chore(deps): update node.js to v26

.woodpecker/build-ci-images.yml

@@ -47,7 +47,7 @@ when:
 
 steps:
   - name: build-ansible
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/ansible
     # Only rebuild when THIS image's source (or the pipeline file) changed, or
     # on a manual run. Without this every step ran on any matching push, so a
@@ -74,7 +74,7 @@ steps:
           --destination gitea.renner.uno/gitea_admin/ci-ansible:latest
 
   - name: build-k8s
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/k8s
     when:
       - event: deployment
@@ -97,7 +97,7 @@ steps:
           --destination gitea.renner.uno/gitea_admin/ci-k8s:latest
 
   - name: build-vmtest
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/vmtest
     when:
       - event: deployment
@@ -120,7 +120,7 @@ steps:
           --destination gitea.renner.uno/gitea_admin/ci-vmtest:latest
 
   - name: build-tofu
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/tofu
     when:
       - event: deployment
@@ -150,7 +150,7 @@ steps:
   # Runtime image, not CI tooling: a static musl binary in a FROM-scratch image,
   # used as the base for secret-rotation CronJobs. Replaces per-job inline Python.
   - name: build-secret-rotator
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: secret-rotator
     when:
       - event: deployment
@@ -175,7 +175,7 @@ steps:
   # review-bot: the Go service that reviews pull requests with a Mistral agent (webhook plus sweep).
   # Runs after Gitea is up, so no ghcr mirror.
   - name: build-review-bot
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: review-bot
     when:
       - event: deployment
@@ -225,7 +225,7 @@ steps:
   #
   # The gitea_admin/ copy stays until nothing references it any more.
   - name: build-alpine-jq
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/alpine-jq
     when:
       - event: deployment
@@ -276,7 +276,7 @@ steps:
   # note on build-alpine-jq. Anything an app needs while the cluster is still
   # being built cannot live only in that cluster's own registry.
   - name: build-cni-plugins
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/cni-plugins
     when:
       - event: deployment
@@ -316,7 +316,7 @@ steps:
   # gitea.renner.uno is not there to serve it. A cold-rebuild rehearsal left
   # paperless in Init:ErrImagePull on exactly this image.
   - name: build-alpine-openssl
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/alpine-openssl
     when:
       - event: deployment
@@ -351,7 +351,7 @@ steps:
   # Ansible converge. Not a ci-* image -- it is a runtime artifact -- but it
   # builds the same way and lands in the same registry so the audit sees it.
   - name: build-heating-can
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/heating-can
     when:
       - event: deployment
@@ -377,7 +377,7 @@ steps:
   # services (public Ingress hosts -> TLS passthrough -> Traefik ClusterIP).
   # Runtime artifact like heating-can; same registry so the audit tracks it.
   - name: build-netbird-service-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/netbird-service-sync
     when:
       - event: deployment
@@ -402,7 +402,7 @@ steps:
   # authentik-gate-sync: the authentik-gate ingress class (Ingress -> Authentik
   # proxy gate + Traefik route). Its unit tests run as a stage of the image build.
   - name: build-authentik-gate-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/authentik-gate-sync
     when:
       - event: deployment
@@ -428,7 +428,7 @@ steps:
   # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. Its unit
   # tests run as a stage of the image build.
   - name: build-kuma-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/kuma-sync
     when:
       - event: deployment
@@ -454,7 +454,7 @@ steps:
   # cloudflare-lb-sync: reconciles CloudflareLoadBalancer resources into
   # Cloudflare. Its unit tests run as a stage of the image build.
   - name: build-cloudflare-lb-sync
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/cloudflare-lb-sync
     when:
       - event: deployment
@@ -480,7 +480,7 @@ steps:
   # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
   # artifact like heating-can; same registry so the audit tracks it.
   - name: build-bird
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/bird
     when:
       - event: deployment
@@ -504,7 +504,7 @@ steps:
 
   # Orchestrator for the monthly backup-verify CronJob (velero ns).
   - name: build-backup-verify
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/backup-verify
     when:
       - event: deployment

.woodpecker/ci-claude-refresh.yml

@@ -131,7 +131,7 @@ steps:
   #    --build-arg to the resolved version (not "latest") guarantees the tag and
   #    the image content agree even if a new release lands mid-run.
   - name: build
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/claude
     depends_on: [decide]
     environment:

