chore(deps): Update Helm release kube-prometheus-stack to v92

Merge pull request 'chore(deps): Update pihole/pihole Docker tag to v2026.10.1' (#109 ) from renovate/pihole-pihole-2026.x into main
Merge pull request 'chore(deps): Update docker.io/moby/buildkit Docker tag to v0.34.2' (#108 ) from renovate/docker.io-moby-buildkit-0.x into main
2026-11-05 08:17:29 +00:00 · 2026-11-04 08:22:16 +00:00 · 2026-11-04 08:19:20 +00:00 · 2026-11-04 08:16:12 +00:00 · 2026-11-04 08:15:52 +00:00 · 2026-11-03 08:22:33 +00:00
12 changed files with 57 additions and 13 deletions
@@ -62,7 +62,7 @@ spec:
    spec:
      containers:
      - name: pihole
-        image: pihole/pihole:2026.10.0
+        image: pihole/pihole:2026.10.1
        ports:
        - containerPort: 80
        env:
@@ -122,7 +122,7 @@ spec:
    spec:
      containers:
      - name: sonarr
-        image: lscr.io/linuxserver/sonarr:4.0.15
+        image: lscr.io/linuxserver/sonarr:4.0.20
        ports:
        - containerPort: 8989
        env:
@@ -5,7 +5,7 @@
 name: pihole
 kind: container
 source:
-  image: pihole/pihole:2026.10.0
+  image: pihole/pihole:2026.10.1
 exposure: internal            # LAN-only admin UI (docs/13 row 6; R-DNS/R-NET)
 egress: internet              # normal WAN egress (docs/03; R-NET-05)
 storage:
@@ -8,7 +8,7 @@
 name: sonarr
 kind: container
 source:
-  image: lscr.io/linuxserver/sonarr:4.0.15   # pinned stable v4 tag (R-UPD-01); update.range governs advancement
+  image: lscr.io/linuxserver/sonarr:4.0.20   # pinned stable v4 tag (R-UPD-01); update.range governs advancement
 # LinuxServer images run their service as the user `abc`, whose uid/gid these two set. They are
 # LOAD-BEARING for the bulk mount, not cosmetic: see the storage note below. The default is 911,
 # which cannot write a 1000:3000-owned 0755 tree.
@@ -0,0 +1,41 @@
+---
+date: 2026-10-31
+branch: chore/pm-agent-digest-99
+title: Pin pm-agent dispatcher and worker to the agent-runner digest built from PR #99's merge
+---
+
+## What changed
+
+- `platform/pm-agent/deployment.yaml`: the dispatcher `image:` moves from
+  `agent-runner@sha256:df36d9b7…` (images run 383) to
+  `agent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2`.
+  `config-generation` goes from "4" to "5" so the pod rolls.
+- `platform/pm-agent/configmap.yaml`: `PM_WORKER_IMAGE` gets the same digest. A comment line
+  records where it came from. The `# renovate-digest:` marker still sits directly above both
+  values.
+- No other values changed. `PM_DRY_RUN` stays "false". `PM_DECISION_MAX_TURNS` is not set, so
+  it keeps its in-code default of 1. No `*.sops.yaml` was touched.
+
+## What I verified
+
+- PR #99's merge commit is `466f63ec3c3df968a1dab25a8811dcd41961efde` (origin/main HEAD at
+  branch time).
+- The Gitea Actions tasks API shows the `images` workflow (images.yaml) on that commit as
+  **run 394** (task 643), with event `push` and status `success`.
+- I resolved the digest read-only from the registry by HEADing the manifests with OCI and
+  Docker Accept headers. Both `agent-runner:sha-466f63ec3c3d` and `agent-runner:main` returned
+  `200`, an `application/vnd.oci.image.manifest.v1+json` content type, and
+  `docker-content-digest: sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2`.
+  The two are identical.
+- Toolbox gate: the rc and skipped stages are in the PR description.
+
+## What I did NOT verify
+
+- That the dispatcher actually rolls to the new digest after merge, and that Flux applies it.
+  Flux's `lastAppliedRevision` and the pod's image were not checked. That is post-merge work.
+- That the new image surfaces the triage failure's real cause. It will show only on the next
+  failing triage, in the dispatcher log.
+- That admission (rule 7, `imagePullSecrets`) admits worker Jobs from this digest. The
+  template comes from `infra/agent/` at PR #99's merge, which still carries the
+  `imagePullSecrets` entry, but no Job was created to prove it.
+- I did not run the image's own selftest against this digest.
@@ -60,7 +60,7 @@ spec:
          # Pinned by digest (the multi-arch index). The kubernetes manager in renovate.json5
          # tracks platform/**, so Renovate proposes bumps; the CI client (buildx, pinned in
          # versions.env) talks to any recent daemon.
-          image: docker.io/moby/buildkit:v0.34.1-rootless@sha256:f68752a5a94acfcdad2d07867b7075601a421638e17fc5f28efc1c814d0c4f89
+          image: docker.io/moby/buildkit:v0.34.2-rootless@sha256:c8252268760e1baba80780d63d738ef9f260fb7c7c0973c78494cb9ddd99eda1
          args:
            - --addr
            - unix:///run/user/1000/buildkit/buildkitd.sock   # local only: the probes below
@@ -63,7 +63,7 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
-        image: intel/intel-gpu-plugin:0.37.0
+        image: intel/intel-gpu-plugin:0.37.1
        imagePullPolicy: IfNotPresent
        name: intel-gpu-plugin
        resources:
@@ -96,4 +96,4 @@ images:
  - name: intel/intel-gpu-plugin
    newName: docker.io/intel/intel-gpu-plugin
    # renovate: datasource=github-releases depName=intel/intel-device-plugins-for-kubernetes
-    newTag: "0.37.0"
+    newTag: "0.37.1"
@@ -33,6 +33,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  # renovate: datasource=github-releases depName=kubevirt/kubevirt
-  - https://github.com/kubevirt/kubevirt/releases/download/v1.9.0/kubevirt-operator.yaml
+  - https://github.com/kubevirt/kubevirt/releases/download/v1.9.1/kubevirt-operator.yaml
  # renovate: datasource=github-releases depName=kubevirt/containerized-data-importer
-  - https://github.com/kubevirt/containerized-data-importer/releases/download/v1.66.0/cdi-operator.yaml
+  - https://github.com/kubevirt/containerized-data-importer/releases/download/v1.66.1/cdi-operator.yaml
@@ -24,7 +24,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: ">=88.0.0 <89.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
+      version: "<93.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -63,8 +63,11 @@ data:
  # agent-runner:sha-ddd04d460ef6, pinned in PR #96) bakes a template that carries
  # `imagePullSecrets: pm-agent-registry`, which is what made turning PM_DRY_RUN off possible
  # (decisions/2026-10-31-pm-agent-runner-digest.md). A digest older than that would be DENIED.
+  # The digest below (14a42ba, images run 394, agent-runner:sha-466f63ec3c3d = PR #99's merge)
+  # adds the CLI failure envelope to triage errors and the PM_DECISION_MAX_TURNS knob
+  # (decisions/2026-10-31-pm-agent-digest-99.md).
  # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d"
+  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2"

  # --- the model -------------------------------------------------------------
  # The PM only reads a thread and answers with one JSON object, so it holds no tools and
@@ -48,7 +48,7 @@ spec:
        # It is a hand-maintained marker rather than a computed hash because Flux's
        # Kustomization here does not run a configmap generator; bump it in the same commit
        # as a change to configmap.yaml.
-        pm-agent.homelab.keithjackson.dev/config-generation: "4"
+        pm-agent.homelab.keithjackson.dev/config-generation: "5"
    spec:
      serviceAccountName: pm-agent
      # The kubelet's credential for pulling this image. Not the agent's Gitea credential —
@@ -78,7 +78,7 @@ spec:
          # the registry's manifest endpoint on 2026-10-30 and pinned by hand once so the
          # dispatcher does not wait on Renovate's first run; every later bump is Renovate's.
          # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-          image: gitea.home.keithjackson.dev/home-network/agent-runner@sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d
+          image: gitea.home.keithjackson.dev/home-network/agent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2
          imagePullPolicy: IfNotPresent
          command:
            - /usr/local/bin/pm-dispatch
Author	SHA1	Message	Date
renovate-bot	160652f59d	chore(deps): Update Helm release kube-prometheus-stack to v92 gate / gate (pull_request) Successful in 2m55s Details gate / conformance (pull_request) Has been skipped Details	2026-11-05 08:17:29 +00:00
renovate-bot	552330398b	Merge pull request 'chore(deps): Update pihole/pihole Docker tag to v2026.10.1' (#109 ) from renovate/pihole-pihole-2026.x into main gate / gate (push) Successful in 2m56s Details gate / conformance (push) Has been skipped Details renovate / renovate (push) Successful in 3m19s Details	2026-11-04 08:22:16 +00:00
renovate-bot	e49aebc803	Merge pull request 'chore(deps): Update docker.io/moby/buildkit Docker tag to v0.34.2' (#108 ) from renovate/docker.io-moby-buildkit-0.x into main gate / conformance (push) Has been cancelled Details gate / gate (push) Has been cancelled Details	2026-11-04 08:19:20 +00:00
renovate-bot	9c0292001e	chore(deps): Update pihole/pihole Docker tag to v2026.10.1 gate / gate (pull_request) Successful in 2m57s Details gate / conformance (pull_request) Has been skipped Details	2026-11-04 08:16:12 +00:00
renovate-bot	db9416d3b5	chore(deps): Update docker.io/moby/buildkit Docker tag to v0.34.2 gate / gate (pull_request) Successful in 2m59s Details gate / conformance (pull_request) Has been skipped Details	2026-11-04 08:15:52 +00:00
renovate-bot	cb4a1bf2de	Merge pull request 'chore(deps): Update lscr.io/linuxserver/sonarr Docker tag to v4.0.20' (#107 ) from renovate/lscr.io-linuxserver-sonarr-4.x into main gate / gate (push) Successful in 3m3s Details gate / conformance (push) Has been skipped Details renovate / renovate (push) Successful in 1m12s Details	2026-11-03 08:22:33 +00:00
renovate-bot	028f5229f0	Merge pull request 'chore(deps): Update kubevirt-cdi' (#106 ) from renovate/kubevirt-cdi into main gate / conformance (push) Has been cancelled Details gate / gate (push) Has been cancelled Details	2026-11-03 08:19:36 +00:00
renovate-bot	44e2cd3c64	chore(deps): Update lscr.io/linuxserver/sonarr Docker tag to v4.0.20 gate / gate (pull_request) Successful in 2m56s Details gate / conformance (pull_request) Has been skipped Details	2026-11-03 08:16:12 +00:00
renovate-bot	b30b7e6f67	chore(deps): Update kubevirt-cdi gate / gate (pull_request) Successful in 2m59s Details gate / conformance (pull_request) Has been skipped Details	2026-11-03 08:16:06 +00:00
renovate-bot	5a3a5f8df2	Merge pull request 'chore(deps): Update intel/intel-gpu-plugin Docker tag to v0.37.1' (#105 ) from renovate/intel-intel-gpu-plugin-0.x into main gate / gate (push) Successful in 2m57s Details gate / conformance (push) Has been skipped Details renovate / renovate (push) Successful in 1m31s Details	2026-11-02 08:22:07 +00:00
renovate-bot	f698bc82a0	chore(deps): Update intel/intel-gpu-plugin Docker tag to v0.37.1 gate / gate (pull_request) Successful in 2m57s Details gate / conformance (pull_request) Has been skipped Details	2026-11-02 08:16:06 +00:00
renovate-bot	6bc10fb60d	Merge pull request 'chore(deps): Update dependency intel/intel-device-plugins-for-kubernetes to v0.37.1' (#102 ) from renovate/intel-intel-device-plugins-for-kubernetes-0.x into main gate / gate (push) Successful in 2m58s Details gate / conformance (push) Has been skipped Details renovate / renovate (push) Successful in 1m4s Details	2026-11-01 08:18:56 +00:00
renovate-bot	d8c330fb8c	chore(deps): Update dependency intel/intel-device-plugins-for-kubernetes to v0.37.1 gate / gate (pull_request) Successful in 2m57s Details gate / conformance (pull_request) Has been skipped Details	2026-11-01 08:15:52 +00:00
jakman85	a1d89f4a5f	Merge pull request 'chore(pm-agent): pin agent-runner to the run-394 digest (`466f63e`, PR #99 ), bump config-generation' (#100 ) from chore/pm-agent-digest-99 into main gate / gate (push) Successful in 2m56s Details gate / conformance (push) Has been skipped Details renovate / renovate (push) Successful in 51s Details Reviewed-on: #100 Reviewed-by: Keith Jackson <[email protected]>	2026-10-31 17:23:18 +00:00
jakman85andClaude Opus 5.5	19097e4d4f	chore(pm-agent): pin agent-runner to the run-394 digest (`466f63e`, PR #99 ), bump config-generation gate / gate (pull_request) Successful in 2m57s Details gate / conformance (pull_request) Has been skipped Details Dispatcher image and PM_WORKER_IMAGE both move to sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2, the digest the registry returns for agent-runner:sha-466f63ec3c3d and :main. config-generation 4 -> 5. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-31 12:17:00 -05:00
jakman85	466f63ec3c	Merge pull request 'fix(pm-agent): log the CLI's stdout envelope when triage fails; add PM_DECISION_MAX_TURNS' (#99 ) from fix/pm-agent-triage-exit into main gate / gate (push) Successful in 2m56s Details images / images (push) Successful in 16s Details gate / conformance (push) Has been skipped Details Reviewed-on: #99	2026-10-31 17:12:40 +00:00