chore(deps): update helm release cilium to v1.19.1

chore(deps): update kube-prometheus-stack docker tag to v82.4.0 (#4232 )
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [kube-prometheus-stack](https://github.com/prometheus-operator/kube-prometheus) ([source](https://github.com/prometheus-community/helm-charts)) | minor | `82.3.0` → `82.4.0` | --- ### Release Notes <details> <summary>prometheus-community/helm-charts (kube-prometheus-stack)</summary> ### [`v82.4.0`](https://github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-82.4.0) [Compare Source](https://github.com/prometheus-community/helm-charts/compare/kube-prometheus-stack-82.3.0...kube-prometheus-stack-82.4.0) kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator. #### What's Changed - \[kube-prometheus-stack] unify PodDisruptionBudget configuration by [@mkmet](https://github.com/mkmet) in [#6669](https://github.com/prometheus-community/helm-charts/pull/6669) #### New Contributors - [@mkmet](https://github.com/mkmet) made their first contribution in [#6669](https://github.com/prometheus-community/helm-charts/pull/6669) **Full Changelog**: <https://github.com/prometheus-community/helm-charts/compare/prometheus-nginx-exporter-1.19.1...kube-prometheus-stack-82.4.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: #4232 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
2026-02-26 00:07:19 +00:00 · 2026-02-26 00:02:47 +00:00 · 2026-02-25 17:42:52 -06:00 · 2026-02-25 17:25:18 -06:00 · 2026-02-25 17:08:38 -06:00 · 2026-02-25 17:03:38 -06:00
26 changed files with 391 additions and 16 deletions
--- a/clusters/cl01tl/helm/authentik/templates/reference-grant.yaml
+++ b/clusters/cl01tl/helm/authentik/templates/reference-grant.yaml
@@ -0,0 +1,39 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-outpost-cross-namespace-access
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: allow-outpost-cross-namespace-access
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: lidarr
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: radarr
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: radarr-4k
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: radarr-anime
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: radarr-standup
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: sonarr
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: sonarr-4k
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: sonarr-anime
+  to:
+    - group: ""
+      kind: Service
+      name: ak-outpost-traefik-proxy-auth
--- a/clusters/cl01tl/helm/booklore/Chart.yaml
+++ b/clusters/cl01tl/helm/booklore/Chart.yaml
@@ -30,4 +30,4 @@ dependencies:
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
 # renovate: datasource=github-releases depName=booklore-app/BookLore
-appVersion: v2.0.1
+appVersion: v2.0.2
--- a/clusters/cl01tl/helm/booklore/values.yaml
+++ b/clusters/cl01tl/helm/booklore/values.yaml
@@ -9,7 +9,7 @@ booklore:
        main:
          image:
            repository: ghcr.io/booklore-app/booklore
-            tag: v2.0.1
+            tag: v2.0.2
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/cilium/Chart.lock
+++ b/clusters/cl01tl/helm/cilium/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
  repository: https://helm.cilium.io/
-  version: 1.18.6
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
-generated: "2026-02-05T12:00:20.15778-06:00"
+  version: 1.19.1
+digest: sha256:bf5e8b3233c18bdb9409bb98c9a7ea4114e0e04e8489a49fdb2d29ded0cfa429
+generated: "2026-02-26T00:07:10.014164289Z"
--- a/clusters/cl01tl/helm/cilium/Chart.yaml
+++ b/clusters/cl01tl/helm/cilium/Chart.yaml
@@ -15,7 +15,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: cilium
-    version: 1.18.6
+    version: 1.19.1
    repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
--- a/clusters/cl01tl/helm/elastic-operator/Chart.lock
+++ b/clusters/cl01tl/helm/elastic-operator/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: eck-operator
  repository: https://helm.elastic.co
-  version: 3.3.0
-digest: sha256:d2b00de6c03bf7624fdf496b326262149a2d2635012f14e900ed0724545c95d9
-generated: "2026-02-03T18:05:00.461644575Z"
+  version: 3.3.1
+digest: sha256:8585f3ea3e4cafc4ff2969ea7e797017b7cfe4becb3385f0b080725908c02f09
+generated: "2026-02-25T18:48:55.77034549Z"
--- a/clusters/cl01tl/helm/elastic-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/elastic-operator/Chart.yaml
@@ -15,8 +15,8 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: eck-operator
-    version: 3.3.0
+    version: 3.3.1
    repository: https://helm.elastic.co
 icon: https://helm.elastic.co/icons/eck.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s
-appVersion: v3.3.0
+appVersion: v3.3.1
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock
@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
  repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.3.0
+  version: 82.4.0
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.6.2
 - name: redis-replication
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.0.4
-digest: sha256:41de0559e2f4e85a33ca006520cf67c85abaf5691f3cd0aacf7b66ba0d95ce50
-generated: "2026-02-24T20:10:32.588038295Z"
+digest: sha256:24214c0bc1e6aed9954385aa61b403a7fa4b4e92bac09777504635cba98735ba
+generated: "2026-02-25T23:46:14.059155578Z"
--- a/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
+++ b/clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml
@@ -20,7 +20,7 @@ maintainers:
  - name: alexlebens
 dependencies:
  - name: kube-prometheus-stack
-    version: 82.3.0
+    version: 82.4.0
    repository: oci://ghcr.io/prometheus-community/charts
  - name: app-template
    alias: ntfy-alertmanager
--- a/clusters/cl01tl/helm/lidarr/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/lidarr/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/lidarr/values.yaml
+++ b/clusters/cl01tl/helm/lidarr/values.yaml
@@ -84,12 +84,28 @@ lidarr:
      hostnames:
        - lidarr.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: lidarr
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/radarr-4k/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/radarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/radarr-4k/values.yaml
@@ -84,12 +84,28 @@ radarr-4k:
      hostnames:
        - radarr-4k.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: radarr-4k
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/radarr-anime/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/radarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/radarr-anime/values.yaml
@@ -82,12 +82,28 @@ radarr-anime:
      hostnames:
        - radarr-anime.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: radarr-anime
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/radarr-standup/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/radarr-standup/values.yaml
+++ b/clusters/cl01tl/helm/radarr-standup/values.yaml
@@ -82,12 +82,28 @@ radarr-standup:
      hostnames:
        - radarr-standup.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: radarr-standup
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/radarr/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/radarr/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/radarr/values.yaml
+++ b/clusters/cl01tl/helm/radarr/values.yaml
@@ -84,12 +84,28 @@ radarr:
      hostnames:
        - radarr.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: radarr
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/sonarr-4k/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/sonarr-4k/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-4k/values.yaml
@@ -82,12 +82,28 @@ sonarr-4k:
      hostnames:
        - sonarr-4k.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: sonarr-4k
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/sonarr-anime/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/sonarr-anime/values.yaml
+++ b/clusters/cl01tl/helm/sonarr-anime/values.yaml
@@ -82,12 +82,28 @@ sonarr-anime:
      hostnames:
        - sonarr-anime.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: sonarr-anime
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/sonarr/templates/middleware.yaml
+++ b/clusters/cl01tl/helm/sonarr/templates/middleware.yaml
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-forward-auth
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: oidc-forward-auth
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-entitlements
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
--- a/clusters/cl01tl/helm/sonarr/values.yaml
+++ b/clusters/cl01tl/helm/sonarr/values.yaml
@@ -82,12 +82,28 @@ sonarr:
      hostnames:
        - sonarr.alexlebens.net
      rules:
+        - backendRefs:
+            - name: ak-outpost-traefik-proxy-auth
+              namespace: authentik
+              port: 9000
+              weight: 100
+          filters: []
+          matches:
+            - path:
+                type: PathPrefix
+                value: /outpost.goauthentik.io
        - backendRefs:
            - group: ''
              kind: Service
              name: sonarr
              port: 80
              weight: 100
+          filters:
+            - type: ExtensionRef
+              extensionRef:
+                group: traefik.io
+                kind: Middleware
+                name: oidc-forward-auth
          matches:
            - path:
                type: PathPrefix
--- a/clusters/cl01tl/helm/tailscale-operator/Chart.yaml
+++ b/clusters/cl01tl/helm/tailscale-operator/Chart.yaml
@@ -21,4 +21,4 @@ dependencies:
    repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.94.1
+appVersion: v1.94.2
Author	SHA1	Message	Date
Renovate Bot	e03d1f0d41	chore(deps): update helm release cilium to v1.19.1 All checks were successful lint-test-helm / lint-helm (pull_request) Successful in 2m0s Details	2026-02-26 00:07:19 +00:00
Renovate Bot	fbc8b4014f	chore(deps): update kube-prometheus-stack docker tag to v82.4.0 (#4232 ) All checks were successful render-manifests-push / render-manifests-push (push) Has been skipped Details lint-test-helm / lint-helm (push) Successful in 1m37s Details renovate / renovate (push) Successful in 3m12s Details This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [kube-prometheus-stack](https://github.com/prometheus-operator/kube-prometheus) ([source](https://github.com/prometheus-community/helm-charts)) \| minor \| `82.3.0` → `82.4.0` \| --- ### Release Notes <details> <summary>prometheus-community/helm-charts (kube-prometheus-stack)</summary> ### [`v82.4.0`](https://github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-82.4.0) [Compare Source](https://github.com/prometheus-community/helm-charts/compare/kube-prometheus-stack-82.3.0...kube-prometheus-stack-82.4.0) kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator. #### What's Changed - \[kube-prometheus-stack] unify PodDisruptionBudget configuration by [@mkmet](https://github.com/mkmet) in [#6669](https://github.com/prometheus-community/helm-charts/pull/6669) #### New Contributors - [@mkmet](https://github.com/mkmet) made their first contribution in [#6669](https://github.com/prometheus-community/helm-charts/pull/6669) Full Changelog: <https://github.com/prometheus-community/helm-charts/compare/prometheus-nginx-exporter-1.19.1...kube-prometheus-stack-82.4.0> </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNS43IiwidXBkYXRlZEluVmVyIjoiNDMuMjUuNyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=--> Reviewed-on: #4232 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>	2026-02-26 00:02:47 +00:00
Alex Lebens	7411f391e8	feat: add proxy auth All checks were successful lint-test-helm / lint-helm (push) Successful in 1m21s Details render-manifests-push / render-manifests-push (push) Successful in 4m17s Details renovate / renovate (push) Successful in 5m3s Details	2026-02-25 17:42:52 -06:00
Alex Lebens	536e164b03	fix: change headers All checks were successful lint-test-helm / lint-helm (push) Successful in 40s Details render-manifests-push / render-manifests-push (push) Successful in 2m26s Details renovate / renovate (push) Successful in 3m3s Details	2026-02-25 17:25:18 -06:00
Alex Lebens	ade761cc85	feat: add reference grant All checks were successful lint-test-helm / lint-helm (push) Successful in 47s Details render-manifests-push / render-manifests-push (push) Successful in 2m2s Details renovate / renovate (push) Successful in 3m24s Details	2026-02-25 17:08:38 -06:00
Alex Lebens	218cb6c9de	fix: apply rule for routing All checks were successful lint-test-helm / lint-helm (push) Successful in 40s Details render-manifests-push / render-manifests-push (push) Successful in 1m52s Details renovate / renovate (push) Successful in 3m30s Details	2026-02-25 17:03:38 -06:00
Alex Lebens	9ba91dd00b	fix: fix headers All checks were successful lint-test-helm / lint-helm (push) Successful in 1m18s Details render-manifests-push / render-manifests-push (push) Successful in 2m38s Details renovate / renovate (push) Successful in 3m9s Details	2026-02-25 16:44:58 -06:00
Alex Lebens	4c02107d95	fix: fix placement All checks were successful lint-test-helm / lint-helm (push) Successful in 31s Details render-manifests-push / render-manifests-push (push) Successful in 1m26s Details renovate / renovate (push) Successful in 4m13s Details	2026-02-25 16:27:01 -06:00
Alex Lebens	4faecf7888	feat: add proxy auth Some checks failed lint-test-helm / lint-helm (push) Successful in 30s Details render-manifests-push / render-manifests-push (push) Failing after 1m3s Details renovate / renovate (push) Has been cancelled Details	2026-02-25 16:24:43 -06:00
Renovate Bot	b0e7da062a	chore(deps): update dependency elastic/cloud-on-k8s to v3.3.1 (#4237 ) All checks were successful render-manifests-push / render-manifests-push (push) Has been skipped Details lint-test-helm / lint-helm (push) Successful in 1m1s Details renovate / renovate (push) Successful in 2m32s Details	2026-02-25 21:47:42 +00:00
Renovate Bot	91540f1955	chore(deps): update booklore-app/booklore to v2.0.2 (#4236 ) Some checks failed render-manifests-push / render-manifests-push (push) Has been skipped Details lint-test-helm / lint-helm (push) Has been cancelled Details renovate / renovate (push) Has been cancelled Details	2026-02-25 21:47:16 +00:00
Renovate Bot	cd35da4bed	chore(deps): update helm release eck-operator to v3.3.1 (#4234 ) All checks were successful render-manifests-push / render-manifests-push (push) Has been skipped Details lint-test-helm / lint-helm (push) Successful in 44s Details renovate / renovate (push) Successful in 3m7s Details	2026-02-25 18:49:22 +00:00
Renovate Bot	752c9fc47d	chore(deps): update dependency tailscale/tailscale to v1.94.2 (#4233 ) Some checks failed render-manifests-push / render-manifests-push (push) Has been skipped Details lint-test-helm / lint-helm (push) Failing after 6s Details renovate / renovate (push) Has been cancelled Details	2026-02-25 18:48:42 +00:00
Renovate Bot	826558ae44	chore(deps): update helm release authentik to v2026 (#4227 ) All checks were successful render-manifests-push / render-manifests-push (push) Has been skipped Details lint-test-helm / lint-helm (push) Successful in 24s Details renovate / renovate (push) Successful in 1m52s Details Reviewed-on: #4227 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>	2026-02-25 04:46:25 +00:00