Automated Manifest Update (#2740)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

Reviewed-on: #2740
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>

clusters/cl01tl/manifests/booklore/Deployment-booklore.yaml

@@ -50,7 +50,7 @@ spec:
               value: "6060"
             - name: SWAGGER_ENABLED
               value: "false"
-          image: ghcr.io/booklore-app/booklore:v1.14.1
+          image: ghcr.io/booklore-app/booklore:v1.15.0
           imagePullPolicy: IfNotPresent
           name: main
           resources:

clusters/cl01tl/manifests/external-secrets/ClusterRole-external-secrets-cert-controller.yaml

@@ -3,10 +3,10 @@ kind: ClusterRole
 metadata:
   name: external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:

clusters/cl01tl/manifests/external-secrets/ClusterRole-external-secrets-controller.yaml

@@ -3,10 +3,10 @@ kind: ClusterRole
 metadata:
   name: external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:

clusters/cl01tl/manifests/external-secrets/ClusterRole-external-secrets-edit.yaml

@@ -3,10 +3,10 @@ kind: ClusterRole
 metadata:
   name: external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"

clusters/cl01tl/manifests/external-secrets/ClusterRole-external-secrets-servicebindings.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:

clusters/cl01tl/manifests/external-secrets/ClusterRole-external-secrets-view.yaml

@@ -3,10 +3,10 @@ kind: ClusterRole
 metadata:
   name: external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"

clusters/cl01tl/manifests/external-secrets/ClusterRoleBinding-external-secrets-cert-controller.yaml

@@ -3,10 +3,10 @@ kind: ClusterRoleBinding
 metadata:
   name: external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io

clusters/cl01tl/manifests/external-secrets/ClusterRoleBinding-external-secrets-controller.yaml

@@ -3,10 +3,10 @@ kind: ClusterRoleBinding
 metadata:
   name: external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io

clusters/cl01tl/manifests/external-secrets/CustomResourceDefinition-clustersecretstores.external-secrets.io.yaml

@@ -765,8 +765,11 @@ spec:
                           type: string
                         customCloudConfig:
                           description: |-
-                            CustomCloudConfig defines custom Azure Stack Hub or Azure Stack Edge endpoints.
+                            CustomCloudConfig defines custom Azure endpoints for non-standard clouds.
                             Required when EnvironmentType is AzureStackCloud.
+                            Optional for other environment types - useful for Azure China when using Workload Identity
+                            with AKS, where the OIDC issuer (login.partner.microsoftonline.cn) differs from the
+                            standard China Cloud endpoint (login.chinacloudapi.cn).
                             IMPORTANT: This feature REQUIRES UseAzureSDK to be set to true. Custom cloud
                             configuration is not supported with the legacy go-autorest SDK.
                           properties:
@@ -850,6 +853,97 @@ spec:
                       required:
                         - vaultUrl
                       type: object
+                    barbican:
+                      description: Barbican configures this store to sync secrets using the OpenStack Barbican provider
+                      properties:
+                        auth:
+                          description: BarbicanAuth contains the authentication information for Barbican.
+                          properties:
+                            password:
+                              description: BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
+                              properties:
+                                secretRef:
+                                  description: |-
+                                    SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+                                    In some instances, `key` is a required field.
+                                  properties:
+                                    key:
+                                      description: |-
+                                        A key in the referenced Secret.
+                                        Some instances of this field may be defaulted, in others it may be required.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[-._a-zA-Z0-9]+$
+                                      type: string
+                                    name:
+                                      description: The name of the Secret resource being referred to.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        The namespace of the Secret resource being referred to.
+                                        Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  type: object
+                              required:
+                                - secretRef
+                              type: object
+                            username:
+                              description: BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+                              maxProperties: 1
+                              minProperties: 1
+                              properties:
+                                secretRef:
+                                  description: |-
+                                    SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+                                    In some instances, `key` is a required field.
+                                  properties:
+                                    key:
+                                      description: |-
+                                        A key in the referenced Secret.
+                                        Some instances of this field may be defaulted, in others it may be required.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[-._a-zA-Z0-9]+$
+                                      type: string
+                                    name:
+                                      description: The name of the Secret resource being referred to.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        The namespace of the Secret resource being referred to.
+                                        Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  type: object
+                                value:
+                                  type: string
+                              type: object
+                          required:
+                            - password
+                            - username
+                          type: object
+                        authURL:
+                          type: string
+                        domainName:
+                          type: string
+                        region:
+                          type: string
+                        tenantName:
+                          type: string
+                      required:
+                        - auth
+                      type: object
                     beyondtrust:
                       description: Beyondtrust configures this store to sync secrets using Password Safe provider.
                       properties:
@@ -1607,8 +1701,53 @@ spec:
                         auth:
                           description: Auth configures how the Operator authenticates with the Doppler API
                           properties:
+                            oidcConfig:
+                              description: OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.
+                              properties:
+                                expirationSeconds:
+                                  default: 600
+                                  description: |-
+                                    ExpirationSeconds sets the ServiceAccount token validity duration.
+                                    Defaults to 10 minutes.
+                                  format: int64
+                                  type: integer
+                                identity:
+                                  description: Identity is the Doppler Service Account Identity ID configured for OIDC authentication.
+                                  type: string
+                                serviceAccountRef:
+                                  description: ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.
+                                  properties:
+                                    audiences:
+                                      description: |-
+                                        Audience specifies the `aud` claim for the service account token
+                                        If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+                                        then this audiences will be appended to the list
+                                      items:
+                                        type: string
+                                      type: array
+                                    name:
+                                      description: The name of the ServiceAccount resource being referred to.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace of the resource being referred to.
+                                        Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                              required:
+                                - identity
+                                - serviceAccountRef
+                              type: object
                             secretRef:
-                              description: DopplerAuthSecretRef contains the secret reference for accessing the Doppler API.
+                              description: SecretRef authenticates using a Doppler service token stored in a Kubernetes Secret.
                               properties:
                                 dopplerToken:
                                   description: |-
@@ -1642,9 +1781,10 @@ spec:
                               required:
                                 - dopplerToken
                               type: object
-                          required:
-                            - secretRef
                           type: object
+                          x-kubernetes-validations:
+                            - message: Exactly one of 'secretRef' or 'oidcConfig' must be specified
+                              rule: (has(self.secretRef) && !has(self.oidcConfig)) || (!has(self.secretRef) && has(self.oidcConfig))
                         config:
                           description: Doppler config (required if not using a Service Token)
                           type: string

