Merge branch 'main' into renovate/kubernetes-monorepo

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [kubectl-tree](https://github.com/ahmetb/kubectl-tree) | minor | `0.4.3` → `0.6.0` |

---

### Release Notes

<details>
<summary>ahmetb/kubectl-tree (kubectl-tree)</summary>

### [`v0.6.0`](https://github.com/ahmetb/kubectl-tree/releases/tag/v0.6.0)

#### Changelog

- [`07c5f12`](https://github.com/ahmetb/kubectl-tree/commit/07c5f1241c0af99171cd3d3ff5ec0f109f37058f) Release v0.6.0
- [`52dda04`](https://github.com/ahmetb/kubectl-tree/commit/52dda045e341f7b24e4258c0286c3fec10410ed2) feat: filter resources ([#&#8203;115](https://github.com/ahmetb/kubectl-tree/issues/115))
- [`55f6b48`](https://github.com/ahmetb/kubectl-tree/commit/55f6b482b7a828554850d30a603fc7bfcd05ba43) Merge pull request [#&#8203;117](https://github.com/ahmetb/kubectl-tree/issues/117) from ahmetb/dependabot/go\_modules/github.com/fatih/color-1.19.0
- [`f8a3daf`](https://github.com/ahmetb/kubectl-tree/commit/f8a3daf738056f538876d39047c24c7859650884) Merge pull request [#&#8203;116](https://github.com/ahmetb/kubectl-tree/issues/116) from ahmetb/dependabot/go\_modules/kubernetes-cc55a87f86
- [`f524512`](https://github.com/ahmetb/kubectl-tree/commit/f5245124c6dd6885075bc80d1a88a46e515c87ca) chore(deps): bump github.com/fatih/color from 1.15.0 to 1.19.0
- [`9d3c3c9`](https://github.com/ahmetb/kubectl-tree/commit/9d3c3c9aaa641f2c2a2a5a55077acd5d9477144b) chore(deps): bump the kubernetes group with 3 updates

### [`v0.5.0`](https://github.com/ahmetb/kubectl-tree/releases/tag/v0.5.0)

#### Changelog

- [`44b7841`](https://github.com/ahmetb/kubectl-tree/commit/44b784104c46a1ebd3c9a2f990106c2790de7708) chore(deps): bump goreleaser/goreleaser-action from 6 to 7 ([#&#8203;110](https://github.com/ahmetb/kubectl-tree/issues/110))

### [`v0.4.6`](https://github.com/ahmetb/kubectl-tree/releases/tag/v0.4.6)

#### Changelog

- [`ee7f2ca`](https://github.com/ahmetb/kubectl-tree/commit/ee7f2ca11e271c8ece1a8426bce4119d1ff38bac) Fix namespace and CRD handling logic (vibe slop)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Oslo)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->

---------

Co-authored-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
Co-authored-by: Renovate Bot <renovate@forteapps.net>
Reviewed-on: https://git.forteapps.net/Forte/launchpad/pulls/39
Reviewed-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
Co-authored-by: gitea_admin <admin@forteapps.net>
Co-committed-by: gitea_admin <admin@forteapps.net>

apps/base/mcp10x/forte10x-app-credentials-sealed.yaml

@@ -7,7 +7,8 @@ metadata:
   namespace: mcp10x
 spec:
   encryptedData:
-    FLOWCASE_TOKEN: AgAjQ0Jm779LiB2/EBKtIl18Iky/tgl7VvEvkJfr82mbe7JIp99+I8WPIMgmlXsxWBDfwJ/DZoDEAKG5o8mvwc7DtaE7LkpPSXKRIviLrm+7amNdEpwb1zKjCmZ3vNOPXLnCTD3W1od8u106MEvrZpt1N1Pzav/QUElAA4lqyf4AZPuio0H/7jF8QciVHIN4BdofodOmWWCTxP1aVMylat3txlkzuqwkXc1fKBPmOKC1qWepAG7dlQ3xJ2C5Cinz5IqOYnQPO6sm/Gp+c8yQSS+0NpKO3dp93yuwRsOLOMNpCeeYOyzn2ypFIdiBuLA5k85l5WyI9BCvRjP+kzRX+u69XL7p2eMEg+vRVfoOWNetysYCdK+96bWNVVleQEuPAFxsbJWK5eV8jTZk+QeFES8kkXQwUoTMqh+JULgONakxrzc1LmA+FtKNwHWCHalh8pLQ9KeI2i9E5CtotjHfEGLE6T0ibwwOg1ZrL3irQVII8VFm4Rk+dSicbeEMAtIaII023NWuZlonrwIIy+GSVzskhhcjV7t51hylqFA3yfb+RQCzdGYA5fySlJBWhli8IotvqnDmWduPBHGb/+yrdXHsaiDqWuUu6JBUg4JqM+AMa8FkaFh8SbctbGBoycpzLVFn9N2qWviojhC9s1NJ4MiCegvE6IsCLaHidY4UXeeGjUK6Mx6h4x3y/q7ZIrBIpUOJ+8I4Mgvi9sTCogeR+vWtpP9ZZ/31MXELuu/ho3Wn9Q==
+    BENKEN_CLIENT_SECRET: AgBjps8BCn20C8upAaAdb1fG4Qh3eKBbTeFuuWhQb8WoIvHmk+v03mw8i39evkQwlUWvLBWV1mtGiKwpCNhmAAdicRFG6u0m30+21K6ZtYqtKEniPKo/kjPd9nDbtxvIwiaqKs+kvFpqbxKaeqF5THYNxHZBg8gGeSbAkSx+BNIY2iLm8NRBzgC5FME5jbX8pet+DN7tbmsQTtG5f1q+h24aKXjvN5SigPft1BetfleHGlus0hFXpJ7zS4rV7rpSKSiLVV/KtS5YqEDj9uunZKyGT8j93z5xQbj0bCPVF3TU5+RCL6eE/GSgJxM4ePZ2gWZRG4eHDlGK2qE+JaNIng8wWycqLVrbs1kWoP2cdRGq6b8GHwoplAM4h4ud2fac6+5V4alhy8uhRTAX7dUG3UkwOQV/hTRb97pctPwQfltkBpDBhhW3Lfy9whSdqBuD9OqhegTqxCuWXr/P4KVOORUr0V0Iex45oLMqivI3FB2rTq9Lkwpf5YKE14d7RbKWF1G28FCNAcV8vnOIslkztLuu3GgQbVIoIiZGnnYEPofjUxbDZ/Sd1LrGeHEPR+/JJnNhNxv2297UuIIEC8kfiKuwjtLOMVQg51UbESx/+d1XmgLPqkz+jAqEPxvu8u5wO0Dov6vliTbtewJf8+fet3xnFNvyuY5ymmiTla6Gm9XPJscLj5iCzT3VhA/QuhhWXinmE/UnpYP0U4YPl5B/dUA9qT95BA6GBpDXPrDJRWNfpAH1wfG70lEBuBQXgdixYlwvx2JO6OI5+ztBKO0qFkgK
+    FLOWCASE_TOKEN: AgBLN1BWnFs3R2K+Wvb37ABucQWvx8mVVDEhZiIOYYLE8SDdbshxluP4J4IISmHwLX7Q0gYWeypfTCfvMa9c5b9AEjTcpodv4CMhjp5Mq7zUCtTI6pH6QZgLhjGheKCY+RciIK1DBsNk7CZa9MuVUdd1w0/m2C7fwikPPvNDHcNLR7zBBPWVlprgRyMrsdykcm7cmWcyqTwa/55DVPPJsG9x1K2YnjzgWHlX7BoLB/Nx7qX4XVadKEXnV0jVO5isalARxvke32pwebaiFSg8EZMhe4lntOqMSP26y/9RbveeEZS8qxzoR2OmsVrHUpMeppzpVkvQ9sKi2B4Vx8XoiRY6hZR+TmZKTvFa6JKx9gwAOVs53LEUaF7+uOQOrIcFyOXm7Ibj/azf7opqfvGajygRzSUaffTIixj+M5eJnm/iua/BWarW2w4c+ZIKvQ9DhcYpnF9Gj0U7+EWfNZyzlMoLRHsOIyKNUhOeEaSLoVQGyqRY72ZGqs83EPfQYlEu74PGyXPjd11KMhAayluGLadeAH2QDyigpf7REdXAGULNDhkJrqeYMmmGCZCyrvNOoXjYC4jQQEYA4Sd4QJA05q/EW8aFE/++nY8RqhbHqDz6wshAW/WFsTsR4JC6fc5qR+YVSmjKOa7lnk7I9vD7uPEZzCc6ImvA/NxTCfDKCREvLA5G0lYsmiTuxYmBesUgCSVVMxflEl1GXvGpFniZKPyvxIdna9j7XEQjUZsGTiyN1w==
   template:
     metadata:
       creationTimestamp: null

devbox.json

@@ -1,24 +1,24 @@
 {
   "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
   "packages": [
-    "kubectl@1.33.2",
+    "kubectl@1.36.3",
     "kubernetes-helm@3.18.4",
     "k9s@0.50.7",
     "kubeseal@0.30.0",
     "argocd@2.14.11",
     "kubecm@0.33.1",
-    "kubectl-tree@0.4.3",
+    "kubectl-tree@0.6.0",
     "kind@0.29.0",
     "kustomize@5.7.0",
     "kyverno@1.14.3",
     "syft@1.29.0",
     "grype@0.92.2",
     "traefik@3.6.7",
-    "claude-code@latest",
+    "claude-code@0.2.122",
     "go@latest",
-    "dotnet-sdk@latest",
+    "dotnet-sdk@2.1.810",
     "opentofu@1.11.6",
-    "_1password@latest",
+    "_1password@1.12.2",
     "github-cli@latest",
     "upcloud-cli@3.29.0",
     "awscli2@2.34.24"

docs/DEVELOPER-GUIDE.md

@@ -1469,12 +1469,6 @@ ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the
 | `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
 | `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |
 
-#### Public CLI Client (Device-Code Login)
-
-`forte-cli` is a shared **public** client (no secret) with the RFC 8628 device-authorization grant enabled (`oauth2.device.authorization.grant.enabled: "true"`, `standardFlowEnabled: false`, `directAccessGrantsEnabled: false`). Downloaded skills and CLI tools that log in through the Auth Sidecar (forte-drop first) use it with `<PREFIX>_CLIENT_ID=forte-cli`; nothing per-tool needs to be registered in Keycloak.
-
-It must be defined in `forte-realm.json` (this legacy path): the self-service registrar hardcodes `publicClient: false` / `standardFlowEnabled: true` and drops `attributes`, so a `client-config` Secret cannot produce a public device-code client. It carries no `k8s.secret.sync` attribute (the registrar's secret sync skips it) and is listed in the cleanup CronJob's protected clients.
-
 ### Retrieving Secrets for External Deployments
 
 The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:

infra/base/fluent-bit/fluent-bit.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://fluent.github.io/helm-charts
     chart: fluent-bit
-    targetRevision: 0.47.10
+    targetRevision: 0.58.2
     helm:
       releaseName: fluent-bit
       valueFiles:

infra/base/kyverno/kyverno.yaml

@@ -36,7 +36,7 @@ spec:
   source:
     chart: kyverno
     repoURL: https://kyverno.github.io/kyverno/
-    targetRevision: v3.7.0 # Update to latest stable version
+    targetRevision: 3.9.1
     helm:
       releaseName: kyverno
       valuesObject:

infra/base/loki/loki.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://grafana.github.io/helm-charts
     chart: loki
-    targetRevision: "6.0.0"
+    targetRevision: "7.0.0"
     helm:
       releaseName: loki
       valueFiles:

infra/base/renovate/renovate.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: ghcr.io/renovatebot/charts
     chart: renovate
-    targetRevision: "46.109.0"
+    targetRevision: "46.318.0"
     helm:
       releaseName: renovate
       valueFiles:

infra/base/sealedsecrets/sealedsecrets.yaml

@@ -16,8 +16,8 @@ spec:
 
   source:
     chart: sealed-secrets
-    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    repoURL: https://bitnami.github.io/sealed-secrets
-    targetRevision: 2.16.2 # Update to latest stable version
+    targetRevision: 2.20.0
     helm:
       releaseName: sealed-secrets
       parameters:

infra/base/vault/vault.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://helm.releases.hashicorp.com
     chart: vault
-    targetRevision: "0.32.0"
+    targetRevision: "0.34.1"
     helm:
       releaseName: vault
       valueFiles:

infra/values/base/keycloak-values.yaml

@@ -186,21 +186,6 @@ keycloakConfigCli:
                 }
               }
             ]
-          },
-          {
-            "clientId": "forte-cli",
-            "name": "Forte CLI",
-            "description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
-            "enabled": true,
-            "protocol": "openid-connect",
-            "standardFlowEnabled": false,
-            "directAccessGrantsEnabled": false,
-            "publicClient": true,
-            "redirectUris": [],
-            "webOrigins": [],
-            "attributes": {
-              "oauth2.device.authorization.grant.enabled": "true"
-            }
           }
         ],
         "browserFlow": "browser-auto-idp",
@@ -305,6 +290,7 @@ extraDeploy:
     namespace: keycloak
   spec:
     schedule: "*/2 * * * *"
+    timeZone: "Europe/Oslo"
     concurrencyPolicy: Forbid
     successfulJobsHistoryLimit: 1
     failedJobsHistoryLimit: 3
@@ -317,7 +303,7 @@ extraDeploy:
             restartPolicy: Never
             containers:
             - name: registrar
-              image: alpine:3.20
+              image: alpine:3.24
               command: [ "/bin/sh", "-c" ]
               args:
               - |
@@ -632,7 +618,9 @@ extraDeploy:
     name: keycloak-client-cleanup
     namespace: keycloak
   spec:
-    schedule: "0 3 * * 0"
+    schedule: "0 3 1 * *"
+    timeZone: "Europe/Oslo"
+    startingDeadlineSeconds: 3600
     concurrencyPolicy: Forbid
     successfulJobsHistoryLimit: 1
     failedJobsHistoryLimit: 3
@@ -645,7 +633,7 @@ extraDeploy:
             restartPolicy: Never
             containers:
             - name: cleanup
-              image: alpine:3.20
+              image: alpine:3.24
               command: [ "/bin/sh", "-c" ]
               args:
               - |
@@ -683,22 +671,24 @@ extraDeploy:
                 MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))
 
                 # Hardcoded protected clients (never delete these)
-                PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
+                PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
 
                 echo "Fetching clients from realm '${REALM}'..."
                 CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
                   "${KEYCLOAK_URL}/admin/realms/${REALM}/clients")
 
-                CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
+                CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" \
+                  --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
                   [
                     .[]
                     | select(.clientId as $cid | $protected | index($cid) | not)
                     | select(.attributes["k8s.secret.sync"] != "true")
                     | select(.clientId | test($pattern; "i"))
-                    | select((.createdTimestamp // 0) / 1000 < ($now - $min_age))
+                    | select(.attributes["client.secret.creation.time"] != null)
+                    | select((.attributes["client.secret.creation.time"] | tonumber) < ($now - $min_age))
                   ]
                 ')
-
+                
                 COUNT=$(echo "$CANDIDATES" | jq 'length')
                 echo "Found ${COUNT} candidate client(s) matching pattern and age threshold"
 
@@ -743,7 +733,7 @@ extraDeploy:
               - name: DRY_RUN
                 value: "false"
               - name: MIN_AGE_DAYS
-                value: "15"
+                value: "60"
               volumeMounts:
               - name: keycloak-credentials
                 mountPath: /secrets

infra/values/base/loki-values.yaml

@@ -17,7 +17,14 @@ loki:
         period: 24h
       object_store: filesystem # we're storing on filesystem so there's no real persistence here.
       schema: v13
+  compactor:
+    working_directory: /var/loki/compactor
+    retention_enabled: true
+    delete_request_store: filesystem
+    compaction_interval: 10m
+    retention_delete_delay: 2h
   limits_config:
+    retention_period: 168h # 7 days
     reject_old_samples: true
     reject_old_samples_max_age: 168h
     ingestion_rate_mb: 15
@@ -28,6 +35,8 @@ chunksCache:
 resultsCache:
   enabled: false
 singleBinary:
+  persistence:
+    size: 20Gi 
   replicas: 1
   resources:
     requests:

infra/values/base/renovate-values.yaml

@@ -21,6 +21,11 @@ renovate:
           "assignees": ["danijel.simeunovic"],
           "reviewers": ["danijel.simeunovic"]
         },
+        {
+          "matchRepositories": ["**/launchpad"],
+          "assignees": ["danijel.simeunovic"],
+          "reviewers": ["danijel.simeunovic"]
+        },
         {
           "matchRepositories": ["**/forte-helm"],
           "assignees": ["danijel.simeunovic"],

renovate.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "group:allNonMajor",
+    ":dependencyDashboard",
+    ":semanticCommits"
+  ],
+  "timezone": "Europe/Oslo",
+  "labels": ["renovate"],
+  "reviewers": ["danijel.simeunovic"],
+
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 4,
+  "minimumReleaseAge": "3 days",
+
+  "ignorePaths": [
+    "**/*-sealed.yaml",
+    "cluster-resources/policies/**",
+    "private/**",
+    ".devbox/**"
+  ],
+
+  "argocd": {
+    "description": "ArgoCD Applications live under infra/, apps/ and the root app-of-apps files. The manager skips any file without an argoproj.io apiVersion, so matching broadly is safe.",
+    "managerFilePatterns": [
+      "/^_app-of-apps-.+\\.yaml$/",
+      "/^apps/.+\\.yaml$/",
+      "/^infra/.+\\.yaml$/"
+    ]
+  },
+
+  "helm-values": {
+    "description": "Values files are named <app>-values.yaml, not the default values.yaml.",
+    "managerFilePatterns": ["/^infra/values/.+\\.ya?ml$/"]
+  },
+
+  "kubernetes": {
+    "description": "Plain manifests with inline image references. Kyverno policies are excluded via ignorePaths - their images are Go templates, not tags.",
+    "managerFilePatterns": [
+      "/^cluster-resources/.+\\.yaml$/",
+      "/^apps/.+/resources/.+\\.yaml$/"
+    ]
+  },
+
+  "packageRules": [
+    {
+      "description": "Every Application carries a second source pointing at this repo at HEAD for $values. HEAD is not a version.",
+      "matchDatasources": ["git-tags"],
+      "matchDepNames": ["/forteapps\\.net/"],
+      "enabled": false
+    },
+    {
+      "description": "Platform chart majors usually carry values-schema or CRD breaks - flag them for a careful read.",
+      "matchFileNames": ["infra/**"],
+      "matchUpdateTypes": ["major"],
+      "labels": ["renovate", "breaking-change"],
+      "minimumReleaseAge": "7 days"
+    },
+    {
+      "description": "Patch-level platform bumps are routine - let them through faster.",
+      "matchFileNames": ["infra/**"],
+      "matchUpdateTypes": ["patch"],
+      "minimumReleaseAge": "1 day"
+    }
+  ]
+}