chore(deps): update helm release eck-operator to v3.3.2 (#5380)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cloudnative-pg](https://cloudnative-pg.io) ([source](https://github.com/cloudnative-pg/charts)) | minor | `0.27.1` → `0.28.0` |
| [cloudnative-pg/cloudnative-pg](https://github.com/cloudnative-pg/cloudnative-pg) | minor | `1.28.1` → `1.29.0` |

---

### Release Notes

<details>
<summary>cloudnative-pg/charts (cloudnative-pg)</summary>

### [`v0.28.0`](https://github.com/cloudnative-pg/charts/releases/tag/cloudnative-pg-v0.28.0)

[Compare Source](https://github.com/cloudnative-pg/charts/compare/cloudnative-pg-v0.27.1...cloudnative-pg-v0.28.0)

CloudNativePG Operator Helm Chart

#### What's Changed

- fix(security): harden GitHub Actions workflows against expression injection by [@&#8203;mnencia](https://github.com/mnencia) in [#&#8203;823](https://github.com/cloudnative-pg/charts/pull/823)
- feat(monitoring): add support for custom PodMonitor by [@&#8203;Dashing-Nelson](https://github.com/Dashing-Nelson) in [#&#8203;724](https://github.com/cloudnative-pg/charts/pull/724)
- Release cloudnative-pg-v0.28.0 by [@&#8203;cnpg-bot](https://github.com/cnpg-bot) in [#&#8203;845](https://github.com/cloudnative-pg/charts/pull/845)

#### New Contributors

- [@&#8203;Dashing-Nelson](https://github.com/Dashing-Nelson) made their first contribution in [#&#8203;724](https://github.com/cloudnative-pg/charts/pull/724)

**Full Changelog**: <https://github.com/cloudnative-pg/charts/compare/cluster-v0.6.0...cloudnative-pg-v0.28.0>

</details>

<details>
<summary>cloudnative-pg/cloudnative-pg (cloudnative-pg/cloudnative-pg)</summary>

### [`v1.29.0`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0)

[Compare Source](https://github.com/cloudnative-pg/cloudnative-pg/compare/v1.28.2...v1.29.0-rc1)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#&#8203;10167](https://github.com/cloudnative-pg/cloudnative-pg/pull/10167)) <!-- 1.28 1.27 -->

##### Features

- **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#&#8203;9781](https://github.com/cloudnative-pg/cloudnative-pg/pull/9781))

- **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#&#8203;10148](https://github.com/cloudnative-pg/cloudnative-pg/pull/10148))

- **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@&#8203;bozkayasalihx](https://github.com/bozkayasalihx). ([#&#8203;9287](https://github.com/cloudnative-pg/cloudnative-pg/pull/9287))

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@&#8203;alex1989hu](https://github.com/alex1989hu). ([#&#8203;9571](https://github.com/cloudnative-pg/cloudnative-pg/pull/9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#&#8203;10104](https://github.com/cloudnative-pg/cloudnative-pg/pull/10104), [#&#8203;10298](https://github.com/cloudnative-pg/cloudnative-pg/pull/10298)) <!-- 1.28 1.27 -->

- Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#&#8203;10040](https://github.com/cloudnative-pg/cloudnative-pg/pull/10040))

- Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@&#8203;GabriFedi97](https://github.com/GabriFedi97). ([#&#8203;10020](https://github.com/cloudnative-pg/cloudnative-pg/pull/10020))

- Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#&#8203;10250](https://github.com/cloudnative-pg/cloudnative-pg/pull/10250))

- Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#&#8203;10375](https://github.com/cloudnative-pg/cloudnative-pg/pull/10375))

- Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#&#8203;9560](https://github.com/cloudnative-pg/cloudnative-pg/pull/9560))

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#&#8203;9971](https://github.com/cloudnative-pg/cloudnative-pg/pull/9971)) <!-- 1.28 1.27 1.25 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#&#8203;9720](https://github.com/cloudnative-pg/cloudnative-pg/pull/9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#&#8203;9968](https://github.com/cloudnative-pg/cloudnative-pg/pull/9968)) <!-- 1.28 -->

- Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#&#8203;9353](https://github.com/cloudnative-pg/cloudnative-pg/pull/9353))

- Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#&#8203;9351](https://github.com/cloudnative-pg/cloudnative-pg/pull/9351))

- Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#&#8203;9364](https://github.com/cloudnative-pg/cloudnative-pg/pull/9364))

