Update renovate/renovate Docker tag to v42.27.1

2025-12-01 06:28:18 +00:00
17 changed files with 17 additions and 123 deletions
--- a/.gitea/workflows/kubeconform.yml
+++ b/.gitea/workflows/kubeconform.yml
@@ -1,95 +0,0 @@
-name: Validate Kubernetes Manifests
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  kubeconform:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/yannh/kubeconform:v0.7.0-alpine
-    steps:
-
-      - name: Install dependencies
-        run: |
-          apk add --no-cache \
-            yq \
-            findutils \
-            curl \
-            jq \
-            npm \
-            nodejs \
-            bash
-
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Create kubeconform configuration
-        run: |
-          cat > /tmp/kubeconform-config.yaml << 'EOF'
-          schema_location:
-            - default
-            - "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/{{ .ResourceKind }}_{{ .ResourceAPIVersion }}.json"
-          EOF
-
-      - name: Validate Manifests
-        shell: bash
-        run: |
-          # Define schema mappings
-          declare -A SCHEMA_MAP=(
-            ["HelmRelease"]="helm.toolkit.fluxcd.io/helmrelease_v2.json"
-            ["HelmRepository"]="source.toolkit.fluxcd.io/helmrepository_v1.json"
-            ["L2Advertisement"]="metallb.io/l2advertisement_v1beta1.json"
-            ["IPAddressPool"]="metallb.io/ipaddresspool_v1beta1.json"
-            ["SealedSecret"]="bitnami.com/sealedsecret_v1alpha1.json"
-          )
-          
-          # Create cache directory
-          export KUBECONFORM_CACHE_DIR="/tmp/kubeconform-cache"
-          mkdir -p "$KUBECONFORM_CACHE_DIR"
-          
-          # Exit code tracking
-          EXIT_CODE=0
-          
-          # Process all YAML files
-          while IFS= read -r file; do
-            echo "=== Validating: $file ==="
-            
-            # Skip excluded paths
-            if [[ "$file" == *".gitea/"* ]] || [[ "$file" == *"clusters/default/system-upgrade/"* ]]; then
-              echo "Skipping excluded file"
-              continue
-            fi
-            
-            # Detect resource kind
-            KIND=$(yq -r '.kind // ""' "$file" 2>/dev/null || echo "")
-            
-            if [[ -n "$KIND" && -n "${SCHEMA_MAP[$KIND]}" ]]; then
-              echo "Found $KIND - using custom schema"
-              SCHEMA_URL="https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/${SCHEMA_MAP[$KIND]}"
-              
-              if ! /kubeconform \
-                -schema-location "$SCHEMA_URL" \
-                -cache "$KUBECONFORM_CACHE_DIR" \
-                -output json \
-                "$file"; then
-                EXIT_CODE=1
-              fi
-            else
-              echo "Validating with default schemas"
-              if ! /kubeconform \
-                -schema-location default \
-                -cache "$KUBECONFORM_CACHE_DIR" \
-                -output json \
-                "$file"; then
-                EXIT_CODE=1
-              fi
-            fi
-            
-            echo ""
-          done < <(find . -type f \( -name "*.yml" \) -print)
-          
-          exit $EXIT_CODE
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -9,7 +9,7 @@ jobs:
  renovate:
    runs-on: ubuntu-latest
    container:
-      image: renovate/renovate:42.26.11
+      image: renovate/renovate:42.27.1

    steps:
      - name: Checkout repository
--- a/.gitignore
+++ b/.gitignore
@@ -1 +0,0 @@
-/tmp-pod.yml
--- a/clusters/default/git-ops/gitea-act/gitea-act-secrets.yml
+++ b/clusters/default/git-ops/gitea-act/gitea-act-secrets.yml
@@ -6,8 +6,8 @@ metadata:
  namespace: git-ops
 spec:
  encryptedData:
-    TOKEN: AgCCHSvlowNtj3ghhB/mYSnSlVMiB/yxLjWesHNtxiFLO4lGPfDp/KYMJ+0makytpQBlOS5nfSCh8u11Vh4vje0v2QLCkt8XCkDfpYOb/tJIaeMuojszaoaf3ZQqgzEbwy4hgaV8ur3K77jnHE+dnYMGNcd0Thg3nVhIs8rMK/2kBcTrp/Jfy61TAeyS3ObFgjayGqyUCc8BI1VjkKFXLPp82d7tqlGKTYlI+hVnWpSwS7MrybesTU8AGYC5GLRr3crfbff/H20m6aFb/4rDKQb7FIEOXYhbuxZw5OuFxlORnGNFWQP+aCyywOxmalNV1F2kZk0YRlWoaXrtyeT46cBI7WIgbFeUwlpRLxKGz8mBdJ8QluE2vu9HSUmMiFCOV6V0znUjz5jWyJ839FsUDHY78sRLaycu5fZNBeq0QndBDNYYkkhZ/uxvGsfdF8camCGNLIGC65nT3kHnWuZ0ZRSXJRf4Jb5TdK81aBceAEHqrtFkjger3v6ZEblTABV2fykRyFeK3eZ0TF5tsOa/8yNGI94sxjv/TXvdXNK2Z4VuaXRQpmCfnLkvKc4Fra0Pk2N1beI8NDTgqLBHWBPYeK1lryeYZ/nISj7W6hBasEPXdOYcJ8lCYwWmGmWO+B0zt8u0gvm0mkrZAZvluOYqRd+/Y8Cg9Q1S3lIFBd/JaPH/nTAXiHWU5ZNowGxuVYWIo6r85pv5oRJodVFhTZD/7mBsZHAh2XUVbLeN2ZfQHrSTFbZydkDz5f66
-    URL: AgATClAgHoLFuwCkQjQvl0MI0YRe7o2mCiaagecYvNgDH8uCMhY7vVFjmTmamfH0MBEbE+3QGQthlV+/aDjvpjJg3P5cFX+0EnU95SPPJHo0+oKAIxfP5DahCFl6nyyqZ57BTKNN5J4Mki4jCbkXxpnx5o2s+wjv4O56Al2yAK9ykk7vLo44VT9U8glxrEmpwQDp1Q/AVO0pk3NchvluAbq3PpcSQ2tPRK79aPGQyscfId9H/9WL4pNzyRFc+WLhMVuZWHxa2mEVYkl6tHU0BFjG0YZIkZTFfVBvhCXi8CRBWSMm9IeuIQGbLxnaH0SyVPqA2hO5YorQw54TL1gVnXIDo3zxyFYyYew/x7goq5Ab/pAHpb70RfCa9TSUjDVt9trrUyuh/Elvp6OX25FuPcOYiQlKcEnf4Hm/a5fiubZG53ejweEAx22O1KG0zWFTy6LzTXZqU6uhqcmslQgmSjQXCrbUfPV3yHXpRetilh4fHFLFsXHm9FoWqjCQ0qW//BwoNRj9jk7rR3/BDVDmOFYj+xau260TtbkqgE8uWHQw5jXM0AM6f1xDlF/ZdoHnvBs1VGF10SDLc0qr8+44L4MDRHhlLXcADlXBG0osfkXBFDqdYpC+Phsphhh81aV7Wg9u9dCKTbE3FcMGGaOT0mbnyrs2Jm7IS6EW3KeZrpm5taXmJLLjN0xwGPit1XUrKJw9RPngaXfi+SCX/MckEPIy2aLTssCqvKX2zD4=
+    TOKEN: AgACJkhEafIeRdcLRHBiyjAXz8aK4m1w8238FhwhX8cKDMg3J2hD11CDI5K6R+idPxfIxJSry7yarr4j+3hB9JOfrVTGSMyt8zadIjeE6MZMQFrE+Ufbo+JRqz9lBjY2enmxfjvFS5LiZGogUaomuvmeFywWWmqLlLcyANNIHN/sw/JVIZc32oLsElSCQc8GgWoLDHPFbTkoeqqCFtWiEYDhZDf5BsGHxNh2MOI0N55TPL5izKrgSUTHvDiehYddeIYz85K3WCDTGXBztIteM7+DrHGdyuYOimP4J3w9CExnf3ObtqcfnOgv9a1wiXER484q5fpaidWIVZm/dZiTFuLwAWpPNRP/WcTkMXEJVSAEWkdYxb8fk6Zn6VifT1fTSzTUN90TP0IXlrjP55nvG7oHvkBNWydSRxc3d2wwXKhSnAOk94cWPxilOkqhsc/aqCQzkxgHZXNV94jb8KzV5r1XCCD/kYd+crbfNs4uEKXNSa9KZqE4Did8eelEfst+VGhUpWwMLn9QNNlMxKUhWuqjEM30QTO51p7cB12dqQxi1nuXB6NREW8LtOOJ5uRDnSTY0ZTwioNZ5OqgMVfAPAY6HBZrYOQFvG5/rDRkkWLWdDRLJfz1OZq+qwoXBfXhKCEQnK2J8zIxjVJKjdK4U7myWzB9peN5XQN29aisxCY7k0ikpD8Crog7jnxAXo2hmLNaCt2xVgKpHc8RnuC9dNIlJUXI0KhTT649s6Jja09ZfuTF/3oboHBH
+    URL: AgAF2MrmaYUOGlLqyMhJpLyTT/qZbvSHC787uLNKwjqTqRIhU34DoR4F0ZxcDfiUl7KQgZVL+ujOU1MdpBxsMtsvLRFoQl+bGm4G1miE7BUpsETp2ll3kVbLMTk8eNeFdRq1P4WEtF6vidwVfJ0ggwyISdMpLm7tS/oFg4l0FImmpqjsycCMuwheB4azcU/1sEy046NLFQUm+ErKN88qRvFQwMlKj2DHKrtBxGZfdo7xo8hcBdq5IWDfMs8yAvalafp+O922mzF7ADp2IMoTgipCGiGNo8dengg18mfjqI7sUJHZag1apGmJmUSBK8xxFv7Cc8iS8PPpBZIROe8/rEwpNYH/JTVbfNZvdu5qVzmXs7BUppGG6dg5ASUkYW7lVf1Bo1M/dFreuHOlr1UucwJoIXcMFu/eOLcNbAchH4I4K1LQFPNNDkViAKozP5E8k1fIcpGPRSPK9hRnr21w3+kJ8ruJl7TFWY0aqi0kemtXq2lZenFlaUEk2pilINGNZ16AZBAnuzafPRC76c4EVtEKlffKC+/4Oq3hXHneVoikJZYuJ0CP/mqKVzFf/HgfOxzDyGbtXsAZ1m+dcl25U81VzbEuvzGrgt3q7FNLwQ4heSeDNDkkSvotDWji8VT1W3IN6ShXZ+gHmL7UrY3HuG3BsuuekSHvmc1gXGOHOO/qKYkHeJ2NzZODhgh/xo/vbXiilQrNBnuoJ1cxPY8Xz0jAx6WfWqsTtahe2h4=
  template:
    metadata:
      name: gitea-act-runner-secret
--- a/clusters/default/git-ops/gitea-act/gitea-act.yml
+++ b/clusters/default/git-ops/gitea-act/gitea-act.yml
@@ -67,7 +67,7 @@ spec:
        - name: runner-data
          mountPath: /data
      - name: daemon
-        image: docker:29.1.1-dind
+        image: docker:29.0.4-dind
        env:
        - name: DOCKER_TLS_CERTDIR
          value: /certs
--- a/clusters/default/helm/gpu-operator/gpu-operator-release.yml
+++ b/clusters/default/helm/gpu-operator/gpu-operator-release.yml
@@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: gpu-operator
-      version: "v25.10.1"
+      version: "v25.3.2"
      sourceRef:
        kind: HelmRepository
        name: nvidia
--- a/clusters/default/helm/prometheus/prometheus-release.yml
+++ b/clusters/default/helm/prometheus/prometheus-release.yml
@@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: prometheus
-      version: "27.49.0"
+      version: "27.48.0"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
--- a/clusters/default/media/invidious/invidious.yml
+++ b/clusters/default/media/invidious/invidious.yml
@@ -66,7 +66,7 @@ spec:
        - name: postgres-data
          mountPath: /var/lib/postgresql
      - name: inv-companion
-        image: quay.io/invidious/invidious-companion@sha256:a9de6b495fcad1de80d18b4452409e3f328af1f93cd0729c18fc833012efa9c8
+        image: quay.io/invidious/invidious-companion@sha256:9c6039ebe1691e70c76aefd207b1ea2784a4d8d1a7c531cdb18e6d1317c468e9
        restartPolicy: Always
        env:
        - name: SERVER_SECRET_KEY
--- a/clusters/default/media/jellyfin/jellyfin.yml
+++ b/clusters/default/media/jellyfin/jellyfin.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: jellyfin
-        image: jellyfin/jellyfin:10.11.4
+        image: jellyfin/jellyfin:10.11.3
        ports:
        - containerPort: 8096
        volumeMounts:
--- a/clusters/default/monitoring/pulse/pulse.yml
+++ b/clusters/default/monitoring/pulse/pulse.yml
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
      - name: pulse
-        image: rcourtman/pulse:4.36.0
+        image: rcourtman/pulse:v4.34.1
        volumeMounts:
        - name: pulse-data
          mountPath: /data
--- a/clusters/default/system-upgrade/system-upgrade-plan.yaml
+++ b/clusters/default/system-upgrade/system-upgrade-plan.yaml
--- a/clusters/default/tools/code-server/code-server.yml
+++ b/clusters/default/tools/code-server/code-server.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: code-server
-        image: lscr.io/linuxserver/code-server:4.106.3
+        image: lscr.io/linuxserver/code-server:4.106.2
        ports:
        - containerPort: 8443
        env:
--- a/clusters/default/tools/paperless-ngx/paperless-ngx.yml
+++ b/clusters/default/tools/paperless-ngx/paperless-ngx.yml
@@ -27,7 +27,7 @@ spec:
          subPath: redis
      containers:
      - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.1
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.0
        ports:
        - containerPort: 8000
        env:
--- a/clusters/default/tools/pihole/pihole-cm.yml
+++ b/clusters/default/tools/pihole/pihole-cm.yml
@@ -6,10 +6,10 @@ metadata:
 data:
  keepalived.conf: |
    vrrp_instance PIHOLE_VIP {
-      state MASTER
+      state BACKUP
      interface eth0
      virtual_router_id 212
-      priority 50
+      priority 100
      advert_int 1

      virtual_ipaddress {
--- a/clusters/default/tools/pihole/pihole.yml
+++ b/clusters/default/tools/pihole/pihole.yml
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: pihole
+  name: pihole-backup
  namespace: tools
 spec:
  selector:
@@ -14,17 +14,8 @@ spec:
        app: pihole
    spec:
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet

-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: NotIn
-                  values:
-                    - "kube-01"
-                    
      initContainers:
      - name: init-keepalived
        image: osixia/keepalived:2.0.20
--- a/clusters/default/tools/searxng/searxng.yml
+++ b/clusters/default/tools/searxng/searxng.yml
@@ -18,7 +18,7 @@ spec:
    spec:
      containers:
      - name: searxng
-        image: searxng/searxng@sha256:6dd0dffc05a75d92bbacd858953b4e93b8f709403c3fb1fb8a33ca8fd02e40a4
+        image: searxng/searxng@sha256:0124d32d77e0c7360d0b85f5d91882d1837e6ceb243c82e190f5d7e9f1401334
        ports:
        - containerPort: 8080
        env:
--- a/renovate.json
+++ b/renovate.json
@@ -5,8 +5,7 @@
  ],
  "prHourlyLimit": 0,
  "ignorePaths": [
-    "**/disabled/**",
-    "**/.gitea/workflows/**"
+    "**/disabled/**"
  ],
  "flux": {
    "managerFilePatterns": [