chore(deps): update helm release authentik to v2026

clusters/cl01tl/helm/authentik/Chart.lock

@@ -12,4 +12,4 @@ dependencies:
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 1.0.4
 digest: sha256:c8602f093e78af87eac0c99d622f0815ec89ebc1305e097ca4d6f72b003ae57c
-generated: "2026-02-25T03:06:14.95787836Z"
+generated: "2026-02-25T00:28:26.034311747Z"

clusters/cl01tl/helm/authentik/templates/reference-grant.yaml

@@ -1,39 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: ReferenceGrant
-metadata:
-  name: allow-outpost-cross-namespace-access
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: allow-outpost-cross-namespace-access
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: lidarr
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr-4k
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr-anime
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr-standup
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: sonarr
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: sonarr-4k
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: sonarr-anime
-  to:
-    - group: ""
-      kind: Service
-      name: ak-outpost-traefik-proxy-auth

clusters/cl01tl/helm/booklore/Chart.yaml

@@ -30,4 +30,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
 # renovate: datasource=github-releases depName=booklore-app/BookLore
-appVersion: v2.0.2
+appVersion: v2.0.1

clusters/cl01tl/helm/booklore/values.yaml

@@ -9,7 +9,7 @@ booklore:
         main:
           image:
             repository: ghcr.io/booklore-app/booklore
-            tag: v2.0.2
+            tag: v2.0.1
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/elastic-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: eck-operator
   repository: https://helm.elastic.co
-  version: 3.3.1
+  version: 3.3.0
-digest: sha256:8585f3ea3e4cafc4ff2969ea7e797017b7cfe4becb3385f0b080725908c02f09
+digest: sha256:d2b00de6c03bf7624fdf496b326262149a2d2635012f14e900ed0724545c95d9
-generated: "2026-02-25T18:48:55.77034549Z"
+generated: "2026-02-03T18:05:00.461644575Z"

clusters/cl01tl/helm/elastic-operator/Chart.yaml

@@ -15,8 +15,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: eck-operator
-    version: 3.3.1
+    version: 3.3.0
     repository: https://helm.elastic.co
 icon: https://helm.elastic.co/icons/eck.png
 # renovate: datasource=github-releases depName=elastic/cloud-on-k8s
-appVersion: v3.3.1
+appVersion: v3.3.0

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.4.0
+  version: 82.3.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: redis-replication
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 1.0.4
-digest: sha256:24214c0bc1e6aed9954385aa61b403a7fa4b4e92bac09777504635cba98735ba
+digest: sha256:41de0559e2f4e85a33ca006520cf67c85abaf5691f3cd0aacf7b66ba0d95ce50
-generated: "2026-02-25T23:46:14.059155578Z"
+generated: "2026-02-24T20:10:32.588038295Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.4.0
+    version: 82.3.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/lidarr/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/lidarr/values.yaml

@@ -84,28 +84,12 @@ lidarr:
       hostnames:
         - lidarr.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: lidarr
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/radarr-4k/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/radarr-4k/values.yaml

@@ -84,28 +84,12 @@ radarr-4k:
       hostnames:
         - radarr-4k.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: radarr-4k
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/radarr-anime/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/radarr-anime/values.yaml

@@ -82,28 +82,12 @@ radarr-anime:
       hostnames:
         - radarr-anime.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: radarr-anime
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/radarr-standup/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/radarr-standup/values.yaml

@@ -82,28 +82,12 @@ radarr-standup:
       hostnames:
         - radarr-standup.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: radarr-standup
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/radarr/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/radarr/values.yaml

@@ -84,28 +84,12 @@ radarr:
       hostnames:
         - radarr.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: radarr
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/sonarr-4k/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/sonarr-4k/values.yaml

@@ -82,28 +82,12 @@ sonarr-4k:
       hostnames:
         - sonarr-4k.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: sonarr-4k
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/sonarr-anime/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/sonarr-anime/values.yaml

@@ -82,28 +82,12 @@ sonarr-anime:
       hostnames:
         - sonarr-anime.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: sonarr-anime
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/sonarr/templates/middleware.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: oidc-forward-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: oidc-forward-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  forwardAuth:
-    address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-entitlements
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-      - X-authentik-jwt
-      - X-authentik-meta-jwks
-      - X-authentik-meta-outpost
-      - X-authentik-meta-provider
-      - X-authentik-meta-app
-      - X-authentik-meta-version

clusters/cl01tl/helm/sonarr/values.yaml

@@ -82,28 +82,12 @@ sonarr:
       hostnames:
         - sonarr.alexlebens.net
       rules:
-        - backendRefs:
-            - name: ak-outpost-traefik-proxy-auth
-              namespace: authentik
-              port: 9000
-              weight: 100
-          filters: []
-          matches:
-            - path:
-                type: PathPrefix
-                value: /outpost.goauthentik.io
         - backendRefs:
             - group: ''
               kind: Service
               name: sonarr
               port: 80
               weight: 100
-          filters:
-            - type: ExtensionRef
-              extensionRef:
-                group: traefik.io
-                kind: Middleware
-                name: oidc-forward-auth
           matches:
             - path:
                 type: PathPrefix

clusters/cl01tl/helm/tailscale-operator/Chart.yaml

@@ -21,4 +21,4 @@ dependencies:
     repository: https://pkgs.tailscale.com/helmcharts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/tailscale-light.png
 # renovate: datasource=github-releases depName=tailscale/tailscale
-appVersion: v1.94.2
+appVersion: v1.94.1

clusters/cl01tl/helm/talos/values.yaml

@@ -69,7 +69,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:e83b0838f1bb144bc90fa98aa846cb36db62bc737832f3c5e02825b514059ffd
+            tag: latest@sha256:56a7122d9edbb82b372f10dc06809b7ae569ec7906f6b83b7d7b27fa8d638da2
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -155,7 +155,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:e83b0838f1bb144bc90fa98aa846cb36db62bc737832f3c5e02825b514059ffd
+            tag: latest@sha256:56a7122d9edbb82b372f10dc06809b7ae569ec7906f6b83b7d7b27fa8d638da2
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -241,7 +241,7 @@ etcd-backup:
         s3-prune:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:e83b0838f1bb144bc90fa98aa846cb36db62bc737832f3c5e02825b514059ffd
+            tag: latest@sha256:56a7122d9edbb82b372f10dc06809b7ae569ec7906f6b83b7d7b27fa8d638da2
             pullPolicy: IfNotPresent
           command:
             - /bin/sh

clusters/cl01tl/helm/vault/values.yaml

@@ -187,7 +187,7 @@ snapshot:
         s3-backup-local:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:e83b0838f1bb144bc90fa98aa846cb36db62bc737832f3c5e02825b514059ffd
+            tag: latest@sha256:56a7122d9edbb82b372f10dc06809b7ae569ec7906f6b83b7d7b27fa8d638da2
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -208,7 +208,7 @@ snapshot:
         s3-backup-remote:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:e83b0838f1bb144bc90fa98aa846cb36db62bc737832f3c5e02825b514059ffd
+            tag: latest@sha256:56a7122d9edbb82b372f10dc06809b7ae569ec7906f6b83b7d7b27fa8d638da2
             pullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -229,7 +229,7 @@ snapshot:
         s3-backup-external:
           image:
             repository: d3fk/s3cmd
-            tag: latest@sha256:e83b0838f1bb144bc90fa98aa846cb36db62bc737832f3c5e02825b514059ffd
+            tag: latest@sha256:56a7122d9edbb82b372f10dc06809b7ae569ec7906f6b83b7d7b27fa8d638da2
             pullPolicy: IfNotPresent
           command:
             - /bin/sh