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#&#8203;10054](https://github.com/cloudnative-pg/cloudnative-pg/pull/10054), <!-- 1.28 1.27 1.25 --> [#&#8203;10062](https://github.com/cloudnative-pg/cloudnative-pg/pull/10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#&#8203;10048](https://github.com/cloudnative-pg/cloudnative-pg/pull/10048), <!-- 1.28 1.27 1.25 --> [#&#8203;10074](https://github.com/cloudnative-pg/cloudnative-pg/pull/10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#&#8203;9950](https://github.com/cloudnative-pg/cloudnative-pg/pull/9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#&#8203;10090](https://github.com/cloudnative-pg/cloudnative-pg/pull/10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#&#8203;10342](https://github.com/cloudnative-pg/cloudnative-pg/pull/10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#&#8203;10302](https://github.com/cloudnative-pg/cloudnative-pg/pull/10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#&#8203;10192](https://github.com/cloudnative-pg/cloudnative-pg/pull/10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@&#8203;ermakov-oleg](https://github.com/ermakov-oleg). ([#&#8203;9977](https://github.com/cloudnative-pg/cloudnative-pg/pull/9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#&#8203;9952](https://github.com/cloudnative-pg/cloudnative-pg/pull/9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@&#8203;sharifmshaker](https://github.com/sharifmshaker). ([#&#8203;9978](https://github.com/cloudnative-pg/cloudnative-pg/pull/9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@&#8203;jmealo](https://github.com/jmealo). ([#&#8203;9981](https://github.com/cloudnative-pg/cloudnative-pg/pull/9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#&#8203;10268](https://github.com/cloudnative-pg/cloudnative-pg/pull/10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#&#8203;9973](https://github.com/cloudnative-pg/cloudnative-pg/pull/9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#&#8203;10193](https://github.com/cloudnative-pg/cloudnative-pg/pull/10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#&#8203;10035](https://github.com/cloudnative-pg/cloudnative-pg/pull/10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#&#8203;10190](https://github.com/cloudnative-pg/cloudnative-pg/pull/10190), [#&#8203;10311](https://github.com/cloudnative-pg/cloudnative-pg/pull/10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#&#8203;10285](https://github.com/cloudnative-pg/cloudnative-pg/pull/10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#&#8203;9650](https://github.com/cloudnative-pg/cloudnative-pg/pull/9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#&#8203;9849](https://github.com/cloudnative-pg/cloudnative-pg/pull/9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#&#8203;10174](https://github.com/cloudnative-pg/cloudnative-pg/pull/10174)) <!-- 1.28 1.27 1.25 -->

##### Supported versions

- Kubernetes 1.35, 1.34, and 1.33
- PostgreSQL 18, 17, 16, 15, and 14
  - PostgreSQL 18.3 is the default image
  - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/)

### [`v1.28.2`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.2)

[Compare Source](https://github.com/cloudnative-pg/cloudnative-pg/compare/v1.28.1...v1.28.2)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#&#8203;10167](https://github.com/cloudnative-pg/cloudnative-pg/pull/10167)) <!-- 1.28 1.27 -->

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@&#8203;alex1989hu](https://github.com/alex1989hu). ([#&#8203;9571](https://github.com/cloudnative-pg/cloudnative-pg/pull/9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#&#8203;10104](https://github.com/cloudnative-pg/cloudnative-pg/pull/10104), [#&#8203;10298](https://github.com/cloudnative-pg/cloudnative-pg/pull/10298)) <!-- 1.28 1.27 -->

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#&#8203;9971](https://github.com/cloudnative-pg/cloudnative-pg/pull/9971)) <!-- 1.28 1.27 1.25 -->

- Extended the CRD schemas for `Cluster`, `ImageCatalog`, and `ClusterImageCatalog` to accept the `extensions`, `bin_path`, and `env` fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. ([#&#8203;10131](https://github.com/cloudnative-pg/cloudnative-pg/pull/10131), [#&#8203;10387](https://github.com/cloudnative-pg/cloudnative-pg/pull/10387)) <!-- 1.28 1.27 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#&#8203;9720](https://github.com/cloudnative-pg/cloudnative-pg/pull/9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#&#8203;9968](https://github.com/cloudnative-pg/cloudnative-pg/pull/9968)) <!-- 1.28 -->

