chore(deps): update cilium to v1.19.2

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.91.1@sha256:63e27dd3ed7dd5feb755e0f3c8e50516f5845be124311b4f6b3c898b5d767b49
+    container: ghcr.io/renovatebot/renovate:43.89.3@sha256:95ef56f2595ea6ee1acac7c9ef6c8e2112a9be0699a42df9921310923aed7167
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/actual/values.yaml

@@ -14,8 +14,8 @@ actual:
               value: 5006
           resources:
             requests:
-              cpu: 10m
+              cpu: 25m
-              memory: 50Mi
+              memory: 64Mi
           probes:
             liveness:
               enabled: true

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -30,8 +30,8 @@ argo-workflows:
     cronWorkflowWorkers: 2
     resources:
       requests:
-        cpu: 1m
+        cpu: 10m
-        memory: 20Mi
+        memory: 32Mi
     serviceMonitor:
       enabled: true
     workflowNamespaces:
@@ -76,7 +76,7 @@ argo-events:
   controller:
     resources:
       requests:
-        cpu: 1m
+        cpu: 10m
         memory: 32Mi
     metrics:
       enabled: true
@@ -86,8 +86,8 @@ argo-events:
     enabled: true
     resources:
       requests:
-        cpu: 1m
+        cpu: 10m
-        memory: 20Mi
+        memory: 32Mi
 postgres-18-cluster:
   mode: recovery
   recovery:

clusters/cl01tl/helm/argocd/values.yaml

@@ -34,7 +34,7 @@ argo-cd:
     replicas: 1
     resources:
       requests:
-        cpu: 100m
+        cpu: 15m
         memory: 1Gi
     readinessProbe:
       failureThreshold: 3
@@ -77,7 +77,7 @@ argo-cd:
     enabled: true
     resources:
       requests:
-        cpu: 1m
+        cpu: 10m
         memory: 64Mi
     metrics:
       enabled: true
@@ -98,7 +98,7 @@ argo-cd:
       resources:
         requests:
           cpu: 1000m
-          memory: 50Mi
+          memory: 64Mi
     haproxy:
       enabled: true
       image:
@@ -106,8 +106,8 @@ argo-cd:
         tag: 3.3.6-alpine@sha256:744be2dca649a44d490a4c565d36968d19482dd387f1bdd44c168f4322bc6b1e
       resources:
         requests:
-          cpu: 5m
+          cpu: 10m
-          memory: 90Mi
+          memory: 128Mi
       metrics:
         enabled: true
         serviceMonitor:
@@ -138,8 +138,8 @@ argo-cd:
     replicas: 2
     resources:
      requests:
-       cpu: 20m
+       cpu: 10m
-       memory: 80Mi
+       memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -157,8 +157,8 @@ argo-cd:
     replicas: 2
     resources:
       requests:
-        cpu: 1m
+        cpu: 10m
-        memory: 50Mi
+        memory: 64Mi
     readinessProbe:
       enabled: true
       failureThreshold: 3
@@ -182,7 +182,7 @@ argo-cd:
     resources:
       requests:
         cpu: 10m
-        memory: 50Mi
+        memory: 64Mi
     metrics:
       enabled: true
       serviceMonitor:
@@ -218,8 +218,8 @@ argo-cd:
             value: Bearer $ntfy-token
     resources:
       requests:
-        cpu: 2m
+        cpu: 10m
-        memory: 50Mi
+        memory: 64Mi
     livenessProbe:
       enabled: true
     readinessProbe:

clusters/cl01tl/helm/audiobookshelf/values.yaml

@@ -18,7 +18,7 @@ audiobookshelf:
               value: America/Chicago
           resources:
             requests:
-              cpu: 1m
+              cpu: 10m
               memory: 200Mi
         apprise-api:
           image:

clusters/cl01tl/helm/authentik/values.yaml

@@ -33,7 +33,7 @@ authentik:
     replicas: 2
     resources:
       requests:
-        cpu: 20m
+        cpu: 100m
         memory: 700Mi
     livenessProbe:
       failureThreshold: 3
@@ -66,8 +66,8 @@ authentik:
     replicas: 2
     resources:
       requests:
-        cpu: 80m
+        cpu: 100m
-        memory: 650Mi
+        memory: 512Mi
     metrics:
       enabled: true
       serviceMonitor:

clusters/cl01tl/helm/backrest/values.yaml

@@ -22,8 +22,8 @@ backrest:
               value: /tmp
           resources:
             requests:
-              cpu: 1m
+              cpu: 10m
-              memory: 30Mi
+              memory: 80Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/bazarr/values.yaml

@@ -14,7 +14,7 @@ bazarr:
         main:
           image:
             repository: ghcr.io/linuxserver/bazarr
-            tag: v1.5.6-ls342@sha256:9a631194c0dee21c85b5bff59e23610e1ae2f54594e922973949d271102e585e
+            tag: 1.5.6@sha256:05f9d5b24884f37120453dc1a008a47be244eebec32099ae1bd29032e75b67aa
           env:
             - name: TZ
               value: America/Chicago
@@ -23,11 +23,9 @@ bazarr:
             - name: PGID
               value: 1000
           resources:
-            limits:
-              cpu: 100m
             requests:
-              cpu: 1m
+              cpu: 10m
-              memory: 250Mi
+              memory: 256Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/blocky/values.yaml

@@ -15,7 +15,7 @@ blocky:
           resources:
             requests:
               cpu: 10m
-              memory: 100Mi
+              memory: 90Mi
   configMaps:
     config:
       enabled: true

clusters/cl01tl/helm/cilium/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
   repository: https://helm.cilium.io/
-  version: 1.18.6
+  version: 1.19.2
-digest: sha256:8ea328ac238524b5b423e6289f5e25d05ef64e6aa19cfd5de238f1d5dd533e9b
+digest: sha256:11f8eef4733b70c2b9a91ce39fe3c1ea1ad3fa3c46750efb015e03ff6ea3655b
-generated: "2026-02-05T12:00:20.15778-06:00"
+generated: "2026-03-25T02:58:57.58573105Z"

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -14,8 +14,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.18.6
+    version: 1.19.2
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
-appVersion: 1.18.6
+appVersion: 1.19.2

clusters/cl01tl/helm/cloudnative-pg/values.yaml

@@ -3,7 +3,7 @@ cloudnative-pg:
   resources:
     requests:
       cpu: 10m
-      memory: 100Mi
+      memory: 64Mi
   monitoring:
     podMonitorEnabled: true
 plugin-barman-cloud:
@@ -12,5 +12,5 @@ plugin-barman-cloud:
     create: true
   resources:
     requests:
-      cpu: 1m
+      cpu: 10m
-      memory: 20Mi
+      memory: 64Mi

clusters/cl01tl/helm/code-server/values.yaml

@@ -27,8 +27,8 @@ code-server:
                 name: codeserver-password-secret
           resources:
             requests:
-              cpu: 1m
+              cpu: 10m
-              memory: 50Mi
+              memory: 80Mi
   service:
     main:
       controller: main

clusters/cl01tl/helm/coredns/values.yaml

@@ -8,8 +8,8 @@ coredns:
       cpu: null
       memory: null
     requests:
-      cpu: 30m
+      cpu: 20m
-      memory: 30Mi
+      memory: 32Mi
   prometheus:
     service:
       enabled: true

clusters/cl01tl/helm/dawarich/values.yaml

@@ -106,7 +106,7 @@ dawarich:
                 timeoutSeconds: 10
           resources:
             requests:
-              cpu: 20m
+              cpu: 10m
               memory: 750Mi
         sidekiq:
           image:

clusters/cl01tl/helm/democratic-csi-synology-iscsi/Chart.yaml

@@ -5,7 +5,8 @@ description: Democratic CSI
 keywords:
   - democratic-csi-synology-iscsi
   - iscsi
-home: https://docs.alexlebens.dev/applications/democratic-csi-synology-iscsi/
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/0cc6ba65-024b-4489-952a-fc0f647fd099
 sources:
   - https://github.com/democratic-csi/democratic-csi
   - https://github.com/democratic-csi/charts/tree/master/stable/democratic-csi

clusters/cl01tl/helm/democratic-csi-synology-iscsi/templates/external-secret.yaml

@@ -14,5 +14,8 @@ spec:
   data:
     - secretKey: driver-config-file.yaml
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: /cl01tl/democratic-csi-synology-iscsi/config
+        metadataPolicy: None
         property: driver-config-file.yaml

clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml

@@ -3,13 +3,12 @@ democratic-csi:
     existingConfigSecret: synology-iscsi-config-secret
     config:
       driver: synology-iscsi
-    resources:
-      requests:
-        cpu: 1m
-        memory: 128Mi
   csiDriver:
     name: "org.democratic-csi.iscsi-synology"
   controller:
+    enabled: true
+    rbac:
+      enabled: true
     replicaCount: 2
   storageClasses:
     - name: synology-iscsi-delete

clusters/cl01tl/helm/descheduler/Chart.yaml

@@ -5,7 +5,8 @@ description: Descheduler
 keywords:
   - descheduler
   - kube-scheduler
-home: https://docs.alexlebens.dev/applications/descheduler/
+  - kubernetes
+home: https://wiki.alexlebens.dev/s/0c38b7e4-4573-487c-82b0-4eeeb00e1276
 sources:
   - https://github.com/kubernetes-sigs/descheduler
   - https://github.com/kubernetes-sigs/descheduler/tree/master/charts/descheduler

