feat: merge

clusters/cl01tl/manifests/actual/Deployment-actual.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: actual
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: actual
-    helm.sh/chart: actual-4.6.2
+    helm.sh/chart: actual-5.0.0
   namespace: actual
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: actual
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: actual
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/actual/HTTPRoute-actual.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: actual
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: actual
-    helm.sh/chart: actual-4.6.2
+    helm.sh/chart: actual-5.0.0
   namespace: actual
 spec:
   parentRefs:

clusters/cl01tl/manifests/actual/PersistentVolumeClaim-actual-data.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: actual
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: actual
-    helm.sh/chart: actual-4.6.2
+    helm.sh/chart: actual-5.0.0
   namespace: actual
 spec:
   accessModes:

clusters/cl01tl/manifests/actual/Service-actual.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: actual
     app.kubernetes.io/service: actual
-    helm.sh/chart: actual-4.6.2
+    helm.sh/chart: actual-5.0.0
   namespace: actual
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/actual/ServiceAccount-actual.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: actual
+  labels:
+    app.kubernetes.io/instance: actual
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: actual
+    helm.sh/chart: actual-5.0.0
+  namespace: actual

clusters/cl01tl/manifests/audiobookshelf/Deployment-audiobookshelf.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: audiobookshelf
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
+    helm.sh/chart: audiobookshelf-5.0.0
   namespace: audiobookshelf
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: audiobookshelf
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: audiobookshelf
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/manifests/audiobookshelf/HTTPRoute-audiobookshelf.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: audiobookshelf
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
+    helm.sh/chart: audiobookshelf-5.0.0
   namespace: audiobookshelf
 spec:
   parentRefs:

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-config.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: audiobookshelf
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
+    helm.sh/chart: audiobookshelf-5.0.0
   namespace: audiobookshelf
 spec:
   accessModes:

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-metadata.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: audiobookshelf
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
+    helm.sh/chart: audiobookshelf-5.0.0
   namespace: audiobookshelf
 spec:
   accessModes:

clusters/cl01tl/manifests/audiobookshelf/Service-audiobookshelf.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: audiobookshelf
     app.kubernetes.io/service: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
+    helm.sh/chart: audiobookshelf-5.0.0
   namespace: audiobookshelf
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/audiobookshelf/ServiceAccount-audiobookshelf.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: audiobookshelf
+  labels:
+    app.kubernetes.io/instance: audiobookshelf
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: audiobookshelf
+    helm.sh/chart: audiobookshelf-5.0.0
+  namespace: audiobookshelf

clusters/cl01tl/manifests/audiobookshelf/ServiceMonitor-audiobookshelf.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: audiobookshelf
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
+    helm.sh/chart: audiobookshelf-5.0.0
   namespace: audiobookshelf
 spec:
-  jobLabel: audiobookshelf
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - audiobookshelf

clusters/cl01tl/manifests/backrest/Deployment-backrest.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
+    helm.sh/chart: backrest-5.0.0
   namespace: backrest
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: backrest
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: backrest
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/backrest/HTTPRoute-backrest.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
+    helm.sh/chart: backrest-5.0.0
   namespace: backrest
 spec:
   parentRefs:

clusters/cl01tl/manifests/backrest/PersistentVolumeClaim-backrest-config.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
+    helm.sh/chart: backrest-5.0.0
   namespace: backrest
 spec:
   accessModes:

clusters/cl01tl/manifests/backrest/PersistentVolumeClaim-backrest-data.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
+    helm.sh/chart: backrest-5.0.0
   namespace: backrest
 spec:
   accessModes:

clusters/cl01tl/manifests/backrest/Service-backrest.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest
     app.kubernetes.io/service: backrest
-    helm.sh/chart: backrest-4.6.2
+    helm.sh/chart: backrest-5.0.0
   namespace: backrest
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/backrest/ServiceAccount-backrest.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backrest
+  labels:
+    app.kubernetes.io/instance: backrest
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: backrest
+    helm.sh/chart: backrest-5.0.0
+  namespace: backrest

clusters/cl01tl/manifests/backrest/ServiceMonitor-backrest.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
+    helm.sh/chart: backrest-5.0.0
   namespace: backrest
 spec:
-  jobLabel: backrest
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - backrest

