feat(container): update image tuppr (0.1.40 → 0.2.7)

[ixxel-bot]

This PR contains the following updates:

Package	Update	Change
tuppr	minor	0.1.40 → 0.2.7

---

Release Notes

home-operations/tuppr (tuppr)

v0.2.7

Compare Source

Bug Fixes

• controllers: surface reconcile errors in TalosUpgrade/Kubernetes Upgrade status (#​342) (02af953)

v0.2.6

Compare Source

Bug Fixes

• talos: default placement to hard, degrade to preferred on single-node (#​335) (5ab17c6)

v0.2.5

Compare Source

Features

• deps: update module github.com/onsi/ginkgo/v2 (v2.29.0 → v2.30.0) (#​328) (827a597)
• taint outdated nodes with PreferNoSchedule to reduce upgrade churn (578a6a2)

Miscellaneous Chores

• mise: update tool kubectl (1.36.1 → 1.36.2) (#​330) (565c1e5)

v0.2.4

Compare Source

Features

• github-release: update release helm-unittest/helm-unittest (v1.0.3 → v1.1.1) (#​316) (f98ea83)
• mise: update tool cosign (3.0.6 → 3.1.1) (#​324) (0d653c8)
• mise: update tool oxfmt (0.53.0 → 0.54.0) (#​319) (10f63b5)
• talos: Add NoDrain to talos policy (#​325) (f4cb065)

Bug Fixes

• deps: update module github.com/nicholas-fedor/shoutrrr (v0.16.0 → v0.16.1) (#​321) (be87ceb)

v0.2.3

Compare Source

Features

• chart: digest pinning, generated README + values schema, CI caching (#​312) (65545b9)

Bug Fixes

• mise: update go toolchain (1.26.2 → 1.26.4) (#​309) (2491500)

v0.2.2

Compare Source

Features

• make controller upgrade first (3b43bcf)

Miscellaneous Chores

• disable automerge for Go toolchain dependencies (76555e7)
• update release-please-config.json to simplify paths (6256955)

v0.2.1

Compare Source

Features

• mise: update tool hcloud (1.61.0 → 1.65.0) (aabeb88)
• mise: update tool helm (4.1.1 → 4.2.0) (3b12189)
• mise: update tool kubectl (1.35.1 → 1.36.1) (0785dd4)
• mise: update tool opentofu (1.11.4 → 1.12.1) (0558ecb)
• mise: update tool stern (1.33.1 → 1.34.0) (b0a9584)
• mise: update tool talosctl (1.12.4 → 1.13.3) (23d5fd8)

Bug Fixes

• talos: disable talosctl drain on single-node upgrades (#​310) (a82650e)
• use mise as the single source of truth for go versions (#​307) (f0ee83d)

v0.2.0

Compare Source

⚠ BREAKING CHANGES

• talos: replace drain kubectl-safety fields with explicit enabled toggle

Features

• deps: update module github.com/netresearch/go-cron (v0.14.0 → v0.15.0) (#​305) (e3cfcc4)
• deps: update module github.com/nicholas-fedor/shoutrrr (v0.14.3 → v0.15.1) (#​299) (8ec342a)
• deps: update module github.com/nicholas-fedor/shoutrrr (v0.15.1 → v0.16.0) (#​306) (23a9499)
• mise: update tool kind (0.31.0 → 0.32.0) (7de70c0)
• mise: update tool oxfmt (0.52.0 → 0.53.0) (cddeee2)
• talos: replace drain kubectl-safety fields with explicit enabled toggle (cfa6288)

Bug Fixes

• mise: update tool go (1.26.3 → 1.26.4) (3e57408)

Miscellaneous Chores

• move mise to mise folder (85719a6)
• update mise lockfile (7077075)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[ixxel-bot]

--- main/tuppr_gitops_manifests_system-upgrade_genmachine_manifest_main.yaml	2026-06-24 05:04:13.317016906 +0000
+++ pr/tuppr_gitops_manifests_system-upgrade_genmachine_manifest_pr.yaml	2026-06-24 05:04:12.764002798 +0000
@@ -1,64 +1,64 @@
 ---
 # Source: tuppr/charts/tuppr/templates/serviceaccount.tpl
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: tuppr
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 automountServiceAccountToken: true
 ---
 # Source: tuppr/charts/tuppr/templates/serviceaccount.tpl
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
 metadata:
   name: tuppr-talosconfig
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 spec:
   roles:
     - os:admin
 ---
 # Source: tuppr/charts/tuppr/templates/secret.tpl
 apiVersion: v1
 kind: Secret
 metadata:
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
   name: tuppr-webhook-server-cert
   namespace: 'default'
 ---
 # Source: tuppr/charts/tuppr/templates/rbac.tpl
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: tuppr-manager-role
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 rules:
 # Health check permissions - read-only access to all resources
 - apiGroups:
   - "*"
   resources:
   - "*"
   verbs:
   - get
   - list
@@ -175,45 +175,45 @@
   - watch
   - patch
   - update
 ---
 # Source: tuppr/charts/tuppr/templates/rbac.tpl
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: tuppr-manager-rolebinding
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: tuppr-manager-role
 subjects:
 - kind: ServiceAccount
   name: tuppr
   namespace: default
 ---
 # Source: tuppr/charts/tuppr/templates/rbac.tpl
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: tuppr-leader-election-role
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
   - ""
   resources:
   - configmaps
   verbs:
   - get
   - list
   - watch
@@ -241,124 +241,125 @@
   - create
   - patch
 ---
 # Source: tuppr/charts/tuppr/templates/rbac.tpl
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: tuppr-leader-election-rolebinding
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: tuppr-leader-election-role
 subjects:
 - kind: ServiceAccount
   name: tuppr
   namespace: default
 ---
 # Source: tuppr/charts/tuppr/templates/service.tpl
 apiVersion: v1
 kind: Service
 metadata:
   name: tuppr-metrics-service
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 spec:
   type: ClusterIP
   ports:
     - port: 8080
       targetPort: metrics
       protocol: TCP
       name: metrics
   selector:
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
 ---
 # Source: tuppr/charts/tuppr/templates/webhook.tpl
 apiVersion: v1
 kind: Service
 metadata:
   name: tuppr-webhook-service
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 spec:
   ports:
     - port: 443
       protocol: TCP
       targetPort: 9443
       name: webhook
   selector:
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
 ---
 # Source: tuppr/charts/tuppr/templates/deployment.tpl
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: tuppr
   namespace: default
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: tuppr
       app.kubernetes.io/instance: tuppr
   template:
     metadata:
       labels:
-        helm.sh/chart: tuppr-0.1.40
+        helm.sh/chart: tuppr-0.2.7
         app.kubernetes.io/name: tuppr
         app.kubernetes.io/instance: tuppr
-        app.kubernetes.io/version: "0.1.40"
+        app.kubernetes.io/version: "0.2.7"
         app.kubernetes.io/managed-by: Helm
     spec:
       enableServiceLinks: false
       serviceAccountName: tuppr
       priorityClassName: system-node-critical
       securityContext:
         fsGroup: 65532
+        runAsGroup: 65532
         runAsNonRoot: true
         runAsUser: 65532
       containers:
         - name: manager
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
               drop:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
             runAsUser: 65532
-          image: ghcr.io/home-operations/tuppr:0.1.40
+          image: ghcr.io/home-operations/tuppr@sha256:bca79f9cfc4a75b318e160bd811948fa513327f178c32cf85713833be7a480e2
           imagePullPolicy: IfNotPresent
           command:
             - /manager
           args:
             - --log-level=info
             - --leader-elect=true
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081
             - --talosconfig-secret=tuppr-talosconfig
             - --metrics-secure=false
@@ -472,24 +473,24 @@
       kind: Node
       expr: "status.conditions.exists(c, c.type == 'Ready' && c.status == 'True')"
       timeout: 10m
 ---
 # Source: tuppr/charts/tuppr/templates/webhook.tpl
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: tuppr-validating-webhook
   labels:
-    helm.sh/chart: tuppr-0.1.40
+    helm.sh/chart: tuppr-0.2.7
     app.kubernetes.io/name: tuppr
     app.kubernetes.io/instance: tuppr
-    app.kubernetes.io/version: "0.1.40"
+    app.kubernetes.io/version: "0.2.7"
     app.kubernetes.io/managed-by: Helm
 webhooks:
   - name: vkubernetesupgrade.kb.io
     admissionReviewVersions:
       - v1
     clientConfig:
       service:
         name: tuppr-webhook-service
         namespace: default
         path: /validate-tuppr-home-operations-com-v1alpha1-kubernetesupgrade