Automated Manifest Update (#5276)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

### Details
- **Trigger**: `workflow_dispatch` by `@alexlebens`
- **Commit**: `361db06` (on `main`)
- **Charts Updated**: `postiz`

### Update Details (2026-03-30 01:44 UTC)
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `4130942` (on `4130942c8720bd14bc99b776da2f28c23f3619c8`)
- **Charts Updated**: `harbor,headlamp,home-assistant`

Reviewed-on: #5276
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>

clusters/cl01tl/manifests/headlamp/Deployment-headlamp.yaml

@@ -32,7 +32,7 @@ spec:
             runAsGroup: 101
             runAsNonRoot: true
             runAsUser: 100
-          image: "ghcr.io/headlamp-k8s/headlamp:v0.41.0"
+          image: "ghcr.io/headlamp-k8s/headlamp:v0.41.0@sha256:89c6c65810bfde61796483c93c70d659104355593792bf55cab680d685da8eeb"
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
@@ -60,8 +60,8 @@ spec:
               port: http
           resources:
             requests:
-              cpu: 10m
-              memory: 128Mi
+              cpu: 1m
+              memory: 80Mi
           volumeMounts:
             - name: plugins-dir
               mountPath: /headlamp/plugins

clusters/cl01tl/manifests/headlamp/ExternalSecret-headlamp-oidc-secret.yaml

@@ -14,43 +14,25 @@ spec:
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: validator-issuer-url
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/headlamp
-        metadataPolicy: None
         property: validator-client-id

clusters/cl01tl/manifests/headlamp/HTTPRoute-headlamp.yaml

@@ -4,9 +4,11 @@ metadata:
   name: headlamp
   namespace: headlamp
   labels:
+    helm.sh/chart: headlamp-0.41.0
     app.kubernetes.io/name: headlamp
     app.kubernetes.io/instance: headlamp
-    app.kubernetes.io/part-of: headlamp
+    app.kubernetes.io/version: "0.41.0"
+    app.kubernetes.io/managed-by: Helm
 spec:
   parentRefs:
     - group: gateway.networking.k8s.io
@@ -16,13 +18,13 @@ spec:
   hostnames:
     - headlamp.alexlebens.net
   rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - group: ''
+    - backendRefs:
+        - group: ""
           kind: Service
           name: headlamp
           port: 80
           weight: 100
+      matches:
+        - path:
+            type: PathPrefix
+            value: /