Skip to content

chore(deps): update helm charts#462

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/helm-charts
Open

chore(deps): update helm charts#462
renovate[bot] wants to merge 1 commit intomainfrom
renovate/helm-charts

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 8, 2026 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
argo-cd helm_release minor 9.4.17 → 9.5.0
cert-manager (source) helm_release patch v1.20.1 → v1.20.2
external-secrets helm_release minor 2.2.0 → 2.3.0

Release Notes

argoproj/argo-helm (argo-cd)

v9.5.0

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

New Contributors

Full Changelog: argoproj/argo-helm@argo-cd-9.4.18...argo-cd-9.5.0

v9.4.18

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.7...argo-cd-9.4.18

cert-manager/cert-manager (cert-manager)

v1.20.2

Compare Source

v1.20.2 fixes invalid YAML generated in the Helm chart when both webhook.config
and webhook.volumes are defined, and bumps Go to 1.26.2 along with dependencies
to address reported vulnerabilities.

Changes by Kind

Bug or Regression
Other (Cleanup or Flake)
external-secrets/external-secrets (external-secrets)

v2.3.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.3.0
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.3.0-ubi-boringssl

What's Changed
General
Dependencies
New Contributors

Full Changelog: external-secrets/external-secrets@v2.2.0...v2.3.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file helm labels Apr 8, 2026
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 8, 2026 •
edited
Loading

Terraform Plan (03-services)

→ Resource Changes: 0 to create, 3 to update, 0 to re-create, 0 to delete, 0 ephemeral.

♻️ Update

helm_release.argocd 
! id                         = "argocd" -> (known after apply)
! metadata                   = {
!     app_version    = "v3.3.6" -> (known after apply)
!     chart          = "argo-cd" -> (known after apply)
!     first_deployed = 1770562152 -> (known after apply)
!     last_deployed  = 1775345187 -> (known after apply)
!     name           = "argocd" -> (known after apply)
!     namespace      = "argocd" -> (known after apply)
!     notes          = <<-EOT
          In order to access the server UI you have the following options:
          
          1. kubectl port-forward service/argocd-server -n argocd 8080:443
          
              and then open the browser on http://localhost:8080 and accept the certificate
          
          2. enable ingress in the values file `server.ingress.enabled` and either
                - Add the annotation for ssl passthrough: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough
                - Set the `configs.params."server.insecure"` in the values file and terminate SSL at your ingress: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts
          
          
          After reaching the UI the first time you can login with username: admin and the random password generated during the installation. You can find the password by running:
          
          kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
          
          (You should delete the initial secret afterwards as suggested by the Getting Started Guide: https://argo-cd.readthedocs.io/en/stable/getting_started/#4-login-using-the-cli)
      EOT -> (known after apply)
!     revision       = 6 -> (known after apply)
!     values         = jsonencode(
          {
            - applicationSet = {
                - enabled = true
              }
            - configs        = {
                - cm     = {
                    - "oidc.config" = <<-EOT
                          "clientID": "argocd"
                          "clientSecret": "$oidc.authentik.clientSecret"
                          "issuer": "https://auth.lippok.dev/application/o/argocd/"
                          "name": "Authentik"
                          "requestedScopes":
                          - "openid"
                          - "profile"
                          - "email"
                          - "groups"
                      EOT
                    - url           = "https://argocd.lippok.dev"
                  }
                - params = {
                    - "server.insecure" = "true"
                  }
                - rbac   = {
                    - "policy.csv"     = "g, authentik Admins, role:admin"
                    - "policy.default" = "role:readonly"
                    - scopes           = "[groups]"
                  }
              }
            - global         = {
                - logging = {
                    - level = "warn"
                  }
              }
            - notifications  = {
                - enabled       = true
                - notifiers     = {
                    - "service.webhook.discord" = <<-EOT
                          url: $discord-webhook
                      EOT
                    - "service.webhook.github"  = <<-EOT
                          url: https://api.github.com
                          headers:
                            - name: Authorization
                              value: "token $github-token"
                            - name: Content-Type
                              value: application/json
                      EOT
                  }
                - secret        = {
                    - create = false
                  }
                - subscriptions = [
                    - {
                        - recipients = [
                            - "github",
                          ]
                        - triggers   = [
                            - "on-sync-running",
                            - "on-sync-succeeded",
                            - "on-sync-failed",
                            - "on-health-degraded",
                          ]
                      },
                    - {
                        - recipients = [
                            - "discord",
                          ]
                        - triggers   = [
                            - "on-app-failed",
                          ]
                      },
                  ]
                - templates     = {
                    - "template.discord-alert"        = <<-EOT
                          webhook:
                            discord:
                              method: POST
                              path: /
                              body: |
                                {
                                  "content": "**ArgoCD** `{{.app.metadata.name}}` — {{if eq .app.status.operationState.phase "Error"}}Sync error: {{.app.status.operationState.message}}{{else if eq .app.status.operationState.phase "Failed"}}Sync failed: {{.app.status.operationState.message}}{{else}}Health degraded ({{.app.status.health.status}}){{end}}\n<https://argocd.lippok.dev/applications/{{.app.metadata.name}}>"
                                }
                      EOT
                    - "template.github-commit-status" = <<-EOT
                          webhook:
                            github:
                              method: POST
                              path: /repos/{{call .repo.FullNameByRepoURL .app.spec.source.repoURL}}/statuses/{{.app.status.operationState.operation.sync.revision}}
                              body: |
                                {
                                  "state": "{{if eq .app.status.operationState.phase "Running"}}pending{{else if and (eq .app.status.operationState.phase "Succeeded") (eq .app.status.health.status "Healthy")}}success{{else}}failure{{end}}",
                                  "description": "{{if eq .app.status.operationState.phase "Running"}}Syncing…{{else if and (eq .app.status.operationState.phase "Succeeded") (eq .app.status.health.status "Healthy")}}Healthy{{else if eq .app.status.health.status "Degraded"}}Health degraded{{else}}Sync failed{{end}}",
                                  "target_url": "https://argocd.lippok.dev/applications/{{.app.metadata.name}}",
                                  "context": "argocd/{{.app.metadata.name}}"
                                }
                      EOT
                  }
                - triggers      = {
                    - "trigger.on-app-failed"      = <<-EOT
                          - when: app.status.operationState.phase in ['Error', 'Failed'] || app.status.health.status == 'Degraded'
                            send: [discord-alert]
                      EOT
                    - "trigger.on-health-degraded" = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.health.status == 'Degraded'
                            send: [github-commit-status]
                      EOT
                    - "trigger.on-sync-failed"     = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.operationState.phase in ['Error', 'Failed']
                            send: [github-commit-status]
                      EOT
                    - "trigger.on-sync-running"    = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.operationState != nil && app.status.operationState.phase in ['Running']
                            send: [github-commit-status]
                      EOT
                    - "trigger.on-sync-succeeded"  = <<-EOT
                          - when: app.spec.source.repoURL contains 'github.com' && app.status.operationState.phase in ['Succeeded'] && app.status.health.status == 'Healthy'
                            send: [github-commit-status]
                      EOT
                  }
              }
            - redis          = {
                - enabled      = true
                - volumeMounts = [
                    - {
                        - mountPath = "/data"
                        - name      = "redis-data"
                      },
                  ]
                - volumes      = [
                    - {
                        - emptyDir = {
                            - medium    = "Memory"
                            - sizeLimit = "1Gi"
                          }
                        - name     = "redis-data"
                      },
                  ]
              }
            - redis-ha       = {
                - enabled = false
              }
            - repoServer     = {
                - env            = [
                    - {
                        - name  = "TMPDIR"
                        - value = "/nfs-tmp"
                      },
                  ]
                - initContainers = [
                    - {
                        - command         = [
                            - "sh",
                            - "-c",
                            - "chown 999:999 /nfs-tmp && chmod 777 /nfs-tmp",
                          ]
                        - image           = "busybox"
                        - name            = "fix-nfs-permissions"
                        - securityContext = {
                            - runAsUser = 0
                          }
                        - volumeMounts    = [
                            - {
                                - mountPath = "/nfs-tmp"
                                - name      = "nfs-tmp"
                              },
                          ]
                      },
                  ]
                - volumeMounts   = [
                    - {
                        - mountPath = "/nfs-tmp"
                        - name      = "nfs-tmp"
                      },
                  ]
                - volumes        = [
                    - {
                        - name                  = "nfs-tmp"
                        - persistentVolumeClaim = {
                            - claimName = "argocd-repo-server-nfs"
                          }
                      },
                  ]
              }
            - server         = {
                - extraArgs = [
                    - "--insecure",
                  ]
              }
          }
      ) -> (known after apply)
!     version        = "9.4.17" -> (known after apply)
  } -> (known after apply)
  name                       = "argocd"
! version                    = "9.4.17" -> "9.5.0"
  # (28 unchanged attributes hidden)
helm_release.cert_manager 
! id                         = "cert-manager" -> (known after apply)
! metadata                   = {
!     app_version    = "v1.20.1" -> (known after apply)
!     chart          = "cert-manager" -> (known after apply)
!     first_deployed = 1770562151 -> (known after apply)
!     last_deployed  = 1775345185 -> (known after apply)
!     name           = "cert-manager" -> (known after apply)
!     namespace      = "cert-manager" -> (known after apply)
!     notes          = <<-EOT
          cert-manager v1.20.1 has been deployed successfully!
          
          In order to begin issuing certificates, you will need to set up a ClusterIssuer
          or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
          
          More information on the different types of issuers and how to configure them
          can be found in our documentation:
          
          https://cert-manager.io/docs/configuration/
          
          For information on how to configure cert-manager to automatically provision
          Certificates for Ingress resources, take a look at the `ingress-shim`
          documentation:
          
          https://cert-manager.io/docs/usage/ingress/
          
          For information on how to configure cert-manager to automatically provision
          Certificates for Gateway API resources, take a look at the `gateway resource`
          documentation:
          
          https://cert-manager.io/docs/usage/gateway/
      EOT -> (known after apply)
!     revision       = 2 -> (known after apply)
!     values         = jsonencode(
          {
            - config = {
                - apiVersion       = "controller.config.cert-manager.io/v1alpha1"
                - enableGatewayAPI = true
                - kind             = "ControllerConfiguration"
              }
            - crds   = {
                - enabled = true
              }
          }
      ) -> (known after apply)
!     version        = "v1.20.1" -> (known after apply)
  } -> (known after apply)
  name                       = "cert-manager"
! version                    = "v1.20.1" -> "v1.20.2"
  # (28 unchanged attributes hidden)
helm_release.external_secrets 
! id                         = "external-secrets" -> (known after apply)
! metadata                   = {
!     app_version    = "v2.2.0" -> (known after apply)
!     chart          = "external-secrets" -> (known after apply)
!     first_deployed = 1772488004 -> (known after apply)
!     last_deployed  = 1775345185 -> (known after apply)
!     name           = "external-secrets" -> (known after apply)
!     namespace      = "external-secrets" -> (known after apply)
!     notes          = <<-EOT
          external-secrets has been deployed successfully in namespace external-secrets!
          
          In order to begin using ExternalSecrets, you will need to set up a SecretStore
          or ClusterSecretStore resource (for example, by creating a 'vault' SecretStore).
          
          More information on the different types of SecretStores and how to configure them
          can be found in our Github: https://github.com/external-secrets/external-secrets
      EOT -> (known after apply)
!     revision       = 3 -> (known after apply)
!     values         = jsonencode(
          {
            - installCRDs = true
          }
      ) -> (known after apply)
!     version        = "2.2.0" -> (known after apply)
  } -> (known after apply)
  name                       = "external-secrets"
! version                    = "2.2.0" -> "2.3.0"
  # (28 unchanged attributes hidden)

Triggered by @renovate[bot], Commit: 4ad6cc620e910b7e25ce3cfbb3bd92a607d9eeca

@renovate renovate bot force-pushed the renovate/helm-charts branch from 180cf28 to d08ef33 Compare April 10, 2026 15:07
@renovate renovate bot changed the title chore(deps): update helm release argo-cd to v9.5.0 chore(deps): update helm charts Apr 10, 2026
@renovate renovate bot force-pushed the renovate/helm-charts branch from d08ef33 to 4ad6cc6 Compare April 13, 2026 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file helm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants