Component catch-up batch 1: external-dns 1.21, oauth2-proxy 10.x, Alloy 1.x, CNPG in-place flag

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/cnpg/helmrelease.yaml

@@ -25,6 +25,11 @@ spec:
     remediation:
       retries: 3
   values:
+    # Avoid a full Postgres switchover on future operator minor bumps: update the instance-manager
+    # binary in place rather than recreating the pod (lands in the cnpg-controller-manager-config CM).
+    config:
+      data:
+        ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES: "true"
     # Single operator replica is plenty for a home cluster; it only reconciles CRs.
     replicaCount: 1
     resources:

platform/externaldns/helmrelease.yaml

@@ -11,7 +11,7 @@ spec:
   chart:
     spec:
       chart: external-dns
-      version: ">=1.15.0 <1.16.0"   # TODO(WS-NET): pin at bring-up; Renovate maintains
+      version: ">=1.21.0 <1.22.0"   # k8s-1.36 catch-up (app v0.21; policy already set). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: external-dns

platform/monitoring/alloy.yaml

@@ -12,7 +12,7 @@ spec:
   chart:
     spec:
       chart: alloy
-      version: ">=0.10.0 <1.0.0"   # TODO(WS-OBS): pin at bring-up; Renovate maintains
+      version: ">=1.0.0 <2.0.0"   # k8s-1.36 catch-up (1.x line). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: grafana

platform/oauth2-proxy/helmrelease.yaml

@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: oauth2-proxy
-      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      version: ">=10.0.0 <11.0.0"   # k8s-1.36 catch-up (app v7.15.x). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: oauth2-proxy