Automated Manifest Update (#5396)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

### Details
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `91c2800` (on `91c2800de2bff6f0e5132b767391c4871712e525`)
- **Charts Updated**: `houndarr,immich,intel-device-plugin`

### Update Details (2026-04-02 00:53 UTC)
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `201eac7` (on `201eac78a4966703d139718722c52a08d06a23fd`)
- **Charts Updated**: `gitea,immich,jellyfin,jellystat,karakeep`

Reviewed-on: #5396
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>

clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml

@@ -41,13 +41,8 @@ spec:
             - --remote-debugging-address=0.0.0.0
             - --remote-debugging-port=9222
             - --hide-scrollbars
-          image: gcr.io/zenika-hub/alpine-chrome:124
-          imagePullPolicy: IfNotPresent
+          image: gcr.io/zenika-hub/alpine-chrome:124@sha256:1a0046448e0bb6c275c88f86e01faf0de62b02ec8572901256ada0a8c08be23f
           name: chrome
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
         - env:
             - name: DATA_DIR
               value: /data
@@ -125,13 +120,12 @@ spec:
               value: mxbai-embed-large
             - name: INFERENCE_JOB_TIMEOUT_SEC
               value: "720"
-          image: ghcr.io/karakeep-app/karakeep:0.31.0
-          imagePullPolicy: IfNotPresent
+          image: ghcr.io/karakeep-app/karakeep:0.31.0@sha256:20754dbdafb11dfe288bbb1c2342a7855081b08ea069e86fcf2d4a2d945d3653
           name: main
           resources:
             requests:
               cpu: 10m
-              memory: 256Mi
+              memory: 500Mi
           volumeMounts:
             - mountPath: /data
               name: data

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-bucket-garage.yaml

@@ -14,22 +14,13 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: ACCESS_SECRET_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
     - secretKey: ACCESS_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
         property: ACCESS_REGION

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-key-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/karakeep/key
-        metadataPolicy: None
         property: key
     - secretKey: prometheus-token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/karakeep/key
-        metadataPolicy: None
         property: prometheus-token

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-meilisearch-master-key-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/karakeep/meilisearch
-        metadataPolicy: None
         property: MEILI_MASTER_KEY

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-oidc-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: AUTHENTIK_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/karakeep
-        metadataPolicy: None
         property: client
     - secretKey: AUTHENTIK_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/karakeep
-        metadataPolicy: None
         property: secret

clusters/cl01tl/manifests/karakeep/PersistentVolumeClaim-karakeep.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep
     helm.sh/chart: karakeep-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: karakeep
 spec:
   accessModes:

clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml

@@ -92,4 +92,4 @@ spec:
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 50Mi