clusters/cl01tl/manifests/external-secrets/CustomResourceDefinition-secretstores.external-secrets.io.yaml

@@ -765,8 +765,11 @@ spec:
                           type: string
                         customCloudConfig:
                           description: |-
-                            CustomCloudConfig defines custom Azure Stack Hub or Azure Stack Edge endpoints.
+                            CustomCloudConfig defines custom Azure endpoints for non-standard clouds.
                             Required when EnvironmentType is AzureStackCloud.
+                            Optional for other environment types - useful for Azure China when using Workload Identity
+                            with AKS, where the OIDC issuer (login.partner.microsoftonline.cn) differs from the
+                            standard China Cloud endpoint (login.chinacloudapi.cn).
                             IMPORTANT: This feature REQUIRES UseAzureSDK to be set to true. Custom cloud
                             configuration is not supported with the legacy go-autorest SDK.
                           properties:
@@ -850,6 +853,97 @@ spec:
                       required:
                         - vaultUrl
                       type: object
+                    barbican:
+                      description: Barbican configures this store to sync secrets using the OpenStack Barbican provider
+                      properties:
+                        auth:
+                          description: BarbicanAuth contains the authentication information for Barbican.
+                          properties:
+                            password:
+                              description: BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
+                              properties:
+                                secretRef:
+                                  description: |-
+                                    SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+                                    In some instances, `key` is a required field.
+                                  properties:
+                                    key:
+                                      description: |-
+                                        A key in the referenced Secret.
+                                        Some instances of this field may be defaulted, in others it may be required.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[-._a-zA-Z0-9]+$
+                                      type: string
+                                    name:
+                                      description: The name of the Secret resource being referred to.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        The namespace of the Secret resource being referred to.
+                                        Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  type: object
+                              required:
+                                - secretRef
+                              type: object
+                            username:
+                              description: BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+                              maxProperties: 1
+                              minProperties: 1
+                              properties:
+                                secretRef:
+                                  description: |-
+                                    SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+                                    In some instances, `key` is a required field.
+                                  properties:
+                                    key:
+                                      description: |-
+                                        A key in the referenced Secret.
+                                        Some instances of this field may be defaulted, in others it may be required.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[-._a-zA-Z0-9]+$
+                                      type: string
+                                    name:
+                                      description: The name of the Secret resource being referred to.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        The namespace of the Secret resource being referred to.
+                                        Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  type: object
+                                value:
+                                  type: string
+                              type: object
+                          required:
+                            - password
+                            - username
+                          type: object
+                        authURL:
+                          type: string
+                        domainName:
+                          type: string
+                        region:
+                          type: string
+                        tenantName:
+                          type: string
+                      required:
+                        - auth
+                      type: object
                     beyondtrust:
                       description: Beyondtrust configures this store to sync secrets using Password Safe provider.
                       properties:
@@ -1607,8 +1701,53 @@ spec:
                         auth:
                           description: Auth configures how the Operator authenticates with the Doppler API
                           properties:
+                            oidcConfig:
+                              description: OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.
+                              properties:
+                                expirationSeconds:
+                                  default: 600
+                                  description: |-
+                                    ExpirationSeconds sets the ServiceAccount token validity duration.
+                                    Defaults to 10 minutes.
+                                  format: int64
+                                  type: integer
+                                identity:
+                                  description: Identity is the Doppler Service Account Identity ID configured for OIDC authentication.
+                                  type: string
+                                serviceAccountRef:
+                                  description: ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.
+                                  properties:
+                                    audiences:
+                                      description: |-
+                                        Audience specifies the `aud` claim for the service account token
+                                        If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+                                        then this audiences will be appended to the list
+                                      items:
+                                        type: string
+                                      type: array
+                                    name:
+                                      description: The name of the ServiceAccount resource being referred to.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace of the resource being referred to.
+                                        Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  required:
+                                    - name
+                                  type: object
+                              required:
+                                - identity
+                                - serviceAccountRef
+                              type: object
                             secretRef:
-                              description: DopplerAuthSecretRef contains the secret reference for accessing the Doppler API.
+                              description: SecretRef authenticates using a Doppler service token stored in a Kubernetes Secret.
                               properties:
                                 dopplerToken:
                                   description: |-
@@ -1642,9 +1781,10 @@ spec:
                               required:
                                 - dopplerToken
                               type: object
-                          required:
-                            - secretRef
                           type: object
+                          x-kubernetes-validations:
+                            - message: Exactly one of 'secretRef' or 'oidcConfig' must be specified
+                              rule: (has(self.secretRef) && !has(self.oidcConfig)) || (!has(self.secretRef) && has(self.oidcConfig))
                         config:
                           description: Doppler config (required if not using a Service Token)
                           type: string

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets-cert-controller.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -19,10 +19,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-1.1.1
+        helm.sh/chart: external-secrets-1.2.0
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: external-secrets
-        app.kubernetes.io/version: "v1.1.1"
+        app.kubernetes.io/version: "v1.2.0"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -40,7 +40,7 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v1.1.1
+          image: ghcr.io/external-secrets/external-secrets:v1.2.0
           imagePullPolicy: IfNotPresent
           args:
             - certcontroller

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets-webhook.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets-webhook
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -19,10 +19,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-1.1.1
+        helm.sh/chart: external-secrets-1.2.0
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: external-secrets
-        app.kubernetes.io/version: "v1.1.1"
+        app.kubernetes.io/version: "v1.2.0"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -40,7 +40,7 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v1.1.1
+          image: ghcr.io/external-secrets/external-secrets:v1.2.0
           imagePullPolicy: IfNotPresent
           args:
             - webhook

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -19,10 +19,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-1.1.1
+        helm.sh/chart: external-secrets-1.2.0
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: external-secrets
-        app.kubernetes.io/version: "v1.1.1"
+        app.kubernetes.io/version: "v1.2.0"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets
@@ -40,7 +40,7 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v1.1.1
+          image: ghcr.io/external-secrets/external-secrets:v1.2.0
           imagePullPolicy: IfNotPresent
           args:
             - --concurrent=1

clusters/cl01tl/manifests/external-secrets/Role-external-secrets-leaderelection.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets-leaderelection
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:

clusters/cl01tl/manifests/external-secrets/RoleBinding-external-secrets-leaderelection.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets-leaderelection
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io

clusters/cl01tl/manifests/external-secrets/Secret-external-secrets-webhook.yaml

@@ -4,9 +4,9 @@ metadata:
   name: external-secrets-webhook
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook

clusters/cl01tl/manifests/external-secrets/Service-external-secrets-webhook.yaml

@@ -4,10 +4,10 @@ metadata:
   name: external-secrets-webhook
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:

clusters/cl01tl/manifests/external-secrets/ServiceAccount-external-secrets-cert-controller.yaml

@@ -4,8 +4,8 @@ metadata:
   name: external-secrets-cert-controller
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm

clusters/cl01tl/manifests/external-secrets/ServiceAccount-external-secrets-webhook.yaml

@@ -4,8 +4,8 @@ metadata:
   name: external-secrets-webhook
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm

clusters/cl01tl/manifests/external-secrets/ServiceAccount-external-secrets.yaml

@@ -4,8 +4,8 @@ metadata:
   name: external-secrets
   namespace: external-secrets
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm

clusters/cl01tl/manifests/external-secrets/ValidatingWebhookConfiguration-externalsecret-validate.yaml

@@ -3,10 +3,10 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: externalsecret-validate
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 webhooks:

clusters/cl01tl/manifests/external-secrets/ValidatingWebhookConfiguration-secretstore-validate.yaml

@@ -3,10 +3,10 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: secretstore-validate
   labels:
-    helm.sh/chart: external-secrets-1.1.1
+    helm.sh/chart: external-secrets-1.2.0
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.1.1"
+    app.kubernetes.io/version: "v1.2.0"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 webhooks:

clusters/cl01tl/manifests/immich/Deployment-immich.yaml

@@ -70,7 +70,7 @@ spec:
                 secretKeyRef:
                   key: password
                   name: immich-postgresql-18-cluster-app
-          image: ghcr.io/immich-app/immich-server:v2.3.1
+          image: ghcr.io/immich-app/immich-server:v2.4.1
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 3

clusters/cl01tl/manifests/qbittorrent/Deployment-qbittorrent-qui.yaml

@@ -59,7 +59,7 @@ spec:
               value: https://qui.alexlebens.net/api/auth/oidc/callback
             - name: QUI__OIDC_DISABLE_BUILT_IN_LOGIN
               value: "false"
-          image: ghcr.io/autobrr/qui:v1.10.0
+          image: ghcr.io/autobrr/qui:v1.11.0
           imagePullPolicy: IfNotPresent
           name: qui
           resources: