Update renovate/renovate Docker tag to v42

2025-11-28 00:04:34 +00:00
25 changed files with 127 additions and 269 deletions
--- a/.gitea/workflows/kubeconform.yml
+++ b/.gitea/workflows/kubeconform.yml
@@ -1,95 +0,0 @@
-name: Validate Kubernetes Manifests
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  kubeconform:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/yannh/kubeconform:v0.7.0-alpine
-    steps:
-
-      - name: Install dependencies
-        run: |
-          apk add --no-cache \
-            yq \
-            findutils \
-            curl \
-            jq \
-            npm \
-            nodejs \
-            bash
-
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Create kubeconform configuration
-        run: |
-          cat > /tmp/kubeconform-config.yaml << 'EOF'
-          schema_location:
-            - default
-            - "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/{{ .ResourceKind }}_{{ .ResourceAPIVersion }}.json"
-          EOF
-
-      - name: Validate Manifests
-        shell: bash
-        run: |
-          # Define schema mappings
-          declare -A SCHEMA_MAP=(
-            ["HelmRelease"]="helm.toolkit.fluxcd.io/helmrelease_v2.json"
-            ["HelmRepository"]="source.toolkit.fluxcd.io/helmrepository_v1.json"
-            ["L2Advertisement"]="metallb.io/l2advertisement_v1beta1.json"
-            ["IPAddressPool"]="metallb.io/ipaddresspool_v1beta1.json"
-            ["SealedSecret"]="bitnami.com/sealedsecret_v1alpha1.json"
-          )
-          
-          # Create cache directory
-          export KUBECONFORM_CACHE_DIR="/tmp/kubeconform-cache"
-          mkdir -p "$KUBECONFORM_CACHE_DIR"
-          
-          # Exit code tracking
-          EXIT_CODE=0
-          
-          # Process all YAML files
-          while IFS= read -r file; do
-            echo "=== Validating: $file ==="
-            
-            # Skip excluded paths
-            if [[ "$file" == *".gitea/"* ]] || [[ "$file" == *"clusters/default/system-upgrade/"* ]]; then
-              echo "Skipping excluded file"
-              continue
-            fi
-            
-            # Detect resource kind
-            KIND=$(yq -r '.kind // ""' "$file" 2>/dev/null || echo "")
-            
-            if [[ -n "$KIND" && -n "${SCHEMA_MAP[$KIND]}" ]]; then
-              echo "Found $KIND - using custom schema"
-              SCHEMA_URL="https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/${SCHEMA_MAP[$KIND]}"
-              
-              if ! /kubeconform \
-                -schema-location "$SCHEMA_URL" \
-                -cache "$KUBECONFORM_CACHE_DIR" \
-                -output json \
-                "$file"; then
-                EXIT_CODE=1
-              fi
-            else
-              echo "Validating with default schemas"
-              if ! /kubeconform \
-                -schema-location default \
-                -cache "$KUBECONFORM_CACHE_DIR" \
-                -output json \
-                "$file"; then
-                EXIT_CODE=1
-              fi
-            fi
-            
-            echo ""
-          done < <(find . -type f \( -name "*.yml" \) -print)
-          
-          exit $EXIT_CODE
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -9,7 +9,7 @@ jobs:
  renovate:
    runs-on: ubuntu-latest
    container:
-      image: renovate/renovate:42.26.11
+      image: renovate/renovate:42.26.2

    steps:
      - name: Checkout repository
--- a/.gitignore
+++ b/.gitignore
@@ -1 +0,0 @@
-/tmp-pod.yml
--- a/clusters/default/arr-stack/sabnzbd/sabnzbd.yml
+++ b/clusters/default/arr-stack/sabnzbd/sabnzbd.yml
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
      - name: sabnzbd
-        image: lscr.io/linuxserver/sabnzbd:4.5.5
+        image: lscr.io/linuxserver/sabnzbd:latest
        env:
        - name: PUID
          value: "1000"
--- a/clusters/default/flux-system/gotk-components.yaml
+++ b/clusters/default/flux-system/gotk-components.yaml
@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.7.5
+# Flux Version: v2.7.0
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: flux-system
@@ -19,7 +19,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: allow-egress
  namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: allow-scraping
  namespace: flux-system
 spec:
@@ -59,7 +59,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: allow-webhooks
  namespace: flux-system
 spec:
@@ -78,7 +78,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: critical-pods-flux-system
  namespace: flux-system
 spec:
@@ -98,7 +98,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +204,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: flux-edit-flux-system
@@ -212,7 +212,6 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
-  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -231,7 +230,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -240,7 +239,6 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
-  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -257,7 +255,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: cluster-reconciler-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -277,7 +275,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: crd-controller-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -315,7 +313,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: buckets.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1086,7 +1084,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: externalartifacts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1282,7 +1280,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: gitrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2236,7 +2234,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: helmcharts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2962,7 +2960,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: helmrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -3593,7 +3591,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: ocirepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -4419,7 +4417,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: source-controller
  namespace: flux-system
 ---
@@ -4430,7 +4428,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4451,7 +4449,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4472,11 +4470,11 @@ spec:
        app.kubernetes.io/component: source-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.0
    spec:
      containers:
      - args:
-        - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
+        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./
        - --watch-all-namespaces=true
        - --log-level=info
        - --log-encoding=json
@@ -4495,7 +4493,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.7.4
+        image: ghcr.io/fluxcd/source-controller:v1.7.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -4559,7 +4557,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
  group: kustomize.toolkit.fluxcd.io
@@ -5929,7 +5927,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: kustomize-controller
  namespace: flux-system
 ---
@@ -5940,7 +5938,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: kustomize-controller
  namespace: flux-system
@@ -5959,11 +5957,11 @@ spec:
        app.kubernetes.io/component: kustomize-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.0
    spec:
      containers:
      - args:
-        - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
+        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./
        - --watch-all-namespaces=true
        - --log-level=info
        - --log-encoding=json
@@ -5978,7 +5976,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
+        image: ghcr.io/fluxcd/kustomize-controller:v1.7.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -6035,7 +6033,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: helmreleases.helm.toolkit.fluxcd.io
 spec:
  group: helm.toolkit.fluxcd.io
@@ -8666,7 +8664,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: helm-controller
  namespace: flux-system
 ---
@@ -8677,7 +8675,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: helm-controller
  namespace: flux-system
@@ -8696,11 +8694,11 @@ spec:
        app.kubernetes.io/component: helm-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.0
    spec:
      containers:
      - args:
-        - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
+        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./
        - --watch-all-namespaces=true
        - --log-level=info
        - --log-encoding=json
@@ -8715,7 +8713,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.4.5
+        image: ghcr.io/fluxcd/helm-controller:v1.4.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -8772,7 +8770,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: alerts.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9162,7 +9160,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: providers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9574,7 +9572,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: receivers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -10051,7 +10049,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
  name: notification-controller
  namespace: flux-system
 ---
@@ -10062,7 +10060,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10083,7 +10081,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: webhook-receiver
  namespace: flux-system
@@ -10104,7 +10102,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.0
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10123,7 +10121,7 @@ spec:
        app.kubernetes.io/component: notification-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.0
    spec:
      containers:
      - args:
@@ -10141,7 +10139,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.7.5
+        image: ghcr.io/fluxcd/notification-controller:v1.7.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
--- a/clusters/default/git-ops/gitea-act/gitea-act-secrets.yml
+++ b/clusters/default/git-ops/gitea-act/gitea-act-secrets.yml
@@ -6,8 +6,8 @@ metadata:
  namespace: git-ops
 spec:
  encryptedData:
-    TOKEN: AgCCHSvlowNtj3ghhB/mYSnSlVMiB/yxLjWesHNtxiFLO4lGPfDp/KYMJ+0makytpQBlOS5nfSCh8u11Vh4vje0v2QLCkt8XCkDfpYOb/tJIaeMuojszaoaf3ZQqgzEbwy4hgaV8ur3K77jnHE+dnYMGNcd0Thg3nVhIs8rMK/2kBcTrp/Jfy61TAeyS3ObFgjayGqyUCc8BI1VjkKFXLPp82d7tqlGKTYlI+hVnWpSwS7MrybesTU8AGYC5GLRr3crfbff/H20m6aFb/4rDKQb7FIEOXYhbuxZw5OuFxlORnGNFWQP+aCyywOxmalNV1F2kZk0YRlWoaXrtyeT46cBI7WIgbFeUwlpRLxKGz8mBdJ8QluE2vu9HSUmMiFCOV6V0znUjz5jWyJ839FsUDHY78sRLaycu5fZNBeq0QndBDNYYkkhZ/uxvGsfdF8camCGNLIGC65nT3kHnWuZ0ZRSXJRf4Jb5TdK81aBceAEHqrtFkjger3v6ZEblTABV2fykRyFeK3eZ0TF5tsOa/8yNGI94sxjv/TXvdXNK2Z4VuaXRQpmCfnLkvKc4Fra0Pk2N1beI8NDTgqLBHWBPYeK1lryeYZ/nISj7W6hBasEPXdOYcJ8lCYwWmGmWO+B0zt8u0gvm0mkrZAZvluOYqRd+/Y8Cg9Q1S3lIFBd/JaPH/nTAXiHWU5ZNowGxuVYWIo6r85pv5oRJodVFhTZD/7mBsZHAh2XUVbLeN2ZfQHrSTFbZydkDz5f66
-    URL: AgATClAgHoLFuwCkQjQvl0MI0YRe7o2mCiaagecYvNgDH8uCMhY7vVFjmTmamfH0MBEbE+3QGQthlV+/aDjvpjJg3P5cFX+0EnU95SPPJHo0+oKAIxfP5DahCFl6nyyqZ57BTKNN5J4Mki4jCbkXxpnx5o2s+wjv4O56Al2yAK9ykk7vLo44VT9U8glxrEmpwQDp1Q/AVO0pk3NchvluAbq3PpcSQ2tPRK79aPGQyscfId9H/9WL4pNzyRFc+WLhMVuZWHxa2mEVYkl6tHU0BFjG0YZIkZTFfVBvhCXi8CRBWSMm9IeuIQGbLxnaH0SyVPqA2hO5YorQw54TL1gVnXIDo3zxyFYyYew/x7goq5Ab/pAHpb70RfCa9TSUjDVt9trrUyuh/Elvp6OX25FuPcOYiQlKcEnf4Hm/a5fiubZG53ejweEAx22O1KG0zWFTy6LzTXZqU6uhqcmslQgmSjQXCrbUfPV3yHXpRetilh4fHFLFsXHm9FoWqjCQ0qW//BwoNRj9jk7rR3/BDVDmOFYj+xau260TtbkqgE8uWHQw5jXM0AM6f1xDlF/ZdoHnvBs1VGF10SDLc0qr8+44L4MDRHhlLXcADlXBG0osfkXBFDqdYpC+Phsphhh81aV7Wg9u9dCKTbE3FcMGGaOT0mbnyrs2Jm7IS6EW3KeZrpm5taXmJLLjN0xwGPit1XUrKJw9RPngaXfi+SCX/MckEPIy2aLTssCqvKX2zD4=
+    TOKEN: AgACJkhEafIeRdcLRHBiyjAXz8aK4m1w8238FhwhX8cKDMg3J2hD11CDI5K6R+idPxfIxJSry7yarr4j+3hB9JOfrVTGSMyt8zadIjeE6MZMQFrE+Ufbo+JRqz9lBjY2enmxfjvFS5LiZGogUaomuvmeFywWWmqLlLcyANNIHN/sw/JVIZc32oLsElSCQc8GgWoLDHPFbTkoeqqCFtWiEYDhZDf5BsGHxNh2MOI0N55TPL5izKrgSUTHvDiehYddeIYz85K3WCDTGXBztIteM7+DrHGdyuYOimP4J3w9CExnf3ObtqcfnOgv9a1wiXER484q5fpaidWIVZm/dZiTFuLwAWpPNRP/WcTkMXEJVSAEWkdYxb8fk6Zn6VifT1fTSzTUN90TP0IXlrjP55nvG7oHvkBNWydSRxc3d2wwXKhSnAOk94cWPxilOkqhsc/aqCQzkxgHZXNV94jb8KzV5r1XCCD/kYd+crbfNs4uEKXNSa9KZqE4Did8eelEfst+VGhUpWwMLn9QNNlMxKUhWuqjEM30QTO51p7cB12dqQxi1nuXB6NREW8LtOOJ5uRDnSTY0ZTwioNZ5OqgMVfAPAY6HBZrYOQFvG5/rDRkkWLWdDRLJfz1OZq+qwoXBfXhKCEQnK2J8zIxjVJKjdK4U7myWzB9peN5XQN29aisxCY7k0ikpD8Crog7jnxAXo2hmLNaCt2xVgKpHc8RnuC9dNIlJUXI0KhTT649s6Jja09ZfuTF/3oboHBH
+    URL: AgAF2MrmaYUOGlLqyMhJpLyTT/qZbvSHC787uLNKwjqTqRIhU34DoR4F0ZxcDfiUl7KQgZVL+ujOU1MdpBxsMtsvLRFoQl+bGm4G1miE7BUpsETp2ll3kVbLMTk8eNeFdRq1P4WEtF6vidwVfJ0ggwyISdMpLm7tS/oFg4l0FImmpqjsycCMuwheB4azcU/1sEy046NLFQUm+ErKN88qRvFQwMlKj2DHKrtBxGZfdo7xo8hcBdq5IWDfMs8yAvalafp+O922mzF7ADp2IMoTgipCGiGNo8dengg18mfjqI7sUJHZag1apGmJmUSBK8xxFv7Cc8iS8PPpBZIROe8/rEwpNYH/JTVbfNZvdu5qVzmXs7BUppGG6dg5ASUkYW7lVf1Bo1M/dFreuHOlr1UucwJoIXcMFu/eOLcNbAchH4I4K1LQFPNNDkViAKozP5E8k1fIcpGPRSPK9hRnr21w3+kJ8ruJl7TFWY0aqi0kemtXq2lZenFlaUEk2pilINGNZ16AZBAnuzafPRC76c4EVtEKlffKC+/4Oq3hXHneVoikJZYuJ0CP/mqKVzFf/HgfOxzDyGbtXsAZ1m+dcl25U81VzbEuvzGrgt3q7FNLwQ4heSeDNDkkSvotDWji8VT1W3IN6ShXZ+gHmL7UrY3HuG3BsuuekSHvmc1gXGOHOO/qKYkHeJ2NzZODhgh/xo/vbXiilQrNBnuoJ1cxPY8Xz0jAx6WfWqsTtahe2h4=
  template:
    metadata:
      name: gitea-act-runner-secret
--- a/clusters/default/git-ops/gitea-act/gitea-act.yml
+++ b/clusters/default/git-ops/gitea-act/gitea-act.yml
@@ -67,7 +67,7 @@ spec:
        - name: runner-data
          mountPath: /data
      - name: daemon
-        image: docker:29.1.2-dind
+        image: docker:29.0.4-dind
        env:
        - name: DOCKER_TLS_CERTDIR
          value: /certs
--- a/clusters/default/helm/metallb/metallb-release.yml
+++ b/clusters/default/helm/metallb/metallb-release.yml
@@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: metallb
-      version: "0.15.3"
+      version: "0.15.2"
      sourceRef:
        kind: HelmRepository
        name: metallb
--- a/clusters/default/helm/prometheus/prometheus-release.yml
+++ b/clusters/default/helm/prometheus/prometheus-release.yml
@@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: prometheus
-      version: "27.50.0"
+      version: "27.46.0"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
--- a/clusters/default/media/ersatztv/ersatztv.yml
+++ b/clusters/default/media/ersatztv/ersatztv.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: ersatztv
-        image: jasongdove/ersatztv:v25.9.0
+        image: jasongdove/ersatztv:v25.8.0
        ports:
        - containerPort: 8409
        volumeMounts:
--- a/clusters/default/media/invidious/invidious.yml
+++ b/clusters/default/media/invidious/invidious.yml
@@ -66,7 +66,7 @@ spec:
        - name: postgres-data
          mountPath: /var/lib/postgresql
      - name: inv-companion
-        image: quay.io/invidious/invidious-companion@sha256:a9de6b495fcad1de80d18b4452409e3f328af1f93cd0729c18fc833012efa9c8
+        image: quay.io/invidious/invidious-companion@sha256:9c6039ebe1691e70c76aefd207b1ea2784a4d8d1a7c531cdb18e6d1317c468e9
        restartPolicy: Always
        env:
        - name: SERVER_SECRET_KEY
--- a/clusters/default/media/jellyfin/jellyfin.yml
+++ b/clusters/default/media/jellyfin/jellyfin.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: jellyfin
-        image: jellyfin/jellyfin:10.11.4
+        image: jellyfin/jellyfin:10.11.3
        ports:
        - containerPort: 8096
        volumeMounts:
--- a/clusters/default/monitoring/pulse/pulse.yml
+++ b/clusters/default/monitoring/pulse/pulse.yml
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
      - name: pulse
-        image: rcourtman/pulse:4.36.2
+        image: rcourtman/pulse:v4.33.1
        volumeMounts:
        - name: pulse-data
          mountPath: /data
--- a/clusters/default/monitoring/speedtest/speedtest.yml
+++ b/clusters/default/monitoring/speedtest/speedtest.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.12.0
+        image: lscr.io/linuxserver/speedtest-tracker:1.9.0
        ports:
        - containerPort: 80
        env:
--- a/clusters/default/system-upgrade/system-upgrade-plan.yaml
+++ b/clusters/default/system-upgrade/system-upgrade-plan.yaml
--- a/clusters/default/tools/code-server/code-server.yml
+++ b/clusters/default/tools/code-server/code-server.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: code-server
-        image: lscr.io/linuxserver/code-server:4.106.3
+        image: lscr.io/linuxserver/code-server:4.106.2
        ports:
        - containerPort: 8443
        env:
--- a/clusters/default/tools/nextcloud/collabora.yml
+++ b/clusters/default/tools/nextcloud/collabora.yml
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
      - name: collabora
-        image: collabora/code:25.04.7.3.1
+        image: collabora/code:25.04.7.2.1
        ports:
        - containerPort: 9980
        env:
--- a/clusters/default/tools/paperless-ngx/paperless-ngx.yml
+++ b/clusters/default/tools/paperless-ngx/paperless-ngx.yml
@@ -27,7 +27,7 @@ spec:
          subPath: redis
      containers:
      - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.1
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.0
        ports:
        - containerPort: 8000
        env:
--- a/clusters/default/tools/pihole/pihole-cm.yml
+++ b/clusters/default/tools/pihole/pihole-cm.yml
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: keepalived-config
-  namespace: tools
-data:
-  keepalived.conf: |
-    vrrp_instance PIHOLE_VIP {
-      state MASTER
-      interface eth0
-      virtual_router_id 212
-      priority 50
-      advert_int 1
-
-      virtual_ipaddress {
-        192.168.1.212/24
-      }
-    }
--- a/clusters/default/tools/pihole/pihole.yml
+++ b/clusters/default/tools/pihole/pihole.yml
@@ -1,90 +0,0 @@
---
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: pihole
-  namespace: tools
-spec:
-  selector:
-    matchLabels:
-      app: pihole
-  template:
-    metadata:
-      labels:
-        app: pihole
-    spec:
-      hostNetwork: true
-
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: NotIn
-                  values:
-                    - "kube-01"
-                    
-      initContainers:
-      - name: init-keepalived
-        image: osixia/keepalived:2.0.20
-        command:
-          - sh
-          - -c
-          - |
-            cp -r /container/service/keepalived/assets/* /etc/keepalived/
-            cp /config/keepalived.conf /etc/keepalived/keepalived.conf
-        volumeMounts:
-          - name: keepalived-config
-            mountPath: /config
-          - name: keepalived-runtime
-            mountPath: /etc/keepalived
-
-      containers:
-      - name: pihole
-        image: pihole/pihole:latest
-        securityContext:
-          capabilities:
-            add: ["NET_ADMIN"]
-        env:
-          - name: TZ
-            value: "Asia/Kolkata"
-          - name: FTLCONF_webserver_api_password
-            valueFrom:
-              secretKeyRef:
-                name: pihole-webpassword
-                key: password
-        ports:
-          - containerPort: 53
-            protocol: UDP
-          - containerPort: 53
-            protocol: TCP
-          - containerPort: 67
-            protocol: UDP
-          - containerPort: 80
-            protocol: TCP
-        volumeMounts:
-          - name: pihole-data
-            mountPath: /etc/pihole
-
-      - name: keepalived
-        image: osixia/keepalived:2.0.20
-        securityContext:
-          capabilities:
-            add: ["NET_ADMIN", "NET_BROADCAST", "NET_RAW"]
-
-        volumeMounts:
-          - name: keepalived-runtime
-            mountPath: /container/service/keepalived/assets
-
-      volumes:
-      - name: keepalived-config
-        configMap:
-          name: keepalived-config
-
-      - name: keepalived-runtime
-        emptyDir: {}
-
-      - name: pihole-data
-        persistentVolumeClaim:
-          claimName: pihole-longhorn
--- a/clusters/default/tools/searxng/searxng.yml
+++ b/clusters/default/tools/searxng/searxng.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: searxng
-        image: searxng/searxng@sha256:b40d6e5ee3792e450f4034c53bdcb50f12d906e0cfb74df169e979b125b99f78
+        image: searxng/searxng@sha256:fc076352d72154feb1d8c0eb42dd5570a3ebc9ca8c6b9c8318ce545a8dfd1ea4
        ports:
        - containerPort: 8080
        env:
--- a/clusters/default/tools/pihole/pihole-pvc.yml
+++ b/clusters/default/tools/pihole/pihole-pvc.yml
@@ -6,7 +6,7 @@ metadata:
  namespace: tools
 spec:
  accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
--- a/disabled/pihole/pihole-svc.yml
+++ b/disabled/pihole/pihole-svc.yml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-tcp-service
+  namespace: tools
+spec:
+  type: LoadBalancer
+  loadBalancerIP: 192.168.1.229
+  selector:
+    app: pihole
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: web
--- a/disabled/pihole/pihole.yml
+++ b/disabled/pihole/pihole.yml
@@ -0,0 +1,49 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  namespace: tools
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+    spec:
+      hostNetwork: true
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - kube-02
+                - kube-03
+                - kube-04
+                - kube-05
+      containers:
+      - name: pihole
+        image: pihole/pihole@sha256:e28e239f55e648a9d32c8f065650acfe987ddebf1cd5f64f1c071e8716156ceb
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        env:
+        - name: TZ
+          value: "Asia/Kolkata"
+        - name: FTLCONF_dns_listeningMode
+          value: "all"
+        volumeMounts:
+        - name: pihole-data
+          mountPath: /etc/pihole
+      volumes:
+      - name: pihole-data
+        persistentVolumeClaim:
+          claimName: pihole-longhorn
--- a/renovate.json
+++ b/renovate.json
@@ -5,8 +5,7 @@
  ],
  "prHourlyLimit": 0,
  "ignorePaths": [
-    "**/disabled/**",
-    "**/.gitea/workflows/**"
+    "**/disabled/**"
  ],
  "flux": {
    "managerFilePatterns": [