2025-12-18 03:20:33 +00:00
43 changed files with 3379 additions and 142 deletions
--- a/clusters/cl01tl/manifests/booklore/Deployment-booklore.yaml
+++ b/clusters/cl01tl/manifests/booklore/Deployment-booklore.yaml
@@ -50,7 +50,7 @@ spec:
              value: "6060"
            - name: SWAGGER_ENABLED
              value: "false"
-          image: ghcr.io/booklore-app/booklore:v1.13.2
+          image: ghcr.io/booklore-app/booklore:v1.14.1
          imagePullPolicy: IfNotPresent
          name: main
          resources:
--- a/clusters/cl01tl/manifests/code-server/Deployment-code-server.yaml
+++ b/clusters/cl01tl/manifests/code-server/Deployment-code-server.yaml
@@ -46,7 +46,7 @@ spec:
          envFrom:
            - secretRef:
                name: codeserver-password-secret
-          image: ghcr.io/linuxserver/code-server:4.106.3@sha256:83793e4460090d6c46f4842ff6ab8aa26ad8a567885112bbe754b45c61935055
+          image: ghcr.io/linuxserver/code-server:4.107.0@sha256:0d48d3a48b7db214556bea453ed371f0d295130fb5c3d43534aedb41627446f2
          imagePullPolicy: IfNotPresent
          name: main
          resources:
--- a/clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml
+++ b/clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml
@@ -47,7 +47,7 @@ spec:
              rm -rf /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
              cp -r xExtension-YouTubeChannel2RssFeed /var/www/FreshRSS/extensions
              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
-          image: alpine:3.23.0
+          image: alpine:3.23.2
          imagePullPolicy: IfNotPresent
          name: init-download-extension-1
          resources:
@@ -72,7 +72,7 @@ spec:
              rm -rf /var/www/FreshRSS/extensions/xExtension-ImageProxy
              cp -r xExtension-ImageProxy /var/www/FreshRSS/extensions
              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-ImageProxy
-          image: alpine:3.23.0
+          image: alpine:3.23.2
          imagePullPolicy: IfNotPresent
          name: init-download-extension-2
          resources:
@@ -95,7 +95,7 @@ spec:
              mkdir /var/www/FreshRSS/extensions/xExtension-karakeep-button
              cp -r /tmp/xExtension-karakeep-button-*/* /var/www/FreshRSS/extensions/xExtension-karakeep-button
              chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-karakeep-button
-          image: alpine:3.23.0
+          image: alpine:3.23.2
          imagePullPolicy: IfNotPresent
          name: init-download-extension-3
          resources:
--- a/clusters/cl01tl/manifests/gitea/ConfigMap-gitea-meilisearch-environment.yaml
+++ b/clusters/cl01tl/manifests/gitea/ConfigMap-gitea-meilisearch-environment.yaml
@@ -3,10 +3,10 @@ kind: ConfigMap
 metadata:
  name: gitea-meilisearch-environment
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/gitea/PersistentVolumeClaim-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/PersistentVolumeClaim-gitea-meilisearch.yaml
@@ -3,10 +3,10 @@ apiVersion: v1
 metadata:
  name: gitea-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/gitea/Pod-gitea-meilisearch-test-connection.yaml
+++ b/clusters/cl01tl/manifests/gitea/Pod-gitea-meilisearch-test-connection.yaml
@@ -4,7 +4,7 @@ metadata:
  name: gitea-meilisearch-test-connection
  labels:
    app.kubernetes.io/name: meilisearch
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
  annotations:
--- a/clusters/cl01tl/manifests/gitea/Service-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/Service-gitea-meilisearch.yaml
@@ -3,10 +3,10 @@ kind: Service
 metadata:
  name: gitea-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/ServiceAccount-gitea-meilisearch.yaml
@@ -3,10 +3,10 @@ kind: ServiceAccount
 metadata:
  name: gitea-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-meilisearch.yaml
@@ -4,10 +4,10 @@ metadata:
  name: gitea-meilisearch
  namespace: gitea
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
@@ -3,10 +3,10 @@ kind: StatefulSet
 metadata:
  name: gitea-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
@@ -20,15 +20,15 @@ spec:
  template:
    metadata:
      labels:
-        helm.sh/chart: meilisearch-0.18.0
+        helm.sh/chart: meilisearch-0.19.0
        app.kubernetes.io/name: meilisearch
        app.kubernetes.io/instance: gitea
-        app.kubernetes.io/version: "v1.29.0"
+        app.kubernetes.io/version: "v1.30.0"
        app.kubernetes.io/component: search-engine
        app.kubernetes.io/part-of: meilisearch
        app.kubernetes.io/managed-by: Helm
      annotations:
-        checksum/config: 0dcdfebbe9f0558f0a01c68e43d6ae46a5d6da6a1df0b04b4272cc4bd66a3c20
+        checksum/config: ba12cd39231aea0d6d2aaf47a345c3a877553132986a6a55e59b318d7da313bb
    spec:
      serviceAccountName: gitea-meilisearch
      securityContext:
@@ -45,7 +45,7 @@ spec:
            claimName: gitea-meilisearch
      containers:
        - name: meilisearch
-          image: "getmeili/meilisearch:v1.29.0"
+          image: "getmeili/meilisearch:v1.30.0"
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
--- a/clusters/cl01tl/manifests/grafana-operator/ClusterRole-grafana-operator.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/ClusterRole-grafana-operator.yaml
@@ -3,10 +3,10 @@ kind: ClusterRole
 metadata:
  name: grafana-operator
  labels:
-    helm.sh/chart: grafana-operator-v5.20.0
+    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/version: "v5.20.0"
+    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
@@ -62,20 +62,9 @@ rules:
      - update
      - watch
  - apiGroups:
-      - grafana.integreatly.org
+      - gateway.networking.k8s.io
    resources:
-      - grafanaalertrulegroups
-      - grafanacontactpoints
-      - grafanadashboards
-      - grafanadatasources
-      - grafanafolders
-      - grafanalibrarypanels
-      - grafanamutetimings
-      - grafananotificationpolicies
-      - grafananotificationpolicyroutes
-      - grafananotificationtemplates
-      - grafanas
-      - grafanaserviceaccounts
+      - httproutes
    verbs:
      - create
      - delete
@@ -87,35 +76,23 @@ rules:
  - apiGroups:
      - grafana.integreatly.org
    resources:
-      - grafanaalertrulegroups/finalizers
-      - grafanacontactpoints/finalizers
-      - grafanadashboards/finalizers
-      - grafanadatasources/finalizers
-      - grafanafolders/finalizers
-      - grafanalibrarypanels/finalizers
-      - grafanamutetimings/finalizers
-      - grafananotificationpolicies/finalizers
-      - grafananotificationpolicyroutes/finalizers
-      - grafananotificationtemplates/finalizers
-      - grafanas/finalizers
-      - grafanaserviceaccounts/finalizers
+      - '*'
    verbs:
+      - get
+      - list
+      - patch
+      - watch
+  - apiGroups:
+      - grafana.integreatly.org
+    resources:
+      - '*/finalizers'
+    verbs:
+      - patch
      - update
  - apiGroups:
      - grafana.integreatly.org
    resources:
-      - grafanaalertrulegroups/status
-      - grafanacontactpoints/status
-      - grafanadashboards/status
-      - grafanadatasources/status
-      - grafanafolders/status
-      - grafanalibrarypanels/status
-      - grafanamutetimings/status
-      - grafananotificationpolicies/status
-      - grafananotificationpolicyroutes/status
-      - grafananotificationtemplates/status
-      - grafanas/status
-      - grafanaserviceaccounts/status
+      - '*/status'
    verbs:
      - get
      - patch
--- a/clusters/cl01tl/manifests/grafana-operator/ClusterRoleBinding-grafana-operator.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/ClusterRoleBinding-grafana-operator.yaml
@@ -3,10 +3,10 @@ kind: ClusterRoleBinding
 metadata:
  name: grafana-operator
  labels:
-    helm.sh/chart: grafana-operator-v5.20.0
+    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/version: "v5.20.0"
+    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanaalertrulegroups.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanaalertrulegroups.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanaalertrulegroups.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -127,7 +127,6 @@ spec:
                  description: Name of the alert rule group. If not specified, the resource name will be used.