clusters/cl01tl/manifests/bazarr/Deployment-bazarr.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr
-    helm.sh/chart: bazarr-4.6.2
+    helm.sh/chart: bazarr-5.0.0
   namespace: bazarr
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: bazarr
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: bazarr
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/manifests/bazarr/HTTPRoute-bazarr.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr
-    helm.sh/chart: bazarr-4.6.2
+    helm.sh/chart: bazarr-5.0.0
   namespace: bazarr
 spec:
   parentRefs:

clusters/cl01tl/manifests/bazarr/PersistentVolumeClaim-bazarr-config.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr
-    helm.sh/chart: bazarr-4.6.2
+    helm.sh/chart: bazarr-5.0.0
   namespace: bazarr
 spec:
   accessModes:

clusters/cl01tl/manifests/bazarr/Service-bazarr.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr
     app.kubernetes.io/service: bazarr
-    helm.sh/chart: bazarr-4.6.2
+    helm.sh/chart: bazarr-5.0.0
   namespace: bazarr
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/bazarr/ServiceAccount-bazarr.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bazarr
+  labels:
+    app.kubernetes.io/instance: bazarr
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: bazarr
+    helm.sh/chart: bazarr-5.0.0
+  namespace: bazarr

clusters/cl01tl/manifests/bazarr/ServiceMonitor-bazarr.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr
-    helm.sh/chart: bazarr-4.6.2
+    helm.sh/chart: bazarr-5.0.0
   namespace: bazarr
 spec:
-  jobLabel: bazarr
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - bazarr

clusters/cl01tl/manifests/blocky/ConfigMap-blocky.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: blocky
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: blocky
-    helm.sh/chart: blocky-4.6.2
+    helm.sh/chart: blocky-5.0.0
   namespace: blocky
 data:
   config.yml: |

clusters/cl01tl/manifests/blocky/Deployment-blocky.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: blocky
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: blocky
-    helm.sh/chart: blocky-4.6.2
+    helm.sh/chart: blocky-5.0.0
   namespace: blocky
 spec:
   revisionHistoryLimit: 3
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/name: blocky
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: blocky
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/blocky/Service-blocky-dns-external.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: blocky
     app.kubernetes.io/service: blocky-dns-external
-    helm.sh/chart: blocky-4.6.2
+    helm.sh/chart: blocky-5.0.0
   annotations:
     tailscale.com/expose: "true"
   namespace: blocky

clusters/cl01tl/manifests/blocky/Service-blocky-metrics.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: blocky
     app.kubernetes.io/service: blocky-metrics
-    helm.sh/chart: blocky-4.6.2
+    helm.sh/chart: blocky-5.0.0
   namespace: blocky
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/blocky/ServiceAccount-blocky.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: blocky
+  labels:
+    app.kubernetes.io/instance: blocky
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: blocky
+    helm.sh/chart: blocky-5.0.0
+  namespace: blocky

clusters/cl01tl/manifests/blocky/ServiceMonitor-blocky.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: blocky
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: blocky
-    helm.sh/chart: blocky-4.6.2
+    helm.sh/chart: blocky-5.0.0
   namespace: blocky
 spec:
-  jobLabel: blocky
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - blocky

clusters/cl01tl/manifests/cloudnative-pg/CronJob-cloudnative-pg-postgres-backups-external-rclone.yaml

@@ -11,11 +11,11 @@ metadata:
     helm.sh/chart: rclone-postgres-backups-external-0.7.0
   namespace: cloudnative-pg
 spec:
-  suspend: true
+  suspend: false
   concurrencyPolicy: Forbid
   startingDeadlineSeconds: 30
   timeZone: America/Chicago
-  schedule: "0 6 * * 6"
+  schedule: "0 6 * * 1"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
   jobTemplate:
@@ -40,7 +40,7 @@ spec:
           containers:
             - args:
                 - delete
-                - dest:postgres-backups-ecc1010276b61716
+                - dest:postgres-backups-775957147abfbc73
                 - --min-age
                 - 45d
                 - --verbose
@@ -48,29 +48,29 @@ spec:
                 - name: RCLONE_CONFIG_DEST_TYPE
                   value: s3
                 - name: RCLONE_CONFIG_DEST_PROVIDER
-                  value: DigitalOcean
+                  value: Other
                 - name: RCLONE_CONFIG_DEST_ENV_AUTH
                   value: "false"
                 - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_KEY_ID
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_SECRET_KEY
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_REGION
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_REGION
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_ENDPOINT
                   valueFrom:
                     secretKeyRef:
                       key: DEST_ENDPOINT
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_FORCE_PATH_STYLE
                   value: "true"
               image: rclone/rclone:1.74.0@sha256:d2e0e88359d0b2e67cfcd2c43d5405185eb8adfc207079df27c42da82c5207bc
@@ -78,8 +78,8 @@ spec:
               name: prune
             - args:
                 - sync
-                - src:openbao-backups
+                - src:postgres-backups
-                - dest:postgres-backups-ecc1010276b61716
+                - dest:postgres-backups-775957147abfbc73
                 - --s3-no-check-bucket
                 - --max-age
                 - 45d
@@ -101,50 +101,50 @@ spec:
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_KEY_ID
-                      name: openbao-backups-rclone-source-config
+                      name: postgres-backups-rclone-source-config
                 - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_SECRET_KEY
-                      name: openbao-backups-rclone-source-config
+                      name: postgres-backups-rclone-source-config
                 - name: RCLONE_CONFIG_SRC_REGION
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_REGION
-                      name: openbao-backups-rclone-source-config
+                      name: postgres-backups-rclone-source-config
                 - name: RCLONE_CONFIG_SRC_ENDPOINT
                   valueFrom:
                     secretKeyRef:
                       key: SRC_ENDPOINT
-                      name: openbao-backups-rclone-source-config
+                      name: postgres-backups-rclone-source-config
                 - name: RCLONE_CONFIG_SRC_FORCE_PATH_STYLE
                   value: "true"
                 - name: RCLONE_CONFIG_DEST_TYPE
                   value: s3
                 - name: RCLONE_CONFIG_DEST_PROVIDER
-                  value: DigitalOcean
+                  value: Other
                 - name: RCLONE_CONFIG_DEST_ENV_AUTH
                   value: "false"
                 - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_KEY_ID
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_SECRET_KEY
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_REGION
                   valueFrom:
                     secretKeyRef:
                       key: ACCESS_REGION
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_ENDPOINT
                   valueFrom:
                     secretKeyRef:
                       key: DEST_ENDPOINT
-                      name: postgres-backups-ecc1010276b61716-rclone-destination-config
+                      name: postgres-backups-775957147abfbc73-rclone-destination-config
                 - name: RCLONE_CONFIG_DEST_FORCE_PATH_STYLE
                   value: "true"
               image: rclone/rclone:1.74.0@sha256:d2e0e88359d0b2e67cfcd2c43d5405185eb8adfc207079df27c42da82c5207bc

clusters/cl01tl/manifests/cloudnative-pg/CronJob-cloudnative-pg-postgres-backups-remote-rclone.yaml

@@ -15,7 +15,7 @@ spec:
   concurrencyPolicy: Forbid
   startingDeadlineSeconds: 30
   timeZone: America/Chicago
-  schedule: "0 6 * * 6"
+  schedule: "30 6 * * 1"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
   jobTemplate:

clusters/cl01tl/manifests/cloudnative-pg/ExternalSecret-openbao-backups-rclone-source-config.yaml

@@ -1,33 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: openbao-backups-rclone-source-config
-  namespace: cloudnative-pg
-  labels:
-    helm.sh/chart: rclone-postgres-backups-external-0.7.0
-    app.kubernetes.io/instance: cloudnative-pg
-    app.kubernetes.io/part-of: cloudnative-pg
-    app.kubernetes.io/version: "0.7.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openbao-backups-rclone-source-config
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /garage/home-infra/postgres-backups
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /garage/home-infra/postgres-backups
-        property: ACCESS_SECRET_KEY
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        key: /garage/home-infra/postgres-backups
-        property: ACCESS_REGION
-    - secretKey: SRC_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_LOCAL

clusters/cl01tl/manifests/cloudnative-pg/ExternalSecret-postgres-backups-775957147abfbc73-rclone-destination-config.yaml

@@ -1,7 +1,7 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: postgres-backups-ecc1010276b61716-rclone-destination-config
+  name: postgres-backups-775957147abfbc73-rclone-destination-config
   namespace: cloudnative-pg
   labels:
     helm.sh/chart: rclone-postgres-backups-external-0.7.0
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/part-of: cloudnative-pg
     app.kubernetes.io/version: "0.7.0"
     app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: postgres-backups-ecc1010276b61716-rclone-destination-config
+    app.kubernetes.io/name: postgres-backups-775957147abfbc73-rclone-destination-config
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -17,17 +17,17 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        key: /digital-ocean/home-infra/postgres-backups
+        key: /backblaze/home-infra/postgres-backups
         property: AWS_ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        key: /digital-ocean/home-infra/postgres-backups
+        key: /backblaze/home-infra/postgres-backups
         property: AWS_SECRET_ACCESS_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
-        key: /digital-ocean/home-infra/postgres-backups
+        key: /backblaze/home-infra/postgres-backups
         property: AWS_REGION
     - secretKey: DEST_ENDPOINT
       remoteRef:
-        key: /digital-ocean/config
+        key: /backblaze/config
         property: ENDPOINT

clusters/cl01tl/manifests/dawarich/Deployment-dawarich.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: dawarich
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: dawarich
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/dawarich/HTTPRoute-dawarich.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
   parentRefs:

clusters/cl01tl/manifests/dawarich/PersistentVolumeClaim-dawarich-public.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
   accessModes:

clusters/cl01tl/manifests/dawarich/PersistentVolumeClaim-dawarich-storage.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
   accessModes:

clusters/cl01tl/manifests/dawarich/PersistentVolumeClaim-dawarich-watched.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
   accessModes:

clusters/cl01tl/manifests/dawarich/Service-dawarich.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
     app.kubernetes.io/service: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/dawarich/ServiceAccount-dawarich.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dawarich
+  labels:
+    app.kubernetes.io/instance: dawarich
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: dawarich
+    helm.sh/chart: dawarich-5.0.0
+  namespace: dawarich

clusters/cl01tl/manifests/dawarich/ServiceMonitor-dawarich.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
-    helm.sh/chart: dawarich-4.6.2
+    helm.sh/chart: dawarich-5.0.0
   namespace: dawarich
 spec:
-  jobLabel: dawarich
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - dawarich

clusters/cl01tl/manifests/directus/CronJob-directus-directus-assets-external-rclone.yaml

@@ -0,0 +1,108 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: directus-directus-assets-external-rclone
+  labels:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: directus
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: directus-assets-external-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-directus-assets-external-0.7.0
+  namespace: directus
+spec:
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 30
+  timeZone: America/Chicago
+  schedule: "0 6 * * 2"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      parallelism: 1
+      backoffLimit: 3
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/controller: main
+            app.kubernetes.io/instance: directus
+            app.kubernetes.io/name: directus-assets-external-rclone
+        spec:
+          enableServiceLinks: false
+          serviceAccountName: directus
+          automountServiceAccountToken: true
+          hostIPC: false
+          hostNetwork: false
+          hostPID: false
+          dnsPolicy: ClusterFirst
+          restartPolicy: Never
+          containers:
+            - args:
+                - sync
+                - src:directus-assets
+                - dest:directus-assets-37363a16b71dc59b
+                - --s3-no-check-bucket
+                - --verbose
+              env:
+                - name: RCLONE_S3_PROVIDER
+                  value: Other
+                - name: RCLONE_CONFIG_SRC_TYPE
+                  value: s3
+                - name: RCLONE_CONFIG_SRC_PROVIDER
+                  value: Other
+                - name: RCLONE_CONFIG_SRC_ENV_AUTH
+                  value: "false"
+                - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
+                  valueFrom:
+                    secretKeyRef:
+                      key: ACCESS_KEY_ID
+                      name: directus-assets-rclone-source-config
+                - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      key: ACCESS_SECRET_KEY
+                      name: directus-assets-rclone-source-config
+                - name: RCLONE_CONFIG_SRC_REGION
+                  valueFrom:
+                    secretKeyRef:
+                      key: ACCESS_REGION
+                      name: directus-assets-rclone-source-config
+                - name: RCLONE_CONFIG_SRC_ENDPOINT
+                  valueFrom:
+                    secretKeyRef:
+                      key: SRC_ENDPOINT
+                      name: directus-assets-rclone-source-config
+                - name: RCLONE_CONFIG_SRC_FORCE_PATH_STYLE
+                  value: "true"
+                - name: RCLONE_CONFIG_DEST_TYPE
+                  value: s3
+                - name: RCLONE_CONFIG_DEST_PROVIDER
+                  value: Other
+                - name: RCLONE_CONFIG_DEST_ENV_AUTH
+                  value: "false"
+                - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
+                  valueFrom:
+                    secretKeyRef:
+                      key: ACCESS_KEY_ID
+                      name: directus-assets-37363a16b71dc59b-rclone-destination-config
+                - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      key: ACCESS_SECRET_KEY
+                      name: directus-assets-37363a16b71dc59b-rclone-destination-config
+                - name: RCLONE_CONFIG_DEST_REGION
+                  valueFrom:
+                    secretKeyRef:
+                      key: ACCESS_REGION
+                      name: directus-assets-37363a16b71dc59b-rclone-destination-config
+                - name: RCLONE_CONFIG_DEST_ENDPOINT
+                  valueFrom:
+                    secretKeyRef:
+                      key: DEST_ENDPOINT
+                      name: directus-assets-37363a16b71dc59b-rclone-destination-config
+                - name: RCLONE_CONFIG_DEST_FORCE_PATH_STYLE
+                  value: "true"
+              image: rclone/rclone:1.74.0@sha256:d2e0e88359d0b2e67cfcd2c43d5405185eb8adfc207079df27c42da82c5207bc
+              imagePullPolicy: IfNotPresent
+              name: sync

clusters/cl01tl/manifests/directus/CronJob-directus-directus-assets-remote-rclone.yaml

@@ -1,12 +1,12 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: directus-directus-assets-rclone
+  name: directus-directus-assets-remote-rclone
   labels:
     app.kubernetes.io/controller: main
     app.kubernetes.io/instance: directus
     app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: directus-assets-rclone
+    app.kubernetes.io/name: directus-assets-remote-rclone
     app.kubernetes.io/version: v1.74.0
     helm.sh/chart: rclone-directus-assets-remote-0.7.0
   namespace: directus
@@ -15,7 +15,7 @@ spec:
   concurrencyPolicy: Forbid
   startingDeadlineSeconds: 30
   timeZone: America/Chicago
-  schedule: "0 0 * * *"
+  schedule: "30 6 * * 2"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
   jobTemplate:
@@ -27,10 +27,10 @@ spec:
           labels:
             app.kubernetes.io/controller: main
             app.kubernetes.io/instance: directus
-            app.kubernetes.io/name: directus-assets-rclone
+            app.kubernetes.io/name: directus-assets-remote-rclone
         spec:
           enableServiceLinks: false
-          serviceAccountName: default
+          serviceAccountName: directus
           automountServiceAccountToken: true
           hostIPC: false
           hostNetwork: false

clusters/cl01tl/manifests/directus/Deployment-directus.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: directus
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: directus
-    helm.sh/chart: directus-4.6.2
+    helm.sh/chart: directus-5.0.0
   namespace: directus
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: directus
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: directus
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/directus/ExternalSecret-directus-assets-37363a16b71dc59b-rclone-destination-config.yaml

@@ -0,0 +1,33 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: directus-assets-37363a16b71dc59b-rclone-destination-config
+  namespace: directus
+  labels:
+    helm.sh/chart: rclone-directus-assets-external-0.7.0
+    app.kubernetes.io/instance: directus
+    app.kubernetes.io/part-of: directus
+    app.kubernetes.io/version: "0.7.0"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: directus-assets-37363a16b71dc59b-rclone-destination-config
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        key: /backblaze/home-infra/directus-assets
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        key: /backblaze/home-infra/directus-assets
+        property: ACCESS_SECRET_KEY
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        key: /backblaze/home-infra/directus-assets
+        property: ACCESS_REGION
+    - secretKey: DEST_ENDPOINT
+      remoteRef:
+        key: /backblaze/config
+        property: ENDPOINT

clusters/cl01tl/manifests/directus/HTTPRoute-directus.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: directus
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: directus
-    helm.sh/chart: directus-4.6.2
+    helm.sh/chart: directus-5.0.0
   namespace: directus
 spec:
   parentRefs:

clusters/cl01tl/manifests/directus/Service-directus.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: directus
     app.kubernetes.io/service: directus
-    helm.sh/chart: directus-4.6.2
+    helm.sh/chart: directus-5.0.0
   namespace: directus
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/directus/ServiceAccount-directus-directus-assets-external-rclone.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: directus-directus-assets-external-rclone
+  labels:
+    app.kubernetes.io/instance: directus
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: directus-assets-external-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-directus-assets-external-0.7.0
+  namespace: directus

clusters/cl01tl/manifests/directus/ServiceAccount-directus-directus-assets-remote-rclone.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: directus-directus-assets-remote-rclone
+  labels:
+    app.kubernetes.io/instance: directus
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: directus-assets-remote-rclone
+    app.kubernetes.io/version: v1.74.0
+    helm.sh/chart: rclone-directus-assets-remote-0.7.0
+  namespace: directus

clusters/cl01tl/manifests/directus/ServiceAccount-directus.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: directus
+  labels:
+    app.kubernetes.io/instance: directus
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: directus
+    helm.sh/chart: directus-5.0.0
+  namespace: directus

clusters/cl01tl/manifests/directus/ServiceMonitor-directus.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: directus
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: directus
-    helm.sh/chart: directus-4.6.2
+    helm.sh/chart: directus-5.0.0
   namespace: directus
 spec:
-  jobLabel: directus
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - directus

clusters/cl01tl/manifests/eraser/ConfigMap-eraser-config.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: eraser
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: eraser-metrics
-    helm.sh/chart: eraser-metrics-4.6.2
+    helm.sh/chart: eraser-metrics-5.0.0
   namespace: eraser
 data:
   otel-collector-config.yaml: |

clusters/cl01tl/manifests/eraser/Deployment-eraser-metrics.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: eraser
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: eraser-metrics
-    helm.sh/chart: eraser-metrics-4.6.2
+    helm.sh/chart: eraser-metrics-5.0.0
   namespace: eraser
 spec:
   revisionHistoryLimit: 3
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/name: eraser-metrics
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: eraser
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/eraser/Service-eraser-metrics.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: eraser-metrics
     app.kubernetes.io/service: eraser-metrics
-    helm.sh/chart: eraser-metrics-4.6.2
+    helm.sh/chart: eraser-metrics-5.0.0
   namespace: eraser
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/eraser/ServiceAccount-eraser-metrics.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eraser-metrics
+  labels:
+    app.kubernetes.io/instance: eraser
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: eraser-metrics
+    helm.sh/chart: eraser-metrics-5.0.0
+  namespace: eraser

clusters/cl01tl/manifests/eraser/ServiceMonitor-eraser-metrics.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: eraser
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: eraser-metrics
-    helm.sh/chart: eraser-metrics-4.6.2
+    helm.sh/chart: eraser-metrics-5.0.0
   namespace: eraser
 spec:
-  jobLabel: eraser-metrics
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - eraser

clusters/cl01tl/manifests/excalidraw/Deployment-excalidraw.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: excalidraw
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: excalidraw
-    helm.sh/chart: excalidraw-4.6.2
+    helm.sh/chart: excalidraw-5.0.0
   namespace: excalidraw
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: excalidraw
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: excalidraw
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/excalidraw/HTTPRoute-excalidraw.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: excalidraw
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: excalidraw
-    helm.sh/chart: excalidraw-4.6.2
+    helm.sh/chart: excalidraw-5.0.0
   namespace: excalidraw
 spec:
   parentRefs:

clusters/cl01tl/manifests/excalidraw/Service-excalidraw.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: excalidraw
     app.kubernetes.io/service: excalidraw
-    helm.sh/chart: excalidraw-4.6.2
+    helm.sh/chart: excalidraw-5.0.0
   namespace: excalidraw
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/excalidraw/ServiceAccount-excalidraw.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: excalidraw
+  labels:
+    app.kubernetes.io/instance: excalidraw
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: excalidraw
+    helm.sh/chart: excalidraw-5.0.0
+  namespace: excalidraw

clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram
-    helm.sh/chart: foldergram-4.6.2
+    helm.sh/chart: foldergram-5.0.0
   namespace: foldergram
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
     spec:
       enableServiceLinks: false
       serviceAccountName: default
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/manifests/foldergram/HTTPRoute-foldergram.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram
-    helm.sh/chart: foldergram-4.6.2
+    helm.sh/chart: foldergram-5.0.0
   namespace: foldergram
 spec:
   parentRefs:

clusters/cl01tl/manifests/foldergram/PersistentVolumeClaim-foldergram-data.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram
-    helm.sh/chart: foldergram-4.6.2
+    helm.sh/chart: foldergram-5.0.0
   namespace: foldergram
 spec:
   accessModes:

clusters/cl01tl/manifests/foldergram/PersistentVolumeClaim-foldergram-db.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram
-    helm.sh/chart: foldergram-4.6.2
+    helm.sh/chart: foldergram-5.0.0
   namespace: foldergram
 spec:
   accessModes:

clusters/cl01tl/manifests/foldergram/Service-foldergram.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram
     app.kubernetes.io/service: foldergram
-    helm.sh/chart: foldergram-4.6.2
+    helm.sh/chart: foldergram-5.0.0
   namespace: foldergram
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss
-    helm.sh/chart: freshrss-4.6.2
+    helm.sh/chart: freshrss-5.0.0
   namespace: freshrss
 spec:
   revisionHistoryLimit: 3
@@ -28,7 +28,7 @@ spec:
     spec:
       enableServiceLinks: false
       serviceAccountName: default
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/freshrss/PersistentVolumeClaim-freshrss-data.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss
-    helm.sh/chart: freshrss-4.6.2
+    helm.sh/chart: freshrss-5.0.0
   namespace: freshrss
 spec:
   accessModes:

clusters/cl01tl/manifests/freshrss/Service-freshrss.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss
     app.kubernetes.io/service: freshrss
-    helm.sh/chart: freshrss-4.6.2
+    helm.sh/chart: freshrss-5.0.0
   namespace: freshrss
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/garage/ConfigMap-garage.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 data:
   garage-1.toml: |

clusters/cl01tl/manifests/garage/Deployment-garage-server-1.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   revisionHistoryLimit: 3
@@ -30,8 +30,8 @@ spec:
         garage-type: server
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: garage
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/garage/Deployment-garage-server-2.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   revisionHistoryLimit: 3
@@ -30,8 +30,8 @@ spec:
         garage-type: server
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: garage
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/garage/Deployment-garage-server-3.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   revisionHistoryLimit: 3
@@ -30,8 +30,8 @@ spec:
         garage-type: server
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: garage
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/garage/Deployment-garage-webui.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   revisionHistoryLimit: 3
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/name: garage
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: garage
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/garage/HTTPRoute-garage-s3.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   parentRefs:

clusters/cl01tl/manifests/garage/HTTPRoute-garage-webui.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   parentRefs:

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-data-2.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   annotations:
     helm.sh/resource-policy: keep
   namespace: garage

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-data-3.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   annotations:
     helm.sh/resource-policy: keep
   namespace: garage

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-data.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   accessModes:

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-db-1.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   accessModes:

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-db-2.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   accessModes:

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-db-3.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   accessModes:

clusters/cl01tl/manifests/garage/PersistentVolumeClaim-garage-snapshots.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   annotations:
     helm.sh/resource-policy: keep
   namespace: garage

clusters/cl01tl/manifests/garage/Service-garage-1.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
     app.kubernetes.io/service: garage-1
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/garage/Service-garage-2.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
     app.kubernetes.io/service: garage-2
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/garage/Service-garage-3.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
     app.kubernetes.io/service: garage-3
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/garage/Service-garage-webui.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
     app.kubernetes.io/service: garage-webui
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/garage/ServiceAccount-garage.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: garage
+  labels:
+    app.kubernetes.io/instance: garage
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: garage
+    helm.sh/chart: garage-5.0.0
+  namespace: garage

clusters/cl01tl/manifests/garage/ServiceMonitor-garage.yaml

@@ -6,10 +6,10 @@ metadata:
     app.kubernetes.io/instance: garage
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.6.2
+    helm.sh/chart: garage-5.0.0
   namespace: garage
 spec:
-  jobLabel: garage
+  jobLabel: app.kubernetes.io/name
   namespaceSelector:
     matchNames:
       - garage

clusters/cl01tl/manifests/grimmory/Deployment-grimmory.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory
-    helm.sh/chart: grimmory-4.6.2
+    helm.sh/chart: grimmory-5.0.0
   namespace: grimmory
 spec:
   revisionHistoryLimit: 3
@@ -27,8 +27,8 @@ spec:
         app.kubernetes.io/name: grimmory
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: grimmory
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch

clusters/cl01tl/manifests/grimmory/HTTPRoute-grimmory.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory
-    helm.sh/chart: grimmory-4.6.2
+    helm.sh/chart: grimmory-5.0.0
   namespace: grimmory
 spec:
   parentRefs:

clusters/cl01tl/manifests/grimmory/PersistentVolumeClaim-grimmory-config.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory
-    helm.sh/chart: grimmory-4.6.2
+    helm.sh/chart: grimmory-5.0.0
   namespace: grimmory
 spec:
   accessModes:

clusters/cl01tl/manifests/grimmory/Service-grimmory.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory
     app.kubernetes.io/service: grimmory
-    helm.sh/chart: grimmory-4.6.2
+    helm.sh/chart: grimmory-5.0.0
   namespace: grimmory
 spec:
   type: ClusterIP

clusters/cl01tl/manifests/grimmory/ServiceAccount-grimmory.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: grimmory
+  labels:
+    app.kubernetes.io/instance: grimmory
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: grimmory
+    helm.sh/chart: grimmory-5.0.0
+  namespace: grimmory

clusters/cl01tl/manifests/headlamp/ClusterRoleBinding-headlamp-admin.yaml

@@ -3,10 +3,10 @@ kind: ClusterRoleBinding
 metadata:
   name: headlamp-admin
   labels:
-    helm.sh/chart: headlamp-0.41.0
+    helm.sh/chart: headlamp-0.42.0
     app.kubernetes.io/name: headlamp
     app.kubernetes.io/instance: headlamp
-    app.kubernetes.io/version: "0.41.0"
+    app.kubernetes.io/version: "0.42.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io

clusters/cl01tl/manifests/headlamp/ConfigMap-headlamp-plugin-config.yaml

@@ -4,10 +4,10 @@ metadata:
   name: headlamp-plugin-config
   namespace: headlamp
   labels:
-    helm.sh/chart: headlamp-0.41.0
+    helm.sh/chart: headlamp-0.42.0
     app.kubernetes.io/name: headlamp
     app.kubernetes.io/instance: headlamp
-    app.kubernetes.io/version: "0.41.0"
+    app.kubernetes.io/version: "0.42.0"
     app.kubernetes.io/managed-by: Helm
 data:
   plugin.yml: |

clusters/cl01tl/manifests/headlamp/Deployment-headlamp.yaml

@@ -4,10 +4,10 @@ metadata:
   name: headlamp
   namespace: headlamp
   labels:
-    helm.sh/chart: headlamp-0.41.0
+    helm.sh/chart: headlamp-0.42.0
     app.kubernetes.io/name: headlamp
     app.kubernetes.io/instance: headlamp
-    app.kubernetes.io/version: "0.41.0"
+    app.kubernetes.io/version: "0.42.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 2
@@ -32,7 +32,7 @@ spec:
             runAsGroup: 101
             runAsNonRoot: true
             runAsUser: 100
-          image: "ghcr.io/headlamp-k8s/headlamp:v0.41.0@sha256:89c6c65810bfde61796483c93c70d659104355593792bf55cab680d685da8eeb"
+          image: "ghcr.io/headlamp-k8s/headlamp:v0.42.0@sha256:c9754bae1d799220da0547e51ceee234f6e66ebadc138518ca73e33ecd331e59"
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:

clusters/cl01tl/manifests/headlamp/HTTPRoute-headlamp.yaml

@@ -4,10 +4,10 @@ metadata:
   name: headlamp
   namespace: headlamp
   labels:
-    helm.sh/chart: headlamp-0.41.0
+    helm.sh/chart: headlamp-0.42.0
     app.kubernetes.io/name: headlamp
     app.kubernetes.io/instance: headlamp
-    app.kubernetes.io/version: "0.41.0"
+    app.kubernetes.io/version: "0.42.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   parentRefs:

clusters/cl01tl/manifests/headlamp/Service-headlamp.yaml

@@ -4,10 +4,10 @@ metadata:
   name: headlamp
   namespace: headlamp
   labels:
-    helm.sh/chart: headlamp-0.41.0
+    helm.sh/chart: headlamp-0.42.0
     app.kubernetes.io/name: headlamp
     app.kubernetes.io/instance: headlamp
-    app.kubernetes.io/version: "0.41.0"
+    app.kubernetes.io/version: "0.42.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   type: ClusterIP