.woodpecker/ci-manifests-test.yml

@@ -172,7 +172,7 @@ steps:
   # whenever it trails the deployed server. If you bump the server, bump here.
   - name: woodpecker-lint
     depends_on: [] # see note above `steps:`
-    image: woodpeckerci/woodpecker-cli:v3.20.1-alpine@sha256:74c576faf49cce699825d11c7d7bd38ab5f007dd4f57cdbdd55099d2c0f2621a
+    image: woodpeckerci/woodpecker-cli:v3.19.0-alpine@sha256:27a77117e38d7bbdc380f0e90ff3ee4871ab1eefa78b5d9136a2c969fbecd9f4
     commands:
       - |
         set -eu

.woodpecker/ci-scripts-test.yml

@@ -63,7 +63,7 @@ steps:
   # bridge, and the secret guard.
   - name: hermes-skill-tests
     depends_on: []
-    image: python:3.15-alpine@sha256:20a82dbc2783112ddb91d1534603f802d222a3e63e593cd002eb2ac534e70211
+    image: python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
     environment:
       PYTHONDONTWRITEBYTECODE: "1"
     commands:

.woodpecker/hermes-image.yml

@@ -10,7 +10,7 @@ when:
 
 steps:
   - name: build
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
     directory: ci/images/hermes
     environment:
       # registry-bot write:package PAT (konairius org secret).

.woodpecker/review-bot-test.yml

@@ -6,7 +6,7 @@ when:
 
 steps:
   - name: go-test
-    image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9
+    image: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
     commands:
       - test -z "$(gofmt -l review-bot)"
       - go -C review-bot vet ./...

ci/images/authentik-gate-sync/Containerfile

@@ -5,12 +5,12 @@
 
 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS test
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v
 
-FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py

ci/images/claude/Containerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85
+FROM node:26-alpine@sha256:c6ad9e9c1d80f6eb607c26b4b0a132ff7a2344fad1c78ea3baa2a7d4c8de6d94
 
 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a

ci/images/cloudflare-lb-sync/Containerfile

@@ -2,7 +2,7 @@
 # Cloudflare. The unit tests (no tags, so no envtest) gate the image: the
 # final stage copies the binary out of this stage, so a failing test fails the
 # build.
-FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS build
+FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -10,7 +10,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/cloudflare-lb-sync ./cmd/cloudflare-lb-sync
 
-FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
+FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
 COPY --from=build /out/cloudflare-lb-sync /cloudflare-lb-sync
 USER 65532
 ENTRYPOINT ["/cloudflare-lb-sync"]

ci/images/heating-can/Containerfile

@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS build
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build
 
 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
  && rm -rf /opt/e3oncan/.git
 
 
-FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
 
 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1

ci/images/hermes/Containerfile

@@ -6,10 +6,10 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends jq \
  && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/siderolabs/talosctl:v1.14.5@sha256:0b852e35c1f513ee5eacc22183d6193486012420569fde39fcd5260c51938443 /talosctl /usr/local/bin/talosctl
-COPY --from=alpine/kubectl:1.37.2@sha256:5e2de75d37e811ba6eb92e06890b1b3263eae4f0a1c17b49269edec589b1352a /usr/local/bin/kubectl /usr/local/bin/kubectl
-COPY --from=ghcr.io/fluxcd/flux-cli:v2.10.0@sha256:1a5178b1770052d6e88ab1c7c8434c5ac9bca8a8ab984dcaf6b9df31814ce9f2 /usr/local/bin/flux /usr/local/bin/flux
-COPY --from=quay.io/openbao/openbao:2.7.2@sha256:5046911075e137e154ce49ab051502f4ec7cf367d484ae4a4dce665d9b90561f /usr/bin/bao /usr/local/bin/bao
+COPY --from=ghcr.io/siderolabs/talosctl:v1.14.4@sha256:b3233234327350f20ed194f3fad83d90a64344c1940f839c7b0c0abef50c8c33 /talosctl /usr/local/bin/talosctl
+COPY --from=alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7 /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.6@sha256:b1ac18156f227af9a524b842a96f2c20986c7a779ef721df3ba4e4540f449d76 /usr/local/bin/flux /usr/local/bin/flux
+COPY --from=quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf /usr/bin/bao /usr/local/bin/bao
 COPY --from=gitea/tea:0.16.0@sha256:af50a2060ce4d8fd76b7ebe75a3d6db4bb0c615c5bc8f2bdfd8ea83207c4752d /usr/bin/tea /usr/local/bin/tea
 
 RUN talosctl version --client \

ci/images/kuma-sync/Containerfile

@@ -1,7 +1,7 @@
 # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. The unit tests
 # (no tags, so no Docker and no envtest) gate the image: the final stage copies
 # the binary out of this stage, so a failing test fails the build.
-FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS build
+FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -9,7 +9,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/kuma-sync ./cmd/kuma-sync
 
-FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
+FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
 COPY --from=build /out/kuma-sync /kuma-sync
 USER 65532
 ENTRYPOINT ["/kuma-sync"]

ci/images/netbird-service-sync/Containerfile

@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py

kubernetes/NETWORK-traffic-classes.md

@@ -22,13 +22,6 @@ Two rules, one per family, send every packet with a pod source to table 47
 (`talos/patches/site-homelab.yaml`, priorities 1000/1001, below main). The
 table decides by longest prefix; no rule carves out exceptions.
 
-A reply from a LoadBalancer VIP is pod traffic as well, but it reaches the
-routing decision with the VIP as its source. Two more rules (1002/1003) send
-the LoadBalancer pool to table 47, so the reply leaves over `ingress0`, where
-the request arrived as the BGP next hop. Without them main sent it out
-`mgmt0`. The pool is a site fact: the site patch's `lb-pool-site` ConfigMap,
-which `bgp-pool` takes by Flux substitution, and the rules beside it.
-
 bird (`kubernetes/infrastructure/bird/`) owns table 47 and fills it with:
 
 - the node's attached networks — `mgmt0`, `ingress0`, `pod0`, `node0` —

kubernetes/apps/audiobookshelf/deployment.yaml

@@ -48,7 +48,7 @@ spec:
         # cert when doing server-side OIDC token exchange. Bundle both
         # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
         - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
+          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
           command:
             - sh
             - -c

kubernetes/apps/authentik/helmrelease.yaml

@@ -20,7 +20,7 @@ spec:
       # Pinned to match the samba-bridge fork's app image (server.Dockerfile
       # AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a
       # floating range drifts the chart ahead of the pinned app image.
-      version: "2026.8.5"
+      version: "2026.8.4"
       sourceRef:
         kind: HelmRepository
         name: authentik

kubernetes/apps/evcc/deployment.yaml

@@ -28,7 +28,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: evcc
-          image: evcc/evcc:0.318.2@sha256:7ef9bcb15a4fdbfe3bf75d7a0857c40b6272b8783ea833fcbb22f8f134b336c7
+          image: evcc/evcc:0.318.1@sha256:2f8163ab22f04863afd86cd511c09607ba71debd9eebd65511f3d654922a80d1
           # evcc auto-discovers /etc/evcc.yaml on its default search path;
           # the file is delivered (with the MQTT password) via the
           # sops-encrypted evcc-config Secret mounted below.

kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml

@@ -88,7 +88,7 @@ spec:
         # deliver, and the ClusterIP has no backend while HA restarts. The
         # trap forwards SIGTERM so the pod still terminates promptly.
         - name: socat-ipv4
-          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -130,7 +130,7 @@ spec:
         # depends on the kernel's bindv6only default rather than on anything
         # stated here, so the roles are made explicit instead of inherited.
         - name: socat-ipv6
-          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -46,7 +46,7 @@ spec:
         k8s.v1.cni.cncf.io/networks: shelly-manager-iot
         # Changing this rolls the pod, which is the only way a change to the
         # shelly-manager-iot attachment takes effect.
-        net.renner.uno/iot-attachment-config: "tuning-no-ra-no-mtu-probing"
+        net.renner.uno/iot-attachment-config: "tuning-no-ra"
     spec:
       # eth0 (Cilium-managed pod network) is still the primary — it
       # carries the ingress, mosquitto LB return path, etc. The macvlan
@@ -64,7 +64,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-11-02-1412 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-10-30-1343 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml

@@ -50,9 +50,6 @@ spec:
   # to IPv6 clients on v30iot leave via net1, bypassing Cilium's LoadBalancer
   # reverse NAT. tuning turns RA processing off on net1; the link-local
   # address mDNS uses stays.
-  #
-  # tcp_mtu_probing (pod-wide; Cilium sets 1): Shelly flash-write stalls
-  # trip black-hole detection, which cuts firmware downloads to 48-byte MSS.
   config: |
     {
       "cniVersion": "0.3.1",
@@ -70,8 +67,7 @@ spec:
           "type": "tuning",
           "sysctl": {
             "net.ipv6.conf.IFNAME.accept_ra": "0",
-            "net.ipv6.conf.IFNAME.autoconf": "0",
-            "net.ipv4.tcp_mtu_probing": "0"
+            "net.ipv6.conf.IFNAME.autoconf": "0"
           }
         },
         {

kubernetes/apps/home-assistant/deployment.yaml

@@ -60,7 +60,7 @@ spec:
         # repo's configuration.yaml reads this key, so HA does not start
         # without it. Removing this init container takes the recorder down.
         - name: render-db-url
-          image: busybox:1.38@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
+          image: busybox:1.38@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
           command:
             - sh
             - -c
@@ -97,7 +97,7 @@ spec:
         # (homeassistant repo packages/matrix_assist.yaml), same filter-then-append
         # render as recorder_db_url above. Value is hex, nothing to escape.
         - name: render-matrix-password
-          image: busybox:1.38@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
+          image: busybox:1.38@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
           command:
             - sh
             - -c
@@ -275,7 +275,7 @@ spec:
         # any LAN client can edit, matching the user's trust-the-network
         # model. Runs as root so its writes match HA's root-owned files.
         - name: code-server
-          image: codercom/code-server:4.144.0@sha256:b9e8056bb74bd0c4f90284c7559eddeccd38400cfedc28e64c9d3ca50fef1f83
+          image: codercom/code-server:4.143.1@sha256:377b66bec5645510ed52549bb00e648c273edc604d230a3f90fd2b2433afcb97
           args:
             - "--auth=none"
             - "--bind-addr=0.0.0.0:8080"
@@ -337,7 +337,7 @@ spec:
         # dedicated long-lived token.
         # Runs as root to match HA's root-owned /config files. See config-sync.sh.
         - name: config-sync
-          image: alpine/git:2.54.0@sha256:ac6c828f15d82775d204d3d75112e1d34af8945da80ccf922713c9891ba68e7a
+          image: alpine/git:2.54.0@sha256:e8ceedc73bd80992ae8d58a7d24c58b8322146c354f1d2e81a97db4452068ec0
           command: ["/bin/sh", "/scripts/sync.sh"]
           env:
             - name: SYNC_BRANCH

kubernetes/apps/home-assistant/esphome-deployment.yaml

@@ -36,7 +36,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: esphome
-          image: ghcr.io/esphome/esphome:2026.10.1@sha256:eab8cd6b4f51077c3883af4cedc058280ddc34a94f3b2ffee23e9d2cd5f1db64
+          image: ghcr.io/esphome/esphome:2026.10.0@sha256:1dff19a59070cdb523b76576cdc74d200f862d43c1407809088855920cf57145
           imagePullPolicy: IfNotPresent
           # Default entrypoint runs the dashboard (Device Builder) against the
           # mounted /config — no command override needed.

kubernetes/apps/home-assistant/mqtt-account-controller.yaml

@@ -223,7 +223,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/konairius/mqtt-account-controller:2026-11-02-1058 # {"$imagepolicy": "flux-system:mqtt-account-controller"}
+          image: gitea.renner.uno/konairius/mqtt-account-controller:2026-10-29-1634 # {"$imagepolicy": "flux-system:mqtt-account-controller"}
           env:
             - name: BROKER_URL
               value: ssl://mosquitto.home-assistant.svc.cluster.local:8884

kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml

@@ -163,7 +163,7 @@ spec:
           # Pinned tag. No Flux image-automation marker yet (unlike mosquitto) —
           # add an infrastructure/image-automation/zigbee2mqtt.yaml policy as a
           # follow-up if desired; pinned-and-manual is fine for the initial cutover.
-          image: ghcr.io/koenkk/zigbee2mqtt:2.14.3@sha256:fb4a6b0f6868ad1cd6a9996479802b2420e599c3463b62bbff8c8cd9a908f43a
+          image: ghcr.io/koenkk/zigbee2mqtt:2.14.2@sha256:addbfb08fcef2e4477de1535636118241e10d13e898fbe4d9faba8a4d7396311
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

kubernetes/apps/ical-proxy/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: ical-proxy
-          image: gitea.renner.uno/konairius/ical-proxy:2026-11-02-1055 # {"$imagepolicy": "flux-system:ical-proxy"}
+          image: gitea.renner.uno/konairius/ical-proxy:2026-10-28-0651 # {"$imagepolicy": "flux-system:ical-proxy"}
           ports:
             - containerPort: 8080
               name: http

