2026-04-02 00:56:09 +00:00
35 changed files with 72 additions and 108 deletions
--- a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
@@ -91,5 +91,5 @@ spec:
            timeoutSeconds: 10
          resources:
            requests:
-              cpu: 1m
-              memory: 160Mi
+              cpu: 10m
+              memory: 150Mi
--- a/clusters/cl01tl/manifests/immich/Cluster-immich-postgresql-18-cluster.yaml
+++ b/clusters/cl01tl/manifests/immich/Cluster-immich-postgresql-18-cluster.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: immich-postgresql-18-cluster
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  instances: 3
@@ -26,8 +26,8 @@ spec:
    limits:
      hugepages-2Mi: 256Mi
    requests:
-      cpu: 100m
-      memory: 256Mi
+      cpu: 20m
+      memory: 80Mi
  affinity:
    enablePodAntiAffinity: true
    topologyKey: kubernetes.io/hostname
--- a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-postgresql-18-backup-garage-local-secret.yaml
+++ b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-postgresql-18-backup-garage-local-secret.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: immich-postgresql-18-backup-garage-local-secret
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-postgresql-18-recovery-secret.yaml
+++ b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-postgresql-18-recovery-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: immich-postgresql-18-recovery-secret
  namespace: immich
  labels:
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: immich-postgresql-18-recovery-secret
 spec:
--- a/clusters/cl01tl/manifests/immich/ObjectStore-immich-postgresql-18-backup-garage-local.yaml
+++ b/clusters/cl01tl/manifests/immich/ObjectStore-immich-postgresql-18-backup-garage-local.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: immich-postgresql-18-backup-garage-local
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  retentionPolicy: 7d
--- a/clusters/cl01tl/manifests/immich/ObjectStore-immich-postgresql-18-recovery.yaml
+++ b/clusters/cl01tl/manifests/immich/ObjectStore-immich-postgresql-18-recovery.yaml
@@ -4,10 +4,10 @@ metadata:
  name: "immich-postgresql-18-recovery"
  namespace: immich
  labels:
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: "immich-postgresql-18-recovery"
 spec:
--- a/clusters/cl01tl/manifests/immich/PrometheusRule-immich-postgresql-18-alert-rules.yaml
+++ b/clusters/cl01tl/manifests/immich/PrometheusRule-immich-postgresql-18-alert-rules.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: immich-postgresql-18-alert-rules
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  groups:
--- a/clusters/cl01tl/manifests/immich/ScheduledBackup-immich-postgresql-18-scheduled-backup-live-backup.yaml
+++ b/clusters/cl01tl/manifests/immich/ScheduledBackup-immich-postgresql-18-scheduled-backup-live-backup.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: "immich-postgresql-18-scheduled-backup-live-backup"
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: immich
    app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  immediate: true
--- a/clusters/cl01tl/manifests/immich/StatefulSet-immich-valkey.yaml
+++ b/clusters/cl01tl/manifests/immich/StatefulSet-immich-valkey.yaml
@@ -95,7 +95,7 @@ spec:
          resources:
            requests:
              cpu: 10m
-              memory: 128Mi
+              memory: 20Mi
          volumeMounts:
            - name: valkey-data
              mountPath: /data
@@ -117,8 +117,8 @@ spec:
              port: metrics
          resources:
            requests:
-              cpu: 10m
-              memory: 64M
+              cpu: 1m
+              memory: 10M
          env:
            - name: REDIS_ALIAS
              value: immich-valkey
--- a/clusters/cl01tl/manifests/jellyfin/Deployment-jellyfin.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/Deployment-jellyfin.yaml
@@ -43,18 +43,16 @@ spec:
                secretKeyRef:
                  key: token
                  name: jellyfin-exporter-secret
-          image: rebelcore/jellyfin-exporter:v1.4.0
-          imagePullPolicy: IfNotPresent
+          image: rebelcore/jellyfin-exporter:v1.4.0@sha256:dd35d901df663141025670b4b44a62a178b331e9fa084b17016f6fba46343ce9
          name: exporter
        - env:
            - name: TZ
-              value: US/Central
+              value: America/Chicago
            - name: JELLYFIN_hostwebclient
              value: "true"
            - name: JELLYFIN_PublishedServerUrl
              value: https://jellyfin.alexlebens.net/
-          image: ghcr.io/jellyfin/jellyfin:10.11.7
-          imagePullPolicy: IfNotPresent
+          image: ghcr.io/jellyfin/jellyfin:10.11.7@sha256:2b93aa3830dcd0aab7185c635e20edef1f8dc5d2e999768baf1724e88c078004
          name: main
          resources:
            limits:
@@ -62,7 +60,7 @@ spec:
            requests:
              cpu: 1
              gpu.intel.com/i915: 1
-              memory: 2Gi
+              memory: 1Gi
          volumeMounts:
            - mountPath: /cache
              name: cache
@@ -74,8 +72,9 @@ spec:
              name: youtube
              readOnly: true
      volumes:
-        - emptyDir: {}
-          name: cache
+        - name: cache
+          persistentVolumeClaim:
+            claimName: jellyfin-cache
        - name: config
          persistentVolumeClaim:
            claimName: jellyfin-config
--- a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-exporter-secret.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-exporter-secret.yaml
@@ -14,8 +14,5 @@ spec:
  data:
    - secretKey: token
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/jellyfin/exporter
-        metadataPolicy: None
        property: token
--- a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-meilisearch-master-key-secret.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-meilisearch-master-key-secret.yaml
@@ -14,8 +14,5 @@ spec:
  data:
    - secretKey: MEILI_MASTER_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/jellyfin/meilisearch
-        metadataPolicy: None
        property: MEILI_MASTER_KEY
--- a/clusters/cl01tl/manifests/jellyfin/HTTPRoute-jellyfin.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/HTTPRoute-jellyfin.yaml
@@ -23,7 +23,7 @@ spec:
          name: jellyfin
          namespace: jellyfin
          port: 80
-          weight: 100
+          weight: 1
      matches:
        - path:
            type: PathPrefix
--- a/clusters/cl01tl/manifests/jellyfin/PersistentVolumeClaim-jellyfin-cache.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/PersistentVolumeClaim-jellyfin-cache.yaml
@@ -0,0 +1,17 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: jellyfin-cache
+  labels:
+    app.kubernetes.io/instance: jellyfin
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: jellyfin
+    helm.sh/chart: jellyfin-4.6.2
+  namespace: jellyfin
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "20Gi"
+  storageClassName: "ceph-block"
--- a/clusters/cl01tl/manifests/jellyfin/PersistentVolumeClaim-jellyfin-config.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/PersistentVolumeClaim-jellyfin-config.yaml
@@ -7,8 +7,6 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: jellyfin
    helm.sh/chart: jellyfin-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
  namespace: jellyfin
 spec:
  accessModes:
--- a/clusters/cl01tl/manifests/jellyfin/PersistentVolumeClaim-jellyfin-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/PersistentVolumeClaim-jellyfin-meilisearch.yaml
@@ -16,4 +16,4 @@ spec:
  resources:
    requests:
      storage: "5Gi"
-  storageClassName: "local-path"
+  storageClassName: "ceph-block"
--- a/clusters/cl01tl/manifests/jellyfin/StatefulSet-jellyfin-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/StatefulSet-jellyfin-meilisearch.yaml
@@ -92,4 +92,4 @@ spec:
          resources:
            requests:
              cpu: 10m
-              memory: 128Mi
+              memory: 1Gi
--- a/clusters/cl01tl/manifests/jellystat/Cluster-jellystat-postgresql-18-cluster.yaml
+++ b/clusters/cl01tl/manifests/jellystat/Cluster-jellystat-postgresql-18-cluster.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: jellystat
  labels:
    app.kubernetes.io/name: jellystat-postgresql-18-cluster
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  instances: 3
@@ -26,8 +26,8 @@ spec:
    limits:
      hugepages-2Mi: 256Mi
    requests:
-      cpu: 100m
-      memory: 256Mi
+      cpu: 20m
+      memory: 80Mi
  affinity:
    enablePodAntiAffinity: true
    topologyKey: kubernetes.io/hostname
--- a/clusters/cl01tl/manifests/jellystat/Deployment-jellystat.yaml
+++ b/clusters/cl01tl/manifests/jellystat/Deployment-jellystat.yaml
@@ -36,7 +36,7 @@ spec:
      containers:
        - env:
            - name: TZ
-              value: US/Central
+              value: America/Chicago
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
@@ -77,13 +77,12 @@ spec:
                secretKeyRef:
                  key: port
                  name: jellystat-postgresql-18-cluster-app
-          image: cyfershepard/jellystat:1.1.8
-          imagePullPolicy: IfNotPresent
+          image: ghcr.io/cyfershepard/jellystat:1.1.8@sha256:c8c451704ba7985340142cd047e2364cabaf41b613669b6c5340688ed217f82a
          name: main
          resources:
            requests:
              cpu: 10m
-              memory: 256Mi
+              memory: 400Mi
          volumeMounts:
            - mountPath: /app/backend/backup-data
              name: data
--- a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-postgresql-18-backup-garage-local-secret.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-postgresql-18-backup-garage-local-secret.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: jellystat
  labels:
    app.kubernetes.io/name: jellystat-postgresql-18-backup-garage-local-secret
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  secretStoreRef:
--- a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-postgresql-18-recovery-secret.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-postgresql-18-recovery-secret.yaml
@@ -4,10 +4,10 @@ metadata:
  name: jellystat-postgresql-18-recovery-secret
  namespace: jellystat
  labels:
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: jellystat-postgresql-18-recovery-secret
 spec:
--- a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-secret.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-secret.yaml
@@ -14,22 +14,13 @@ spec:
  data:
    - secretKey: secret-key
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/jellystat/auth
-        metadataPolicy: None
        property: secret-key
    - secretKey: user
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/jellystat/auth
-        metadataPolicy: None
        property: user
    - secretKey: password
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/jellystat/auth
-        metadataPolicy: None
        property: password
--- a/clusters/cl01tl/manifests/jellystat/HTTPRoute-jellystat.yaml
+++ b/clusters/cl01tl/manifests/jellystat/HTTPRoute-jellystat.yaml
@@ -23,7 +23,7 @@ spec:
          name: jellystat
          namespace: jellystat
          port: 80
-          weight: 100
+          weight: 1
      matches:
        - path:
            type: PathPrefix
--- a/clusters/cl01tl/manifests/jellystat/ObjectStore-jellystat-postgresql-18-backup-garage-local.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ObjectStore-jellystat-postgresql-18-backup-garage-local.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: jellystat
  labels:
    app.kubernetes.io/name: jellystat-postgresql-18-backup-garage-local
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  retentionPolicy: 7d
--- a/clusters/cl01tl/manifests/jellystat/ObjectStore-jellystat-postgresql-18-recovery.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ObjectStore-jellystat-postgresql-18-recovery.yaml
@@ -4,10 +4,10 @@ metadata:
  name: "jellystat-postgresql-18-recovery"
  namespace: jellystat
  labels:
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: "jellystat-postgresql-18-recovery"
 spec:
--- a/clusters/cl01tl/manifests/jellystat/PersistentVolumeClaim-jellystat-data.yaml
+++ b/clusters/cl01tl/manifests/jellystat/PersistentVolumeClaim-jellystat-data.yaml
@@ -7,8 +7,6 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: jellystat
    helm.sh/chart: jellystat-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
  namespace: jellystat
 spec:
  accessModes:
--- a/clusters/cl01tl/manifests/jellystat/PrometheusRule-jellystat-postgresql-18-alert-rules.yaml
+++ b/clusters/cl01tl/manifests/jellystat/PrometheusRule-jellystat-postgresql-18-alert-rules.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: jellystat
  labels:
    app.kubernetes.io/name: jellystat-postgresql-18-alert-rules
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  groups:
--- a/clusters/cl01tl/manifests/jellystat/ScheduledBackup-jellystat-postgresql-18-scheduled-backup-live-backup.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ScheduledBackup-jellystat-postgresql-18-scheduled-backup-live-backup.yaml
@@ -5,10 +5,10 @@ metadata:
  namespace: jellystat
  labels:
    app.kubernetes.io/name: "jellystat-postgresql-18-scheduled-backup-live-backup"
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.1
    app.kubernetes.io/instance: jellystat
    app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  immediate: true
--- a/clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
+++ b/clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
@@ -41,13 +41,8 @@ spec:
            - --remote-debugging-address=0.0.0.0
            - --remote-debugging-port=9222
            - --hide-scrollbars
-          image: gcr.io/zenika-hub/alpine-chrome:124
-          imagePullPolicy: IfNotPresent
+          image: gcr.io/zenika-hub/alpine-chrome:124@sha256:1a0046448e0bb6c275c88f86e01faf0de62b02ec8572901256ada0a8c08be23f
          name: chrome
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
        - env:
            - name: DATA_DIR
              value: /data
@@ -125,13 +120,12 @@ spec:
              value: mxbai-embed-large
            - name: INFERENCE_JOB_TIMEOUT_SEC
              value: "720"
-          image: ghcr.io/karakeep-app/karakeep:0.31.0
-          imagePullPolicy: IfNotPresent
+          image: ghcr.io/karakeep-app/karakeep:0.31.0@sha256:20754dbdafb11dfe288bbb1c2342a7855081b08ea069e86fcf2d4a2d945d3653
          name: main
          resources:
            requests:
              cpu: 10m
-              memory: 256Mi
+              memory: 500Mi
          volumeMounts:
            - mountPath: /data
              name: data
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-bucket-garage.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-bucket-garage.yaml
@@ -14,22 +14,13 @@ spec:
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: ACCESS_REGION
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/karakeep-assets
-        metadataPolicy: None
        property: ACCESS_REGION
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-key-secret.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-key-secret.yaml
@@ -14,15 +14,9 @@ spec:
  data:
    - secretKey: key
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/karakeep/key
-        metadataPolicy: None
        property: key
    - secretKey: prometheus-token
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/karakeep/key
-        metadataPolicy: None
        property: prometheus-token
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-meilisearch-master-key-secret.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-meilisearch-master-key-secret.yaml
@@ -14,8 +14,5 @@ spec:
  data:
    - secretKey: MEILI_MASTER_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/karakeep/meilisearch
-        metadataPolicy: None
        property: MEILI_MASTER_KEY
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-oidc-secret.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-oidc-secret.yaml
@@ -14,15 +14,9 @@ spec:
  data:
    - secretKey: AUTHENTIK_CLIENT_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/karakeep
-        metadataPolicy: None
        property: client
    - secretKey: AUTHENTIK_CLIENT_SECRET
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/karakeep
-        metadataPolicy: None
        property: secret
--- a/clusters/cl01tl/manifests/karakeep/PersistentVolumeClaim-karakeep.yaml
+++ b/clusters/cl01tl/manifests/karakeep/PersistentVolumeClaim-karakeep.yaml
@@ -7,8 +7,6 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: karakeep
    helm.sh/chart: karakeep-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
  namespace: karakeep
 spec:
  accessModes:
--- a/clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml
@@ -92,4 +92,4 @@ spec:
          resources:
            requests:
              cpu: 10m
-              memory: 128Mi
+              memory: 50Mi