Merge pull request 'fix(dns): pods ask the UDM on the segment they leave on' (#1448) from claude/k8s-gateway-ingress-resolver into main

Reviewed-on: #1448

.woodpecker/ci-manifests-test.yml

@@ -319,7 +319,7 @@ steps:
   # writes its stripped mirror under mktemp and never into the workspace.
   - name: promtool
     depends_on: [] # see note above `steps:`
-    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
+    image: prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
     commands:
       - sh scripts/ci/promtool-rules.sh
 

.woodpecker/ci-scripts-test.yml

@@ -63,7 +63,7 @@ steps:
   # bridge, and the secret guard.
   - name: hermes-skill-tests
     depends_on: []
-    image: python:3.14-alpine@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
+    image: python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
     environment:
       PYTHONDONTWRITEBYTECODE: "1"
     commands:

.woodpecker/deploy-infrastructure.yml

@@ -13,7 +13,7 @@ when:
 
 steps:
   - name: validate-secrets
-    image: alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+    image: alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
     environment:
       TF_VAR_proxmox_api_url:
         from_secret: proxmox_api_url

.woodpecker/review-bot-test.yml

@@ -6,7 +6,7 @@ when:
 
 steps:
   - name: go-test
-    image: golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
+    image: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
     commands:
       - test -z "$(gofmt -l review-bot)"
       - go -C review-bot vet ./...

.woodpecker/security-scan.yml

@@ -18,12 +18,12 @@ when:
 
 steps:
   - name: iac-scan
-    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
+    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
     commands:
       - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .
 
   - name: image-scans
-    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
+    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
     commands:
       - trivy image --download-db-only
       - |

ci/images/alpine-jq/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # Alpine plus jq. Nothing application-specific — a general-purpose base for any
 # workload that needs to read JSON from a shell script.

ci/images/alpine-openssl/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # Alpine plus the openssl CLI. Nothing application-specific — named for what it
 # is, so anything needing `openssl s_client` / `x509` from a shell script can use

ci/images/ansible/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 RUN apk add --no-cache \
       ansible \

ci/images/authentik-gate-sync/Containerfile

@@ -5,12 +5,12 @@
 
 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS test
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v
 
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py

ci/images/backup-verify/Containerfile

@@ -1,6 +1,6 @@
-FROM hetznercloud/cli:v1.70.1@sha256:795ac09a5ecabd48cc13a8f1c3dc45983c8f75ae1277c70d621719e07f276ccb AS hcloud
+FROM hetznercloud/cli:v1.70.2@sha256:3b3a8f66323a5754089df7939fd9d3f350127072deed13418f3d3052b4bbeeae AS hcloud
 
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 RUN apk add --no-cache \
       bash \

ci/images/bird/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # bird: BGP daemon for the pod-network mesh over pod0. Distro package, no build
 # step — the image is the binary plus its runtime.

ci/images/claude/Containerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f
+FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 
 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a

ci/images/cloudflare-lb-sync/Containerfile

@@ -2,7 +2,7 @@
 # Cloudflare. The unit tests (no tags, so no envtest) gate the image: the
 # final stage copies the binary out of this stage, so a failing test fails the
 # build.
-FROM golang:1.27@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS build
+FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -10,7 +10,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/cloudflare-lb-sync ./cmd/cloudflare-lb-sync
 
-FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3
+FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
 COPY --from=build /out/cloudflare-lb-sync /cloudflare-lb-sync
 USER 65532
 ENTRYPOINT ["/cloudflare-lb-sync"]

ci/images/cni-plugins/Containerfile

@@ -28,7 +28,7 @@
 # amd64 only, matching the ARCH the installer already hardcoded and the cluster's
 # node architecture. Add a second stage if a different arch is ever needed.
 
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS fetch
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS fetch
 
 ARG CNI_PLUGINS_VERSION=v1.9.1
 ARG CNI_PLUGINS_SHA256=b98f74a0f8522f0a83867178729c1aa70f2158f90c45a2ca8fa791db1c76b303
@@ -61,7 +61,7 @@ RUN set -eu; \
       [ -x "/plugins/$p" ] || { echo "FATAL: /plugins/$p missing or not executable" >&2; exit 1; }; \
     done
 
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # Alpine rather than scratch: the installer needs a shell to copy the binaries
 # onto the host. busybox covers cp/mv/chown/ls, so nothing is added.

ci/images/heating-can/Containerfile

@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS build
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build
 
 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
  && rm -rf /opt/e3oncan/.git
 
 
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
 
 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1

ci/images/hermes/Containerfile

@@ -1,4 +1,4 @@
-FROM nousresearch/hermes-agent:v0.22.2@sha256:36099926da316742423544e055d4734777105ffe6341873af5459b957d0c2919
+FROM nousresearch/hermes-agent:v0.22.5@sha256:9c5561579f3ffdf333401797094ac3a743738d6c25d40f4331c7bf77b694238d
 
 USER root
 
@@ -6,9 +6,9 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends jq \
  && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/siderolabs/talosctl:v1.13.10@sha256:3116f64c97ddffb53bd3c5bf87c8614d99f04df4326177dbbb7702b5087f0e4d /talosctl /usr/local/bin/talosctl
-COPY --from=alpine/kubectl:1.36.3@sha256:dae261106d5555008acede256b7102c8a6decde7209198434f5999f051460f57 /usr/local/bin/kubectl /usr/local/bin/kubectl
-COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.5@sha256:704d5529535570a495249b643159c93a9aa88ffca07813c974a54b7ba6edbd86 /usr/local/bin/flux /usr/local/bin/flux
+COPY --from=ghcr.io/siderolabs/talosctl:v1.14.4@sha256:b3233234327350f20ed194f3fad83d90a64344c1940f839c7b0c0abef50c8c33 /talosctl /usr/local/bin/talosctl
+COPY --from=alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7 /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.6@sha256:b1ac18156f227af9a524b842a96f2c20986c7a779ef721df3ba4e4540f449d76 /usr/local/bin/flux /usr/local/bin/flux
 COPY --from=quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf /usr/bin/bao /usr/local/bin/bao
 COPY --from=gitea/tea:0.16.0@sha256:af50a2060ce4d8fd76b7ebe75a3d6db4bb0c615c5bc8f2bdfd8ea83207c4752d /usr/bin/tea /usr/local/bin/tea
 

ci/images/k8s/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 ARG TALOS_VERSION=v1.13.12
 ARG VELERO_VERSION=v1.16.0

ci/images/kuma-sync/Containerfile

@@ -1,7 +1,7 @@
 # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. The unit tests
 # (no tags, so no Docker and no envtest) gate the image: the final stage copies
 # the binary out of this stage, so a failing test fails the build.
-FROM golang:1.27@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS build
+FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -9,7 +9,7 @@ COPY . .
 RUN go test ./...
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/kuma-sync ./cmd/kuma-sync
 
-FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3
+FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
 COPY --from=build /out/kuma-sync /kuma-sync
 USER 65532
 ENTRYPOINT ["/kuma-sync"]

ci/images/netbird-service-sync/Containerfile

@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
+FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py

ci/images/tofu/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 ARG TOFU_VERSION=1.11.0
 

ci/images/vmtest/Containerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # Everything `bootstrap.sh vmtest` needs, so the rebuild test can run as a Job in
 # the cluster instead of on a workstation. The workstation has 31G and the test

kubernetes/apps/audiobookshelf/deployment.yaml

@@ -48,7 +48,7 @@ spec:
         # cert when doing server-side OIDC token exchange. Bundle both
         # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
         - name: fetch-le-staging-roots
-          image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
           command:
             - sh
             - -c

kubernetes/apps/evcc/deployment.yaml

@@ -28,7 +28,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: evcc
-          image: evcc/evcc:0.317.1@sha256:c50cd4f83c22b39722a76a76b8d428b69bf8ab3334209ed9ed24ec0e3c48dde5
+          image: evcc/evcc:0.318.1@sha256:2f8163ab22f04863afd86cd511c09607ba71debd9eebd65511f3d654922a80d1
           # evcc auto-discovers /etc/evcc.yaml on its default search path;
           # the file is delivered (with the MQTT password) via the
           # sops-encrypted evcc-config Secret mounted below.

kubernetes/apps/gatus/configmap.yaml

@@ -20,7 +20,7 @@ metadata:
 #   services group                   infrastructure group
 #     Web Service 1 = Authentik        Infrastructure 1 = retired (was PBS 2)
 #     Web Service 2 = Gitea            Infrastructure 2 = retired (was Proxmox VE)
-#     Web Service 3 = Immich           Infrastructure 3 = UDM DNS (10.2.40.1)
+#     Web Service 3 = Immich           Infrastructure 3 = UDM DNS (10.2.47.1)
 #     Web Service 4 = Woodpecker CI    Infrastructure 4 = Mosquitto MQTT broker
 #     Web Service 5 = Grafana
 #     Web Service 6 = Home Assistant
@@ -290,9 +290,11 @@ data:
       # a backup server that nothing backs up to reports on nothing. Re-add
       # alongside the first host that is declared to back up to it.
 
+      # The UDM on the segment pod traffic leaves on (k8s-gateway-site in
+      # talos/patches/site-homelab.yaml).
       - name: Infrastructure 3
         group: infrastructure
-        url: 10.2.40.1
+        url: 10.2.47.1
         interval: 30s
         dns:
           query-name: udm.renner.uno

kubernetes/apps/gitea/package-retention.yaml

@@ -115,7 +115,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: retention
-              image: docker.io/library/python:3.14-alpine@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
+              image: docker.io/library/python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
               command: ["python3", "/app/package-retention.py"]
               env:
                 # In-cluster Service; the public name hairpins off the ingress

kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml

@@ -88,7 +88,7 @@ spec:
         # deliver, and the ClusterIP has no backend while HA restarts. The
         # trap forwards SIGTERM so the pod still terminates promptly.
         - name: socat-ipv4
-          image: alpine/socat:1.8.1.3@sha256:fb3862c949af7c79996d0e514ee96128644d840835ed5368eeecb14a869de361
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -130,7 +130,7 @@ spec:
         # depends on the kernel's bindv6only default rather than on anything
         # stated here, so the roles are made explicit instead of inherited.
         - name: socat-ipv6
-          image: alpine/socat:1.8.1.3@sha256:fb3862c949af7c79996d0e514ee96128644d840835ed5368eeecb14a869de361
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -61,7 +61,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/k.renner/shelly-manager:build.1792387459 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/k.renner/shelly-manager:build.1792997278 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -177,7 +177,7 @@ spec:
         # No probes: it only serves the API-key path, and a probe failure would
         # also pull the pod out of the shelly-manager Service.
         - name: api-proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b9241c6e7b8e9a862f129d8d4199ab64b10390949a78bdd5603379b32c844083
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
           env:
             - name: POD_IP
               valueFrom:

kubernetes/apps/home-assistant/deployment.yaml

@@ -192,7 +192,7 @@ spec:
         # substitution to POD_IP so nginx-runtime variables like $host
         # / $http_x_forwarded_for in the template stay intact.
         - name: proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
           env:
             - name: POD_IP
               valueFrom:
@@ -236,7 +236,7 @@ spec:
         # readiness probe on purpose: a broker outage must not take HA out of
         # its Service endpoints.
         - name: mqtt-tls
-          image: ghostunnel/ghostunnel:v1.11.4@sha256:e5248233863aadd36383a11c92360f2981141881ef05e38360a6ada8630d36b1
+          image: ghostunnel/ghostunnel:v1.11.5@sha256:65c4e34ec0ee0f30ea1f72b7411ec70a91c32fc50f067a8466ad2adb1e7420f2
           args:
             - client
             - --listen=127.0.0.1:11883
@@ -275,7 +275,7 @@ spec:
         # any LAN client can edit, matching the user's trust-the-network
         # model. Runs as root so its writes match HA's root-owned files.
         - name: code-server
-          image: codercom/code-server:4.141.0@sha256:72ab24b5680ee597dd647b30d82625752f40109b5f61bef90ffbf1ea1f02dbb8
+          image: codercom/code-server:4.143.1@sha256:377b66bec5645510ed52549bb00e648c273edc604d230a3f90fd2b2433afcb97
           args:
             - "--auth=none"
             - "--bind-addr=0.0.0.0:8080"
@@ -337,7 +337,7 @@ spec:
         # dedicated long-lived token.
         # Runs as root to match HA's root-owned /config files. See config-sync.sh.
         - name: config-sync
-          image: alpine/git:2.54.0@sha256:03228d7ded483b0b3e55e1de7fa660d70d3e1bb432fa7021d29e192640de11aa
+          image: alpine/git:2.54.0@sha256:e8ceedc73bd80992ae8d58a7d24c58b8322146c354f1d2e81a97db4452068ec0
           command: ["/bin/sh", "/scripts/sync.sh"]
           env:
             - name: SYNC_BRANCH

kubernetes/apps/home-assistant/esphome-deployment.yaml

@@ -36,7 +36,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: esphome
-          image: ghcr.io/esphome/esphome:2026.9.1@sha256:776a845d508909bf426d2ee7bdd81796361ebe6a7f091807ce1d6d0b48985413
+          image: ghcr.io/esphome/esphome:2026.10.0@sha256:1dff19a59070cdb523b76576cdc74d200f862d43c1407809088855920cf57145
           imagePullPolicy: IfNotPresent
           # Default entrypoint runs the dashboard (Device Builder) against the
           # mounted /config — no command override needed.

kubernetes/apps/immich/server.yaml

@@ -66,7 +66,7 @@ spec:
         # The library PVC is populated by the seed phase before this
         # Deployment reconciles, so no rsync init is needed here.
         - name: fetch-le-staging-roots
-          image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
           command:
             - sh
             - -c

kubernetes/apps/influxdb/grafana-token-job.yaml

@@ -57,7 +57,7 @@ spec:
         runAsNonRoot: false
       initContainers:
         - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }
@@ -80,7 +80,7 @@ spec:
               echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
       containers:
         - name: create
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }

kubernetes/apps/influxdb/ha-token-job.yaml

@@ -88,7 +88,7 @@ spec:
         # state). Two-stage so we don't try to create an auth before
         # the chart's `influx setup` has finished.
         - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }
@@ -111,7 +111,7 @@ spec:
               echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
       containers:
         - name: create
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
           env:
             - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
             - { name: INFLUX_ORG, value: renner }

kubernetes/apps/influxdb/helmrelease.yaml

@@ -55,7 +55,7 @@ spec:
       repository: influxdb
       # Was pinned to VM 108's 2.7.4 for the one-time `influx restore`; that
       # migration is done. No downgrade below 2.9 without `influxd downgrade`.
-      tag: "2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac"
+      tag: "2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2"
     # Single replica — InfluxDB OSS doesn't cluster. RWO Ceph-block + Velero
     # backups (pending) is the durability story.
     persistence:

kubernetes/apps/matrix/element.yaml

@@ -72,7 +72,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: element-web
-          image: ghcr.io/element-hq/element-web:v1.12.30@sha256:3e7dbd4424de9e11c812bc740acf2725b2abe66ea0d0802023b56fd85d3fa09a
+          image: ghcr.io/element-hq/element-web:v1.12.32@sha256:f8700633d4336258af7a05b53865a4f479e0d628cf2d9ca83d28b5939314d4ce
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

kubernetes/apps/matrix/mas.yaml

@@ -137,7 +137,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0@sha256:e089f1048a1d4a9a492ed17b9fe759100f1bd619407b001f5927928d88b780c4
+          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1@sha256:02712e68c90f3743fedbd5e3343517481b2b4f246a9fd9e2f050dc2553033847
           # The server applies database migrations and syncs the upstream
           # providers from the config on start.
           args: ["server", "--config", "/config/config.yaml"]

kubernetes/apps/matrix/rtc.yaml

@@ -124,7 +124,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: livekit
-          image: livekit/livekit-server:v1.13.10@sha256:89ca9ce0791e18d6e03bf6e2c49ceb27e1c754eae8bd50c989386c1a5963791a
+          image: livekit/livekit-server:v1.13.11@sha256:25cd902de7cacbd5f1f779f6a6ac1eae20ba8f56b0935934ce6b0ab80d1e3d20
           args:
             - --config
             - /config/livekit.yaml

kubernetes/apps/matrix/synapse.yaml

@@ -179,7 +179,7 @@ spec:
         # first. The marker on the data PVC makes later starts skip it.
         # Debug image: the plain one has no shell for the marker check.
         - name: migrate-to-mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0-debug@sha256:46f7480f5ea4243ccb6fd2c447ea859e0230c8b3c0e676ee285d4ae6ca344ee3
+          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1-debug@sha256:75f369b206785f1480f4a9f8dd81d7f9f3c6793c40fd184358ecd5d7acae17d4
           command:
             - /busybox/sh
             - -ec
@@ -234,7 +234,7 @@ spec:
               mountPath: /data
       containers:
         - name: synapse
-          image: ghcr.io/element-hq/synapse:v1.162.0@sha256:6b84a7bbac36f080b2d2e51e0289cf1b08b349598ea44a558df38d558f2c2311
+          image: ghcr.io/element-hq/synapse:v1.163.2@sha256:c3c21919a322f74d177a43bce8031adc81ef839ddd117a8dd03cfec350e76e02
           # Bypass /start.py: it expects to run as root and template a config
           # from env. Default mode is generate-missing-and-run, which creates
           # the signing key on first start.

kubernetes/apps/monitoring-rules/probes-dns.yaml

@@ -5,7 +5,9 @@
 #
 # The UDM is queried directly rather than through the cluster resolver:
 # k8s-gateway caches these with `serve_stale 1h immediate`, which would keep
-# a deleted record green for an hour.
+# a deleted record green for an hour. The addresses are the UDM on the segment
+# pod traffic leaves on, the same upstream k8s-gateway uses (k8s-gateway-site
+# in talos/patches/site-homelab.yaml).
 #
 # `release` is load-bearing — probeSelector matches on it.
 apiVersion: monitoring.coreos.com/v1
@@ -25,8 +27,8 @@ spec:
   targets:
     staticConfig:
       static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
       # instance is the resolver and identical across these Probes, so the
       # queried name has to come from a label.
       labels:
@@ -49,8 +51,8 @@ spec:
   targets:
     staticConfig:
       static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
       labels:
         dns_name: mqtt.renner.uno
 ---
@@ -71,8 +73,8 @@ spec:
   targets:
     staticConfig:
       static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
       labels:
         dns_name: ldap.renner.uno
 ---
@@ -93,8 +95,8 @@ spec:
   targets:
     staticConfig:
       static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
       labels:
         dns_name: syslog.renner.uno
 ---
@@ -115,8 +117,8 @@ spec:
   targets:
     staticConfig:
       static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
       labels:
         dns_name: ftp.paperless.renner.uno
 ---
@@ -137,7 +139,7 @@ spec:
   targets:
     staticConfig:
       static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
       labels:
         dns_name: syncthing.paperless.renner.uno

kubernetes/apps/monitoring/helmrelease-loki.yaml

@@ -32,6 +32,9 @@ spec:
     deploymentMode: SingleBinary
     loki:
       auth_enabled: false
+      # No usage reports to stats.grafana.org (egress is not allowed anyway).
+      analytics:
+        reporting_enabled: false
       commonConfig:
         replication_factor: 1
       storage:

kubernetes/apps/monitoring/helmrelease-prometheus.yaml

@@ -17,7 +17,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "92.3.0"
+      version: "92.13.1"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

kubernetes/apps/otbr/dataset-bootstrap.yaml

@@ -74,7 +74,7 @@ spec:
           # alpine/kubectl is the maintained replacement. Pin the tag
           # to the cluster's server version so kubectl is in lock-step
           # (mismatched skew can break exec streaming).
-          image: docker.io/alpine/kubectl:1.37.1@sha256:b568e8beb6a79aee269c142343078a278b85e7710f1c0e7d8d6b21d1eb566a48
+          image: docker.io/alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7
           env:
             - name: DATASET_TLV
               valueFrom:

kubernetes/apps/otbr/deployment.yaml

@@ -47,7 +47,7 @@ spec:
         #
         # Hence socat is installed at startup and run inside this container.
         - name: otbr
-          image: openthread/otbr:latest@sha256:a1ccea58241c2e0c2e16a55590cdd5651336462c3b4fa26e24a59607e155ef72
+          image: openthread/otbr:latest@sha256:f3e43ccd86d6da87323873efa0c9b6f92a2a8cc75a804ea50e34c96680363e2e
           command:
             - bash
             - -c

kubernetes/apps/paperless/ftp-scanner.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: prepare-dirs
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+          image: alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
           command:
             - sh
             - -c

kubernetes/apps/paperless/paperless.yaml

@@ -287,7 +287,7 @@ spec:
               add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
         # anchor: bridge-tls-proxy
         - name: bridge-tls-proxy
-          image: alpine/socat:1.8.1.3@sha256:fb3862c949af7c79996d0e514ee96128644d840835ed5368eeecb14a869de361
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
           args:
             - "-d"
             - "TCP-LISTEN:11143,fork,reuseaddr,bind=127.0.0.1"

kubernetes/apps/paperless/syncthing.yaml

@@ -50,7 +50,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: syncthing
-          image: syncthing/syncthing:2.1.6@sha256:4d0281bdcb4ed9baf503d251d0544ddd856f49fce3f114056257ae172b7fb670
+          image: syncthing/syncthing:2.1.7@sha256:2b71da7c0d0a91a6ae5285ad079226fecc0a365d08b27720e1f7037b018f7546
           env:
             # UI bind: any-interface so the ClusterIP Service can reach
             # it. Network exposure is gated by the absence of an Ingress

kubernetes/apps/renovate/cronjob.yaml

@@ -59,7 +59,7 @@ spec:
             - name: renovate
               # Pinned by tag and digest. Renovate updates itself through
               # homelab's renovate.json, like any other image here.
-              image: docker.io/renovate/renovate:44.151.2@sha256:9ea828b38867af0ca5f269e6c5feace9e74e7f035da150bb16f8c5f70bf2e6e8
+              image: docker.io/renovate/renovate:44.181.8@sha256:b28b2de1dfd35de7e8198756d7f7cdd84ebc28c3f25e80f5b09e598d3faefb2a
               env:
                 - name: RENOVATE_CONFIG_FILE
                   value: /config/config.json

kubernetes/apps/review-bot/deployment.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-25-1455 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-26-0647 # {"$imagepolicy": "flux-system:review-bot"}
           env:
             - name: REPOS
               value: konairius/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager

kubernetes/apps/wiki/cronjobs.yaml

@@ -0,0 +1,152 @@
+# The wiki's schedules. The service runs nothing on its own clock; these jobs
+# call its API with the `scheduler` key. Run one now:
+#   kubectl -n ai create job --from=cronjob/wiki-encyclopedia wiki-encyclopedia-now
+# Generated once in-cluster, nothing in OpenBao.
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: wiki-scheduler-key
+  namespace: ai
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - Auth__ApiKeys__scheduler
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-scheduler-key
+  namespace: ai
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: wiki-scheduler-key
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: wiki-scheduler-key
+---
+# Interval sync; the Gitea push webhook is the fast path.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wiki-sync
+  namespace: ai
+  labels:
+    app.kubernetes.io/name: wiki-sync
+spec:
+  schedule: "*/30 * * * *"
+  timeZone: Etc/UTC
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  startingDeadlineSeconds: 600
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 1800
+      ttlSecondsAfterFinished: 86400
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: wiki-sync
+        spec:
+          restartPolicy: Never
+          enableServiceLinks: false
+          automountServiceAccountToken: false
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: sync
+              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              command:
+                - sh
+                - -c
+                - 'curl -fsS --max-time 1700 -X POST -H "X-Api-Key: $API_KEY" http://wiki.ai.svc.cluster.local:8080/api/v1/sync'
+              env:
+                - name: API_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: wiki-scheduler-key
+                      key: Auth__ApiKeys__scheduler
+              resources:
+                requests:
+                  cpu: 5m
+                  memory: 16Mi
+                limits:
+                  memory: 64Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+---
+# Plans and writes the house encyclopedia (/house). The endpoint syncs first and
+# answers 502 when the run fails or the Anthropic API stopped it.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wiki-encyclopedia
+  namespace: ai
+  labels:
+    app.kubernetes.io/name: wiki-encyclopedia
+spec:
+  schedule: "0 6 * * *"
+  timeZone: Europe/Berlin
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  startingDeadlineSeconds: 3600
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 11400
+      ttlSecondsAfterFinished: 604800
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: wiki-encyclopedia
+        spec:
+          restartPolicy: Never
+          enableServiceLinks: false
+          automountServiceAccountToken: false
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: run
+              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              command:
+                - sh
+                - -c
+                - 'curl -fsS --max-time 10800 -X POST -H "X-Api-Key: $API_KEY" http://wiki.ai.svc.cluster.local:8080/api/v1/encyclopedia/run'
+              env:
+                - name: API_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: wiki-scheduler-key
+                      key: Auth__ApiKeys__scheduler
+              resources:
+                requests:
+                  cpu: 5m
+                  memory: 16Mi
+                limits:
+                  memory: 64Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]

kubernetes/apps/wiki/deployment.yaml

@@ -24,7 +24,7 @@ metadata:
   namespace: ai
   annotations:
     # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
-    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic,wiki-api-basic-auth
+    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-scheduler-key,wiki-typesafe,wiki-anthropic,wiki-api-basic-auth
   labels:
     app.kubernetes.io/name: wiki
 spec:
@@ -53,7 +53,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: wiki
-          image: gitea.renner.uno/konairius/wiki:build.1792939775 # {"$imagepolicy": "flux-system:wiki"}
+          image: gitea.renner.uno/konairius/wiki:build.1792997373 # {"$imagepolicy": "flux-system:wiki"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -89,6 +89,9 @@ spec:
                 name: wiki-gitea
             - secretRef:
                 name: wiki-api-keys
+            # The key the wiki-sync and wiki-encyclopedia CronJobs call with (cronjobs.yaml).
+            - secretRef:
+                name: wiki-scheduler-key
             - secretRef:
                 name: wiki-typesafe
             - secretRef:

kubernetes/apps/wiki/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - externalsecrets.yaml
   - deployment.yaml
   - ingress.yaml
+  - cronjobs.yaml

kubernetes/infrastructure-inhouse/bird/daemonset.yaml

@@ -69,7 +69,7 @@ spec:
           # first build of that day — imagePullPolicy: Always does not help,
           # because the tag itself resolves stale. Update this when the image
           # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:afd8c3a1fc21a9f2c67af366b3bf77ca9b948f07f66a4977821e4972c8fa6ae4
+          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -95,7 +95,7 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:afd8c3a1fc21a9f2c67af366b3bf77ca9b948f07f66a4977821e4972c8fa6ae4
+          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
           resources:
             requests:
               cpu: "50m"