kubernetes/apps/immich/server.yaml

@@ -66,7 +66,7 @@ spec:
         # The library PVC is populated by the seed phase before this
         # Deployment reconciles, so no rsync init is needed here.
         - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
+          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
           command:
             - sh
             - -c

kubernetes/apps/influxdb/grafana-token-job.yaml

@@ -57,7 +57,7 @@ spec:
         runAsNonRoot: false
       initContainers:
         - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }
@@ -80,7 +80,7 @@ spec:
               echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
       containers:
         - name: create
-          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }

kubernetes/apps/influxdb/ha-token-job.yaml

@@ -88,7 +88,7 @@ spec:
         # state). Two-stage so we don't try to create an auth before
         # the chart's `influx setup` has finished.
         - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }
@@ -111,7 +111,7 @@ spec:
               echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
       containers:
         - name: create
-          image: influxdb:2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }

kubernetes/apps/influxdb/helmrelease.yaml

@@ -55,7 +55,7 @@ spec:
       repository: influxdb
       # Was pinned to VM 108's 2.7.4 for the one-time `influx restore`; that
       # migration is done. No downgrade below 2.9 without `influxd downgrade`.
-      tag: "2.9.1@sha256:a450f6faf9573e6c2e96a0f575885ae8b7387cc87e4de94599e247ebfa3ac417"
+      tag: "2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2"
     # Single replica — InfluxDB OSS doesn't cluster. RWO Ceph-block + Velero
     # backups (pending) is the durability story.
     persistence:

kubernetes/apps/libation/cronjob.yaml

@@ -48,7 +48,7 @@ spec:
             # this sentinel: the entrypoint copies AccountsSettings.json
             # into ephemeral /config-internal rather than symlinking it.
             - name: seed-config
-              image: busybox:1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
+              image: busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
               command: ["/bin/sh", "-eu", "-c"]
               args:
                 - |
@@ -94,7 +94,7 @@ spec:
             - name: libation
               # Pinned by digest: Spegel caches mutable tag resolutions, so
               # :latest stayed on 13.7.11 despite imagePullPolicy Always.
-              image: docker.io/rmcrackan/libation:14.2.5@sha256:7bb47a417311d154c6691747320d0b62ce15527280ad99f0e2a85ac9a6b07e40
+              image: docker.io/rmcrackan/libation:14.2.2@sha256:fe188ac3c4ce63cc305971c76e648748341427e16bcf884011da8a384fd3908c
               # The entrypoint stages config into ephemeral /config-internal
               # by copy (only the DB is symlinked to the PVC), so Audible
               # tokens refreshed during a run are lost at container exit.

kubernetes/apps/matrix/element.yaml

@@ -72,7 +72,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: element-web
-          image: ghcr.io/element-hq/element-web:v1.12.33@sha256:b0aa4b5a4fc1afaaff62e2dbd0c92d57e2b20724f3ccb2fef53aae949088c3d2
+          image: ghcr.io/element-hq/element-web:v1.12.32@sha256:f8700633d4336258af7a05b53865a4f479e0d628cf2d9ca83d28b5939314d4ce
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

kubernetes/apps/matrix/mas.yaml

@@ -137,7 +137,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.28.0@sha256:494c67f08ee8344368f4ed336611dea02b26c4e058bf37a212d090d50b612659
+          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1@sha256:02712e68c90f3743fedbd5e3343517481b2b4f246a9fd9e2f050dc2553033847
           # The server applies database migrations and syncs the upstream
           # providers from the config on start.
           args: ["server", "--config", "/config/config.yaml"]

kubernetes/apps/matrix/synapse.yaml

@@ -179,7 +179,7 @@ spec:
         # first. The marker on the data PVC makes later starts skip it.
         # Debug image: the plain one has no shell for the marker check.
         - name: migrate-to-mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.28.0-debug@sha256:362b8cc6b1176aec059f3539da2d47c8b47587d1584431bf1aca285146d42b08
+          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1-debug@sha256:75f369b206785f1480f4a9f8dd81d7f9f3c6793c40fd184358ecd5d7acae17d4
           command:
             - /busybox/sh
             - -ec
@@ -234,7 +234,7 @@ spec:
               mountPath: /data
       containers:
         - name: synapse
-          image: ghcr.io/element-hq/synapse:v1.164.1@sha256:fa4aa980f279bcf26d4e7ecc2a2c9a701c73f2ebe8841da9bdcf3b2fdf693d75
+          image: ghcr.io/element-hq/synapse:v1.163.2@sha256:c3c21919a322f74d177a43bce8031adc81ef839ddd117a8dd03cfec350e76e02
           # Bypass /start.py: it expects to run as root and template a config
           # from env. Default mode is generate-missing-and-run, which creates
           # the signing key on first start.

kubernetes/apps/monitoring/helmrelease-prometheus.yaml

@@ -17,7 +17,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "92.17.0"
+      version: "92.13.1"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

kubernetes/apps/otbr/dataset-bootstrap.yaml

@@ -74,7 +74,7 @@ spec:
           # alpine/kubectl is the maintained replacement. Pin the tag
           # to the cluster's server version so kubectl is in lock-step
           # (mismatched skew can break exec streaming).
-          image: docker.io/alpine/kubectl:1.37.2@sha256:5e2de75d37e811ba6eb92e06890b1b3263eae4f0a1c17b49269edec589b1352a
+          image: docker.io/alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7
           env:
             - name: DATASET_TLV
               valueFrom:

kubernetes/apps/otbr/deployment.yaml

@@ -47,7 +47,7 @@ spec:
         #
         # Hence socat is installed at startup and run inside this container.
         - name: otbr
-          image: openthread/otbr:latest@sha256:51f9af250252f4faae85d0197574a7c17ada873c78799854461a93e3e42cf324
+          image: openthread/otbr:latest@sha256:f3e43ccd86d6da87323873efa0c9b6f92a2a8cc75a804ea50e34c96680363e2e
           command:
             - bash
             - -c

kubernetes/apps/paperless/paperless.yaml

@@ -287,7 +287,7 @@ spec:
               add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
         # anchor: bridge-tls-proxy
         - name: bridge-tls-proxy
-          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
           args:
             - "-d"
             - "TCP-LISTEN:11143,fork,reuseaddr,bind=127.0.0.1"

kubernetes/apps/renovate/cronjob.yaml

@@ -59,7 +59,7 @@ spec:
             - name: renovate
               # Pinned by tag and digest. Renovate updates itself through
               # homelab's renovate.json, like any other image here.
-              image: docker.io/renovate/renovate:44.199.2@sha256:0538f498be1b074e2434f8449cab7b2be30f8c0d0baf3b72814010f19db5bcfb
+              image: docker.io/renovate/renovate:44.181.8@sha256:b28b2de1dfd35de7e8198756d7f7cdd84ebc28c3f25e80f5b09e598d3faefb2a
               env:
                 - name: RENOVATE_CONFIG_FILE
                   value: /config/config.json

kubernetes/apps/review-bot/deployment.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-11-02-1054 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-29-1346 # {"$imagepolicy": "flux-system:review-bot"}
           env:
             - name: GITEA_URL
               value: https://gitea.renner.uno

kubernetes/apps/uptime-monitor/deployment.yaml

@@ -57,7 +57,7 @@ spec:
           # Pinned, and deliberately NOT under Flux image automation. rbac.yaml
           # is derived from what this exact version calls; an automatic bump
           # could add a call the Role does not cover, silently.
-          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.14@sha256:6d7b7fcb39d72296b6b6c0301b443fb31e12d86c55e706adcc7e4f92a887a3ba
+          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.13@sha256:3301afb61c10abc4e334deab9cd8601cef069e352b4d7f4dd0897787fca32eac
           command: ["/manager"]
           args:
             - --health-probe-bind-address=:8081

kubernetes/apps/wiki/cronjobs.yaml

@@ -68,7 +68,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: sync
-              image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
+              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
               command:
                 - sh
                 - -c
@@ -128,7 +128,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: run
-              image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
+              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
               command:
                 - sh
                 - -c

kubernetes/apps/wordpress/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         fsGroup: 33
       containers:
         - name: wordpress
-          image: wordpress:7.1.4-php8.5-apache@sha256:131532d893b5dc4fdf4312a878b7e5e4e4d1d40eb54c854c78eddf6282457dfb
+          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
           ports:
             - name: http
               containerPort: 80

kubernetes/clusters/homelab/infrastructure.yaml

@@ -89,9 +89,6 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: cluster-settings
-      # The LoadBalancer pool, from the site's Talos patch (site-*.yaml).
-      - kind: ConfigMap
-        name: lb-pool-site
   dependsOn:
     - name: infrastructure
 ---

kubernetes/infrastructure-inhouse/bird/daemonset.yaml

@@ -69,7 +69,7 @@ spec:
           # first build of that day — imagePullPolicy: Always does not help,
           # because the tag itself resolves stale. Update this when the image
           # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:fee5645ad0d718661fb90da6ea9090d30fe47597bebeecb246c01c2adc6df585
+          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -95,7 +95,7 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:fee5645ad0d718661fb90da6ea9090d30fe47597bebeecb246c01c2adc6df585
+          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
           resources:
             requests:
               cpu: "50m"

kubernetes/infrastructure/openbao/helmrelease.yaml

@@ -24,7 +24,7 @@ spec:
       # window. The StatefulSet rolls one pod at a time (updateStrategyType
       # below). Undo after a pod has run the new server = restore the
       # snapshot, not a git revert.
-      version: ">=0.30.6 <0.31.0"
+      version: ">=0.30.4 <0.31.0"
       sourceRef:
         kind: HelmRepository
         name: openbao

kubernetes/infrastructure/openbao/rotation/home-assistant.yaml

@@ -71,7 +71,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-02 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-29 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false
@@ -133,7 +133,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-02 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-29 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false
@@ -195,7 +195,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-02 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-29 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false

kubernetes/infrastructure/openbao/snapshot-cronjob.yaml

@@ -45,7 +45,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: snapshot
-              image: quay.io/openbao/openbao:2.7.2@sha256:5046911075e137e154ce49ab051502f4ec7cf367d484ae4a4dce665d9b90561f # same image as the server — bao CLI included
+              image: quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf # same image as the server — bao CLI included
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities:

kubernetes/infrastructure/post-crds/cilium-bgp.yaml

@@ -8,10 +8,6 @@
 # Selector is opt-in via `lb-pool: bgp`. There is no default pool —
 # Services without this label do not get a LoadBalancer IP.
 #
-# The ranges are a site fact: lb-pool-site from the site's Talos patch
-# (talos/patches/site-*.yaml), by Flux substitution. A CIDR block uses all its
-# addresses (allowFirstLastIPs defaults to Yes).
-#
 # IPv4 + IPv6 ranges keep matching last bytes (10.2.99.x ↔ fd99::x)
 # so each LB has the same "tail" in both families.
 apiVersion: cilium.io/v2alpha1
@@ -23,8 +19,10 @@ spec:
     matchLabels:
       lb-pool: bgp
   blocks:
-    - cidr: "${LB_POOL_V4}"
-    - cidr: "${LB_POOL_V6}"
+    - start: "10.2.99.0"
+      stop: "10.2.99.255"
+    - start: "fd99::"
+      stop: "fd99::ff"
 ---
 # Cilium BGPv2 control-plane config peering each node with the UDM over the
 # ingress VLAN 47 — never over v30iot, which is the untrusted IoT segment.

kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: rook-ceph
 spec:
   cephVersion:
-    image: quay.io/ceph/ceph:v20.2.5 # {"$imagepolicy": "flux-system:ceph"}
+    image: quay.io/ceph/ceph:v20.2.4 # {"$imagepolicy": "flux-system:ceph"}
     allowUnsupported: false
   dataDirHostPath: /var/lib/rook
   # Defaults to false. With three OSDs and size 3 there is no spare copy, so

kubernetes/infrastructure/rook-ceph-cluster/toolbox.yaml

@@ -38,7 +38,7 @@ spec:
       serviceAccountName: rook-ceph-default
       containers:
         - name: rook-ceph-tools
-          image: quay.io/ceph/ceph:v20.2.5 # {"$imagepolicy": "flux-system:ceph"}
+          image: quay.io/ceph/ceph:v20.2.4 # {"$imagepolicy": "flux-system:ceph"}
           command:
             - /bin/bash
             - -c

kubernetes/talos/patches/site-hcloud.yaml

@@ -67,18 +67,6 @@ cluster:
                 nameservers:
                   - 185.12.64.1
                   - 185.12.64.2
-    # The LoadBalancer pool (see site-homelab.yaml). Services pin their
-    # addresses from the production pool, so a test run carries the same one.
-    - name: lb-pool-site
-      contents: |
-        apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: lb-pool-site
-          namespace: flux-system
-        data:
-          LB_POOL_V4: 10.2.99.0/24
-          LB_POOL_V6: fd99::/120
 ---
 # Host DNS asks k8s-gateway first, so containerd resolves in-cluster names
 # (gitea.renner.uno) in the cluster; bootstrap.sh installs k8s-gateway right

kubernetes/talos/patches/site-homelab.yaml

@@ -85,18 +85,6 @@ cluster:
                 nameservers:
                   - fd02:47::1
                   - 10.2.47.1
-    # The LoadBalancer pool (bgp-pool, infrastructure/post-crds/cilium-bgp.yaml,
-    # by Flux substitution). The routing rules 1002/1003 below name it too.
-    - name: lb-pool-site
-      contents: |
-        apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: lb-pool-site
-          namespace: flux-system
-        data:
-          LB_POOL_V4: 10.2.99.0/24
-          LB_POOL_V6: fd99::/120
 ---
 # All pod traffic goes to table 47, and the table decides — longest prefix
 # match, no exceptions to carve out. bird fills it with the node's attached
@@ -127,21 +115,6 @@ name: "1001"
 src: 10.244.0.0/16
 table: "47"
 ---
-# A LoadBalancer reply is pod traffic too, but it reaches the routing decision
-# with the VIP as its source, so the rules above miss it and main sends it out
-# mgmt0 while the request came in over ingress0. The pool is lb-pool-site above.
-apiVersion: v1alpha1
-kind: RoutingRuleConfig
-name: "1002"
-src: fd99::/120
-table: "47"
----
-apiVersion: v1alpha1
-kind: RoutingRuleConfig
-name: "1003"
-src: 10.2.99.0/24
-table: "47"
----
 # Host DNS asks k8s-gateway first, so containerd resolves in-cluster names
 # (gitea.renner.uno) in the cluster; bootstrap.sh installs k8s-gateway right
 # after the CNI, before anything else needs DNS. The UDM is the site's

kubernetes/talos/patches/site-qemu.yaml

@@ -47,15 +47,3 @@ cluster:
           values.yaml: |
             deployment:
               dnsPolicy: Default
-    # The LoadBalancer pool (see site-homelab.yaml). Services pin their
-    # addresses from the production pool, so a test run carries the same one.
-    - name: lb-pool-site
-      contents: |
-        apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: lb-pool-site
-          namespace: flux-system
-        data:
-          LB_POOL_V4: 10.2.99.0/24
-          LB_POOL_V6: fd99::/120

renovate.json

@@ -10,8 +10,7 @@
     "dockerfile"
   ],
   "ignorePaths": [
-    "kubernetes/clusters/homelab/flux-system/**",
-    "kubernetes/infrastructure/image-automation/**"
+    "kubernetes/clusters/homelab/flux-system/**"
   ],
   "flux": {
     "managerFilePatterns": [
@@ -41,7 +40,6 @@
         "ghcr.io/home-assistant/home-assistant",
         "ghcr.io/immich-app/immich-machine-learning",
         "ghcr.io/immich-app/immich-server",
-        "ghcr.io/linuxserver/lidarr",
         "ghcr.io/matter-js/python-matter-server",
         "ghcr.io/music-assistant/server",
         "ghcr.io/paperless-ngx/paperless-ngx",
@@ -59,6 +57,7 @@
         "gitea.renner.uno/konairius/vsftpd",
         "gitea.renner.uno/konairius/wiki",
         "gotenberg/gotenberg",
+        "lscr.io/linuxserver/lidarr",
         "netbirdio/netbird",
         "quay.io/ceph/ceph",
         "redis",

review-bot/Containerfile

@@ -2,7 +2,7 @@
 #
 # Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
 # (the binary has no shell and no package manager to patch or to exec).
-FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS build
+FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build
 
 WORKDIR /build
 COPY go.mod go.sum ./

secret-rotator/Containerfile

@@ -8,7 +8,7 @@
 # lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
 # OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
 # binary can take over the external-API rotators — Cloudflare, Proxmox.)
-FROM rust:1.99-alpine@sha256:7e9e2d068a107a2adafd19930011178d14a78326053cd4c3a9f7ad3fd049557d AS build
+FROM rust:1.99-alpine@sha256:b1d5dd5a22a09404d3e798c0cf051b689077360374eb505fa5bb93c479693d87 AS build
 
 # musl-dev provides the C runtime bits the linker needs for a fully static
 # binary; nothing from it ends up in the final image.