Skip to content

chore(deps): update helm charts#462

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/helm-charts
Open

chore(deps): update helm charts#462
renovate[bot] wants to merge 1 commit intomainfrom
renovate/helm-charts

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 8, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
argo-cd helm_release minor 9.4.17 → 9.5.9
cert-manager (source) helm_release patch v1.20.1 → v1.20.2
cilium (source) helm_release patch 1.19.2 → 1.19.3
crossplane (source) patch 2.2.0 → 2.2.1
csi-driver-nfs helm_release patch 4.13.1 → 4.13.2
external-secrets helm_release minor 2.2.0 → 2.4.1

Release Notes

argoproj/argo-helm (argo-cd)

v9.5.9

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-cd-9.5.8...argo-cd-9.5.9

v9.5.8

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-cd-9.5.7...argo-cd-9.5.8

v9.5.7

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

  • feat(argo-cd): Make PrometheusRule API version field overridable like it is in ServiceMonitor manifests. by @​rurod in #​3857

New Contributors

Full Changelog: argoproj/argo-helm@argo-cd-9.5.6...argo-cd-9.5.7

v9.5.6

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

New Contributors

Full Changelog: argoproj/argo-helm@argo-cd-9.5.5...argo-cd-9.5.6

v9.5.5

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

New Contributors

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.13...argo-cd-9.5.5

v9.5.4

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

New Contributors

Full Changelog: argoproj/argo-helm@argo-cd-9.5.3...argo-cd-9.5.4

v9.5.3

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-cd-9.5.2...argo-cd-9.5.3

v9.5.2

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-cd-9.5.1...argo-cd-9.5.2

v9.5.1

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

  • feat(argo-cd): add repoServer.copyutil.extraArgs with default '--update=none' to support overriding by @​anandrkskd in #​3835

New Contributors

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.10...argo-cd-9.5.1

v9.5.0

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

New Contributors

Full Changelog: argoproj/argo-helm@argo-cd-9.4.18...argo-cd-9.5.0

v9.4.18

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.7...argo-cd-9.4.18

cert-manager/cert-manager (cert-manager)

v1.20.2

Compare Source

v1.20.2 fixes invalid YAML generated in the Helm chart when both webhook.config
and webhook.volumes are defined, and bumps Go to 1.26.2 along with dependencies
to address reported vulnerabilities.

Changes by Kind

Bug or Regression
Other (Cleanup or Flake)
cilium/cilium (cilium)

v1.19.3: 1.19.3

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

  • [v1.19] Fix incorrect policy service selector handling (#​44888, @​fristonio)
  • bgp: Fix potential race in service advertisements upon error retry (Backport PR #​45211, Upstream PR #​45049, @​rastislavs)
  • clustermesh: fix a bug in the MCS-API CRD installl that could attempt a CRD downgrade when the version label is higher (Backport PR #​44828, Upstream PR #​44738, @​MrFreezeex)
  • ctmap: Change order of active maps (Backport PR #​44828, Upstream PR #​44729, @​brb)
  • Ensure completion.WaitGroup always has a timeout (Backport PR #​45217, Upstream PR #​44731, @​jrajahalme)
  • envoy: Fix xds server npds listeners accounting (Backport PR #​45217, Upstream PR #​44830, @​fristonio)
  • Fix a slow memory leak triggered by incremental policy updates (Backport PR #​44994, Upstream PR #​44328, @​odinuge)
  • Fix endpoints for static pods stuck in init identity (Backport PR #​45211, Upstream PR #​45016, @​aaroniscode)
  • Fix in-cluster NodePort connectivity failure in DSR mode when SocketLB is disabled. When a pod accesses a NodePort service via a remote node's IP (instead of the ClusterIP) and the selected backend resides on the same node as the client, the connection fails due to missing reverse NAT on the reply path. (Backport PR #​44968, Upstream PR #​41963, @​gyutaeb)
  • Fix memory leak triggered by policies being created and deleted (Backport PR #​44828, Upstream PR #​44724, @​odinuge)
  • Fix panic in Hubble Relay when new peer address is unresolvable (Backport PR #​45211, Upstream PR #​45021, @​pesarkhobeee)
  • fix(datapath): ignore link-local IPv6 addresses for NodePort binding (Backport PR #​44974, Upstream PR #​44778, @​Bigdelle)
  • Fixed a bug in dual-stack cluster-pool IPAM where an operator restart with a pre-existing duplicate IPv6 PodCIDR could cause the affected node's IPv4 PodCIDR to be incorrectly freed and reassigned to another node. (Backport PR #​44866, Upstream PR #​44832, @​christarazi)
  • Fixed an issue where policy update ack is never completed after endpoint deletion. (Backport PR #​44818, Upstream PR #​44754, @​jrajahalme)
  • Fixed ipcache identity update hang when last proxy listener is removed. (Backport PR #​45217, Upstream PR #​44597, @​jrajahalme)
  • Fixes GRPCRoute being silently excluded from Envoy config when a Gateway listener explicitly sets allowedRoutes.kinds. (Backport PR #​44974, Upstream PR #​44826, @​eufriction)
  • Fixes increased CPU usage in hubble observe caused by log coloring feature, even when coloring was disabled (Backport PR #​44828, Upstream PR #​44119, @​tporeba)
  • lb: fix panic in orphan backend cleanup when addr is zero-value (Backport PR #​44994, Upstream PR #​44853, @​vipul-21)
  • lb: Skip nil slots during BPF map restore to prevent panic (Backport PR #​44974, Upstream PR #​44895, @​vipul-21)
  • operator/identitygc: fix nil pointer dereference on shutdown (Backport PR #​45211, Upstream PR #​45091, @​tsotne95)
  • wal: Do not truncate in NewWriter (Backport PR #​44974, Upstream PR #​44886, @​joamaki)
  • WireGuard now respects the underlay-protocol=ipv6 setting when selecting peer endpoints in dual-stack clusters with IPv6 underlay, fixing connectivity issues where IPv4 was incorrectly used despite being unreachable across nodes. (Backport PR #​45247, Upstream PR #​44629, @​tibrezus)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.19.3@​sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.3@​sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7

docker-plugin

quay.io/cilium/docker-plugin:v1.19.3@​sha256:728c3903518b0b6904e7208143355b38b7e6de3b514694fb6098b25bb9457397

hubble-relay

quay.io/cilium/hubble-relay:v1.19.3@​sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.3@​sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103

operator-aws

quay.io/cilium/operator-aws:v1.19.3@​sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640

operator-azure

quay.io/cilium/operator-azure:v1.19.3@​sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb

operator-generic

quay.io/cilium/operator-generic:v1.19.3@​sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd

operator

quay.io/cilium/operator:v1.19.3@​sha256:9075e6944996227574762ec0118caab0145d6e67f821409c4a6756b6b6caf6ea

crossplane/crossplane (crossplane)

v2.2.1

Compare Source

v2.2.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Dependency upgrades work correctly with ImageConfig prefix rewriting: Packages installed via an ImageConfig prefix rewrite were previously not being upgraded when their dependencies changed, leaving users stuck on stale versions of dependent packages. Dependency upgrades now behave as expected when prefix rewrites are in use. Backported in #​7277, originally fixed in #​7233.

  • Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". Backported in #​7247, originally fixed in #​7241.

This release also bumps Go to 1.25.9 and pulls in security related updates for a number of Crossplane's upstream dependencies, including cosign, go-git, go-jose, cloudflare/circl, moby/spdystream, sigstore/timestamp-authority, docker/cli, and the OpenTelemetry OTLP HTTP trace exporter

What's Changed

Full Changelog: crossplane/crossplane@v2.2.0...v2.2.1

external-secrets/external-secrets (external-secrets)

v2.4.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.1
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringssl

What's Changed

General
Dependencies

Full Changelog: external-secrets/external-secrets@v2.4.0...v2.4.1

v2.4.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.4.0
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringssl

What's Changed

General
Dependencies

New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file helm labels Apr 8, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 8, 2026 •
edited
Loading

Terraform Plan (03-services)

→ Resource Changes: 0 to create, 5 to update, 0 to re-create, 0 to delete, 0 ephemeral.

♻️ Update

helm_release.argocd 
! id                         = "argocd" -> (known after apply)
! metadata                   = {
!     app_version    = "v3.3.6" -> (known after apply)
!     chart          = "argo-cd" -> (known after apply)
!     first_deployed = 1770562152 -> (known after apply)
!     last_deployed  = 1775345187 -> (known after apply)
!     name           = "argocd" -> (known after apply)
!     namespace      = "argocd" -> (known after apply)
!     notes          = <<-EOT
          In order to access the server UI you have the following options:
          
          1. kubectl port-forward service/argocd-server -n argocd 8080:443
          
              and then open the browser on http://localhost:8080 and accept the certificate
          
          2. enable ingress in the values file `server.ingress.enabled` and either
                - Add the annotation for ssl passthrough: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough
                - Set the `configs.params."server.insecure"` in the values file and terminate SSL at your ingress: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts
          
          
          After reaching the UI the first time you can login with username: admin and the random password generated during the installation. You can find the password by running:
          
          kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
          
          (You should delete the initial secret afterwards as suggested by the Getting Started Guide: https://argo-cd.readthedocs.io/en/stable/getting_started/#4-login-using-the-cli)
      EOT -> (known after apply)
!     revision       = 6 -> (known after apply)
!     values         = jsonencode(
          {
            - applicationSet = {
                - enabled = true
              }
            - configs        = {
                - cm     = {
                    - "oidc.config" = <<-EOT
                          "clientID": "argocd"
                          "clientSecret": "$oidc.authentik.clientSecret"
                          "issuer": "https://auth.lippok.dev/application/o/argocd/"
                          "name": "Authentik"
                          "requestedScopes":
                          - "openid"
                          - "profile"
                          - "email"
                          - "groups"
                      EOT
                    - url           = "https://argocd.lippok.dev"
                  }
                - params = {
                    - "server.insecure" = "true"
                  }
                - rbac   = {
                    - "policy.csv"     = "g, authentik Admins, role:admin"
                    - "policy.default" = "role:readonly"
                    - scopes           = "[groups]"
                  }
              }
            - global         = {
                - logging = {
                    - level = "warn"
                  }
              }
            - notifications  = {
                - enabled       = true
                - notifiers     = {
                    - "service.webhook.discord" = <<-EOT
                          url: $discord-webhook
                      EOT
                    - "service.webhook.github"  = <<-EOT
                          url: https://api.github.com
                          headers:
                            - name: Authorization
                              value: "token $github-token"
                            - name: Content-Type
                              value: application/json
                      EOT
                  }
                - secret        = {
                    - create = false
                  }
                - subscriptions = [
                    - {
                        - recipients = [
                            - "github",
                          ]
                        - triggers   = [
                            - "on-sync-running",
                            - "on-sync-succeeded",
                            - "on-sync-failed",
                            - "on-health-degraded",
                          ]
                      },
                    - {
                        - recipients = [
                            - "discord",
                          ]
                        - triggers   = [
                            - "on-app-failed",
                          ]
                      },
                  ]
                - templates     = {
                    - "template.discord-alert"        = <<-EOT
                          webhook:
                            discord:
                              method: POST
                              path: /
                              body: |
                                {
                                  "content": "**ArgoCD** `{{.app.metadata.name}}` — {{if eq .app.status.operationState.phase "Error"}}Sync error: {{.app.status.operationState.message}}{{else if eq .app.status.operationState.phase "Failed"}}Sync failed: {{.app.status.operationState.message}}{{else}}Health degraded ({{.app.status.health.status}}){{end}}\n<https://argocd.lippok.dev/applications/{{.app.metadata.name}}>"
                                }
                      EOT
                    - "template.github-commit-status" = <<-EOT
                          webhook:
                            github:
                              method: POST
                              path: /repos/{{call .repo.FullNameByRepoURL .app.spec.source.repoURL}}/statuses/{{.app.status.operationState.operation.sync.revision}}
                              body: |
                                {
                                  "state": "{{if eq .app.status.operationState.phase "Running"}}pending{{else if and (eq .app.status.operationState.phase "Succeeded") (eq .app.status.health.status "Healthy")}}success{{else}}failure{{end}}",
                                  "description": "{{if eq .app.status.operationState.phase "Running"}}Syncing…{{else if and (eq .app.status.operationState.phase "Succeeded") (eq .app.status.health.status "Healthy")}}Healthy{{else if eq .app.status.health.status "Degraded"}}Health degraded{{else}}Sync failed{{end}}",
                                  "target_url": "https://argocd.lippok.dev/applications/{{.app.metadata.name}}",
                                  "context": "argocd/{{.app.metadata.name}}"
                                }
                      EOT
                  }
                - triggers      = {
                    - "trigger.on-app-failed"      = <<-EOT
                          - when: app.status.operationState.phase in ['Error', 'Failed'] || app.status.health.status == 'Degraded'
                            send: [discord-alert]
                      EOT
                    - "trigger.on-health-degraded" = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.health.status == 'Degraded'
                            send: [github-commit-status]
                      EOT
                    - "trigger.on-sync-failed"     = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.operationState.phase in ['Error', 'Failed']
                            send: [github-commit-status]
                      EOT
                    - "trigger.on-sync-running"    = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.operationState != nil && app.status.operationState.phase in ['Running']
                            send: [github-commit-status]
                      EOT
                    - "trigger.on-sync-succeeded"  = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.operationState.phase in ['Succeeded'] && app.status.health.status == 'Healthy'
                            send: [github-commit-status]
                      EOT
                  }
              }
            - redis          = {
                - enabled      = true
                - volumeMounts = [
                    - {
                        - mountPath = "/data"
                        - name      = "redis-data"
                      },
                  ]
                - volumes      = [
                    - {
                        - emptyDir = {
                            - medium    = "Memory"
                            - sizeLimit = "1Gi"
                          }
                        - name     = "redis-data"
                      },
                  ]
              }
            - redis-ha       = {
                - enabled = false
              }
            - repoServer     = {
                - env            = [
                    - {
                        - name  = "TMPDIR"
                        - value = "/nfs-tmp"
                      },
                  ]
                - initContainers = [
                    - {
                        - command         = [
                            - "sh",
                            - "-c",
                            - "chown 999:999 /nfs-tmp && chmod 777 /nfs-tmp",
                          ]
                        - image           = "busybox"
                        - name            = "fix-nfs-permissions"
                        - securityContext = {
                            - runAsUser = 0
                          }
                        - volumeMounts    = [
                            - {
                                - mountPath = "/nfs-tmp"
                                - name      = "nfs-tmp"
                              },
                          ]
                      },
                  ]
                - volumeMounts   = [
                    - {
                        - mountPath = "/nfs-tmp"
                        - name      = "nfs-tmp"
                      },
                  ]
                - volumes        = [
                    - {
                        - name                  = "nfs-tmp"
                        - persistentVolumeClaim = {
                            - claimName = "argocd-repo-server-nfs"
                          }
                      },
                  ]
              }
            - server         = {
                - extraArgs = [
                    - "--insecure",
                  ]
              }
          }
      ) -> (known after apply)
!     version        = "9.4.17" -> (known after apply)
  } -> (known after apply)
  name                       = "argocd"
! version                    = "9.4.17" -> "9.5.9"
  # (28 unchanged attributes hidden)
helm_release.cert_manager 
! id                         = "cert-manager" -> (known after apply)
! metadata                   = {
!     app_version    = "v1.20.1" -> (known after apply)
!     chart          = "cert-manager" -> (known after apply)
!     first_deployed = 1770562151 -> (known after apply)
!     last_deployed  = 1775345185 -> (known after apply)
!     name           = "cert-manager" -> (known after apply)
!     namespace      = "cert-manager" -> (known after apply)
!     notes          = <<-EOT
          cert-manager v1.20.1 has been deployed successfully!
          
          In order to begin issuing certificates, you will need to set up a ClusterIssuer
          or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
          
          More information on the different types of issuers and how to configure them
          can be found in our documentation:
          
          https://cert-manager.io/docs/configuration/
          
          For information on how to configure cert-manager to automatically provision
          Certificates for Ingress resources, take a look at the `ingress-shim`
          documentation:
          
          https://cert-manager.io/docs/usage/ingress/
          
          For information on how to configure cert-manager to automatically provision
          Certificates for Gateway API resources, take a look at the `gateway resource`
          documentation:
          
          https://cert-manager.io/docs/usage/gateway/
      EOT -> (known after apply)
!     revision       = 2 -> (known after apply)
!     values         = jsonencode(
          {
            - config = {
                - apiVersion       = "controller.config.cert-manager.io/v1alpha1"
                - enableGatewayAPI = true
                - kind             = "ControllerConfiguration"
              }
            - crds   = {
                - enabled = true
              }
          }
      ) -> (known after apply)
!     version        = "v1.20.1" -> (known after apply)
  } -> (known after apply)
  name                       = "cert-manager"
! version                    = "v1.20.1" -> "v1.20.2"
  # (28 unchanged attributes hidden)
helm_release.cilium 
! id                         = "cilium" -> (known after apply)
! metadata                   = {
!     app_version    = "1.19.2" -> (known after apply)
!     chart          = "cilium" -> (known after apply)
!     first_deployed = 1770561953 -> (known after apply)
!     last_deployed  = 1777388715 -> (known after apply)
!     name           = "cilium" -> (known after apply)
!     namespace      = "kube-system" -> (known after apply)
!     notes          = <<-EOT
          You have successfully installed Cilium with Hubble Relay and Hubble UI.
          
          Your release version is 1.19.2.
          
          For any further help, visit https://docs.cilium.io/en/v1.19/gettinghelp
      EOT -> (known after apply)
!     revision       = 41 -> (known after apply)
!     values         = jsonencode(
          {
            - cgroup               = {
                - autoMount = {
                    - enabled = false
                  }
                - hostRoot  = "/sys/fs/cgroup"
              }
            - cluster              = {
                - id   = 1
                - name = "homelab-k8s"
              }
            - clustermesh          = {
                - apiserver    = {
                    - podAnnotations = {
                        - "cilium.io/caBundleChangeRestartedAt" = "2026-04-22T21:31:38Z"
                      }
                    - service        = {
                        - type = "LoadBalancer"
                      }
                    - tls            = {
                        - auto = {
                            - certManagerIssuerRef = {
                                - group = "cert-manager.io"
                                - kind  = "ClusterIssuer"
                                - name  = "internal-ca-issuer"
                              }
                            - certValidityDuration = 90
                            - enabled              = true
                            - method               = "certmanager"
                          }
                      }
                  }
                - config       = {
                    - clusters = []
                    - enabled  = false
                  }
                - mcsapi       = {
                    - enabled = true
                  }
                - useAPIServer = false
              }
            - gatewayAPI           = {
                - enabled = true
              }
            - hubble               = {
                - enabled = true
                - metrics = {
                    - enableOpenMetrics = true
                    - enabled           = [
                        - "dns:query;ignoreAAAA",
                        - "drop",
                        - "tcp",
                        - "icmp",
                      ]
                    - serviceMonitor    = {
                        - enabled  = true
                        - interval = "30s"
                        - labels   = {
                            - release = "kube-prometheus-stack"
                          }
                      }
                  }
                - relay   = {
                    - enabled    = true
                    - prometheus = {
                        - enabled        = true
                        - serviceMonitor = {
                            - enabled  = true
                            - interval = "30s"
                            - labels   = {
                                - release = "kube-prometheus-stack"
                              }
                          }
                      }
                  }
                - tls     = {
                    - auto = {
                        - certManagerIssuerRef = {
                            - group = "cert-manager.io"
                            - kind  = "ClusterIssuer"
                            - name  = "internal-ca-issuer"
                          }
                        - certValidityDuration = 90
                        - enabled              = true
                        - method               = "certmanager"
                      }
                  }
                - ui      = {
                    - enabled = true
                  }
              }
            - ipam                 = {
                - mode = "kubernetes"
              }
            - k8sServiceHost       = "127.0.0.1"
            - k8sServicePort       = 7445
            - kubeProxyReplacement = "true"
            - l2announcements      = {
                - enabled = true
              }
            - operator             = {
                - prometheus = {
                    - enabled        = true
                    - serviceMonitor = {
                        - enabled  = true
                        - interval = "30s"
                        - labels   = {
                            - release = "kube-prometheus-stack"
