chore(deps): update kubernetes gitops manifests

Kubernetes/apps/prod/gitops/applications/platform-helm-applicationset.yaml

@@ -408,7 +408,7 @@ spec:
               upgradeCRDs: false
               initContainers:
                 - name: velero-plugin-for-aws
-                  image: velero/velero-plugin-for-aws:v1.11.0
+                  image: velero/velero-plugin-for-aws:v1.14.2
                   imagePullPolicy: IfNotPresent
                   volumeMounts:
                     - mountPath: /target

Kubernetes/apps/prod/gitops/config/externalsecret-actions-runner-controller.yaml

@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: actions-runner-controller-auth

Kubernetes/apps/prod/helix-ai/policies/externalsecret-helix-ai-workloads.yaml

@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: helix-ai-workload-secrets

Kubernetes/apps/prod/kube-system/config/externalsecret-longhorn.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/kube-system/config/externalsecret-longhorn.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: longhorn-backup-credentials

Kubernetes/apps/prod/monitoring/config/daemonset-cadvisor.yaml

@@ -41,7 +41,7 @@ spec:
 
       containers:
         - name: cadvisor
-          image: gcr.io/cadvisor/cadvisor:v0.52.1
+          image: gcr.io/cadvisor/cadvisor:v0.55.1
           imagePullPolicy: IfNotPresent
           args:
             - --housekeeping_interval=30s

Kubernetes/apps/prod/monitoring/config/deployment-otel-collector.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: otel-collector
-          image: otel/opentelemetry-collector-contrib:0.116.1
+          image: otel/opentelemetry-collector-contrib:0.155.0
           imagePullPolicy: IfNotPresent
           args:
             - --config=/conf/otel-collector.yaml

Kubernetes/apps/prod/monitoring/config/externalsecret-grafana-admin.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/monitoring/config/externalsecret-grafana-admin.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: grafana-admin

Kubernetes/apps/prod/monitoring/config/externalsecret-loki-s3.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/monitoring/config/externalsecret-loki-s3.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: loki-s3-credentials

Kubernetes/apps/prod/monitoring/config/externalsecret-mimir-s3.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/monitoring/config/externalsecret-mimir-s3.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: mimir-s3-credentials

Kubernetes/apps/prod/monitoring/config/externalsecret-observability.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/monitoring/config/externalsecret-observability.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: observability-object-storage

Kubernetes/apps/prod/monitoring/config/externalsecret-pyroscope-s3.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/monitoring/config/externalsecret-pyroscope-s3.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: pyroscope-s3-credentials

Kubernetes/apps/prod/monitoring/config/externalsecret-tempo-s3.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/monitoring/config/externalsecret-tempo-s3.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: tempo-s3-credentials

Kubernetes/apps/prod/networking/cloudflared/daemonset-cloudflared-helix.yaml

@@ -49,7 +49,7 @@ spec:
 
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2025.2.1
+          image: cloudflare/cloudflared:2025.11.1
           imagePullPolicy: IfNotPresent
           args:
             - tunnel

Kubernetes/apps/prod/networking/cloudflared/daemonset-cloudflared-sinlessgames.yaml

@@ -49,7 +49,7 @@ spec:
 
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2025.2.1
+          image: cloudflare/cloudflared:2025.11.1
           imagePullPolicy: IfNotPresent
           args:
             - tunnel

Kubernetes/apps/prod/networking/cloudflared/externalsecret-cloudflared-tunnels.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/networking/cloudflared/externalsecret-cloudflared-tunnels.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cloudflared-sinlessgames
@@ -45,7 +45,7 @@ spec:
         property: zone_id
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cloudflared-helix

Kubernetes/apps/prod/networking/config/externalsecret-networking-integrations.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/networking/config/externalsecret-networking-integrations.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: platform-integrations

Kubernetes/apps/prod/security/external-secrets/clustersecretstore-vault.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/security/external-secrets/clustersecretstore-vault.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: vault-backend

Kubernetes/apps/prod/security/external-secrets/externalsecret-platform-integrations.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/security/external-secrets/externalsecret-platform-integrations.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: platform-integrations

Kubernetes/apps/prod/security/external-secrets/externalsecret-velero-s3.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/security/external-secrets/externalsecret-velero-s3.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: velero-s3-credentials

Kubernetes/apps/prod/security/velero/values.yaml

@@ -8,7 +8,7 @@ upgradeCRDs: false
 
 initContainers:
   - name: velero-plugin-for-aws
-    image: velero/velero-plugin-for-aws:v1.11.0
+    image: velero/velero-plugin-for-aws:v1.14.2
     imagePullPolicy: IfNotPresent
     volumeMounts:
       - mountPath: /target

Kubernetes/apps/prod/security/wazuh/daemonset.yaml

@@ -42,7 +42,7 @@ spec:
 
       initContainers:
         - name: cleanup-ossec-stale
-          image: busybox:1.36
+          image: busybox:1.38
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -61,7 +61,7 @@ spec:
               mountPath: /agent
 
         - name: seed-ossec-tree
-          image: wazuh/wazuh-agent:4.14.3
+          image: wazuh/wazuh-agent:4.14.6
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -84,7 +84,7 @@ spec:
               mountPath: /agent
 
         - name: write-ossec-config
-          image: busybox:1.36
+          image: busybox:1.38
           imagePullPolicy: IfNotPresent
           env:
             - name: WAZUH_MANAGER
@@ -194,7 +194,7 @@ spec:
               mountPath: /agent
 
         - name: install-authd-pass
-          image: busybox:1.36
+          image: busybox:1.38
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -218,7 +218,7 @@ spec:
               readOnly: true
 
         - name: fix-ossec-permissions
-          image: busybox:1.36
+          image: busybox:1.38
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -245,7 +245,7 @@ spec:
 
       containers:
         - name: wazuh-agent
-          image: wazuh/wazuh-agent:4.14.3
+          image: wazuh/wazuh-agent:4.14.6
           imagePullPolicy: IfNotPresent
 
           command:

Kubernetes/apps/prod/security/wazuh/externalsecret-wazuh-agent.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/security/wazuh/externalsecret-wazuh-agent.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: wazuh-agent-enrollment

Kubernetes/apps/prod/security/wazuh/values.yaml

@@ -2,7 +2,7 @@
 
 image:
   repository: wazuh/wazuh-agent
-  tag: "4.14.3"
+  tag: "4.14.6"
   pullPolicy: IfNotPresent
 
 daemonset:

Kubernetes/apps/prod/sinless-games/garage/externalsecret-garage-bootstrap.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/sinless-games/garage/externalsecret-garage-bootstrap.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: garage-bootstrap-secrets

Kubernetes/apps/prod/sinless-games/garage/externalsecret-garage.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/sinless-games/garage/externalsecret-garage.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: garage-secrets

Kubernetes/apps/prod/sinless-games/garage/job-garage-bootstrap.yaml

@@ -47,7 +47,7 @@ spec:
 
       containers:
         - name: bootstrap
-          image: alpine/k8s:1.30.2
+          image: alpine/k8s:1.36.2
           imagePullPolicy: IfNotPresent
 
           command:

Kubernetes/apps/prod/sinless-games/garage/statefulset-garage.yaml

@@ -56,7 +56,7 @@ spec:
 
       initContainers:
         - name: render-garage-config
-          image: busybox:1.36.1
+          image: busybox:1.38.0
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -135,7 +135,7 @@ spec:
 
       containers:
         - name: garage
-          image: dxflrs/garage:v2.2.0
+          image: dxflrs/garage:v2.3.0
           imagePullPolicy: IfNotPresent
           command:
             - /garage

Kubernetes/apps/prod/sinless-games/homepage/deployment-homepage.yaml

@@ -69,7 +69,7 @@ spec:
 
       containers:
         - name: homepage
-          image: ghcr.io/gethomepage/homepage:v1.5.0
+          image: ghcr.io/gethomepage/homepage:v1.13.2
           imagePullPolicy: IfNotPresent
 
           env:

Kubernetes/apps/prod/sinless-games/n8n/n8n-deployment.yaml

@@ -92,7 +92,7 @@ spec:
 
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:1.123.33
+          image: docker.n8n.io/n8nio/n8n:1.123.63
           imagePullPolicy: IfNotPresent
 
           env:

Kubernetes/apps/prod/sinless-games/open-cost/values.yaml

@@ -107,7 +107,7 @@ extraVolumes:
 # Keep the UI asset directory writable before the UI entrypoint patches BASE_URL.
 extraInitContainers:
   - name: prepare-opencost-ui-assets
-    image: ghcr.io/opencost/opencost-ui:1.120.0@sha256:2a2ed5d423402b1d3f104398971191618a91bfc293f53c704606bbbd39b2652c
+    image: ghcr.io/opencost/opencost-ui:1.120.4@sha256:a59d77750cda9eaf7a220855c0449a5bf929cbefdb17defa109d576acb545494
     command:
       - sh
       - -c

Kubernetes/apps/prod/sinless-games/policies/externalsecret-mailu.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/sinless-games/policies/externalsecret-mailu.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: mailu-secrets
@@ -33,7 +33,7 @@ spec:
         key: kubernetes/production/integrations
         property: mailu_secret_key
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: mailu-initial-account

Kubernetes/apps/prod/sinless-games/policies/externalsecret-sinless-games-workloads.yaml

@@ -1,5 +1,5 @@
 # Kubernetes/apps/prod/sinless-games/policies/externalsecret-sinless-games-workloads.yaml
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: sinless-games-workload-secrets

Kubernetes/validation/prod/examples/sample-external-secret.yaml

@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: helix-api-example