chore(deps): update all-minor-patch-updates

black-start/services/talos-discovery/docker-compose.yaml

@@ -2,7 +2,7 @@ version: "3.8"
 services:
   discovery:
     restart: unless-stopped
-    image: ghcr.io/siderolabs/discovery-service:v1.1.3
+    image: ghcr.io/siderolabs/discovery-service:v1.1.0
     ports:
       - 10.105.6.215:3000:3000
       - 10.105.6.215:3001:3001

black-start/services/vault/docker-compose.yaml

@@ -5,7 +5,7 @@ services:
     command: tunnel run weyma-vault
     env_file: ".env"
   vault:
-    image: hashicorp/vault:2.2
+    image: hashicorp/vault:2.0
     env_file: ".env.vault"
     environment:
       VAULT_ADDR: "https://weyma-vault.infra.dubyatp.xyz:8200"

omni/weyma-talos.yaml

@@ -1,9 +1,9 @@
 kind: Cluster
 name: weyma-talos
 kubernetes:
-  version: v1.36.4
+  version: v1.35.4
 talos:
-  version: v1.13.10
+  version: v1.12.7
 features:
   backupConfiguration:
     interval: 6h0m0s

system-apps/argocd/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: argo-cd
-  version: 10.10.5
+  version: 10.3.3
   repository: https://argoproj.github.io/argo-helm

system-apps/argocd/values.yaml

@@ -27,8 +27,6 @@ argo-cd:
       resource.customizations.ignoreDifferences.Secret: |
         jsonPointers:
           - /data
-      controller.repo.server.timeout.seconds: "300"
-      server.repo.server.timeout.seconds: "300"
     params:
       server.insecure: true
     ssh:

system-apps/cert-manager/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: cert-manager
-  version: v1.21.2
+  version: v1.21.1
   repository: https://charts.jetstack.io

system-apps/external-secrets/chart/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: external-secrets
-  version: 2.13.0
+  version: 2.9.0
   repository: https://charts.external-secrets.io

system-apps/kite/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: kite
-  version: 0.16.0
+  version: 0.14.1
   repository: https://zxh326.github.io/kite

system-apps/monitoring/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: kube-prometheus-stack
-  version: 92.10.1
+  version: 88.3.0
   repository: https://prometheus-community.github.io/helm-charts

system-apps/rook-ceph/clusters/cluster.yaml

@@ -21,24 +21,11 @@ spec:
     # versions running within the cluster. See tags available at https://hub.docker.com/r/ceph/ceph/tags/.
     # If you want to be more precise, you can always use a timestamp tag such as quay.io/ceph/ceph:v19.2.1-20250202
     # This tag might not contain a new Ceph version, just security fixes from the underlying operating system, which will reduce vulnerabilities
-    image: quay.io/ceph/ceph:v20.2.4-20260818
+    image: quay.io/ceph/ceph:v20.2.0-20251104
     # Whether to allow unsupported versions of Ceph. Currently Reef and Squid are supported.
     # Future versions such as Tentacle (v20) would require this to be set to `true`.
     # Do not set to true in production.
     allowUnsupported: false
-  security:
-    cephx:
-      daemon:
-        keyRotationPolicy: KeyGeneration
-        keyGeneration: 2 # must be greater than the current keyGeneration
-      csi:
-        keyRotationPolicy: KeyGeneration
-        keyGeneration: 5 # must be greater than the current keyGeneration
-        keyType: aes # Talos kernel 6.18 / cephcsi v3.17.0 don't support aes256k yet
-      rbdMirrorPeer:
-        keyRotationPolicy: KeyGeneration
-        keyGeneration: 5 # must be greater than the current keyGeneration
-        keyType: aes # Talos kernel 6.18 / cephcsi v3.17.0 don't support aes256k yet
   # The path on the host where configuration files will be persisted. Must be specified. If there are multiple clusters, the directory must be unique for each cluster.
   # Important: if you reinstall the cluster, make sure you delete this directory from each host or else the mons will fail to start on the new cluster.
   # In Minikube, the '/data' directory is configured to persist across reboots. Use "/data/rook" in Minikube environment.
@@ -77,7 +64,7 @@ spec:
       # List of modules to optionally enable or disable.
       # Note the "dashboard" and "monitoring" modules are already configured by other settings in the cluster CR.
       - name: rook
-        enabled: false
+        enabled: true
   # enable the ceph dashboard for viewing cluster status
   dashboard:
     enabled: true
@@ -371,12 +358,3 @@ spec:
         disabled: false
       osd:
         disabled: false
-    muteHealthWarning: # Remove these after Talos uses 7.0+ kernel
-      AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE:
-        policy: mute
-      AUTH_INSECURE_CLIENT_KEY_TYPE:
-        policy: mute
-      AUTH_INSECURE_KEYS_ALLOWED:
-        policy: mute
-      AUTH_INSECURE_KEYS_CREATABLE:
-        policy: mute

system-apps/rook-ceph/operator/Chart.yaml

@@ -24,8 +24,8 @@ appVersion: "1.0"
 
 dependencies:
 - name: rook-ceph
-  version: v1.21.0
+  version: v1.20.3
   repository: https://charts.rook.io/release
 - name: ceph-csi-drivers
-  version: 1.1.0
+  version: 1.0.4
   repository: https://ceph.github.io/ceph-csi-operator

system-apps/traefik/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: traefik
-  version: 42.0.0
+  version: 41.2.0
   repository: https://traefik.github.io/charts

system-apps/traefik/values.yaml

@@ -37,7 +37,7 @@ traefik:
     kind: DaemonSet
     additionalContainers:
     - name: cloudflared
-      image: cloudflare/cloudflared:2026.10.1
+      image: cloudflare/cloudflared:2026.8.1
       command:
         - cloudflared
         - tunnel

system-apps/velero/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: velero
-  version: 12.2.1
+  version: 12.1.0
   repository: https://vmware-tanzu.github.io/helm-charts

system-apps/velero/values.yaml

@@ -59,7 +59,7 @@ velero:
         insecureSkipTLSVerify: "true"
   initContainers:
   - name: velero-plugin-for-aws
-    image: velero/velero-plugin-for-aws:v1.14.4
+    image: velero/velero-plugin-for-aws:v1.14.2
     imagePullPolicy: IfNotPresent
     volumeMounts:
       - mountPath: /target