Update renovate/renovate Docker tag to v42.27.0

.gitea/workflows/kubeconform.yml

@@ -1,95 +0,0 @@
-name: Validate Kubernetes Manifests
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  kubeconform:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/yannh/kubeconform:v0.7.0-alpine
-    steps:
-
-      - name: Install dependencies
-        run: |
-          apk add --no-cache \
-            yq \
-            findutils \
-            curl \
-            jq \
-            npm \
-            nodejs \
-            bash
-
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Create kubeconform configuration
-        run: |
-          cat > /tmp/kubeconform-config.yaml << 'EOF'
-          schema_location:
-            - default
-            - "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/{{ .ResourceKind }}_{{ .ResourceAPIVersion }}.json"
-          EOF
-
-      - name: Validate Manifests
-        shell: bash
-        run: |
-          # Define schema mappings
-          declare -A SCHEMA_MAP=(
-            ["HelmRelease"]="helm.toolkit.fluxcd.io/helmrelease_v2.json"
-            ["HelmRepository"]="source.toolkit.fluxcd.io/helmrepository_v1.json"
-            ["L2Advertisement"]="metallb.io/l2advertisement_v1beta1.json"
-            ["IPAddressPool"]="metallb.io/ipaddresspool_v1beta1.json"
-            ["SealedSecret"]="bitnami.com/sealedsecret_v1alpha1.json"
-          )
-          
-          # Create cache directory
-          export KUBECONFORM_CACHE_DIR="/tmp/kubeconform-cache"
-          mkdir -p "$KUBECONFORM_CACHE_DIR"
-          
-          # Exit code tracking
-          EXIT_CODE=0
-          
-          # Process all YAML files
-          while IFS= read -r file; do
-            echo "=== Validating: $file ==="
-            
-            # Skip excluded paths
-            if [[ "$file" == *".gitea/"* ]] || [[ "$file" == *"clusters/default/system-upgrade/"* ]]; then
-              echo "Skipping excluded file"
-              continue
-            fi
-            
-            # Detect resource kind
-            KIND=$(yq -r '.kind // ""' "$file" 2>/dev/null || echo "")
-            
-            if [[ -n "$KIND" && -n "${SCHEMA_MAP[$KIND]}" ]]; then
-              echo "Found $KIND - using custom schema"
-              SCHEMA_URL="https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/${SCHEMA_MAP[$KIND]}"
-              
-              if ! /kubeconform \
-                -schema-location "$SCHEMA_URL" \
-                -cache "$KUBECONFORM_CACHE_DIR" \
-                -output json \
-                "$file"; then
-                EXIT_CODE=1
-              fi
-            else
-              echo "Validating with default schemas"
-              if ! /kubeconform \
-                -schema-location default \
-                -cache "$KUBECONFORM_CACHE_DIR" \
-                -output json \
-                "$file"; then
-                EXIT_CODE=1
-              fi
-            fi
-            
-            echo ""
-          done < <(find . -type f \( -name "*.yml" \) -print)
-          
-          exit $EXIT_CODE

.gitea/workflows/renovate.yml

@@ -9,7 +9,7 @@ jobs:
   renovate:
     runs-on: ubuntu-latest
     container:
-      image: renovate/renovate:42.26.11
+      image: renovate/renovate:42.27.0
 
     steps:
       - name: Checkout repository

.gitignore

@@ -1 +0,0 @@
-/tmp-pod.yml

clusters/default/arr-stack/sabnzbd/sabnzbd.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: sabnzbd
-        image: lscr.io/linuxserver/sabnzbd:4.5.5
+        image: lscr.io/linuxserver/sabnzbd:latest
         env:
         - name: PUID
           value: "1000"

clusters/default/git-ops/gitea-act/gitea-act-secrets.yml

@@ -6,8 +6,8 @@ metadata:
   namespace: git-ops
 spec:
   encryptedData:
-    TOKEN: AgCCHSvlowNtj3ghhB/mYSnSlVMiB/yxLjWesHNtxiFLO4lGPfDp/KYMJ+0makytpQBlOS5nfSCh8u11Vh4vje0v2QLCkt8XCkDfpYOb/tJIaeMuojszaoaf3ZQqgzEbwy4hgaV8ur3K77jnHE+dnYMGNcd0Thg3nVhIs8rMK/2kBcTrp/Jfy61TAeyS3ObFgjayGqyUCc8BI1VjkKFXLPp82d7tqlGKTYlI+hVnWpSwS7MrybesTU8AGYC5GLRr3crfbff/H20m6aFb/4rDKQb7FIEOXYhbuxZw5OuFxlORnGNFWQP+aCyywOxmalNV1F2kZk0YRlWoaXrtyeT46cBI7WIgbFeUwlpRLxKGz8mBdJ8QluE2vu9HSUmMiFCOV6V0znUjz5jWyJ839FsUDHY78sRLaycu5fZNBeq0QndBDNYYkkhZ/uxvGsfdF8camCGNLIGC65nT3kHnWuZ0ZRSXJRf4Jb5TdK81aBceAEHqrtFkjger3v6ZEblTABV2fykRyFeK3eZ0TF5tsOa/8yNGI94sxjv/TXvdXNK2Z4VuaXRQpmCfnLkvKc4Fra0Pk2N1beI8NDTgqLBHWBPYeK1lryeYZ/nISj7W6hBasEPXdOYcJ8lCYwWmGmWO+B0zt8u0gvm0mkrZAZvluOYqRd+/Y8Cg9Q1S3lIFBd/JaPH/nTAXiHWU5ZNowGxuVYWIo6r85pv5oRJodVFhTZD/7mBsZHAh2XUVbLeN2ZfQHrSTFbZydkDz5f66
+    TOKEN: AgACJkhEafIeRdcLRHBiyjAXz8aK4m1w8238FhwhX8cKDMg3J2hD11CDI5K6R+idPxfIxJSry7yarr4j+3hB9JOfrVTGSMyt8zadIjeE6MZMQFrE+Ufbo+JRqz9lBjY2enmxfjvFS5LiZGogUaomuvmeFywWWmqLlLcyANNIHN/sw/JVIZc32oLsElSCQc8GgWoLDHPFbTkoeqqCFtWiEYDhZDf5BsGHxNh2MOI0N55TPL5izKrgSUTHvDiehYddeIYz85K3WCDTGXBztIteM7+DrHGdyuYOimP4J3w9CExnf3ObtqcfnOgv9a1wiXER484q5fpaidWIVZm/dZiTFuLwAWpPNRP/WcTkMXEJVSAEWkdYxb8fk6Zn6VifT1fTSzTUN90TP0IXlrjP55nvG7oHvkBNWydSRxc3d2wwXKhSnAOk94cWPxilOkqhsc/aqCQzkxgHZXNV94jb8KzV5r1XCCD/kYd+crbfNs4uEKXNSa9KZqE4Did8eelEfst+VGhUpWwMLn9QNNlMxKUhWuqjEM30QTO51p7cB12dqQxi1nuXB6NREW8LtOOJ5uRDnSTY0ZTwioNZ5OqgMVfAPAY6HBZrYOQFvG5/rDRkkWLWdDRLJfz1OZq+qwoXBfXhKCEQnK2J8zIxjVJKjdK4U7myWzB9peN5XQN29aisxCY7k0ikpD8Crog7jnxAXo2hmLNaCt2xVgKpHc8RnuC9dNIlJUXI0KhTT649s6Jja09ZfuTF/3oboHBH
-    URL: AgATClAgHoLFuwCkQjQvl0MI0YRe7o2mCiaagecYvNgDH8uCMhY7vVFjmTmamfH0MBEbE+3QGQthlV+/aDjvpjJg3P5cFX+0EnU95SPPJHo0+oKAIxfP5DahCFl6nyyqZ57BTKNN5J4Mki4jCbkXxpnx5o2s+wjv4O56Al2yAK9ykk7vLo44VT9U8glxrEmpwQDp1Q/AVO0pk3NchvluAbq3PpcSQ2tPRK79aPGQyscfId9H/9WL4pNzyRFc+WLhMVuZWHxa2mEVYkl6tHU0BFjG0YZIkZTFfVBvhCXi8CRBWSMm9IeuIQGbLxnaH0SyVPqA2hO5YorQw54TL1gVnXIDo3zxyFYyYew/x7goq5Ab/pAHpb70RfCa9TSUjDVt9trrUyuh/Elvp6OX25FuPcOYiQlKcEnf4Hm/a5fiubZG53ejweEAx22O1KG0zWFTy6LzTXZqU6uhqcmslQgmSjQXCrbUfPV3yHXpRetilh4fHFLFsXHm9FoWqjCQ0qW//BwoNRj9jk7rR3/BDVDmOFYj+xau260TtbkqgE8uWHQw5jXM0AM6f1xDlF/ZdoHnvBs1VGF10SDLc0qr8+44L4MDRHhlLXcADlXBG0osfkXBFDqdYpC+Phsphhh81aV7Wg9u9dCKTbE3FcMGGaOT0mbnyrs2Jm7IS6EW3KeZrpm5taXmJLLjN0xwGPit1XUrKJw9RPngaXfi+SCX/MckEPIy2aLTssCqvKX2zD4=
+    URL: AgAF2MrmaYUOGlLqyMhJpLyTT/qZbvSHC787uLNKwjqTqRIhU34DoR4F0ZxcDfiUl7KQgZVL+ujOU1MdpBxsMtsvLRFoQl+bGm4G1miE7BUpsETp2ll3kVbLMTk8eNeFdRq1P4WEtF6vidwVfJ0ggwyISdMpLm7tS/oFg4l0FImmpqjsycCMuwheB4azcU/1sEy046NLFQUm+ErKN88qRvFQwMlKj2DHKrtBxGZfdo7xo8hcBdq5IWDfMs8yAvalafp+O922mzF7ADp2IMoTgipCGiGNo8dengg18mfjqI7sUJHZag1apGmJmUSBK8xxFv7Cc8iS8PPpBZIROe8/rEwpNYH/JTVbfNZvdu5qVzmXs7BUppGG6dg5ASUkYW7lVf1Bo1M/dFreuHOlr1UucwJoIXcMFu/eOLcNbAchH4I4K1LQFPNNDkViAKozP5E8k1fIcpGPRSPK9hRnr21w3+kJ8ruJl7TFWY0aqi0kemtXq2lZenFlaUEk2pilINGNZ16AZBAnuzafPRC76c4EVtEKlffKC+/4Oq3hXHneVoikJZYuJ0CP/mqKVzFf/HgfOxzDyGbtXsAZ1m+dcl25U81VzbEuvzGrgt3q7FNLwQ4heSeDNDkkSvotDWji8VT1W3IN6ShXZ+gHmL7UrY3HuG3BsuuekSHvmc1gXGOHOO/qKYkHeJ2NzZODhgh/xo/vbXiilQrNBnuoJ1cxPY8Xz0jAx6WfWqsTtahe2h4=
   template:
     metadata:
       name: gitea-act-runner-secret

clusters/default/git-ops/gitea-act/gitea-act.yml

@@ -67,7 +67,7 @@ spec:
         - name: runner-data
           mountPath: /data
       - name: daemon
-        image: docker:29.1.2-dind
+        image: docker:29.0.4-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs

clusters/default/helm/metallb/metallb-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: metallb
-      version: "0.15.3"
+      version: "0.15.2"
       sourceRef:
         kind: HelmRepository
         name: metallb

clusters/default/helm/prometheus/prometheus-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: prometheus
-      version: "27.50.0"
+      version: "27.47.0"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

clusters/default/media/ersatztv/ersatztv.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: ersatztv
-        image: jasongdove/ersatztv:v25.9.0
+        image: jasongdove/ersatztv:v25.8.0
         ports:
         - containerPort: 8409
         volumeMounts:

clusters/default/media/invidious/invidious.yml

@@ -66,7 +66,7 @@ spec:
         - name: postgres-data
           mountPath: /var/lib/postgresql
       - name: inv-companion
-        image: quay.io/invidious/invidious-companion@sha256:a9de6b495fcad1de80d18b4452409e3f328af1f93cd0729c18fc833012efa9c8
+        image: quay.io/invidious/invidious-companion@sha256:9c6039ebe1691e70c76aefd207b1ea2784a4d8d1a7c531cdb18e6d1317c468e9
         restartPolicy: Always
         env:
         - name: SERVER_SECRET_KEY

clusters/default/media/jellyfin/jellyfin.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: jellyfin
-        image: jellyfin/jellyfin:10.11.4
+        image: jellyfin/jellyfin:10.11.3
         ports:
         - containerPort: 8096
         volumeMounts:

clusters/default/monitoring/pulse/pulse.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: pulse
-        image: rcourtman/pulse:4.36.2
+        image: rcourtman/pulse:4.34.0
         volumeMounts:
         - name: pulse-data
           mountPath: /data

clusters/default/monitoring/speedtest/speedtest.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.12.0
+        image: lscr.io/linuxserver/speedtest-tracker:1.10.2
         ports:
         - containerPort: 80
         env:

clusters/default/tools/code-server/code-server.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: code-server
-        image: lscr.io/linuxserver/code-server:4.106.3
+        image: lscr.io/linuxserver/code-server:4.106.2
         ports:
         - containerPort: 8443
         env:

clusters/default/tools/paperless-ngx/paperless-ngx.yml

@@ -27,7 +27,7 @@ spec:
           subPath: redis
       containers:
       - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.1
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.0
         ports:
         - containerPort: 8000
         env:

clusters/default/tools/pihole/pihole-cm.yml

@@ -6,10 +6,10 @@ metadata:
 data:
   keepalived.conf: |
     vrrp_instance PIHOLE_VIP {
-      state MASTER
+      state BACKUP
       interface eth0
       virtual_router_id 212
-      priority 50
+      priority 100
       advert_int 1
 
       virtual_ipaddress {

clusters/default/tools/pihole/pihole.yml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: pihole
+  name: pihole-backup
   namespace: tools
 spec:
   selector:
@@ -14,16 +14,7 @@ spec:
         app: pihole
     spec:
       hostNetwork: true
-
+      dnsPolicy: ClusterFirstWithHostNet
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: NotIn
-                  values:
-                    - "kube-01"
 
       initContainers:
       - name: init-keepalived

clusters/default/tools/searxng/searxng.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: searxng
-        image: searxng/searxng@sha256:b40d6e5ee3792e450f4034c53bdcb50f12d906e0cfb74df169e979b125b99f78
+        image: searxng/searxng@sha256:7f816e11561d5ef0c9425df04a7192c8b25cb5e9843099a77b58338e9c9a34cc
         ports:
         - containerPort: 8080
         env:

renovate.json

@@ -5,8 +5,7 @@
   ],
   "prHourlyLimit": 0,
   "ignorePaths": [
-    "**/disabled/**",
+    "**/disabled/**"
-    "**/.gitea/workflows/**"
   ],
   "flux": {
     "managerFilePatterns": [