Merge pull request 'fix(authentik): turn off error reporting' (#1604) from fix/authentik-error-reporting-off into main

Reviewed-on: #1604

kubernetes/apps/authentik/helmrelease.yaml

@@ -113,8 +113,10 @@ spec:
           value: "10.244.0.0/16,fd10:244::/48,127.0.0.0/8,::1/128"
     authentik:
       log_level: info
+      # Off: reports would go to authentik.error-reporting.a7k.io (Sentry),
+      # which egress policy denies. The outposts take this from the server.
       error_reporting:
-        enabled: true
+        enabled: false
       postgresql:
         host: "ak-pg-rw.authentik.svc.cluster.local"
         name: "authentik"

kubernetes/apps/authentik/ldap-outpost-cnp.yaml

@@ -34,3 +34,10 @@ spec:
               protocol: TCP
             - port: "6636"
               protocol: TCP
+    # The UDM's LDAPS admin-auth sync.
+    - fromCIDRSet:
+        - cidrGroupRef: udm-k8s-ingress
+      toPorts:
+        - ports:
+            - port: "6636"
+              protocol: TCP

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -64,7 +64,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-1918 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-11-07-2052 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/influxdb/helmrelease.yaml

@@ -100,6 +100,9 @@ spec:
       # Keep tokens unhashed; enable hashing later as its own change.
       - name: INFLUXD_USE_HASHED_TOKENS
         value: "false"
+      # No usage telemetry to telemetry.influxdata.com (egress is denied).
+      - name: INFLUXD_REPORTING_DISABLED
+        value: "true"
     # The chart defaults to liveness/readiness with initialDelaySeconds=0,
     # so after a crash restart the kubelet kills the pod before shards
     # finish opening. Give it 10 minutes to come up cleanly.

kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml

@@ -54,6 +54,9 @@ spec:
       # non-RFC-framed payload). Scoped to this single-purpose receiver
       # only — the pod-log Alloy DaemonSet stays at default stability.
       stabilityLevel: experimental
+      # No usage reporting to stats.grafana.org (egress is denied anyway).
+      extraArgs:
+        - --disable-reporting
       resources:
         requests:
           cpu: 20m

kubernetes/apps/monitoring/helmrelease-loki.yaml

@@ -116,6 +116,9 @@ spec:
       retries: 3
   values:
     alloy:
+      # No usage reporting to stats.grafana.org (egress is denied anyway).
+      extraArgs:
+        - --disable-reporting
       configMap:
         content: |
           // Discover and collect K8s pod logs

kubernetes/infrastructure/image-automation/immich.yaml

@@ -1,11 +1,14 @@
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
+# 6h, not 1h: both repositories carry tens to hundreds of thousands of PR
+# build tags, and every scan pages the full list anonymously, which runs
+# into ghcr.io's rate limit.
 metadata:
   name: immich-server
   namespace: flux-system
 spec:
   image: ghcr.io/immich-app/immich-server
-  interval: 1h
+  interval: 6h
 ---
 # v-prefix tags only, semver 3.x. The 4.x cutover would need manual
 # review — Immich major bumps historically require migration.
@@ -31,7 +34,7 @@ metadata:
   namespace: flux-system
 spec:
   image: ghcr.io/immich-app/immich-machine-learning
-  interval: 1h
+  interval: 6h
 ---
 # Same policy as immich-server; machine-learning image must stay in
 # version-sync with the server image (Immich docs require it).

kubernetes/infrastructure/network-policies/cidr-groups.yaml

@@ -74,6 +74,17 @@ spec:
     - fd02:47::/64
     - 10.2.47.0/24
 ---
+# The UDM's own address on k8s-ingress, which it sources from towards the
+# cluster's LoadBalancer IPs.
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: udm-k8s-ingress
+spec:
+  externalCIDRs:
+    - fd02:47::1/128
+    - 10.2.47.1/32
+---
 apiVersion: cilium.io/v2
 kind: CiliumCIDRGroup
 metadata:

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -467,7 +467,8 @@ spec:
             - port: "443"
               protocol: TCP
 ---
-# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket.
+# zigbee2mqtt: Zigbee coordinator (SLZB) TCP socket, and the OTA index and
+# firmware images (Koenkk/zigbee-OTA) on raw.githubusercontent.com.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -498,6 +499,47 @@ spec:
         - ports:
             - port: "6638"
               protocol: TCP
+    - toFQDNs:
+        - matchName: "raw.githubusercontent.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# matter-server: the CSA DCL (PAA root certificates, vendor names, OTA
+# metadata) and the development PAA certificates of project-chip on GitHub.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: matter-server-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: matter-server
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "on.dcl.csa-iot.org"
+        - matchName: "api.github.com"
+        - matchName: "raw.githubusercontent.com"
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
 ---
 # mqtt-account-controller: credential delivery to deliver.esp32 targets in mqtt-accounts.yaml.
 apiVersion: cilium.io/v2