                  type: string
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
@@ -181,8 +180,7 @@ spec:
                        type: string
                      for:
                        default: 0s
-                        format: duration
-                        pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+                        pattern: ^([0-9]+(\.[0-9]+)?(s|m|h|d|w))+$
                        type: string
                      isPaused:
                        type: boolean
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanacontactpoints.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanacontactpoints.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanacontactpoints.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -53,7 +53,16 @@ spec:
                  description: Allow the Operator to match this resource with Grafanas outside the current namespace
                  type: boolean
                disableResolveMessage:
+                  description: |-
+                    Deprecated: define the receiver under .spec.receivers[]
+                    Will be removed in a later version
                  type: boolean
+                editable:
+                  description: Whether to enable or disable editing of the contact point in Grafana UI
+                  type: boolean
+                  x-kubernetes-validations:
+                    - message: spec.editable is immutable
+                      rule: self == oldSelf
                instanceSelector:
                  description: Selects Grafana instances for import
                  properties:
@@ -102,22 +111,119 @@ spec:
                    - message: spec.instanceSelector is immutable
                      rule: self == oldSelf
                name:
+                  description: |-
+                    Receivers are grouped under the same ContactPoint using the Name
+                    Defaults to the name of the CR
                  type: string
+                  x-kubernetes-validations:
+                    - message: spec.name is immutable
+                      rule: self == oldSelf
+                receivers:
+                  description: List of receivers that Grafana will fan out notifications to
+                  items:
+                    description: Represents an integration to external services that receive Grafana notifications
+                    properties:
+                      disableResolveMessage:
+                        type: boolean
+                      settings:
+                        x-kubernetes-preserve-unknown-fields: true
+                      type:
+                        minLength: 1
+                        type: string
+                      uid:
+                        description: Manually specify the UID the Contact Point is created with. Can be any string consisting of alphanumeric characters, - and _ with a maximum length of 40
+                        maxLength: 40
+                        pattern: ^[a-zA-Z0-9-_]+$
+                        type: string
+                      valuesFrom:
+                        items:
+                          properties:
+                            targetPath:
+                              type: string
+                            valueFrom:
+                              properties:
+                                configMapKeyRef:
+                                  description: Selects a key of a ConfigMap.
+                                  properties:
+                                    key:
+                                      description: The key to select.
+                                      type: string
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                    optional:
+                                      description: Specify whether the ConfigMap or its key must be defined
+                                      type: boolean
+                                  required:
+                                    - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                secretKeyRef:
+                                  description: Selects a key of a Secret.
+                                  properties:
+                                    key:
+                                      description: The key of the secret to select from.  Must be a valid secret key.
+                                      type: string
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                    optional:
+                                      description: Specify whether the Secret or its key must be defined
+                                      type: boolean
+                                  required:
+                                    - key
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              type: object
+                              x-kubernetes-validations:
+                                - message: Either configMapKeyRef or secretKeyRef must be set
+                                  rule: (has(self.configMapKeyRef) && !has(self.secretKeyRef)) || (!has(self.configMapKeyRef) && has(self.secretKeyRef))
+                          required:
+                            - targetPath
+                            - valueFrom
+                          type: object
+                        maxItems: 99
+                        type: array
+                    required:
+                      - settings
+                      - type
+                    type: object
+                  maxItems: 99
+                  type: array
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
                settings:
+                  description: |-
+                    Deprecated: define the receiver under .spec.receivers[]
+                    Will be removed in a later version
                  x-kubernetes-preserve-unknown-fields: true
                suspend:
                  description: Suspend pauses synchronizing attempts and tells the operator to ignore changes
                  type: boolean
                type:
+                  description: |-
+                    Deprecated: define the receiver under .spec.receivers[]
+                    Will be removed in a later version
                  minLength: 1
                  type: string
                uid:
-                  description: Manually specify the UID the Contact Point is created with. Can be any string consisting of alphanumeric characters, - and _ with a maximum length of 40
+                  description: |-
+                    Deprecated: define the receiver under .spec.receivers[]
+                    Manually specify the UID the Contact Point is created with. Can be any string consisting of alphanumeric characters, - and _ with a maximum length of 40
                  maxLength: 40
                  pattern: ^[a-zA-Z0-9-_]+$
                  type: string
@@ -125,6 +231,9 @@ spec:
                    - message: spec.uid is immutable
                      rule: self == oldSelf
                valuesFrom:
+                  description: |-
+                    Deprecated: define the receiver under .spec.receivers[]
+                    Will be removed in a later version
                  items:
                    properties:
                      targetPath:
@@ -187,13 +296,12 @@ spec:
                  type: array
              required:
                - instanceSelector
-                - name
-                - settings
-                - type
              type: object
              x-kubernetes-validations:
-                - message: spec.uid is immutable
-                  rule: ((!has(oldSelf.uid) && !has(self.uid)) || (has(oldSelf.uid) && has(self.uid)))
+                - message: spec.name is immutable
+                  rule: ((!has(oldSelf.name) && !has(self.name)) || (has(oldSelf.name) && has(self.name)))
+                - message: spec.editable is immutable
+                  rule: ((!has(oldSelf.editable) && !has(self.editable)) || (has(oldSelf.editable) && has(self.editable)))
                - message: disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state
                  rule: '!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)'
            status:
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanadashboards.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanadashboards.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanadashboards.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -315,7 +315,6 @@ spec:
                    type: object
                  type: array
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanadatasources.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanadatasources.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanadatasources.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -155,7 +155,6 @@ spec:
                    type: object
                  type: array
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanafolders.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanafolders.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanafolders.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -112,7 +112,6 @@ spec:
                  description: Raw json with folder permissions, potentially exported from Grafana
                  type: string
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanalibrarypanels.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanalibrarypanels.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanalibrarypanels.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -309,7 +309,6 @@ spec:
                    type: object
                  type: array
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanamutetimings.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanamutetimings.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanamutetimings.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -110,7 +110,6 @@ spec:
                  description: A unique name for the mute timing
                  type: string
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafananotificationpolicies.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafananotificationpolicies.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafananotificationpolicies.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -106,13 +106,16 @@ spec:
                    - message: spec.instanceSelector is immutable
                      rule: self == oldSelf
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
                route:
                  description: Routes for alerts to match against
                  properties:
+                    active_time_intervals:
+                      items:
+                        type: string
+                      type: array
                    continue:
                      description: continue
                      type: boolean
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafananotificationpolicyroutes.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafananotificationpolicyroutes.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafananotificationpolicyroutes.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -40,6 +40,10 @@ spec:
            spec:
              description: GrafanaNotificationPolicyRouteSpec defines the desired state of GrafanaNotificationPolicyRoute
              properties:
+                active_time_intervals:
+                  items:
+                    type: string
+                  type: array
                continue:
                  description: continue
                  type: boolean
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafananotificationtemplates.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafananotificationtemplates.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafananotificationtemplates.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -109,7 +109,6 @@ spec:
                  description: Template name
                  type: string
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanas.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanas.grafana.integreatly.org.yaml
--- a/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanaserviceaccounts.grafana.integreatly.org.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/CustomResourceDefinition-grafanaserviceaccounts.grafana.integreatly.org.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.19.0
  name: grafanaserviceaccounts.grafana.integreatly.org
 spec:
  group: grafana.integreatly.org
@@ -67,7 +67,6 @@ spec:
                    - message: spec.name is immutable
                      rule: self == oldSelf
                resyncPeriod:
-                  default: 10m0s
                  description: How often the resource is synced, defaults to 10m0s if not set
                  pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
                  type: string
--- a/clusters/cl01tl/manifests/grafana-operator/Deployment-grafana-operator.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/Deployment-grafana-operator.yaml
@@ -4,10 +4,10 @@ metadata:
  name: grafana-operator
  namespace: grafana-operator
  labels:
-    helm.sh/chart: grafana-operator-v5.20.0
+    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/version: "v5.20.0"
+    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
@@ -20,10 +20,10 @@ spec:
  template:
    metadata:
      labels:
-        helm.sh/chart: grafana-operator-v5.20.0
+        helm.sh/chart: grafana-operator-5.21.3
        app.kubernetes.io/name: grafana-operator
        app.kubernetes.io/instance: grafana-operator
-        app.kubernetes.io/version: "v5.20.0"
+        app.kubernetes.io/version: "v5.21.3"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: grafana-operator
        app.kubernetes.io/component: operator
@@ -38,7 +38,7 @@ spec:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
-          image: "ghcr.io/grafana/grafana-operator:v5.20.0"
+          image: "ghcr.io/grafana/grafana-operator:v5.21.3"
          imagePullPolicy: IfNotPresent
          env:
            - name: WATCH_NAMESPACE
@@ -58,11 +58,15 @@ spec:
            - --zap-encoder=console
            - --zap-log-level=info
            - --zap-time-encoding=rfc3339
+            - --default-resync-period=10m
            - --leader-elect
            - --max-concurrent-reconciles=1
          volumeMounts:
            - name: dashboards-dir
              mountPath: /tmp/dashboards
+            - name: kubeauth-token-volume
+              mountPath: /var/run/secrets/grafana.com/serviceaccount
+              readOnly: true
          ports:
            - containerPort: 9090
              name: metrics
@@ -85,3 +89,10 @@ spec:
      volumes:
        - name: dashboards-dir
          emptyDir: {}
+        - name: kubeauth-token-volume
+          projected:
+            sources:
+              - serviceAccountToken:
+                  audience: operator.grafana.com
+                  expirationSeconds: 3600
+                  path: token
--- a/clusters/cl01tl/manifests/grafana-operator/Service-grafana-operator-metrics-service.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/Service-grafana-operator-metrics-service.yaml
@@ -4,10 +4,10 @@ metadata:
  name: grafana-operator-metrics-service
  namespace: grafana-operator
  labels:
-    helm.sh/chart: grafana-operator-v5.20.0
+    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/version: "v5.20.0"
+    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
--- a/clusters/cl01tl/manifests/grafana-operator/ServiceAccount-grafana-operator.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/ServiceAccount-grafana-operator.yaml
@@ -4,10 +4,10 @@ metadata:
  name: grafana-operator
  namespace: grafana-operator
  labels:
-    helm.sh/chart: grafana-operator-v5.20.0
+    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/version: "v5.20.0"
+    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
--- a/clusters/cl01tl/manifests/grafana-operator/ServiceMonitor-grafana-operator.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/ServiceMonitor-grafana-operator.yaml
@@ -4,10 +4,10 @@ metadata:
  name: grafana-operator
  namespace: grafana-operator
  labels:
-    helm.sh/chart: grafana-operator-v5.20.0
+    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/version: "v5.20.0"
+    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
--- a/clusters/cl01tl/manifests/home-assistant/Deployment-home-assistant.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/Deployment-home-assistant.yaml
@@ -46,7 +46,7 @@ spec:
          envFrom:
            - secretRef:
                name: home-assistant-code-server-password-secret
-          image: ghcr.io/linuxserver/code-server:4.106.3@sha256:83793e4460090d6c46f4842ff6ab8aa26ad8a567885112bbe754b45c61935055
+          image: ghcr.io/linuxserver/code-server:4.107.0@sha256:0d48d3a48b7db214556bea453ed371f0d295130fb5c3d43534aedb41627446f2
          imagePullPolicy: IfNotPresent
          name: code-server
          resources:
--- a/clusters/cl01tl/manifests/karakeep/ConfigMap-karakeep-meilisearch-environment.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ConfigMap-karakeep-meilisearch-environment.yaml
@@ -3,10 +3,10 @@ kind: ConfigMap
 metadata:
  name: karakeep-meilisearch-environment
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: karakeep
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
+++ b/clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
@@ -125,7 +125,7 @@ spec:
              value: mxbai-embed-large
            - name: INFERENCE_JOB_TIMEOUT_SEC
              value: "720"
-          image: ghcr.io/karakeep-app/karakeep:0.29.1
+          image: ghcr.io/karakeep-app/karakeep:0.29.3
          imagePullPolicy: IfNotPresent
          name: main
          resources:
--- a/clusters/cl01tl/manifests/karakeep/PersistentVolumeClaim-karakeep-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/karakeep/PersistentVolumeClaim-karakeep-meilisearch.yaml
@@ -3,10 +3,10 @@ apiVersion: v1
 metadata:
  name: karakeep-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: karakeep
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/karakeep/Pod-karakeep-meilisearch-test-connection.yaml
+++ b/clusters/cl01tl/manifests/karakeep/Pod-karakeep-meilisearch-test-connection.yaml
@@ -4,7 +4,7 @@ metadata:
  name: karakeep-meilisearch-test-connection
  labels:
    app.kubernetes.io/name: meilisearch
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/instance: karakeep
    app.kubernetes.io/managed-by: Helm
  annotations:
--- a/clusters/cl01tl/manifests/karakeep/Service-karakeep-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/karakeep/Service-karakeep-meilisearch.yaml
@@ -3,10 +3,10 @@ kind: Service
 metadata:
  name: karakeep-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: karakeep
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceAccount-karakeep-meilisearch.yaml
@@ -3,10 +3,10 @@ kind: ServiceAccount
 metadata:
  name: karakeep-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: karakeep
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep-meilisearch.yaml
@@ -4,10 +4,10 @@ metadata:
  name: karakeep-meilisearch
  namespace: karakeep
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: karakeep
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
--- a/clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml
@@ -3,10 +3,10 @@ kind: StatefulSet
 metadata:
  name: karakeep-meilisearch
  labels:
-    helm.sh/chart: meilisearch-0.18.0
+    helm.sh/chart: meilisearch-0.19.0
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: karakeep
-    app.kubernetes.io/version: "v1.29.0"
+    app.kubernetes.io/version: "v1.30.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
    app.kubernetes.io/managed-by: Helm
@@ -20,15 +20,15 @@ spec:
  template:
    metadata:
      labels:
-        helm.sh/chart: meilisearch-0.18.0
+        helm.sh/chart: meilisearch-0.19.0
        app.kubernetes.io/name: meilisearch
        app.kubernetes.io/instance: karakeep
-        app.kubernetes.io/version: "v1.29.0"
+        app.kubernetes.io/version: "v1.30.0"
        app.kubernetes.io/component: search-engine
        app.kubernetes.io/part-of: meilisearch
        app.kubernetes.io/managed-by: Helm
      annotations:
-        checksum/config: 954e5b4e04b5db55030743245c1fa5bde554924c5d7162d4f9767a52e5c0e504
+        checksum/config: 293744bf0f8d621f5ed444bd4d6126c2d8d548960c327f0486f7d6b112171710
    spec:
      serviceAccountName: karakeep-meilisearch
      securityContext:
@@ -45,7 +45,7 @@ spec:
            claimName: karakeep-meilisearch
      containers:
        - name: meilisearch
-          image: "getmeili/meilisearch:v1.29.0"
+          image: "getmeili/meilisearch:v1.30.0"
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
--- a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-mautrix-whatsapp.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-mautrix-whatsapp.yaml
@@ -67,7 +67,7 @@ spec:
              readOnly: true
              subPath: mautrix-whatsapp-registration.yaml
      containers:
-        - image: dock.mau.dev/mautrix/whatsapp:v0.2511.0
+        - image: dock.mau.dev/mautrix/whatsapp:v0.2512.0
          imagePullPolicy: IfNotPresent
          name: main
          resources:
--- a/clusters/cl01tl/manifests/qbittorrent/Deployment-qbittorrent-qui.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/Deployment-qbittorrent-qui.yaml
@@ -59,7 +59,7 @@ spec:
              value: https://qui.alexlebens.net/api/auth/oidc/callback
            - name: QUI__OIDC_DISABLE_BUILT_IN_LOGIN
              value: "false"
-          image: ghcr.io/autobrr/qui:v1.9.1
+          image: ghcr.io/autobrr/qui:v1.10.0
          imagePullPolicy: IfNotPresent
          name: qui
          resources:
--- a/clusters/cl01tl/manifests/s3-exporter/ServiceMonitor-s3-exporter-garage-remote.yaml
+++ b/clusters/cl01tl/manifests/s3-exporter/ServiceMonitor-s3-exporter-garage-remote.yaml
@@ -16,5 +16,5 @@ spec:
  endpoints:
    - port: metrics
      interval: 5m
-      scrapeTimeout: 120s
+      scrapeTimeout: 5m
      path: /metrics
--- a/clusters/cl01tl/manifests/tailscale-operator/CustomResourceDefinition-recorders.tailscale.com.yaml
+++ b/clusters/cl01tl/manifests/tailscale-operator/CustomResourceDefinition-recorders.tailscale.com.yaml
@@ -68,6 +68,11 @@ spec:
                    Corresponds to --ui tsrecorder flag https://tailscale.com/kb/1246/tailscale-ssh-session-recording#deploy-a-recorder-node.
                    Required if S3 storage is not set up, to ensure that recordings are accessible.
                  type: boolean
+                replicas:
+                  description: Replicas specifies how many instances of tsrecorder to run. Defaults to 1.
+                  type: integer
+                  format: int32
+                  minimum: 0
                statefulSet:
                  description: |-
                    Configuration parameters for the Recorder's StatefulSet. The operator
@@ -1683,6 +1688,9 @@ spec:
                  items:
                    type: string
                    pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
+              x-kubernetes-validations:
+                - rule: '!(self.replicas > 1 && (!has(self.storage) || !has(self.storage.s3)))'
+                  message: S3 storage must be used when deploying multiple Recorder replicas
            status:
              description: |-
                RecorderStatus describes the status of the recorder. This is set
--- a/clusters/cl01tl/manifests/tailscale-operator/Deployment-operator.yaml
+++ b/clusters/cl01tl/manifests/tailscale-operator/Deployment-operator.yaml
@@ -16,13 +16,9 @@ spec:
        app: operator
    spec:
      serviceAccountName: operator
-      volumes:
-        - name: oauth
-          secret:
-            secretName: operator-oauth
      containers:
        - name: operator
-          image: tailscale/k8s-operator:v1.90.9
+          image: tailscale/k8s-operator:v1.92.3
          imagePullPolicy: Always
          env:
            - name: OPERATOR_INITIAL_TAGS
@@ -41,12 +37,8 @@ spec:
              value:
            - name: OPERATOR_INGRESS_CLASS_NAME
              value: tailscale
-            - name: CLIENT_ID_FILE
-              value: /oauth/client_id
-            - name: CLIENT_SECRET_FILE
-              value: /oauth/client_secret
            - name: PROXY_IMAGE
-              value: tailscale/tailscale:v1.90.9
+              value: tailscale/tailscale:v1.92.3
            - name: PROXY_TAGS
              value: tag:k8s
            - name: APISERVER_PROXY
@@ -63,9 +55,5 @@ spec:
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
-          volumeMounts:
-            - name: oauth
-              mountPath: /oauth
-              readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
--- a/clusters/cl01tl/manifests/unpoller/Deployment-unpoller.yaml
+++ b/clusters/cl01tl/manifests/unpoller/Deployment-unpoller.yaml
@@ -64,7 +64,7 @@ spec:
          envFrom:
            - secretRef:
                name: unpoller-unifi-secret
-          image: ghcr.io/unpoller/unpoller:v2.18.0
+          image: ghcr.io/unpoller/unpoller:v2.19.0
          imagePullPolicy: IfNotPresent
          name: main
          resources: