chore(deps): update helm release external-secrets to v1.1.1 (#62)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

apps/authentik.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     repoURL: https://charts.goauthentik.io
     chart: authentik
-    targetRevision: 2025.10.1
+    targetRevision: 2025.10.2
     helm:
       valuesObject:
         authentik:

apps/external-secrets.yaml

@@ -19,7 +19,7 @@ spec:
   source:
     repoURL: https://charts.external-secrets.io
     chart: external-secrets
-    targetRevision: 1.0.0
+    targetRevision: 1.1.1
     helm:
       valuesObject:
         bitwarden-sdk-server:

apps/immich/values.yaml

@@ -39,7 +39,7 @@ controllers:
       main:
         image:
           # renovate: datasource=github-releases depName=immich-app/immich
-          tag: "v2.2.3"
+          tag: "v2.3.1"
         env:
           DB_URL: postgres://immich@postgres-cluster-rw.postgres/immich?sslcert=/pg/tls.crt&sslkey=/pg/tls.key&sslrootcert=/pg/ca.crt
           IMMICH_CONFIG_FILE: /config/config.yaml

apps/kyoo-v5.yaml

@@ -13,7 +13,7 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
-    - CreateNamespace=true
+      - CreateNamespace=true
   source:
     repoURL: https://github.com/zoriya/Kyoo
     path: chart
@@ -30,11 +30,25 @@ spec:
           postgres:
             shared:
               host: kyoo-v5-postgres
+          extraEnv:
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: "http://otel-collector.otel.svc:4317"
+            - name: OTEL_EXPORTER_OTLP_PROTOCOL
+              value: "grpc"
         postgres:
           enabled: true
+          persistence:
+            size: 16Gi
         kyoo:
           address: https://beta.sdg.moe
           transcoderAcceleration: nvidia
+          auth:
+            apikeys:
+              extra:
+                - name: admin
+                  existingSecret: admin-apikey
+                  apikeyKey: uuid
+                  claims: '{"permissions": ["users.read", "users.write", "apikeys.read", "apikeys.write", "users.delete", "core.read", "core.write", "core.play", "scanner.trigger"], "verified": true}'
         transcoder:
           runtimeClass: nvidia
         ingress:
@@ -63,7 +77,7 @@ spec:
               name: kyoo-v5-medias
             spec:
               accessModes:
-              - ReadWriteOnce
+                - ReadWriteOnce
               capacity:
                 storage: 200Ti
               csi:
@@ -81,7 +95,20 @@ spec:
               storageClassName: ""
               volumeName: kyoo-v5-medias
               accessModes:
-              - ReadWriteOnce
+                - ReadWriteOnce
               resources:
                 requests:
                   storage: 200Ti
+
+          - apiVersion: external-secrets.io/v1
+            kind: ExternalSecret
+            metadata:
+              name: admin-apikey
+            spec:
+              refreshPolicy: CreatedOnce
+              dataFrom:
+                - sourceRef:
+                    generatorRef:
+                      apiVersion: generators.external-secrets.io/v1alpha1
+                      kind: ClusterGenerator
+                      name: uuid

apps/openebs/kustomization.yaml

@@ -6,7 +6,7 @@ helmCharts:
   name: openebs
   namespace: openebs
   releaseName: openebs
-  version: 4.3.3
+  version: 4.4.0
   valuesFile: values.yaml
 
 resources:

apps/otel-operator.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     repoURL: https://open-telemetry.github.io/opentelemetry-helm-charts
     chart: opentelemetry-operator
-    targetRevision: 0.99.1
+    targetRevision: 0.99.2
     helm:
       valuesObject:
         # optional and not used anymore

apps/otel/otel-clickhouse.yaml

@@ -4,6 +4,9 @@ metadata:
   name: otel-cluster
 spec:
   configuration:
+    settings:
+      logger/size: "500M"
+      logger/count: 1
     clusters:
       - name: otel-cluster
         layout:
@@ -58,7 +61,7 @@ spec:
             - ReadWriteOnce
           resources:
             requests:
-              storage: 10Gi
+              storage: 100Gi
       - name: log-volume-template
         spec:
           accessModes:

apps/otel/otel-rbac.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: otel-collector
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "namespaces", "nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: otel-collector
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: otel-collector
+subjects:
+  - kind: ServiceAccount
+    name: otel-collector
+    namespace: otel

apps/otel/otel.yaml

@@ -38,6 +38,8 @@ spec:
       #     paging:
       otlp:
         protocols:
+          grpc:
+            endpoint: 0.0.0.0:4317
           http:
             endpoint: 0.0.0.0:4318
             auth:
@@ -52,6 +54,15 @@ spec:
         send_batch_size: 2000
         send_batch_max_size: 2000
         timeout: 5s
+      k8sattributes:
+        extract:
+          metadata:
+            - k8s.namespace.name
+            - k8s.pod.name
+            - k8s.pod.start_time
+            - k8s.pod.uid
+            - k8s.deployment.name
+            - k8s.node.name
 
     exporters:
       debug:
@@ -88,13 +99,13 @@ spec:
       pipelines:
         traces:
           receivers: [otlp]
-          processors: [memory_limiter, batch]
+          processors: [k8sattributes, memory_limiter, batch]
           exporters: [clickhouse]
         metrics:
           receivers: [otlp] #[otlp, hostmetrics]
-          processors: [memory_limiter, batch]
+          processors: [k8sattributes, memory_limiter, batch]
           exporters: [debug, clickhouse]
         logs:
           receivers: [otlp]
-          processors: [memory_limiter, batch]
+          processors: [k8sattributes, memory_limiter, batch]
           exporters: [clickhouse]