kubernetes/infrastructure/image-automation/gitea-mcp.yaml

@@ -4,7 +4,7 @@ metadata:
   name: gitea-mcp
   namespace: flux-system
 spec:
-  image: docker.gitea.com/gitea-mcp-server
+  image: docker.gitea.com/gitea-mcp-server@sha256:ccdb5660ecdf54c5e480f10cc8120ba2bf150b582cea8a1974de2e59883582d3
   interval: 1h
 ---
 apiVersion: image.toolkit.fluxcd.io/v1

kubernetes/infrastructure/network-policies/paperless-ns.yaml

@@ -288,7 +288,8 @@ spec:
             - port: "80"
               protocol: TCP
 ---
-# syncthing: relays/discovery (443), STUN (3478), peer sync (22000), local discovery (21027).
+# syncthing: relays/discovery (443), STUN (3478, 3479 for the NAT-type
+# change request), peer sync (22000), local discovery (21027).
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -306,6 +307,7 @@ spec:
             - port: "443"
               protocol: TCP
             - port: "3478"
+              endPort: 3479
               protocol: UDP
             - port: "22000"
               protocol: TCP

kubernetes/infrastructure/openbao/rotation/home-assistant.yaml

@@ -71,7 +71,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false
@@ -133,7 +133,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false
@@ -195,7 +195,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false

kubernetes/restore-test/egress-check.yaml

@@ -11,7 +11,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: check
-      image: docker.io/nicolaka/netshoot:v0.13@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
+      image: docker.io/nicolaka/netshoot:v0.16@sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70
       command:
         - /bin/bash
         - -c

kubernetes/talos/patches/site-homelab.yaml

@@ -20,8 +20,9 @@ machine:
         - 10.2.46.0/24
         - fd02:46::/64
   # The UDM on the ingress segment. Published here rather than as a route
-  # because bird owns table 47 and originates the default from it; this is the
-  # one place the address is stated.
+  # because bird owns table 47 and originates the default from it. Bird reads
+  # it from here; k8s-gateway-site below names it again as the pods' resolver,
+  # because a Talos inline manifest cannot read a node annotation.
   nodeAnnotations:
     net.renner.uno/egress-gw-v6: fd02:47::1
     net.renner.uno/egress-gw-v4: 10.2.47.1
@@ -63,7 +64,10 @@ cluster:
               directRoutingDevice: pod0
             ipv4NativeRoutingCIDR: 10.0.0.0/8
             ipv6NativeRoutingCIDR: fd00::/8
-    # The site's upstream for k8s-gateway (its pod resolv.conf): the UDM.
+    # The site's upstream for k8s-gateway (its pod resolv.conf): the UDM on
+    # the segment pod traffic leaves on, ingress0 (net.renner.uno/egress-gw-*
+    # above). The UDM's DNS answers out of the interface a query arrived on,
+    # so its address on another segment gets no reply to a pod source.
     - name: k8s-gateway-site
       contents: |
         apiVersion: v1
@@ -79,8 +83,8 @@ cluster:
               dnsPolicy: None
               dnsConfig:
                 nameservers:
-                  - 10.2.40.1
-                  - fd00::1
+                  - fd02:47::1
+                  - 10.2.47.1
 ---
 # All pod traffic goes to table 47, and the table decides — longest prefix
 # match, no exceptions to carve out. bird fills it with the node's attached

review-bot/Containerfile

@@ -2,7 +2,7 @@
 #
 # Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
 # (the binary has no shell and no package manager to patch or to exec).
-FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS build
+FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build
 
 WORKDIR /build
 COPY go.mod go.sum ./

secret-rotator/Containerfile

@@ -8,7 +8,7 @@
 # lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
 # OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
 # binary can take over the external-API rotators — Cloudflare, Proxmox.)
-FROM rust:1.99-alpine@sha256:0cce0a5e0e8ba67b455257a3a02a1d99005f382748789d6464460028810f1627 AS build
+FROM rust:1.99-alpine@sha256:b1d5dd5a22a09404d3e798c0cf051b689077360374eb505fa5bb93c479693d87 AS build
 
 # musl-dev provides the C runtime bits the linker needs for a fully static
 # binary; nothing from it ends up in the final image.