chore(deps): update cilium to v1.19.3

Merge pull request 'feat: add service account' (#6190 ) from tmp/secrets-13 into main
Reviewed-on: #6190
2026-04-24 16:17:05 +00:00 · 2026-04-24 16:07:36 +00:00 · 2026-04-24 11:03:57 -05:00 · 2026-04-24 11:00:21 -05:00 · 2026-04-24 10:58:57 -05:00 · 2026-04-24 15:36:38 +00:00
18 changed files with 54 additions and 32 deletions
--- a/clusters/cl01tl/helm/cilium/Chart.lock
+++ b/clusters/cl01tl/helm/cilium/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
  repository: https://helm.cilium.io/
-  version: 1.18.6
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
-generated: "2026-02-05T12:00:20.15778-06:00"
+  version: 1.19.3
+digest: sha256:0fb32249f6ab7d68568a1e44796a8ee1ee5da2294b29a9c720153db8f055888b
+generated: "2026-04-24T16:16:54.760620013Z"
--- a/clusters/cl01tl/helm/cilium/Chart.yaml
+++ b/clusters/cl01tl/helm/cilium/Chart.yaml
@@ -14,8 +14,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cilium
-    version: 1.18.6
+    version: 1.19.3
    repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
-appVersion: 1.18.6
+appVersion: 1.19.3
--- a/clusters/cl01tl/helm/excalidraw/Chart.yaml
+++ b/clusters/cl01tl/helm/excalidraw/Chart.yaml
@@ -19,4 +19,4 @@ dependencies:
    version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/excalidraw.png
 # renovate: datasource=github-releases depName=excalidraw/excalidraw
-appVersion: v0.18.0
+appVersion: v0.18.1
--- a/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/values.yaml
@@ -30,7 +30,7 @@ kube-prometheus-stack:
              http_config:
                basic_auth:
                  username: ntfy-alertmanager
-                  password_file: /etc/alertmanager/secrets/alertmanager-config-secret/ntfy_password
+                  password_file: /etc/alertmanager/secrets/alertmanager-config-config/ntfy_password
    route:
      main:
        enabled: true
--- a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
@@ -14,7 +14,7 @@ app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}

 {{/*
-NFS names
+ServiceAccount names
 */}}
 {{- define "custom.serviceAccountName" -}}
 matrix-synapse
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -37,7 +37,7 @@ matrix-synapse:
    strategy:
      type: Recreate
    extraVolumes:
-      - name: config
+      - name: synapse-config
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
@@ -74,7 +74,7 @@ matrix-synapse:
          volumeAttributes:
            secretProviderClass: matrix-synapse-double-puppet-config
    extraVolumeMounts:
-      - name: config
+      - name: synapse-config
        mountPath: /synapse/config/conf.d/config.yaml
        mountPropagation: None
        readOnly: true
@@ -165,6 +165,8 @@ matrix-synapse:
    enabled: false
  gateway:
    enabled: false
+  serviceAccount:
+    name: matrix-synapse
 matrix-hookshot:
  global:
    nameOverride: matrix-hookshot
--- a/clusters/cl01tl/helm/openbao/Chart.yaml
+++ b/clusters/cl01tl/helm/openbao/Chart.yaml
@@ -19,7 +19,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: openbao
-    version: 0.27.1
+    version: 0.27.2
    repository: https://openbao.github.io/openbao-helm
  - name: app-template
    alias: unseal
--- a/clusters/cl01tl/helm/outline/values.yaml
+++ b/clusters/cl01tl/helm/outline/values.yaml
@@ -96,12 +96,8 @@ outline:
                secretKeyRef:
                  name: outline-oidc-authentik
                  key: secret
-            - name: OIDC_AUTH_URI
-              value: https://auth.alexlebens.dev/application/o/authorize/
-            - name: OIDC_TOKEN_URI
-              value: https://auth.alexlebens.dev/application/o/token/
-            - name: OIDC_USERINFO_URI
-              value: https://auth.alexlebens.dev/application/o/userinfo/
+            - name: OIDC_ISSUER_URL
+              value: https://auth.alexlebens.dev/application/o/outline
            - name: OIDC_USERNAME_CLAIM
              value: email
            - name: OIDC_DISPLAY_NAME
--- a/clusters/cl01tl/helm/roundcube/values.yaml
+++ b/clusters/cl01tl/helm/roundcube/values.yaml
@@ -103,7 +103,7 @@ roundcube:
            - name: ROUNDCUBEMAIL_DES_KEY
              valueFrom:
                secretKeyRef:
-                  name: roundcube-key-secret
+                  name: roundcube-key
                  key: DES_KEY
            - name: ROUNDCUBEMAIL_DEFAULT_HOST
              value: tls://stalwart.stalwart
--- a/clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/s3-exporter/templates/external-secret.yaml
@@ -13,15 +13,15 @@ spec:
  data:
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_SECRET_ACCESS_KEY
    - secretKey: AWS_REGION
      remoteRef:
-        key: /digital-ocean/home-infra/s3-exporter
+        key: /digital-ocean/home-infra/all-access
        property: AWS_REGION

 ---
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -10,7 +10,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
          env:
            - name: SEARXNG_BASE_URL
              value: http://searxng-api.searxng:8080
@@ -38,7 +38,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:37c616a774b90fb5df9239eb143f1b11866ddf7b830cd1ebcca6ba11b38cc2bf
+            tag: latest@sha256:c9100c29c14a77d5289263a671580226c3b8a396a1a0130d2f500f57076a0119
          env:
            - name: SEARXNG_BASE_URL
              value: https://searxng.alexlebens.net/
--- a/clusters/cl01tl/helm/talos/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/talos/templates/_helpers.tpl
@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+talos-backup-secrets
+{{- end -}}
--- a/clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/talos/templates/secret-provider-class.yaml
@@ -10,7 +10,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -70,7 +70,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: {{ include "custom.serviceAccountName" . }}
    objects: |
      - objectName: config
        fileName: config
--- a/clusters/cl01tl/helm/talos/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/talos/templates/service-account.yaml
@@ -1,10 +1,10 @@
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
 metadata:
-  name: talos-backup-secrets
+  name: {{ include "custom.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: talos-backup-secrets
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  roles:
--- a/clusters/cl01tl/helm/vault/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/vault/templates/_helpers.tpl
@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+ServiceAccount names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+vault
+{{- end -}}
--- a/clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/vault/templates/secret-provider-class.yaml
@@ -10,7 +10,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -30,7 +30,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
@@ -50,7 +50,7 @@ spec:
  provider: openbao
  parameters:
    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: slskd
+    roleName: vault
    objects: |
      - objectName: .s3cfg
        fileName: .s3cfg
--- a/clusters/cl01tl/helm/vault/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/vault/templates/service-account.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
--- a/clusters/cl01tl/helm/vault/values.yaml
+++ b/clusters/cl01tl/helm/vault/values.yaml
@@ -107,6 +107,8 @@ snapshot:
        schedule: 0 4 * * *
        backoffLimit: 3
        parallelism: 1
+      serviceAccount:
+        name: vault
      initContainers:
        snapshot:
          image:
Author	SHA1	Message	Date
Renovate Bot	011af417b4	chore(deps): update cilium to v1.19.3 Some checks are pending lint-test-helm / validate-kubeconform (pull_request) Blocked by required conditions Details lint-test-helm / lint-helm (pull_request) Successful in 40s Details	2026-04-24 16:17:05 +00:00
Alex Lebens	b446ff06e1	Merge pull request 'feat: add service account' (#6190 ) from tmp/secrets-13 into main Some checks are pending renovate / renovate (push) Waiting to run Details lint-test-helm / lint-helm (push) Successful in 1m34s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details Reviewed-on: #6190	2026-04-24 16:07:36 +00:00
Alex Lebens	92a5ff487d	fix: wrong name All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m18s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m7s Details render-manifests / render-manifests (pull_request) Successful in 2m43s Details	2026-04-24 11:03:57 -05:00
Alex Lebens	d4ab84ed8d	fix: wrong name All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 47s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 46s Details	2026-04-24 11:00:21 -05:00
Alex Lebens	2d1f33e96c	feat: add service account All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m56s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 53s Details	2026-04-24 10:58:57 -05:00
Alex Lebens	ee469329c7	Merge pull request 'feat: add service account' (#6187 ) from tmp/matrix-5 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 51s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 6m28s Details Reviewed-on: #6187	2026-04-24 15:36:38 +00:00
Alex Lebens	221becb66c	feat: add service account All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 59s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m4s Details render-manifests / render-manifests (pull_request) Successful in 3m9s Details	2026-04-24 10:35:35 -05:00
Alex Lebens	1ae52e9303	Merge pull request 'feat: repalce with issuer' (#6185 ) from tmp/outline into main Some checks failed lint-test-helm / lint-helm (push) Successful in 39s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Has been cancelled Details Reviewed-on: #6185	2026-04-24 15:33:03 +00:00
Alex Lebens	d2bf03e00e	feat: repalce with issuer All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 43s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m13s Details	2026-04-24 10:31:43 -05:00
Alex Lebens	8fca397ee5	Merge pull request 'feat: change name' (#6183 ) from tmp/secrets-12 into main All checks were successful lint-test-helm / lint-helm (push) Successful in 57s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 7m24s Details Reviewed-on: #6183	2026-04-24 15:21:45 +00:00
Alex Lebens	11553c54b3	feat: change key All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 44s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 2m0s Details render-manifests / render-manifests (pull_request) Successful in 2m43s Details	2026-04-24 10:16:53 -05:00
Alex Lebens	af188618f6	feat: change name All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 1m23s Details lint-test-helm / validate-kubeconform (pull_request) Successful in 1m15s Details	2026-04-24 10:14:03 -05:00
Renovate Bot	17632c9da7	Merge pull request 'chore(deps): update searxng/searxng:latest docker digest to c9100c2' (#6181 ) from renovate/unified-searxng into main All checks were successful lint-test-helm / lint-helm (push) Successful in 37s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 6m2s Details render-manifests / render-manifests (push) Successful in 14m12s Details	2026-04-24 14:03:33 +00:00
Renovate Bot	efe4d16f40	chore(deps): update searxng/searxng:latest docker digest to c9100c2 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 23s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m13s Details	2026-04-24 14:03:20 +00:00
Renovate Bot	9f96688b1f	Merge pull request 'chore(deps): update searxng/searxng:latest docker digest to f0e5e56' (#6179 ) from renovate/unified-searxng into main All checks were successful lint-test-helm / lint-helm (push) Successful in 19s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 3m38s Details	2026-04-24 13:04:41 +00:00
Renovate Bot	ceeebfc5e1	chore(deps): update searxng/searxng:latest docker digest to f0e5e56 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 20s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 1m6s Details	2026-04-24 13:04:29 +00:00
Renovate Bot	939b9c3f8c	Merge pull request 'chore(deps): update helm release openbao to v0.27.2' (#6177 ) from renovate/unified-openbao into main All checks were successful lint-test-helm / lint-helm (push) Successful in 30s Details lint-test-helm / validate-kubeconform (push) Has been skipped Details renovate / renovate (push) Successful in 5m12s Details	2026-04-24 09:03:36 +00:00
Renovate Bot	78043bdaab	chore(deps): update helm release openbao to v0.27.2	2026-04-24 09:03:36 +00:00
Renovate Bot	912cc8df6c	Merge pull request 'chore(deps): update dependency excalidraw/excalidraw to v0.18.1' (#6176 ) from renovate/unified-excalidraw into main Some checks failed lint-test-helm / lint-helm (push) Has been cancelled Details lint-test-helm / validate-kubeconform (push) Has been cancelled Details renovate / renovate (push) Has been cancelled Details	2026-04-24 09:03:11 +00:00
Renovate Bot	7a06594947	chore(deps): update dependency excalidraw/excalidraw to v0.18.1 All checks were successful renovate/stability-days Updates have met minimum release age requirement Details lint-test-helm / lint-helm (pull_request) Successful in 48s Details lint-test-helm / validate-kubeconform (pull_request) Has been skipped Details render-manifests / render-manifests (pull_request) Successful in 2m5s Details	2026-04-24 09:02:57 +00:00