                          }
                      }
                  }
              }
            - prometheus           = {
                - enabled        = true
                - serviceMonitor = {
                    - enabled  = true
                    - interval = "30s"
                    - labels   = {
                        - release = "kube-prometheus-stack"
                      }
                  }
              }
            - securityContext      = {
                - capabilities = {
                    - ciliumAgent      = [
                        - "CHOWN",
                        - "KILL",
                        - "NET_ADMIN",
                        - "NET_RAW",
                        - "IPC_LOCK",
                        - "SYS_ADMIN",
                        - "SYS_RESOURCE",
                        - "DAC_OVERRIDE",
                        - "FOWNER",
                        - "SETGID",
                        - "SETUID",
                      ]
                    - cleanCiliumState = [
                        - "NET_ADMIN",
                        - "SYS_ADMIN",
                        - "SYS_RESOURCE",
                      ]
                  }
              }
            - tls                  = {
                - ca       = {
                    - cert = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNLZ0F3SUJBZ0lRYU1iTEJjdU9XcW9uTFVNODJob3hPREFLQmdncWhrak9QUVFEQWpBZU1Sd3cKR2dZRFZRUURFeE5vYjIxbGJHRmlMV2x1ZEdWeWJtRnNMV05oTUI0WERUSTJNRFF4T1RJeE5UQXpPVm9YRFRNMgpNRFF4TmpJeE5UQXpPVm93SGpFY01Cb0dBMVVFQXhNVGFHOXRaV3hoWWkxcGJuUmxjbTVoYkMxallUQlpNQk1HCkJ5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQXB1d2xaT2pZWlplVEFHOFEwelVBSGhxYmlGTWlmZlZDRk0KTjNpeExKUk9MNUYwSWxPejRuZlZqOExML1JJQU1mcFBDYVZJelVWOTIzai9qNWRacXdhalFqQkFNQTRHQTFVZApEd0VCL3dRRUF3SUJoakFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFFZW5KM2dKb0Nray81CnVpbHhtcjFsRTZ4ZHpqQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQTRjcmNiSjhLL2pRWTgyTFJMY0t6OC9RdVUKRXMrSHBPQW9YTXlFMSt0ZFN3SWhBT1RWQnliYTJEaUlrcndhRmYwWVlJU1Z5bXNlenpGS3c1a1ZKUE93d3R6YQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
                    - key  = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUFqSi9UdU1wQ0JBVFh5dHpHZEpOVEo4OUtFS1BLZWxqTFl6Y3NLbTdMaFdvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFQ203Q1ZrNk5obGw1TUFieERUTlFBZUdwdUlVeUo5OVVJVXczZUxFc2xFNHZrWFFpVTdQaQpkOVdQd3N2OUVnQXgrazhKcFVqTlJYM2JlUCtQbDFtckJnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
                  }
                - caBundle = {
                    - content   = <<-EOT
                          -----BEGIN CERTIFICATE-----
                          MIIBfDCCASKgAwIBAgIQaMbLBcuOWqonLUM82hoxODAKBggqhkjOPQQDAjAeMRww
                          GgYDVQQDExNob21lbGFiLWludGVybmFsLWNhMB4XDTI2MDQxOTIxNTAzOVoXDTM2
                          MDQxNjIxNTAzOVowHjEcMBoGA1UEAxMTaG9tZWxhYi1pbnRlcm5hbC1jYTBZMBMG
                          ByqGSM49AgEGCCqGSM49AwEHA0IABApuwlZOjYZZeTAG8Q0zUAHhqbiFMiffVCFM
                          N3ixLJROL5F0IlOz4nfVj8LL/RIAMfpPCaVIzUV923j/j5dZqwajQjBAMA4GA1Ud
                          DwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQEenJ3gJoCkk/5
                          uilxmr1lE6xdzjAKBggqhkjOPQQDAgNIADBFAiA4crcbJ8K/jQY82LRLcKz8/QuU
                          Es+HpOAoXMyE1+tdSwIhAOTVByba2DiIkrwaFf0YYISVymsezzFKw5kVJPOwwtza
                          -----END CERTIFICATE-----
                          -----BEGIN CERTIFICATE-----
                          MIIBfDCCASKgAwIBAgIQaMbLBcuOWqonLUM82hoxODAKBggqhkjOPQQDAjAeMRww
                          GgYDVQQDExNob21lbGFiLWludGVybmFsLWNhMB4XDTI2MDQxOTIxNTAzOVoXDTM2
                          MDQxNjIxNTAzOVowHjEcMBoGA1UEAxMTaG9tZWxhYi1pbnRlcm5hbC1jYTBZMBMG
                          ByqGSM49AgEGCCqGSM49AwEHA0IABApuwlZOjYZZeTAG8Q0zUAHhqbiFMiffVCFM
                          N3ixLJROL5F0IlOz4nfVj8LL/RIAMfpPCaVIzUV923j/j5dZqwajQjBAMA4GA1Ud
                          DwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQEenJ3gJoCkk/5
                          uilxmr1lE6xdzjAKBggqhkjOPQQDAgNIADBFAiA4crcbJ8K/jQY82LRLcKz8/QuU
                          Es+HpOAoXMyE1+tdSwIhAOTVByba2DiIkrwaFf0YYISVymsezzFKw5kVJPOwwtza
                          -----END CERTIFICATE-----
                          
