Merge pull request 'Update Helm release open-webui to v16.5.0' (#417) from renovate/open-webui-16.x into fresh-start

Reviewed-on: #417

.woodpecker/build-images.yaml

@@ -7,7 +7,7 @@ when:
 
 steps:
   - name: Get registry creds from OpenBao
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -57,7 +57,7 @@ steps:
     depends_on: ["Get registry creds from OpenBao"]
 
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

.woodpecker/flux-reconcile-source.yaml

@@ -6,7 +6,7 @@ skip_clone: true
 
 steps:
   - name: Get kubernetes access from OpenBao
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -35,13 +35,13 @@ steps:
           --namespace flux-system
       - kubectl config use-context cluster
   - name: Reconcile git source
-    image: ghcr.io/fluxcd/flux-cli:v2.9.3
+    image: ghcr.io/fluxcd/flux-cli:v2.9.5
     environment:
       KUBECONFIG: /woodpecker/kubeconfig
     commands:
       - flux reconcile source git flux-system
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

.woodpecker/renovate.yaml

@@ -6,7 +6,7 @@ skip_clone: true
 
 steps:
   - name: Get renovate token from OpenBao
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -21,7 +21,7 @@ steps:
       - bao kv get -mount secret -field RENOVATE_TOKEN renovate > /woodpecker/renovate_token
       - bao kv get -mount secret -field GITHUB_COM_TOKEN renovate > /woodpecker/github_com_token
   - name: Run Renovate
-    image: renovate/renovate:43
+    image: renovate/renovate:44
     pull: true
     environment:
       RENOVATE_AUTODISCOVER: "true"
@@ -35,7 +35,7 @@ steps:
       - export GITHUB_COM_TOKEN=$(cat /woodpecker/github_com_token)
       - /usr/local/sbin/renovate-entrypoint.sh renovate
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.6.1
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

apps/authentik/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: 2026.5.6
+      version: 2026.8.1
       sourceRef:
         kind: HelmRepository
         name: authentik

apps/gitea/release.yaml

@@ -24,6 +24,8 @@ spec:
         namespace: gitea
       interval: 12h
   values:
+    image:
+      tag: 1.27.2 # REMOVE ME after new helm chart version includes this update
     postgresql-ha:
       enabled: false
 

apps/gitea/valkey-volume.yaml

@@ -7,7 +7,7 @@ metadata:
   name: gitea-valkey-primary-lvmhdd-0
   namespace: openebs
 spec:
-  capacity: 1Gi
+  capacity: "4294967296"
   ownerNodeID: anapistula-delrosalae
   shared: "yes"
   thinProvision: "no"
@@ -20,7 +20,7 @@ metadata:
   name: gitea-valkey-primary-lvmhdd-0
 spec:
   capacity:
-    storage: 1Gi
+    storage: 4Gi
   accessModes:
     - ReadWriteOnce
   persistentVolumeReclaimPolicy: Retain
@@ -41,6 +41,6 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 1Gi
+      storage: 4Gi
   storageClassName: hdd-lvmpv
   volumeName: gitea-valkey-primary-lvmhdd-0

apps/kaneo/release.yaml

@@ -8,7 +8,7 @@ spec:
   interval: 24h
   url: https://github.com/usekaneo/kaneo.git
   ref:
-    tag: v2.9.10
+    tag: v2.22.0
   ignore: |
     # exclude all
     /*
@@ -53,8 +53,6 @@ spec:
       enabled: false
     
     kaneo:
-      image:
-        tag: "2.9.10"  # renovate: depName=ghcr.io/usekaneo/kaneo registryUrl=https://ghcr.io
       env:
         clientUrl: "https://kaneo.lumpiasty.xyz"
         disablePasswordRegistration: true

apps/llama/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: supervisord
-          image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:86e4837462324c47fa49d4f766908e133d84ba5373caf1f8fa5c55f44397b312
+          image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:2676d13df2a0833b27ab8ec441da78c6c43d3f7bf75837d35723eefb40a82ce1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/llama/kokoro.yaml

@@ -21,7 +21,7 @@ spec:
           # OpenAI-compatible Kokoro-FastAPI TTS server, CPU PyTorch backend.
           # Models baked into the image (no PVC needed).
           # v0.3.0 includes fix for per-request voice tensor memory leak (#459).
-          image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.6.0
+          image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.8.1
           ports:
             - containerPort: 8880
               name: http

apps/openwebui/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: open-webui
-      version: 15.2.0
+      version: 16.5.0
       sourceRef:
         kind: HelmRepository
         name: open-webui
@@ -131,6 +131,3 @@ spec:
         value: "flux2-klein-4b:Q4_K_M"
       - name: IMAGE_EDIT_SIZE
         value: "512x512"
-
-    image:
-      tag: v0.11.0

apps/woodpecker/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: woodpecker
-      version: 3.6.5
+      version: 3.7.3
       sourceRef:
         kind: HelmRepository
         name: woodpecker

cluster/flux-system/gotk-components.yaml

@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.9.3
+# Flux Version: v2.9.5
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     pod-security.kubernetes.io/warn: restricted
     pod-security.kubernetes.io/warn-version: latest
   name: flux-system
@@ -19,7 +19,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: allow-egress
   namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: allow-scraping
   namespace: flux-system
 spec:
@@ -59,13 +59,16 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: allow-webhooks
   namespace: flux-system
 spec:
   ingress:
   - from:
     - namespaceSelector: {}
+    ports:
+    - port: 9292
+      protocol: TCP
   podSelector:
     matchLabels:
       app: notification-controller
@@ -78,7 +81,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: critical-pods-flux-system
   namespace: flux-system
 spec:
@@ -98,7 +101,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +207,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
   name: flux-edit-flux-system
@@ -231,7 +234,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -257,7 +260,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: cluster-reconciler-flux-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -277,7 +280,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: crd-controller-flux-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -316,7 +319,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: buckets.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -708,7 +711,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: externalartifacts.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -911,7 +914,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: gitrepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -1406,7 +1409,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: helmcharts.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -1770,7 +1773,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: helmrepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -2101,7 +2104,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: ocirepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -2532,7 +2535,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: source-controller
   namespace: flux-system
 ---
@@ -2543,7 +2546,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: source-controller
   namespace: flux-system
@@ -2564,7 +2567,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: source-controller
   namespace: flux-system
@@ -2585,7 +2588,7 @@ spec:
         app.kubernetes.io/component: source-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.3
+        app.kubernetes.io/version: v2.9.5
     spec:
       containers:
       - args:
@@ -2608,7 +2611,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.9.3
+        image: ghcr.io/fluxcd/source-controller:v1.9.5
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -2673,7 +2676,7 @@ metadata:
     app.kubernetes.io/component: kustomize-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
   group: kustomize.toolkit.fluxcd.io
@@ -3485,7 +3488,7 @@ metadata:
     app.kubernetes.io/component: kustomize-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: kustomize-controller
   namespace: flux-system
 ---
@@ -3496,7 +3499,7 @@ metadata:
     app.kubernetes.io/component: kustomize-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: kustomize-controller
   namespace: flux-system
@@ -3515,7 +3518,7 @@ spec:
         app.kubernetes.io/component: kustomize-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.3
+        app.kubernetes.io/version: v2.9.5
     spec:
       containers:
       - args:
@@ -3534,7 +3537,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.9.4
+        image: ghcr.io/fluxcd/kustomize-controller:v1.9.5
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -3592,7 +3595,7 @@ metadata:
     app.kubernetes.io/component: helm-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: helmreleases.helm.toolkit.fluxcd.io
 spec:
   group: helm.toolkit.fluxcd.io
@@ -5081,7 +5084,7 @@ metadata:
     app.kubernetes.io/component: helm-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: helm-controller
   namespace: flux-system
 ---
@@ -5092,7 +5095,7 @@ metadata:
     app.kubernetes.io/component: helm-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: helm-controller
   namespace: flux-system
@@ -5111,7 +5114,7 @@ spec:
         app.kubernetes.io/component: helm-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.3
+        app.kubernetes.io/version: v2.9.5
     spec:
       containers:
       - args:
@@ -5130,7 +5133,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.6.3
+        image: ghcr.io/fluxcd/helm-controller:v1.6.4
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -5188,7 +5191,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: alerts.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -5360,7 +5363,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: providers.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -5571,7 +5574,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: receivers.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -5945,7 +5948,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
   name: notification-controller
   namespace: flux-system
 ---
@@ -5956,7 +5959,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: notification-controller
   namespace: flux-system
@@ -5977,7 +5980,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: webhook-receiver
   namespace: flux-system
@@ -5998,7 +6001,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.9.3
+    app.kubernetes.io/version: v2.9.5
     control-plane: controller
   name: notification-controller
   namespace: flux-system
@@ -6017,7 +6020,7 @@ spec:
         app.kubernetes.io/component: notification-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.9.3
+        app.kubernetes.io/version: v2.9.5
     spec:
       containers:
       - args:
@@ -6035,7 +6038,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.9.2
+        image: ghcr.io/fluxcd/notification-controller:v1.9.4
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:

docker/coredns/Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: build CoreDNS with minimal plugin set
-FROM golang:1.26-alpine AS build
+FROM golang:1.27-alpine AS build
 
 RUN apk add --no-cache git make bash
 

infra/controllers/cert-manager-webhook-ovh.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: cert-manager-webhook-ovh
-      version: 0.9.14
+      version: 0.9.16
       sourceRef:
         kind: HelmRepository
         name: cert-manager-webhook-ovh

infra/controllers/cilium.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: 1.19.6
+      version: 1.20.1
       sourceRef:
         kind: HelmRepository
         name: cilium

infra/controllers/coredns.yaml

@@ -110,7 +110,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: coredns
-          image: registry.k8s.io/coredns/coredns:v1.14.6
+          image: registry.k8s.io/coredns/coredns:v1.14.7
           imagePullPolicy: IfNotPresent
           args: ["-conf", "/etc/coredns/Corefile"]
           ports:

infra/controllers/dns-public.yaml

@@ -97,7 +97,7 @@ spec:
           env:
             - name: GOMEMLIMIT
               value: 161MiB
-          image: registry.k8s.io/coredns/coredns:v1.14.6
+          image: registry.k8s.io/coredns/coredns:v1.14.7
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 5

infra/controllers/openbao.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: openbao
-      version: 0.28.6
+      version: 0.29.4
       sourceRef:
         kind: HelmRepository
         name: openbao

infra/controllers/vault-secrets-operator.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: vault-secrets-operator
-      version: 1.5.0
+      version: 1.5.1
       sourceRef:
         kind: HelmRepository
         name: hashicorp