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#&#8203;10054](https://github.com/cloudnative-pg/cloudnative-pg/pull/10054), <!-- 1.28 1.27 1.25 --> [#&#8203;10062](https://github.com/cloudnative-pg/cloudnative-pg/pull/10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#&#8203;10048](https://github.com/cloudnative-pg/cloudnative-pg/pull/10048), <!-- 1.28 1.27 1.25 --> [#&#8203;10074](https://github.com/cloudnative-pg/cloudnative-pg/pull/10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#&#8203;9950](https://github.com/cloudnative-pg/cloudnative-pg/pull/9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#&#8203;10090](https://github.com/cloudnative-pg/cloudnative-pg/pull/10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#&#8203;10342](https://github.com/cloudnative-pg/cloudnative-pg/pull/10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#&#8203;10302](https://github.com/cloudnative-pg/cloudnative-pg/pull/10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#&#8203;10192](https://github.com/cloudnative-pg/cloudnative-pg/pull/10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@&#8203;ermakov-oleg](https://github.com/ermakov-oleg). ([#&#8203;9977](https://github.com/cloudnative-pg/cloudnative-pg/pull/9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#&#8203;9952](https://github.com/cloudnative-pg/cloudnative-pg/pull/9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@&#8203;sharifmshaker](https://github.com/sharifmshaker). ([#&#8203;9978](https://github.com/cloudnative-pg/cloudnative-pg/pull/9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@&#8203;jmealo](https://github.com/jmealo). ([#&#8203;9981](https://github.com/cloudnative-pg/cloudnative-pg/pull/9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#&#8203;10268](https://github.com/cloudnative-pg/cloudnative-pg/pull/10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#&#8203;9973](https://github.com/cloudnative-pg/cloudnative-pg/pull/9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#&#8203;10193](https://github.com/cloudnative-pg/cloudnative-pg/pull/10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#&#8203;10035](https://github.com/cloudnative-pg/cloudnative-pg/pull/10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#&#8203;10190](https://github.com/cloudnative-pg/cloudnative-pg/pull/10190), [#&#8203;10311](https://github.com/cloudnative-pg/cloudnative-pg/pull/10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#&#8203;10285](https://github.com/cloudnative-pg/cloudnative-pg/pull/10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#&#8203;9650](https://github.com/cloudnative-pg/cloudnative-pg/pull/9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#&#8203;9849](https://github.com/cloudnative-pg/cloudnative-pg/pull/9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#&#8203;10174](https://github.com/cloudnative-pg/cloudnative-pg/pull/10174)) <!-- 1.28 1.27 1.25 -->

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuNCIsInVwZGF0ZWRJblZlciI6IjQzLjEwMi42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJoZWxtIl19-->

Reviewed-on: #5367
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.102.1@sha256:929ac56e34491346a313a2a16e71fdcc11ee41c6401f4179dcf13774d7f83931
+    container: ghcr.io/renovatebot/renovate:43.102.8@sha256:e230599b399a3ed960987fe652550e39cd4f514dbe9a693839da1b99f049a0e1
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/actual/values.yaml

@@ -8,7 +8,7 @@ actual:
         main:
           image:
             repository: ghcr.io/actualbudget/actual
-            tag: 26.3.0-alpine@sha256:88da05c05de64c3e2b597ffb8fdb9abb50605d64200ad470516da895251bbf9c
+            tag: 26.3.0@sha256:eb8bc26f53025e07e464594c12d77c52c4b95840c8dadd9b95c4f0c4660f8ad2
           env:
             - name: ACTUAL_PORT
               value: 5006
@@ -39,7 +39,6 @@ actual:
         http:
           port: 80
           targetPort: 5006
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -49,11 +49,9 @@ audiobookshelf:
         http:
           port: 80
           targetPort: 80
-          protocol: HTTP
         apprise:
           port: 8000
           targetPort: 8000
-          protocol: HTTP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/backrest/values.yaml

@@ -31,7 +31,6 @@ backrest:
         http:
           port: 80
           targetPort: 9898
-          protocol: TCP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/bazarr/values.yaml

@@ -35,7 +35,6 @@ bazarr:
         http:
           port: 80
           targetPort: 6767
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/cloudnative-pg/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: cloudnative-pg
   repository: https://cloudnative-pg.io/charts/
-  version: 0.27.1
+  version: 0.28.0
 - name: plugin-barman-cloud
   repository: https://cloudnative-pg.io/charts/
   version: 0.5.0
-digest: sha256:e7089ffd089cae87529e28f0e71302b9fc4a869b389cbb6628f1c559644a3a10
+digest: sha256:3e9b26d00fdb61af60f003bcb327e05d02799eb6088e30aaabd01c49c6021aac
-generated: "2026-02-05T19:36:19.473447121Z"
+generated: "2026-04-01T20:05:40.198140255Z"

clusters/cl01tl/helm/cloudnative-pg/Chart.yaml

@@ -17,11 +17,11 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cloudnative-pg
-    version: 0.27.1
+    version: 0.28.0
     repository: https://cloudnative-pg.io/charts/
   - name: plugin-barman-cloud
     version: 0.5.0
     repository: https://cloudnative-pg.io/charts/
 icon: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg.github.io/refs/heads/main/assets/images/hero_image.png
 # renovate: datasource=github-releases depName=cloudnative-pg/cloudnative-pg
-appVersion: 1.28.1
+appVersion: 1.29.0

clusters/cl01tl/helm/code-server/values.yaml

@@ -12,7 +12,7 @@ code-server:
         main:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
+            tag: 4.112.0-ls325@sha256:a17ee95f4e1b43284fe5dfea99e82c8a26f096534215ff36817fa80161eec220
           env:
             - name: TZ
               value: America/Chicago
@@ -36,7 +36,6 @@ code-server:
         http:
           port: 8443
           targetPort: 8443
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/dawarich/values.yaml

@@ -211,11 +211,9 @@ dawarich:
         http:
           port: 80
           targetPort: 3000
-          protocol: TCP
         metrics:
           port: 9394
           targetPort: 9394
-          protocol: TCP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml

@@ -1,5 +1,8 @@
 democratic-csi:
   driver:
+    image:
+      registry: ghcr.io/democratic-csi/democratic-csi
+      tag: v1.9.5@@sha256:fc3b7d7ed3a616714139525075312758e23a5d425ffb539ad12c9bd20fb6001f
     existingConfigSecret: synology-iscsi-config-secret
     config:
       driver: synology-iscsi
@@ -10,7 +13,23 @@ democratic-csi:
   csiDriver:
     name: "org.democratic-csi.iscsi-synology"
   controller:
-    replicaCount: 2
+    replicaCount: 3
+    externalAttacher:
+      image:
+        registry: registry.k8s.io/sig-storage/csi-attacher
+        tag: v4.11.0@sha256:b74b05b39501565022883fc128002b4cb857a7bb6c858606bcb3fdedba0b0b80
+    externalProvisioner:
+      image:
+        registry: registry.k8s.io/sig-storage/csi-provisioner
+        tag: v3.6.4@sha256:e7ad666f1d9b0caa077c7f0c157c9f87d1e73858390732496f66dcc716ff10c5
+    externalResizer:
+      image:
+        registry: registry.k8s.io/sig-storage/csi-resizer
+        tag: v1.9.4@sha256:522911ef68bd2c5c17d90fb2a6d2b2fb72ae790f2c1463a466b4262a07fdbf5a
+    externalSnapshotter:
+      image:
+        registry: registry.k8s.io/sig-storage/csi-snapshotter
+        tag: v8.5.0@sha256:da081c27e8a6d91f36042c1942362d0515ced8d06e18c11b8f893e58c4d6d797
   storageClasses:
     - name: synology-iscsi-delete
       defaultClass: false
@@ -36,3 +55,7 @@ democratic-csi:
           value: /usr/local/sbin/iscsiadm
       iscsiDirHostPath: /var/iscsi
       iscsiDirHostPathType: ""
+  driverRegistrar:
+    image:
+      registry: registry.k8s.io/sig-storage/csi-node-driver-registrar
+      tag: v2.16.0@sha256:ab482308a4921e28a6df09a16ab99a457e9af9641ff44fb1be1a690d07ce8b70

clusters/cl01tl/helm/directus/values.yaml

@@ -151,7 +151,6 @@ directus:
         http:
           port: 80
           targetPort: 8055
-          protocol: TCP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/elastic-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: eck-operator
   repository: https://helm.elastic.co
-  version: 3.3.1
+  version: 3.3.2
-digest: sha256:8585f3ea3e4cafc4ff2969ea7e797017b7cfe4becb3385f0b080725908c02f09
+digest: sha256:ac7a849a6d8244ef56c11f18438c4c76133f92d245228c5a1c8369d42562c177
-generated: "2026-02-25T18:48:55.77034549Z"
+generated: "2026-04-01T21:30:02.975920565Z"

clusters/cl01tl/helm/elastic-operator/Chart.yaml

@@ -14,7 +14,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: eck-operator
-    version: 3.3.1
+    version: 3.3.2
     repository: https://helm.elastic.co
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/elastic.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s

clusters/cl01tl/helm/excalidraw/values.yaml

@@ -25,7 +25,6 @@ excalidraw:
         http:
           port: 80
           targetPort: 80
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/foldergram/values.yaml

@@ -36,7 +36,6 @@ foldergram:
         http:
           port: 80
           targetPort: 4141
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/freshrss/values.yaml

@@ -87,7 +87,6 @@ freshrss:
         http:
           port: 80
           targetPort: 80
-          protocol: HTTP
   persistence:
     data:
       forceRename: freshrss-data

clusters/cl01tl/helm/garage/values.yaml

@@ -212,19 +212,15 @@ garage:
         s3:
           port: 3900
           targetPort: 3900
-          protocol: HTTP
         rpc:
           port: 3901
           targetPort: 3901
-          protocol: HTTP
         web:
           port: 3902
           targetPort: 3902
-          protocol: HTTP
         admin:
           port: 3903
           targetPort: 3903
-          protocol: HTTP
     server-2:
       forceRename: garage-2
       controller: server-2
@@ -232,19 +228,15 @@ garage:
         s3:
           port: 3900
           targetPort: 3900
-          protocol: HTTP
         rpc:
           port: 3901
           targetPort: 3901
-          protocol: HTTP
         web:
           port: 3902
           targetPort: 3902
-          protocol: HTTP
         admin:
           port: 3903
           targetPort: 3903
-          protocol: HTTP
     server-3:
       forceRename: garage-3
       controller: server-3
@@ -252,26 +244,21 @@ garage:
         s3:
           port: 3900
           targetPort: 3900
-          protocol: HTTP
         rpc:
           port: 3901
           targetPort: 3901
-          protocol: HTTP
         web:
           port: 3902
           targetPort: 3902
-          protocol: HTTP
         admin:
           port: 3903
           targetPort: 3903
-          protocol: HTTP
     webui:
       controller: webui
       ports:
         webui:
           port: 3909
           targetPort: 3909
-          protocol: HTTP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/grafana-operator/values.yaml

@@ -1,4 +1,9 @@
 grafana-operator:
+  image:
+    registry: ghcr.io
+    repository: grafana/grafana-operator
+    # renovate: datasource=docker depName=ghcr.io/grafana/grafana-operator
+    tag: v5.22.2@sha256:d45fc24e8f43d83286d81625ee8d919d0fc88255a6500b63f68d7966a4f9e9af
   replicas: 2
   resources:
     requests:

clusters/cl01tl/helm/grimmory/values.yaml

@@ -44,7 +44,6 @@ grimmory:
         http:
           port: 80
           targetPort: 6060
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute

clusters/cl01tl/helm/home-assistant/Chart.yaml

@@ -24,4 +24,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/home-assistant.png
 # renovate: datasource=github-releases depName=home-assistant/core
-appVersion: 2026.3.4
+appVersion: 2026.4.0

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -12,7 +12,7 @@ home-assistant:
         main:
           image:
             repository: ghcr.io/home-assistant/home-assistant
-            tag: 2026.3.4@sha256:916682086154a7390114a9788782b8efb199852d4f7d47066722c2bc5d1829e6
+            tag: 2026.4.0@sha256:7fbf6a5e006e889d7799476ad7646bd18e9dc73e8a4ccd9326b41798de6bb3bf
           env:
             - name: TZ
               value: America/Chicago
@@ -23,7 +23,7 @@ home-assistant:
         code-server:
           image:
             repository: ghcr.io/linuxserver/code-server
-            tag: 4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
+            tag: 4.112.0-ls325@sha256:a17ee95f4e1b43284fe5dfea99e82c8a26f096534215ff36817fa80161eec220
           env:
             - name: TZ
               value: America/Chicago
@@ -43,14 +43,12 @@ home-assistant:
         http:
           port: 80
           targetPort: 8123
-          protocol: TCP
     code-server:
       controller: main
       ports:
         http:
           port: 8443
           targetPort: 8443
-          protocol: HTTP
   serviceMonitor:
     main:
       selector:

clusters/cl01tl/helm/homepage/Chart.yaml

@@ -5,7 +5,7 @@ description: Homepage
 keywords:
   - homepage
   - dashboard
-home: https://wiki.alexlebens.dev/s/a5fabd91-3d89-4e2b-9417-06111aedaeaa
+home: https://docs.alexlebens.dev/applications/homepage/
 sources:
   - https://github.com/gethomepage/homepage
   - https://github.com/gethomepage/homepage/pkgs/container/homepage
@@ -19,4 +19,4 @@ dependencies:
     version: 4.6.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 # renovate: datasource=github-releases depName=gethomepage/homepage
-appVersion: v1.12.2
+appVersion: v1.12.3

clusters/cl01tl/helm/homepage/templates/external-secret.yaml

@@ -14,120 +14,69 @@ spec:
   data:
     - secretKey: HOMEPAGE_VAR_GITEA_API_TOKEN
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/auth/homepage
-        metadataPolicy: None
         property: token
     - secretKey: HOMEPAGE_VAR_ARGOCD_API_TOKEN
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/argocd/credentials/homepage
-        metadataPolicy: None
         property: token
     - secretKey: HOMEPAGE_VAR_KOMODO_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/komodo/homepage
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_KOMODO_API_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/komodo/homepage
-        metadataPolicy: None
         property: secret
     - secretKey: HOMEPAGE_VAR_JELLYSTAT_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/jellystat/homepage
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_USER
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /synology/auth/cl01tl
-        metadataPolicy: None
         property: user
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /synology/auth/cl01tl
-        metadataPolicy: None
         property: password
     - secretKey: HOMEPAGE_VAR_UNIFI_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /unifi/auth/cl01tl
-        metadataPolicy: None
         property: api-key
     - secretKey: HOMEPAGE_VAR_SONARR_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/sonarr4/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_SONARR4K_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/sonarr4-4k/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_SONARRANIME_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/sonarr4-anime/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR4K_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5-4k/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRANIME_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5-anime/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRSTANDUP_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5-standup/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_LIDARR_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/lidarr2/key
-        metadataPolicy: None
         property: key
     - secretKey: HOMEPAGE_VAR_PROWLARR_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/prowlarr/key
-        metadataPolicy: None
         property: key

clusters/cl01tl/helm/homepage/values.yaml

@@ -5,7 +5,7 @@ homepage:
     main:
       type: deployment
       replicas: 1
-      strategy: RollingUpdate
+      strategy: Recreate
       annotations:
         reloader.stakater.com/auto: "true"
       serviceAccount:
@@ -16,8 +16,7 @@ homepage:
         main:
           image:
             repository: ghcr.io/gethomepage/homepage
-            tag: v1.12.2
+            tag: v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
-            pullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
               value: home.alexlebens.net
@@ -26,8 +25,8 @@ homepage:
                 name: homepage-keys-secret
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 256Mi
+              memory: 128Mi
   serviceAccount:
     homepage:
       enabled: true
@@ -57,7 +56,7 @@ homepage:
             - Media:
                 tab: Applications
                 icon: mdi-multimedia-#ffffff
-            - Public:
+            - External:
                 tab: Applications
                 icon: mdi-earth-#ffffff
             - Internal:
@@ -189,7 +188,7 @@ homepage:
                   siteMonitor: http://photoview.photoview:80
                   statusStyle: dot
               - Pictures:
-                  icon: https://raw.githubusercontent.com/foldergram/foldergram/refs/heads/main/client/public/icon-512.png
+                  icon: sh-foldergram.webp
                   description: Foldergram
                   href: https://foldergram.alexlebens.net
                   siteMonitor: http://foldergram.foldergram:80
@@ -200,7 +199,7 @@ homepage:
                   href: https://grimmory.alexlebens.net
                   siteMonitor: http://grimmory.grimmory:80
                   statusStyle: dot
-          - Public:
+          - External:
               - Site:
                   icon: https://web-assets-3bfcb5585cbd63dc365d32a3.nyc3.cdn.digitaloceanspaces.com/alexlebens-net/logo-new-round.png
                   description: Profile Website
@@ -323,7 +322,7 @@ homepage:
                   siteMonitor: http://excalidraw.excalidraw:80
                   statusStyle: dot
           - Code:
-              - Code (Public):
+              - Code (External):
                   icon: sh-gitea.webp
                   description: Gitea
                   href: https://gitea.alexlebens.dev
@@ -345,13 +344,13 @@ homepage:
                   href: https://gitea.alexlebens.net
                   siteMonitor: https://gitea.alexlebens.net
                   statusStyle: dot
-              - Code (ps10rp):
+              - Code (Remote):
                   icon: sh-gitea.webp
                   description: Gitea
                   href: https://gitea-ps10rp.boreal-beaufort.ts.net
                   siteMonitor: https://gitea-ps10rp.boreal-beaufort.ts.net
                   statusStyle: dot
-              - IDE (Public):
+              - IDE (External):
                   icon: sh-visual-studio-code.webp
                   description: VS Code
                   href: https://codeserver.alexlebens.dev
@@ -469,25 +468,31 @@ homepage:
                         query: prometheus_tsdb_storage_blocks_bytes
                         format:
                           type: bytes
-              - Jellystat:
+              - Jellyfin Monitor:
                   icon: sh-jellystat.webp
-                  description: Jellyfin Monitoring
+                  description: Jellystat
                   href: https://jellystat.alexlebens.net
                   siteMonitor: http://jellystat.jellystat:80
                   statusStyle: dot
-              - MediaLyze:
+              - Media Library Statistics:
                   icon: https://raw.githubusercontent.com/frederikemmer/MediaLyze/d8f69c0628bac7c047b90f91a66341648029c273/frontend/public/favicon.svg
-                  description: Jellyfin Media Monitoring
+                  description: MediaLyze
                   href: https://medialyze.alexlebens.net
                   siteMonitor: http://medialyze.medialyze:80
                   statusStyle: dot
           - Services:
-              - Auth (Public):
+              - Auth (External):
                   icon: sh-authentik.webp
                   description: Authentik
                   href: https://auth.alexlebens.dev
                   siteMonitor: https://auth.alexlebens.dev
                   statusStyle: dot
+                  namespace: authentik
+                  app: authentik
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          authentik
+                      )
               - Auth (Local):
                   icon: sh-authentik.webp
                   description: Authentik
@@ -500,18 +505,36 @@ homepage:
                   href: https://stalwart.alexlebens.net
                   siteMonitor: http://stalwart.stalwart:80
                   statusStyle: dot
+                  namespace: stalwart
+                  app: stalwart
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          stalwart
+                      )
               - Notifications:
                   icon: sh-ntfy.webp
                   description: ntfy
                   href: https://ntfy.alexlebens.net
                   siteMonitor: http://ntfy.ntfy:80
                   statusStyle: dot
+                  namespace: ntfy
+                  app: ntfy
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          ntfy
+                      )
               - Reverse Proxy:
                   icon: sh-traefik.webp
                   description: Traefik
                   href: https://traefik-cl01tl.alexlebens.net/dashboard/#/
                   siteMonitor: https://traefik-cl01tl.alexlebens.net/dashboard/#/
                   statusStyle: dot
+                  namespace: traefik
+                  app: traefik
+                  podSelector: >-
+                      app.kubernetes.io/name in (
+                          traefik
+                      )
                   widget:
                     type: traefik
                     url: https://traefik-cl01tl.alexlebens.net
@@ -521,8 +544,14 @@ homepage:
                   href: https://harbor.alexlebens.net
                   siteMonitor: http://harbor-portal.harbor:80
                   statusStyle: dot
+                  namespace: harbor
+                  app: harbor
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          harbor
+                      )
           - Hardware:
-              - Network Management (alexlebens.net):
+              - Network Management (Local):
                   icon: sh-ubiquiti-unifi.webp
                   description: Unifi
                   href: https://unifi.alexlebens.net
@@ -575,13 +604,22 @@ homepage:
                   href: https://ceph.alexlebens.net
                   siteMonitor: http://rook-ceph-mgr-dashboard.rook-ceph:7000
                   statusStyle: dot
-              - Object Storage (NAS):
+                  namespace: rook-ceph
+                  app: rook-ceph
+                  podSelector: ""
+              - Object Storage (Local):
                   icon: sh-garage.webp
                   description: Garage
                   href: https://garage-webui.alexlebens.net
                   siteMonitor: http://garage-webui.garage:3909
                   statusStyle: dot
-              - Object Storage (ps10rp):
+                  namespace: garage
+                  app: garage
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          garage
+                      )
+              - Object Storage (Remote):
                   icon: sh-garage.webp
                   description: Garage
                   href: https://garage-ui-ps10rp.boreal-beaufort.ts.net
@@ -599,12 +637,24 @@ homepage:
                   href: https://vault.alexlebens.net
                   siteMonitor: http://vault.vault:8200
                   statusStyle: dot
+                  namespace: vault
+                  app: vault
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          vault
+                      )
               - Backups:
                   icon: sh-backrest-light.webp
                   description: Backrest
                   href: https://backrest.alexlebens.net
                   siteMonitor: http://backrest.backrest:80
                   statusStyle: dot
+                  namespace: backrest
+                  app: backrest
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          backrest
+                      )
                   widget:
                       type: backrest
                       url: http://backrest.backrest:80
@@ -615,6 +665,12 @@ homepage:
                   href: https://qui.alexlebens.net
                   siteMonitor: http://qbittorrent-qui.qbittorrent:80
                   statusStyle: dot
+                  namespace: qbittorrent
+                  app: qbittorrent
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          qbittorrent
+                      )
                   widget:
                     type: qbittorrent
                     url: http://qbittorrent.qbittorrent:8080
@@ -643,6 +699,12 @@ homepage:
                   href: https://tdarr.alexlebens.net
                   siteMonitor: http://tdarr-web.tdarr:8265
                   statusStyle: dot
+                  namespace: tdarr
+                  app: tdarr
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          tdarr
+                      )
                   widget:
                     type: tdarr
                     url: http://tdarr-web.tdarr:8265
@@ -653,6 +715,12 @@ homepage:
                   href: https://sonarr.alexlebens.net
                   siteMonitor: http://sonarr.sonarr:80
                   statusStyle: dot
+                  namespace: sonarr
+                  app: sonarr
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          sonarr
+                      )
                   widget:
                     type: sonarr
                     url: http://sonarr.sonarr:80
@@ -665,6 +733,12 @@ homepage:
                   href: https://sonarr-4k.alexlebens.net
                   siteMonitor: http://sonarr-4k.sonarr-4k:80
                   statusStyle: dot
+                  namespace: sonarr-4k
+                  app: sonarr-4k
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          sonarr-4k
+                      )
                   widget:
                     type: sonarr
                     url: http://sonarr-4k.sonarr-4k:80
@@ -677,6 +751,12 @@ homepage:
                   href: https://sonarr-anime.alexlebens.net
                   siteMonitor: http://sonarr-anime.sonarr-anime:80
                   statusStyle: dot
+                  namespace: sonarr-anime
+                  app: sonarr-anime
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          sonarr-anime
+                      )
                   widget:
                     type: sonarr
                     url: http://sonarr-anime.sonarr-anime:80
@@ -690,6 +770,12 @@ homepage:
                   href: https://radarr.alexlebens.net
                   siteMonitor: http://radarr.radarr:80
                   statusStyle: dot
+                  namespace: radarr
+                  app: radarr
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          radarr
+                      )
                   widget:
                     type: radarr
                     url: http://radarr.radarr:80
@@ -702,6 +788,12 @@ homepage:
                   href: https://radarr-4k.alexlebens.net
                   siteMonitor: http://radarr-4k.radarr-4k:80
                   statusStyle: dot
+                  namespace: radarr-4k
+                  app: radarr-4k
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          radarr-4k
+                      )
                   widget:
                     type: radarr
                     url: http://radarr-4k.radarr-4k:80
@@ -714,6 +806,12 @@ homepage:
                   href: https://radarr-anime.alexlebens.net
                   siteMonitor: http://radarr-anime.radarr-anime:80
                   statusStyle: dot
+                  namespace: radarr-anime
+                  app: radarr-anime
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          radarr-anime
+                      )
                   widget:
                     type: radarr
                     url: http://radarr-anime.radarr-anime:80
@@ -726,6 +824,12 @@ homepage:
                   href: https://radarr-standup.alexlebens.net
                   siteMonitor: http://radarr-standup.radarr-standup:80
                   statusStyle: dot
+                  namespace: radarr-standup
+                  app: radarr-standup
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          radarr-standup
+                      )
                   widget:
                     type: radarr
                     url: http://radarr-standup.radarr-standup:80
@@ -739,6 +843,12 @@ homepage:
                   href: https://lidarr.alexlebens.net
                   siteMonitor: http://lidarr.lidarr:80
                   statusStyle: dot
+                  namespace: lidarr
+                  app: lidarr
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          lidarr
+                      )
                   widget:
                     type: lidarr
                     url: http://lidarr.lidarr:80
@@ -762,6 +872,12 @@ homepage:
                   href: https://slskd.alexlebens.net
                   siteMonitor: http://slskd.slskd:5030
                   statusStyle: dot
+                  namespace: slskd
+                  app: slskd
+                  podSelector: >-
+                      app.kubernetes.io/instance in (
+                          slskd
+                      )
           - Books:
               - Shelfmark:
                   icon: sh-shelfmark.webp
@@ -828,7 +944,6 @@ homepage:
         http:
           port: 80
           targetPort: 3000
-          protocol: HTTP
   route:
     main:
       kind: HTTPRoute
@@ -841,11 +956,8 @@ homepage:
         - home.alexlebens.net
       rules:
         - backendRefs:
-            - group: ''
+            - name: homepage
-              kind: Service
-              name: homepage
               port: 80
-              weight: 100
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/houndarr/values.yaml

@@ -9,7 +9,7 @@ houndarr:
         main:
           image:
             repository: ghcr.io/av1155/houndarr
-            tag: v1.6.4
+            tag: v1.6.5
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -33,4 +33,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
 # renovate: datasource=github-releases depName=jellyfin/jellyfin
-appVersion: 10.11.6
+appVersion: 10.11.7

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -9,7 +9,7 @@ jellyfin:
         main:
           image:
             repository: ghcr.io/jellyfin/jellyfin
-            tag: 10.11.6
+            tag: 10.11.7
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/kube-prometheus-stack/values.yaml

@@ -148,7 +148,7 @@ ntfy-alertmanager:
         main:
           image:
             repository: xenrox/ntfy-alertmanager
-            tag: 0.5.0
+            tag: 1.0.0
             pullPolicy: IfNotPresent
   service:
     main:

clusters/cl01tl/helm/movie-roulette/values.yaml

@@ -9,7 +9,7 @@ movie-roulette:
         main:
           image:
             repository: ghcr.io/sahara101/movie-roulette
-            tag: v5.4.0
+            tag: v5.4.1
             pullPolicy: IfNotPresent
           env:
             - name: FLASK_SECRET_KEY

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
+            tag: latest@sha256:dac0c447bdd3f20a43687c6bed8140547f493252fd7bad3ad8bef1faffe1002d
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:4d7ed8b7035ecf827bd901ba6d32f5c32d8119bc09bb3cdafeb0ce58f1b951c1
+            tag: latest@sha256:dac0c447bdd3f20a43687c6bed8140547f493252fd7bad3ad8bef1faffe1002d
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/tdarr/values.yaml

@@ -9,7 +9,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr
-            tag: 2.66.01
+            tag: 2.67.01
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -67,7 +67,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.66.01
+            tag: 2.67.01
             pullPolicy: IfNotPresent
           env:
             - name: TZ

hosts/ps10rp/cloudflare-ddns/compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
     cloudflare-ddns:
-        image: favonia/cloudflare-ddns:1.16.0@sha256:8e0f869aed97beeed4e172a01e97090673cb9b04e7e1d62fcb6cfc656f9761ad
+        image: favonia/cloudflare-ddns:1.16.1@sha256:d9eb06b9ddb1ef121334095645e2b55ac208ea1ef1f363a201a255aa8a9798cc
         container_name: cloudflare-ddns
         cap_drop:
             - all

hosts/ps10rp/homepage/compose.yaml

@@ -32,7 +32,7 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
     homepage:
-        image: ghcr.io/gethomepage/homepage:v1.12.2@sha256:ea801368eac6b1f0d08ad35dabcbbd0a91147a49ba9761df84b2e047532d74e5
+        image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
         container_name: homepage
         labels:
             traefik.enable: true