/g"}
-	if wire, back := resendOnWire(t, m, &existing); wire != 0 || back != 0 {
-		t.Errorf("wire=%d read back=%d, want 0", wire, back)
-	}
-}

kubernetes/apps/hermes/skills/homelab-gitea-pr/references/uptime-monitoring.md

@@ -14,9 +14,6 @@ monitor, and its history starts over.
   proxies, the Cloudflare-served apex `renner.uno` and third-party sites.
 - A monitor alerts only through its `notificationRefs` to cluster-scoped `KumaNotification`
   objects (`kubernetes/apps/kuma-sync/notification-*.yaml`). Without refs it sends nothing.
-- Parentless monitors hang under the root group `kuma-sync/renner-uno` (controller env
-  `KUMA_ROOT_GROUP`). Only the root carries `notificationRefs`; don't add `notificationRefs`
-  to service monitors.
 - The CRD lives in `infrastructure/kuma-sync-crds`. Every consuming Flux Kustomization needs
   the KumaMonitor `healthCheckExprs` entry with `current: "true"` (see SKILL.md pitfalls).
 

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -64,7 +64,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-10-29-0949 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-10-29-1803 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -106,6 +106,9 @@ spec:
             # The URL devices download firmware from: Service shelly-manager-firmware.
             - name: Firmware__PublicBaseUrl
               value: http://firmware.shelly-manager.renner.uno
+            # Battery devices get their update when they call in.
+            - name: Firmware__SleepyRollout
+              value: "true"
             - name: ShellyManager__DnsSuffix
               value: iot.renner.uno
             # BLE radios: ESP32 esphome bluetooth_proxy nodes (e.g. the M5 Atom

kubernetes/apps/home-assistant/mqtt-account-controller.yaml

@@ -223,7 +223,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/konairius/mqtt-account-controller:2026-10-28-0657 # {"$imagepolicy": "flux-system:mqtt-account-controller"}
+          image: gitea.renner.uno/konairius/mqtt-account-controller:2026-10-29-1634 # {"$imagepolicy": "flux-system:mqtt-account-controller"}
           env:
             - name: BROKER_URL
               value: ssl://mosquitto.home-assistant.svc.cluster.local:8884

kubernetes/apps/kuma-sync/deployment.yaml

@@ -44,8 +44,6 @@ spec:
                 secretKeyRef:
                   name: kuma-sync-kuma
                   key: password
-            - name: KUMA_ROOT_GROUP
-              value: kuma-sync/renner-uno
           ports:
             - name: metrics
               containerPort: 8080

kubernetes/apps/kuma-sync/kumamonitor-root.yaml

@@ -1,14 +0,0 @@
-# Root group (KUMA_ROOT_GROUP): parent of every monitor without a parentRef; the only one with notificationRefs.
-apiVersion: uptime.renner.uno/v1alpha1
-kind: KumaMonitor
-metadata:
-  name: renner-uno
-  namespace: kuma-sync
-spec:
-  type: group
-  displayName: renner.uno
-  interval: 60
-  # heartbeats, not minutes: 60 x 60s = hourly reminder while down
-  resendInterval: 60
-  notificationRefs:
-    - name: email

kubernetes/apps/kuma-sync/kustomization.yaml

@@ -6,4 +6,3 @@ resources:
   - deployment.yaml
   - statuspage-renner.yaml
   - notification-email.yaml
-  - kumamonitor-root.yaml

kubernetes/apps/navidrome/lidarr.yaml

@@ -93,7 +93,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: lidarr
-          image: lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
+          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
           env:
             - name: PUID
               value: "1000"
@@ -140,7 +140,7 @@ spec:
               drop: ["ALL"]
               add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
         - name: reconcile
-          image: lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
+          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
           command: ["sh", "/scripts/reconcile.sh"]
           volumeMounts:
             - name: config

kubernetes/apps/woodpecker/agent.yaml

@@ -34,7 +34,7 @@ spec:
           # Image automation, range 3.x (see image-automation/woodpecker.yaml).
           # MUST stay version-matched with woodpecker-server (gRPC parity) — both
           # track the same range/filter so they bump together on each release.
-          image: woodpeckerci/woodpecker-agent:v3.20.0 # {"$imagepolicy": "flux-system:woodpecker-agent"}
+          image: woodpeckerci/woodpecker-agent:v3.20.1 # {"$imagepolicy": "flux-system:woodpecker-agent"}
           env:
             - name: WOODPECKER_SERVER
               value: woodpecker.woodpecker.svc.cluster.local:9000 # in-cluster gRPC, replaces LXC :9000

kubernetes/apps/woodpecker/server.yaml

@@ -40,7 +40,7 @@ spec:
           # minor + patch auto-update within 3.x; only the 4.0 major is held for
           # a reviewed bump. Safe now the DB is postgres (the old sqlite-surprise
           # -bump hazard is gone). Stays in lockstep with the agent.
-          image: woodpeckerci/woodpecker-server:v3.20.0 # {"$imagepolicy": "flux-system:woodpecker-server"}
+          image: woodpeckerci/woodpecker-server:v3.20.1 # {"$imagepolicy": "flux-system:woodpecker-server"}
           env:
             - name: WOODPECKER_HOST
               value: https://ci.renner.uno

kubernetes/clusters/homelab/kuma-sync.yaml

@@ -1,5 +1,5 @@
-# kuma-sync controller: KumaMonitor -> Uptime Kuma monitors. Ships only the root group KumaMonitor;
-# service monitors live with their app, the CRD in infrastructure/kuma-sync-crds.
+# kuma-sync controller: KumaMonitor -> Uptime Kuma monitors. Ships no KumaMonitor objects;
+# they live with their app, the CRD in infrastructure/kuma-sync-crds.
 # healthCheckExprs: Flux has no status reader for ExternalSecret; fail only on the non-retrying reasons.
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -21,10 +21,6 @@ spec:
       kind: ExternalSecret
       failed: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'False' && (c.reason == 'SecretOwnedByOther' || c.reason == 'SecretImmutable'))"
       current: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'True')"
-    # KumaMonitor Ready tracks Uptime Kuma on the VPS, not this apply.
-    - apiVersion: uptime.renner.uno/v1alpha1
-      kind: KumaMonitor
-      current: "true"
   dependsOn:
     - name: infrastructure
     - name: infrastructure-crds

kubernetes/infrastructure/image-automation/lidarr.yaml

@@ -4,7 +4,7 @@ metadata:
   name: lidarr
   namespace: flux-system
 spec:
-  image: lscr.io/linuxserver/lidarr
+  image: ghcr.io/linuxserver/lidarr
   interval: 1h
 ---
 # Tags are <maj>.<min>.<patch>.<build>-ls<n>. Two numbers move, and BOTH

kubernetes/infrastructure/kuma-sync-crds/crd-kumamonitors.yaml

@@ -223,13 +223,6 @@ spec:
                 - hostname
                 - port
                 type: object
-              resendInterval:
-                description: |-
-                  Consecutive DOWN heartbeats after which Kuma sends the DOWN notification
-                  again, not minutes; 0 sends it once per outage.
-                format: int32
-                minimum: 0
-                type: integer
               retryInterval:
                 default: 60
                 description: Seconds.