chore(deps): update kube-prometheus-stack docker tag to v82.4.0

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 1.0.4
 digest: sha256:24214c0bc1e6aed9954385aa61b403a7fa4b4e92bac09777504635cba98735ba
-generated: "2026-02-25T21:51:50.676614011Z"
+generated: "2026-02-25T22:30:48.585600926Z"

clusters/cl01tl/helm/sonarr-4k/templates/middleware.yaml

@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -88,6 +88,12 @@ sonarr-4k:
               name: sonarr-4k
               port: 80
               weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix