chore(deps): update all-minor-patch-updates

Reviewed-on: #375

black-start/services/talos-discovery/docker-compose.yaml

@@ -2,7 +2,7 @@ version: "3.8"
 services:
   discovery:
     restart: unless-stopped
-    image: ghcr.io/siderolabs/discovery-service:v1.0.17
+    image: ghcr.io/siderolabs/discovery-service:v1.1.0
     ports:
       - 10.105.6.215:3000:3000
       - 10.105.6.215:3001:3001

black-start/services/vault/docker-compose.yaml

@@ -5,7 +5,7 @@ services:
     command: tunnel run weyma-vault
     env_file: ".env"
   vault:
-    image: hashicorp/vault:2.0
+    image: hashicorp/vault:2.1
     env_file: ".env.vault"
     environment:
       VAULT_ADDR: "https://weyma-vault.infra.dubyatp.xyz:8200"

omni/weyma-talos.yaml

@@ -1,9 +1,9 @@
 kind: Cluster
 name: weyma-talos
 kubernetes:
-  version: v1.35.4
+  version: v1.36.4
 talos:
-  version: v1.12.7
+  version: v1.13.9
 features:
   backupConfiguration:
     interval: 6h0m0s
@@ -310,7 +310,7 @@ patches:
                           }
 
                           rewrite name git.dubyatp.xyz traefik-local.traefik.svc.cluster.local
-                          
+
                           forward . /etc/resolv.conf {
                             max_concurrent 1000
                           }

system-apps/argocd/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: argo-cd
-  version: 10.1.3
+  version: 10.6.0
   repository: https://argoproj.github.io/argo-helm

system-apps/cert-manager/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: cert-manager
-  version: v1.21.0
+  version: v1.21.1
   repository: https://charts.jetstack.io

system-apps/external-secrets/chart/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: external-secrets
-  version: 2.7.0
+  version: 2.10.0
   repository: https://charts.external-secrets.io

system-apps/kite/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: kite
-  version: 0.13.0
+  version: 0.15.0
   repository: https://zxh326.github.io/kite

system-apps/monitoring/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: kube-prometheus-stack
-  version: 87.15.2
+  version: 88.6.2
   repository: https://prometheus-community.github.io/helm-charts

system-apps/rook-ceph/clusters/cluster.yaml

@@ -21,11 +21,24 @@ spec:
     # versions running within the cluster. See tags available at https://hub.docker.com/r/ceph/ceph/tags/.
     # If you want to be more precise, you can always use a timestamp tag such as quay.io/ceph/ceph:v19.2.1-20250202
     # This tag might not contain a new Ceph version, just security fixes from the underlying operating system, which will reduce vulnerabilities
-    image: quay.io/ceph/ceph:v20.2.0-20251104
+    image: quay.io/ceph/ceph:v20.2.4-20260818
     # Whether to allow unsupported versions of Ceph. Currently Reef and Squid are supported.
     # Future versions such as Tentacle (v20) would require this to be set to `true`.
     # Do not set to true in production.
     allowUnsupported: false
+  security:
+    cephx:
+      daemon:
+        keyRotationPolicy: KeyGeneration
+        keyGeneration: 2 # must be greater than the current keyGeneration
+      csi:
+        keyRotationPolicy: KeyGeneration
+        keyGeneration: 3 # must be greater than the current keyGeneration
+        keyType: aes # Talos kernel 6.18 / cephcsi v3.17.0 don't support aes256k yet
+      rbdMirrorPeer:
+        keyRotationPolicy: KeyGeneration
+        keyGeneration: 3 # must be greater than the current keyGeneration
+        keyType: aes # Talos kernel 6.18 / cephcsi v3.17.0 don't support aes256k yet
   # The path on the host where configuration files will be persisted. Must be specified. If there are multiple clusters, the directory must be unique for each cluster.
   # Important: if you reinstall the cluster, make sure you delete this directory from each host or else the mons will fail to start on the new cluster.
   # In Minikube, the '/data' directory is configured to persist across reboots. Use "/data/rook" in Minikube environment.
@@ -64,7 +77,7 @@ spec:
       # List of modules to optionally enable or disable.
       # Note the "dashboard" and "monitoring" modules are already configured by other settings in the cluster CR.
       - name: rook
-        enabled: true
+        enabled: false
   # enable the ceph dashboard for viewing cluster status
   dashboard:
     enabled: true
@@ -358,3 +371,12 @@ spec:
         disabled: false
       osd:
         disabled: false
+    muteHealthWarning: # Remove these after Talos uses 7.0+ kernel
+      AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE:
+        policy: mute
+      AUTH_INSECURE_CLIENT_KEY_TYPE:
+        policy: mute
+      AUTH_INSECURE_KEYS_ALLOWED:
+        policy: mute
+      AUTH_INSECURE_KEYS_CREATABLE:
+        policy: mute

system-apps/rook-ceph/operator/Chart.yaml

@@ -24,7 +24,7 @@ appVersion: "1.0"
 
 dependencies:
 - name: rook-ceph
-  version: v1.20.2
+  version: v1.20.6
   repository: https://charts.rook.io/release
 - name: ceph-csi-drivers
   version: 1.0.4

system-apps/traefik/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: traefik
-  version: 41.0.2
+  version: 41.4.0
   repository: https://traefik.github.io/charts

system-apps/traefik/values.yaml

@@ -37,7 +37,7 @@ traefik:
     kind: DaemonSet
     additionalContainers:
     - name: cloudflared
-      image: cloudflare/cloudflared:2026.7.1
+      image: cloudflare/cloudflared:2026.8.3
       command:
         - cloudflared
         - tunnel