clusters/cl01tl/helm/descheduler/values.yaml

@@ -1,22 +1,27 @@
 descheduler:
   kind: Deployment
   resources:
-    limits:
-      cpu: null
-      memory: null
     requests:
       cpu: 10m
-      memory: 50Mi
+      memory: 64Mi
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    privileged: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
   deschedulingInterval: 5m
-  replicas: 3
+  replicas: 1
   leaderElection:
-    enabled: true
+    enabled: false
-    leaseDuration: 15s
+  command:
-    renewDeadline: 10s
+  - "/bin/descheduler"
-    retryPeriod: 2s
+  cmdOptions:
-    resourceLock: "leases"
+    v: 3
-    resourceName: "descheduler"
+  deschedulerPolicyAPIVersion: "descheduler/v1alpha2"
-    resourceNamespace: "descheduler"
   deschedulerPolicy:
     profiles:
       - name: default
@@ -48,13 +53,13 @@ descheduler:
           - name: LowNodeUtilization
             args:
               thresholds:
-                cpu: 20
+                cpu: 30
-                memory: 20
+                memory: 30
-                pods: 20
+                pods: 50
               targetThresholds:
-                cpu: 50
+                cpu: 60
-                memory: 50
+                memory: 40
-                pods: 60
+                pods: 80
         plugins:
           balance:
             enabled:

clusters/cl01tl/helm/prometheus-operator-crds/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: prometheus-operator-crds
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 28.0.1
+  version: 28.0.0
-digest: sha256:08da63acfe8efd347973d0997698524fa26bbd9df82812973ad73a453696e743
+digest: sha256:82e19c59373b1dd1a854a4e5699c7b864cfbb96e58a065f53ad76e64d7109cff
-generated: "2026-03-25T20:54:34.44672523Z"
+generated: "2026-03-19T22:02:57.659253727Z"

clusters/cl01tl/helm/prometheus-operator-crds/Chart.yaml

@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: prometheus-operator-crds
-    version: 28.0.1
+    version: 28.0.0
     repository: oci://ghcr.io/prometheus-community/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prometheus.png
 # renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:a98723bfb01fb3b8b18a9e33890184b91d270b3fb51f75875a0ad1908ce7b463
+            tag: latest@sha256:c4850cf4ad1954a4d93e0ad5aa8ce2c5b6ba067c889355ce970d820ac6080722
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:a98723bfb01fb3b8b18a9e33890184b91d270b3fb51f75875a0ad1908ce7b463
+            tag: latest@sha256:c4850cf4ad1954a4d93e0ad5aa8ce2c5b6ba067c889355ce970d820ac6080722
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.9.0
+            tag: 0.8.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.16.0
+            tag: 3.15.1
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/tdarr/values.yaml

@@ -9,7 +9,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr
-            tag: 2.66.01
+            tag: 2.65.01
             pullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -48,7 +48,7 @@ tdarr:
         main:
           image:
             repository: ghcr.io/haveagitgat/tdarr_node
-            tag: 2.66.01
+            tag: 2.65.01
             pullPolicy: IfNotPresent
           env:
             - name: TZ

renovate.json

@@ -73,15 +73,6 @@
       ],
       "enabled": false
     },
-    {
-      "description": "Versioning for LinuxServer images",
-      "versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<revision>\\d+)$",
-      "matchPackageNames": [
-        "/^linuxserver\\//",
-        "/^ghcr\\.io/linuxserver\\//",
-        "/^lscr\\.io/linuxserver\\//"
-      ]
-    },
     {
       "description": "Label by datasource",
       "matchDatasources": [
@@ -134,7 +125,7 @@
       "groupName": "{{#if packageName}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' packageName)}}}{{else}}{{{replace 'ghcr.io/' '' (replace 'docker.io/' '' depName)}}}{{/if}}",
       "groupSlug": "unified-{{{groupName}}}",
       "addLabels": [
-        "docker"
+        "image"
       ],
       "automerge": false
     },
@@ -158,10 +149,10 @@
     },
     {
       "description": "Group apps by their keyword",
-      "groupName": "{{{replace '^.*(dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd).*$' '$1' depName}}}",
+      "groupName": "{{{replace '^.*(dawarich|komodo|immich|home-assistant|element-web|cilium).*$' '$1' depName}}}",
       "groupSlug": "unified-{{{groupName}}}",
       "matchPackageNames": [
-        "/(^|/)(?<appName>dawarich|komodo|immich|home-assistant|element-web|cilium|tdarr|argo-cd)/"
+        "/(^|/)(?<appName>dawarich|komodo|immich|home-assistant|element-web|cilium)/"
       ]
     },
     {