                          -----BEGIN CERTIFICATE-----
                          MIIDFDCCAfygAwIBAgIRAJXBbQTS+sMvtj+J89ZZvX4wDQYJKoZIhvcNAQELBQAw
                          FDESMBAGA1UEAxMJQ2lsaXVtIENBMB4XDTI2MDQxMDEwNTQzMVoXDTI5MDQwOTEw
                          NTQzMVowFDESMBAGA1UEAxMJQ2lsaXVtIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
                          AQ8AMIIBCgKCAQEAtxyIOV4aRrd13VncGSYBzQ45TkbhU2xAELCo6ijtXhtCsvTV
                          rGzzMDCSFypy/3UnhQ6J1H/oHI+200j9elQCldG7OFndy1SrFcTIbIoFo9Mllc3r
                          GZM0wbzuWN/owx6+WEooZdKmGEKygHnF1Lqe5Q2p9TEnJmnTmmq/E6/i8MhOhPTk
                          zB0vQ2vB/m1uAGYed+/F9k1v1KAtyoOAJ7H47nmvDbmwZUXIdDUN6fMKbzzCb4re
                          +vhNHxhsKYrt6/ywIPcWBv1keacFzsmOg1C8ZtDLO9XtHsU+/6Zv3FzTH3jiZY6h
                          pvIrfvIta1roSeNPxELKNPBy0oER5V3ywCZV7wIDAQABo2EwXzAOBgNVHQ8BAf8E
                          BAMCAqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQF
                          MAMBAf8wHQYDVR0OBBYEFFOZK0o7WqLYici0MlBwVwko+xlkMA0GCSqGSIb3DQEB
                          CwUAA4IBAQAbaccj94AZ/k7djpOJ3w6n7BZbYgTeWIe7NRFTAny/MYBYGmrqmp2I
                          AvNS7/pPXIKDZwY28BUoz2x4NXbnrwNmCCX7b6foEX6Qux8hETyUQNmL/9W286kQ
                          Uy1AgJLBkUglnfOBpNwFscaA94hz4+IoP7ZtFR2nNwWuRgvAtEhlw7MQ9BcT7NID
                          rP1Tdy50siJSP9K69in02r5mJL8qINW5HGbTjP8iA0Y7dSZrlJ4Pb3REJaKWh9Pj
                          9zJVGADYfBSY9KPlHV+j8a6s6v4PAQ+5OeWG92UL0LmkAacTiXyGy9YCOHhW6lIs
                          MvySIW+CtHEnguwWYEXNfbJrHB1i8hrp
                          -----END CERTIFICATE-----
                          -----BEGIN CERTIFICATE-----
                          MIIDFDCCAfygAwIBAgIRAJXBbQTS+sMvtj+J89ZZvX4wDQYJKoZIhvcNAQELBQAw
                          FDESMBAGA1UEAxMJQ2lsaXVtIENBMB4XDTI2MDQxMDEwNTQzMVoXDTI5MDQwOTEw
                          NTQzMVowFDESMBAGA1UEAxMJQ2lsaXVtIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
                          AQ8AMIIBCgKCAQEAtxyIOV4aRrd13VncGSYBzQ45TkbhU2xAELCo6ijtXhtCsvTV
                          rGzzMDCSFypy/3UnhQ6J1H/oHI+200j9elQCldG7OFndy1SrFcTIbIoFo9Mllc3r
                          GZM0wbzuWN/owx6+WEooZdKmGEKygHnF1Lqe5Q2p9TEnJmnTmmq/E6/i8MhOhPTk
                          zB0vQ2vB/m1uAGYed+/F9k1v1KAtyoOAJ7H47nmvDbmwZUXIdDUN6fMKbzzCb4re
                          +vhNHxhsKYrt6/ywIPcWBv1keacFzsmOg1C8ZtDLO9XtHsU+/6Zv3FzTH3jiZY6h
                          pvIrfvIta1roSeNPxELKNPBy0oER5V3ywCZV7wIDAQABo2EwXzAOBgNVHQ8BAf8E
                          BAMCAqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQF
                          MAMBAf8wHQYDVR0OBBYEFFOZK0o7WqLYici0MlBwVwko+xlkMA0GCSqGSIb3DQEB
                          CwUAA4IBAQAbaccj94AZ/k7djpOJ3w6n7BZbYgTeWIe7NRFTAny/MYBYGmrqmp2I
                          AvNS7/pPXIKDZwY28BUoz2x4NXbnrwNmCCX7b6foEX6Qux8hETyUQNmL/9W286kQ
                          Uy1AgJLBkUglnfOBpNwFscaA94hz4+IoP7ZtFR2nNwWuRgvAtEhlw7MQ9BcT7NID
                          rP1Tdy50siJSP9K69in02r5mJL8qINW5HGbTjP8iA0Y7dSZrlJ4Pb3REJaKWh9Pj
                          9zJVGADYfBSY9KPlHV+j8a6s6v4PAQ+5OeWG92UL0LmkAacTiXyGy9YCOHhW6lIs
                          MvySIW+CtHEnguwWYEXNfbJrHB1i8hrp
                          -----END CERTIFICATE-----
                      EOT
                    - enabled   = true
                    - key       = "ca.crt"
                    - name      = "cilium-root-ca.crt"
                    - useSecret = false
                  }
              }
          }
      ) -> (known after apply)
!     version        = "1.19.2" -> (known after apply)
  } -> (known after apply)
  name                       = "cilium"
! values                     = [
!     (sensitive value),
  ]
! version                    = "1.19.2" -> "1.19.3"
  # (27 unchanged attributes hidden)
helm_release.csi_driver_nfs 
! id                         = "csi-driver-nfs" -> (known after apply)
! metadata                   = {
!     app_version    = "4.13.1" -> (known after apply)
!     chart          = "csi-driver-nfs" -> (known after apply)
!     first_deployed = 1770561951 -> (known after apply)
!     last_deployed  = 1775344870 -> (known after apply)
!     name           = "csi-driver-nfs" -> (known after apply)
!     namespace      = "kube-system" -> (known after apply)
!     notes          = <<-EOT
          The CSI NFS Driver is getting deployed to your cluster.
          
          To check CSI NFS Driver pods status, please run:
          
            kubectl --namespace=kube-system get pods --selector="app.kubernetes.io/instance=csi-driver-nfs" --watch
      EOT -> (known after apply)
!     revision       = 2 -> (known after apply)
!     values         = jsonencode({}) -> (known after apply)
!     version        = "4.13.1" -> (known after apply)
  } -> (known after apply)
  name                       = "csi-driver-nfs"
! version                    = "4.13.1" -> "4.13.2"
  # (27 unchanged attributes hidden)
helm_release.external_secrets 
! id                         = "external-secrets" -> (known after apply)
! metadata                   = {
!     app_version    = "v2.2.0" -> (known after apply)
!     chart          = "external-secrets" -> (known after apply)
!     first_deployed = 1772488004 -> (known after apply)
!     last_deployed  = 1775345185 -> (known after apply)
!     name           = "external-secrets" -> (known after apply)
!     namespace      = "external-secrets" -> (known after apply)
!     notes          = <<-EOT
          external-secrets has been deployed successfully in namespace external-secrets!
          
          In order to begin using ExternalSecrets, you will need to set up a SecretStore
          or ClusterSecretStore resource (for example, by creating a 'vault' SecretStore).
          
          More information on the different types of SecretStores and how to configure them
          can be found in our Github: https://github.com/external-secrets/external-secrets
      EOT -> (known after apply)
!     revision       = 3 -> (known after apply)
!     values         = jsonencode(
          {
            - installCRDs = true
          }
      ) -> (known after apply)
!     version        = "2.2.0" -> (known after apply)
  } -> (known after apply)
  name                       = "external-secrets"
! version                    = "2.2.0" -> "2.4.1"
  # (28 unchanged attributes hidden)

Triggered by @renovate[bot], Commit: 8340b2dedfc4d90027186ad6fb75702ffefa4492

@renovate renovate Bot force-pushed the renovate/helm-charts branch from 180cf28 to d08ef33 Compare April 10, 2026 15:07
@renovate renovate Bot changed the title chore(deps): update helm release argo-cd to v9.5.0 chore(deps): update helm charts Apr 10, 2026
@renovate renovate Bot force-pushed the renovate/helm-charts branch from d08ef33 to 4ad6cc6 Compare April 13, 2026 10:03
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 4ad6cc6 to 70e9cc0 Compare April 16, 2026 09:19
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 70e9cc0 to c0119a9 Compare April 17, 2026 10:02
@renovate renovate Bot force-pushed the renovate/helm-charts branch from c0119a9 to 47f1fa5 Compare April 17, 2026 19:11
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 47f1fa5 to 5b5cb34 Compare April 20, 2026 18:53
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 5b5cb34 to 1738eea Compare April 21, 2026 23:59
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 1738eea to 5ffea9b Compare April 22, 2026 16:07
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 5ffea9b to e32a0f5 Compare April 24, 2026 19:22
@renovate renovate Bot force-pushed the renovate/helm-charts branch from e32a0f5 to 3484a6a Compare April 28, 2026 06:08
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 3484a6a to 1e5ebd6 Compare April 28, 2026 15:43
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 1e5ebd6 to 61556f9 Compare April 29, 2026 00:41
@renovate renovate Bot force-pushed the renovate/helm-charts branch from 61556f9 to 8340b2d Compare April 29, 2026 13:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file helm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants