feat(container)!: Update image quay.io/ceph/ceph (v20.2.2 → v21.1.0) by bot-akira[bot] · Pull Request #3655 · axeII/home-ops

bot-akira · 2026-07-20T13:46:19Z

This PR contains the following updates:

Package	Update	Change
quay.io/ceph/ceph	major	`v20.2.2` → `v21.1.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

This is a merge commit the virtual branches in your workspace. Due to GitButler managing multiple virtual branches, you cannot switch back and forth between git branches and virtual branches easily. If you switch to another branch, GitButler will need to be reinitialized. If you commit on this branch, GitButler will throw it away. Here are the branches that are currently applied: - feat/rook-ceph-v20.2.2 (refs/gitbutler/feat/rook-ceph-v20.2.2) branch head: 439fb15 For more information about what we're doing here, check out our docs: https://docs.gitbutler.com/features/branch-management/integration-branch

🔐 Fix 1password secret format - single string values in stringData

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

This is placeholder commit and will be replaced by a merge of your virtual branches. Due to GitButler managing multiple virtual branches, you cannot switch back and forth between git branches and virtual branches easily. If you switch to another branch, GitButler will need to be reinitialized. If you commit on this branch, GitButler will throw it away. For more information about what we're doing here, check out our docs: https://docs.gitbutler.com/features/branch-management/integration-branch

✨ Migrate 1Password from Connect to SDK provider

hotfix: rotate secret token

… upgrade

fix(tuppr): disable GrafanaDashboard to prevent finalizer blocking on…

…test

feat(helm): update chart external-secrets (2.7.0 → 2.8.0)

fix(tuppr): set maintenance window to 23:15 Paris for tonight's test

…ssing onepasswordSDK)

fix: remove stale inline schema from 1password ClusterSecretStore

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

… hooks

… hooks fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph hooks

…netes provider

fix(tuppr): fix ClusterSecretStore kubernetes provider

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

…r hook jobs

fix(tuppr): add SOPS-encrypted rook-ceph secrets for hook jobs

…stale branch

fix(renovate): move kubelet to Talos group, bump K8s to v1.36.2

…, update AGENTS.md

fix: karakeep-meilisearch, smartctl dashboard, AGENTS.md

… to free node space

fix(karakeep): add chrome memory request, keep required affinity

… chrome pods

fix(karakeep): use controller label for podAffinity to avoid matching chrome

…was using 856Mi with no request)

…Prometheus

…Prom fix(alloy): add memory request+limit, fix out-of-order samples in VM Prom

…valid CLI flag

fix(vm): set out_of_order_time_window in prometheus.yml

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

bot-akira · 2026-07-20T13:46:36Z

konflate — summary

Note

+4 added · 26 changed · −8 removed — 38 resources · 13 apps · 9 CRDs

Blast radius

Kustomization kube-system/external-secrets — 15 dependents (Kustomization kube-system/external-secrets-stores +14 more)
Kustomization kube-system/external-secrets-stores — 14 dependents (Kustomization default/atuin, Kustomization default/home-assistant, Kustomization default/paperless +11 more)
Kustomization rook-ceph/rook-ceph-cluster — 12 dependents (Kustomization default/docmost, Kustomization default/home-assistant, Kustomization default/karakeep +9 more)
Kustomization system-upgrade/tuppr — 1 dependent (Kustomization system-upgrade/tuppr-cr)

Warning

⚠ Cautions

38 resources · 13 apps — large change set — more ground to cover than a typical PR; review with extra care
quay.io/ceph/ceph — major image version bump v20.2.2 → v21.1.0 — likely breaking changes

Image changes

image	from	to
`docker.io/1password/connect-api`	`sha256:e915c0c84397…`	`∅`
`docker.io/1password/connect-sync`	`sha256:6297ca6136c0…`	`∅`
`ghcr.io/external-secrets/external-secrets`	`v2.7.0`	`v2.8.0`
`quay.io/ceph/ceph`	`v20.2.2`	`v21.1.0`

View the full rendered diff →

_{konflate · rendered 51784f5 · advisory, not a gate}

github-advanced-security · 2026-07-20T13:47:37Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

bot-akira Bot and others added 30 commits July 18, 2026 17:46

feat(helm): update chart external-secrets (2.7.0 → 2.8.0)

a94fb2d

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

🔐 Fix 1password secret format - single string values in stringData

8a7de0f

🔐 Fix 1password secret format - single string values in stringData

38a152f

🔐 Fix 1password secret format - single string values in stringData

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

c2aab65

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

43c4cc9

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

✨ Migrate 1Password from Connect to SDK provider

40817ce

Merge remote-tracking branch 'origin/main' into feat/onepassword-sdk

869a60d

✨ Migrate 1Password from Connect to SDK provider

a1a490e

✨ Migrate 1Password from Connect to SDK provider

hotfix: rotate secret token

703066e

Merge pull request #3633 from axeII/fix/issue

a1054ff

hotfix: rotate secret token

fix(tuppr): disable GrafanaDashboard to prevent finalizer blocking on…

55e9f5d

… upgrade

Merge pull request #3634 from axeII/al-branch-398

e345607

fix(tuppr): disable GrafanaDashboard to prevent finalizer blocking on…

fix(tuppr): set maintenance window to 23:15 Paris time for tonight's …

9b3319d

…test

Merge pull request #3627 from axeII/renovate/external-secrets-2.x

12c5ac5

feat(helm): update chart external-secrets (2.7.0 → 2.8.0)

fix(tuppr): set maintenance window to 23:15 Paris for tonight's test

3664cd2

fix(tuppr): set maintenance window to 23:15 Paris for tonight's test

fix: remove stale inline schema from 1password ClusterSecretStore (mi…

8209de1

…ssing onepasswordSDK)

fix: remove stale inline schema from 1password ClusterSecretStore

5ec9b82

fix: remove stale inline schema from 1password ClusterSecretStore

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

fc43d3d

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

dd9298e

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph…

6709f7c

… hooks

fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph…

226e6a4

… hooks fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph hooks

fix(tuppr): rename ClusterSecretStore, use default pod auth for kuber…

d3d3b96

…netes provider

fix(tuppr): fix ClusterSecretStore kubernetes provider

815a5b0

fix(tuppr): fix ClusterSecretStore kubernetes provider

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

e7a16c8

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

d0af2fc

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

fix(tuppr): add SOPS-encrypted rook-ceph secrets to system-upgrade fo…

a8b2370

…r hook jobs

fix(tuppr): add SOPS-encrypted rook-ceph secrets for hook jobs

c27cf30

fix(tuppr): add SOPS-encrypted rook-ceph secrets for hook jobs

chore: bump Kubernetes to v1.36.2 (supported by Talos v1.13.6)

56fff8c

axeII and others added 14 commits July 19, 2026 00:26

fix(renovate): move kubelet to Talos group, remove duplicate, delete …

7aee4e2

…stale branch

fix(renovate): move kubelet to Talos group, bump K8s to v1.36.2

57fc66f

fix(renovate): move kubelet to Talos group, bump K8s to v1.36.2

fix: karakeep-meilisearch memory+affinity, smartctl dashboard+cleanup…

42d1127

…, update AGENTS.md

fix: karakeep-meilisearch, smartctl dashboard, AGENTS.md

2a5be87

fix: karakeep-meilisearch, smartctl dashboard, AGENTS.md

fix(karakeep): revert affinity to required, add chrome memory request…

fe80fbb

… to free node space

fix(karakeep): add chrome memory request, keep required affinity

8787f2c

fix(karakeep): add chrome memory request, keep required affinity

fix(karakeep): use controller label for podAffinity to avoid matching…

5550fe2

… chrome pods

fix(karakeep): use controller label for podAffinity

5ed629b

fix(karakeep): use controller label for podAffinity to avoid matching chrome

fix(observability): set alloy memory request to 512Mi, limit to 1Gi (…

7b3c801

…was using 856Mi with no request)

fix(alloy): add memory request+limit, fix out-of-order samples in VM …

26d76ad

…Prometheus

fix(alloy): add memory request+limit, fix out-of-order samples in VM …

b109df0

…Prom fix(alloy): add memory request+limit, fix out-of-order samples in VM Prom

fix(vm): set out_of_order_time_window in prometheus.yml instead of in…

9a9d168

…valid CLI flag

fix(vm): set out_of_order_time_window in prometheus.yml

c6cccab

fix(vm): set out_of_order_time_window in prometheus.yml

feat(container)!: Update image quay.io/ceph/ceph (v20.2.2 → v21.1.0)

51784f5

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

bot-akira Bot added renovate/container type/major labels Jul 20, 2026

github-actions Bot added the area/kubernetes label Jul 20, 2026

bot-akira Bot added needs-review risk/critical labels Jul 26, 2026

axeII force-pushed the main branch from 57964d4 to 6486283 Compare July 26, 2026 15:07

axeII mentioned this pull request Jul 31, 2026

fix(ci): repair auto-merge critical-infra gate (missing grep -E) + defense-in-depth label gate #3717

Merged

Navigation Menu

feat(container)!: Update image quay.io/ceph/ceph (v20.2.2 → v21.1.0) - #3655

feat(container)!: Update image quay.io/ceph/ceph (v20.2.2 → v21.1.0)#3655
bot-akira[bot] wants to merge 44 commits into
mainfrom
renovate/quay.io-ceph-ceph-21.x

bot-akira Bot commented Jul 20, 2026

Uh oh!

bot-akira Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bot-akira Bot commented Jul 20, 2026

Configuration

Uh oh!

bot-akira Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

konflate — summary

Uh oh!

github-advanced-security AI commented Jul 20, 2026

What Enabling Code Scanning Means:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bot-akira Bot commented Jul 20, 2026 •

edited

Loading