chore(deps): update helm release traefik to v41

This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [azurerm](https://registry.terraform.io/providers/hashicorp/azurerm) ([source](https://github.com/hashicorp/terraform-provider-azurerm)) | required_provider | major | `~> 4.0` → `~> 5.0` | `5.8.0` |

---

### Release Notes

<details>
<summary>hashicorp/terraform-provider-azurerm (azurerm)</summary>

### [`v5.7.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#570-September-24-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.6.0...v5.7.0)

FEATURES:

- **New List Resource**: `azurerm_private_dns_resolver_forwarding_rule` ([#&#8203;33313](https://github.com/hashicorp/terraform-provider-azurerm/issues/33313))
- **New List Resource**: `azurerm_windows_virtual_machine` ([#&#8203;33332](https://github.com/hashicorp/terraform-provider-azurerm/issues/33332))

ENHANCEMENTS:

- dependencies: `go-azure-sdk` - update to `v0.20260917.1142820` ([#&#8203;33495](https://github.com/hashicorp/terraform-provider-azurerm/issues/33495))
- dependencies: `network` - update API version to `2025-07-01` ([#&#8203;33441](https://github.com/hashicorp/terraform-provider-azurerm/issues/33441))
- Data Source: `azurerm_linux_web_app` - export the `virtual_network_image_pull_enabled` property ([#&#8203;33316](https://github.com/hashicorp/terraform-provider-azurerm/issues/33316))
- Data Source: `azurerm_network_interface` - export the `auxiliary_mode`, `auxiliary_sku`, `edge_zone`, and `internal_domain_name_suffix` properties ([#&#8203;33204](https://github.com/hashicorp/terraform-provider-azurerm/issues/33204))
- Data Source: `azurerm_public_ip` - export the `domain_name_label_scope`, `edge_zone`, `public_ip_prefix_id`, and `sku_tier` properties ([#&#8203;33193](https://github.com/hashicorp/terraform-provider-azurerm/issues/33193))
- Data Source: `azurerm_service_plan` - export the `premium_plan_auto_scale_enabled` property ([#&#8203;33300](https://github.com/hashicorp/terraform-provider-azurerm/issues/33300))
- Data Source: `azurerm_storage_blob` - export the `cache_control` and `source_uri` properties ([#&#8203;33318](https://github.com/hashicorp/terraform-provider-azurerm/issues/33318))
- Data Source: `azurerm_traffic_manager_profile` - export the `maximum_return` property ([#&#8203;33346](https://github.com/hashicorp/terraform-provider-azurerm/issues/33346))
- Data Source: `azurerm_web_pubsub` - export the `live_trace` and `identity` properties ([#&#8203;33373](https://github.com/hashicorp/terraform-provider-azurerm/issues/33373))
- `azurerm_kubernetes_cluster_node_pool` - add `Windows2025` as a valid value for the `os_sku` property ([#&#8203;33463](https://github.com/hashicorp/terraform-provider-azurerm/issues/33463))
- `azurerm_kubernetes_cluster` - add `Windows2025` as a valid value for the `os_sku` property ([#&#8203;33463](https://github.com/hashicorp/terraform-provider-azurerm/issues/33463))

BUG FIXES:

- Data Source: `azurerm_kubernetes_cluster` - fix a panic caused by a nil pointer dereference while flattening `agent_pool_profile` ([#&#8203;33488](https://github.com/hashicorp/terraform-provider-azurerm/issues/33488))
- `azurerm_postgresql_flexible_server` - fix `cluster` block read for replica `create_mode` ([#&#8203;33082](https://github.com/hashicorp/terraform-provider-azurerm/issues/33082))

### [`v5.6.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#560-September-17-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.5.0...v5.6.0)

FEATURES:

- **New List Resource**: `azurerm_batch_account` ([#&#8203;33252](https://github.com/hashicorp/terraform-provider-azurerm/issues/33252))
- **New List Resource**: `azurerm_cdn_frontdoor_origin_group` ([#&#8203;33334](https://github.com/hashicorp/terraform-provider-azurerm/issues/33334))
- **New Resource**: `azurerm_storage_discovery_workspace` ([#&#8203;31479](https://github.com/hashicorp/terraform-provider-azurerm/issues/31479))

ENHANCEMENTS:

- dependencies: `containers` - update API version to `2026-05-01` ([#&#8203;32688](https://github.com/hashicorp/terraform-provider-azurerm/issues/32688))
- dependencies: `go-azure-sdk` - update to `v0.20260910.1141000` ([#&#8203;33413](https://github.com/hashicorp/terraform-provider-azurerm/issues/33413))
- dependencies: `qumulo` - update API version to `2026-04-16` ([#&#8203;33421](https://github.com/hashicorp/terraform-provider-azurerm/issues/33421))
- dependencies: `servicebus` - update to API version `2026-01-01` ([#&#8203;33450](https://github.com/hashicorp/terraform-provider-azurerm/issues/33450))
- `azurerm_iothub_device_update_instance` - add support for the `connection_string_wo` and `connection_string_wo_version` properties ([#&#8203;33448](https://github.com/hashicorp/terraform-provider-azurerm/issues/33448))
- `azurerm_linux_function_app` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_linux_function_app_slot` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_linux_web_app` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_linux_web_app_slot` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_mongo_cluster` - Support new property `network_bypass_mode` ([#&#8203;33168](https://github.com/hashicorp/terraform-provider-azurerm/issues/33168))
- `azurerm_servicebus_namespace` - add support for the `1.3` value to the `minimum_tls_version` property ([#&#8203;33457](https://github.com/hashicorp/terraform-provider-azurerm/issues/33457))
- `azurerm_windows_function_app` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_windows_function_app_slot` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_windows_web_app` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))
- `azurerm_windows_web_app_slot` - add support for the `end_to_end_tls_encryption_enabled` property ([#&#8203;31135](https://github.com/hashicorp/terraform-provider-azurerm/issues/31135))

BUG FIXES:

- `azurerm_site_recovery_replicated_vm` - select `managed_disk` properties compared case insensitive ([#&#8203;33424](https://github.com/hashicorp/terraform-provider-azurerm/issues/33424))

### [`v5.5.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#550-September-10-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.4.0...v5.5.0)

FEATURES:

- **New List Resource**: `azurerm_analysis_services_server` ([#&#8203;33250](https://github.com/hashicorp/terraform-provider-azurerm/issues/33250))
- **New List Resource**: `azurerm_application_insights_workbook` ([#&#8203;33244](https://github.com/hashicorp/terraform-provider-azurerm/issues/33244))
- **New List Resource**: `azurerm_attestation_provider` ([#&#8203;33251](https://github.com/hashicorp/terraform-provider-azurerm/issues/33251))
- **New List Resource**: `azurerm_cdn_frontdoor_origin` ([#&#8203;33307](https://github.com/hashicorp/terraform-provider-azurerm/issues/33307))
- **New List Resource**: `azurerm_eventhub_consumer_group` ([#&#8203;33335](https://github.com/hashicorp/terraform-provider-azurerm/issues/33335))
- **New List Resource**: `azurerm_linux_virtual_machine` ([#&#8203;33333](https://github.com/hashicorp/terraform-provider-azurerm/issues/33333))
- **New List Resource**: `azurerm_virtual_hub_connection` ([#&#8203;33311](https://github.com/hashicorp/terraform-provider-azurerm/issues/33311))

ENHANCEMENTS:

- dependencies: `go-azure-sdk` - update to `v0.20260901.1173158` ([#&#8203;33274](https://github.com/hashicorp/terraform-provider-azurerm/issues/33274))
- `azurerm_private_endpoint` - lock on private service connection resource ids ([#&#8203;33298](https://github.com/hashicorp/terraform-provider-azurerm/issues/33298))
- `azurerm_storage_account` - add support for the `public_network_access` property ([#&#8203;33292](https://github.com/hashicorp/terraform-provider-azurerm/issues/33292))

BUG FIXES:

- `azurerm_resource_group` - the `managed_by` property now forces recreation when changed as the API does not support changing this value ([#&#8203;33339](https://github.com/hashicorp/terraform-provider-azurerm/issues/33339))
- `go-azure-sdk` - `Delete` operations now poll on asynchronous operation URLs if returned by the API instead of only checking for a `404` on the resource URL, ensuring deletion errors are reported to the user ([#&#8203;33274](https://github.com/hashicorp/terraform-provider-azurerm/issues/33274))

### [`v5.4.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#540-September-03-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.3.0...v5.4.0)

FEATURES:

- **New List Resource**: `azurerm_application_insights_standard_web_test` ([#&#8203;33243](https://github.com/hashicorp/terraform-provider-azurerm/issues/33243))
- **New List Resource**: `azurerm_application_insights_workbook_template` ([#&#8203;33245](https://github.com/hashicorp/terraform-provider-azurerm/issues/33245))
- **New List Resource**: `azurerm_arc_kubernetes_provisioned_cluster` ([#&#8203;33247](https://github.com/hashicorp/terraform-provider-azurerm/issues/33247))
- **New List Resource**: `azurerm_availability_set` ([#&#8203;33241](https://github.com/hashicorp/terraform-provider-azurerm/issues/33241))
- **New List Resource**: `azurerm_batch_application` ([#&#8203;33254](https://github.com/hashicorp/terraform-provider-azurerm/issues/33254))
- **New List Resource**: `azurerm_dedicated_host_group` ([#&#8203;33257](https://github.com/hashicorp/terraform-provider-azurerm/issues/33257))
- **New List Resource**: `azurerm_log_analytics_workspace` ([#&#8203;33259](https://github.com/hashicorp/terraform-provider-azurerm/issues/33259))

ENHANCEMENTS:

- dependencies: `azurerm_mongo_cluster` - update API version to `2026-06-01` ([#&#8203;33195](https://github.com/hashicorp/terraform-provider-azurerm/issues/33195))
- dependencies: `azurerm_mongo_cluster_firewall_rule` - update API version to `2026-06-01` ([#&#8203;33195](https://github.com/hashicorp/terraform-provider-azurerm/issues/33195))
- dependencies: `azurerm_mongo_cluster_user` - update API version to `2026-06-01` ([#&#8203;33195](https://github.com/hashicorp/terraform-provider-azurerm/issues/33195))
- dependencies: `netapp` - update API version to `2026-05-01` ([#&#8203;33215](https://github.com/hashicorp/terraform-provider-azurerm/issues/33215))
- Data Source: `azurerm_api_management_workspace` - export the `description` property ([#&#8203;33205](https://github.com/hashicorp/terraform-provider-azurerm/issues/33205))
- Data Source: `azurerm_attestation_provider` - export the `sev_snp_policy_base64`, `open_enclave_policy_base64`, `sgx_enclave_policy_base64`, and `tpm_policy_base64` properties ([#&#8203;33125](https://github.com/hashicorp/terraform-provider-azurerm/issues/33125))
- Data Source: `azurerm_automation_account` - export the `dsc_primary_access_key`, `dsc_server_endpoint`, `dsc_secondary_access_key`, `public_network_access_enabled`, `sku_name`, and `tags` properties ([#&#8203;33135](https://github.com/hashicorp/terraform-provider-azurerm/issues/33135))
- Data Source: `azurerm_automation_account` - export the `encryption` block ([#&#8203;33135](https://github.com/hashicorp/terraform-provider-azurerm/issues/33135))
- Data Source: `azurerm_ip_group` - export the `firewall_ids` and `firewall_policy_ids` properties ([#&#8203;33190](https://github.com/hashicorp/terraform-provider-azurerm/issues/33190))
- Data Source: `azurerm_private_link_service` - export the `fqdns` and `destination_ip_address` properties ([#&#8203;33191](https://github.com/hashicorp/terraform-provider-azurerm/issues/33191))
- `azurerm_key_vault_managed_hardware_security_module_key` - allow the `key_size` property to be set when `key_type` is `oct-HSM` ([#&#8203;32690](https://github.com/hashicorp/terraform-provider-azurerm/issues/32690))
- `azurerm_lb_probe ` - add support for the `no_healthy_backends_behavior` property ([#&#8203;32645](https://github.com/hashicorp/terraform-provider-azurerm/issues/32645))
- `azurerm_linux_virtual_machine_scale_set` - add support for the `NvmeDisk` value to the `os_disk.diff_disk_settings.placement` property ([#&#8203;30328](https://github.com/hashicorp/terraform-provider-azurerm/issues/30328))
- `azurerm_linux_web_app` - add support for the `8.5` value in the  `site_config.application_stack.php_version` property ([#&#8203;33308](https://github.com/hashicorp/terraform-provider-azurerm/issues/33308))
- `azurerm_linux_web_app_slot` - add support for the `8.5` value in the  `site_config.application_stack.php_version` property ([#&#8203;33308](https://github.com/hashicorp/terraform-provider-azurerm/issues/33308))
- `azurerm_netapp_volume` - support for the `breakthrough_mode_enabled` property ([#&#8203;33215](https://github.com/hashicorp/terraform-provider-azurerm/issues/33215))
- `azurerm_postgresql_flexible_server` - add support for the `storage_type`, `storage_iops`, and `storage_throughput` properties which allows choice of the new "Premium V2 LRS" storage type ([#&#8203;32121](https://github.com/hashicorp/terraform-provider-azurerm/issues/32121))
- `azurerm_storage_account` - add support for an in-place migration of `account_replication_type` between matching non-zonal and zonal types instead of resource recreation ([#&#8203;33236](https://github.com/hashicorp/terraform-provider-azurerm/issues/33236))
- `azurerm_storage_table` - add support for AAD authentication ([#&#8203;32997](https://github.com/hashicorp/terraform-provider-azurerm/issues/32997))
- `azurerm_synapse_spark_pool` - migrate to `go-azure-sdk` ([#&#8203;33258](https://github.com/hashicorp/terraform-provider-azurerm/issues/33258))
- `azurerm_windows_virtual_machine_scale_set` - add support for the `NvmeDisk` value to the `os_disk.diff_disk_settings.placement` property ([#&#8203;30328](https://github.com/hashicorp/terraform-provider-azurerm/issues/30328))

BUG FIXES:

- `azurerm_synapse_spark_pool` - fix `lifecycle.ignore_changes` support ([#&#8203;33258](https://github.com/hashicorp/terraform-provider-azurerm/issues/33258))

### [`v5.3.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#530-August-27-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.2.0...v5.3.0)

FEATURES:

- **New Data Source**: `azurerm_playwright_workspace` ([#&#8203;31954](https://github.com/hashicorp/terraform-provider-azurerm/issues/31954))
- **New List Resource**: `azurerm_cognitive_deployment` ([#&#8203;33149](https://github.com/hashicorp/terraform-provider-azurerm/issues/33149))
- **New List Resource**: `azurerm_playwright_workspace` ([#&#8203;31954](https://github.com/hashicorp/terraform-provider-azurerm/issues/31954))
- **New Resource**: `azurerm_playwright_workspace` ([#&#8203;31954](https://github.com/hashicorp/terraform-provider-azurerm/issues/31954))

ENHANCEMENTS:

- dependencies: `go-azure-helpers` - update version to `0.82.0` ([#&#8203;33142](https://github.com/hashicorp/terraform-provider-azurerm/issues/33142))
- dependencies: `sql` - update API version to `2025-01-01` ([#&#8203;33201](https://github.com/hashicorp/terraform-provider-azurerm/issues/33201))
- Data Source: `azurerm_role_definition` - export the `role_definition_resource_id` property ([#&#8203;33126](https://github.com/hashicorp/terraform-provider-azurerm/issues/33126))
- `azurerm_cognitive_deployment` - add Resource Identity support ([#&#8203;33149](https://github.com/hashicorp/terraform-provider-azurerm/issues/33149))
- `azurerm_federated_identity_credential` - add additional polling to account for Azure's eventual consistency ([#&#8203;32935](https://github.com/hashicorp/terraform-provider-azurerm/issues/32935))
- `azurerm_kubernetes_cluster` - add support for the `oms_agent.retina_flow_logs_enabled` property ([#&#8203;33222](https://github.com/hashicorp/terraform-provider-azurerm/issues/33222))
- `azurerm_managed_application` - add support for the `identity` block ([#&#8203;30725](https://github.com/hashicorp/terraform-provider-azurerm/issues/30725))
- `azurerm_private_endpoint` - extend validation for the `private_service_connection.subresource_names` property to allow names containing spaces ([#&#8203;32887](https://github.com/hashicorp/terraform-provider-azurerm/issues/32887))
- `azurerm_search_service` - allow in-place downgrades of the `sku` property between Basic and Standard tiers ([#&#8203;33069](https://github.com/hashicorp/terraform-provider-azurerm/issues/33069))
- `azurerm_site_recovery_replicated_vm` - add update support to the `managed_disk` block without requiring resource recreation ([#&#8203;33140](https://github.com/hashicorp/terraform-provider-azurerm/issues/33140))
- `azurerm_user_assigned_identity` - add additional polling to account for Azure's eventual consistency ([#&#8203;33142](https://github.com/hashicorp/terraform-provider-azurerm/issues/33142))

BUG FIXES:

- Data Source: `azurerm_app_configuration_key` - now correctly sets `tags` into state ([#&#8203;33182](https://github.com/hashicorp/terraform-provider-azurerm/issues/33182))
- `azurerm_eventhub_namespace` - prevent `network_rulesets.x.default_action` being set to `Deny` if `ip_rule` or `virtual_network_rule` is not specified ([#&#8203;33216](https://github.com/hashicorp/terraform-provider-azurerm/issues/33216))

### [`v5.2.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#520-August-20-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.1.0...v5.2.0)

FEATURES:

- **New List Resource**: `azurerm_user_assigned_identity` ([#&#8203;32667](https://github.com/hashicorp/terraform-provider-azurerm/issues/32667))

ENHANCEMENTS:

- dependencies: `go` - update to `1.26.6` ([#&#8203;33141](https://github.com/hashicorp/terraform-provider-azurerm/issues/33141))
- dependencies: `go-azure-sdk` - update to `v0.20260811.1225050` ([#&#8203;33079](https://github.com/hashicorp/terraform-provider-azurerm/issues/33079))
- `azurerm_cdn_frontdoor_batch_rule_set` - allow `/` as an input to `rule.conditions.request_path.values` ([#&#8203;33023](https://github.com/hashicorp/terraform-provider-azurerm/issues/33023))
- `azurerm_databricks_workspace` - remove a redundant key vault existence check ([#&#8203;33136](https://github.com/hashicorp/terraform-provider-azurerm/issues/33136))
- `azurerm_databricks_workspace_root_dbfs_customer_managed_key` - remove a redundant key vault existence check ([#&#8203;33136](https://github.com/hashicorp/terraform-provider-azurerm/issues/33136))
- `azurerm_logic_app_standard` - add support for `v10.0` to `site_config.dotnet_framework_version` ([#&#8203;33116](https://github.com/hashicorp/terraform-provider-azurerm/issues/33116))
- `azurerm_mongo_cluster` - `administrator_password` is no longer required when `create_mode` is `Default` to support Entra ID-only authentication ([#&#8203;32092](https://github.com/hashicorp/terraform-provider-azurerm/issues/32092))
- `azurerm_redhat_openshift_cluster` - add support for the `network_profile.load_balancer_profile` block ([#&#8203;32473](https://github.com/hashicorp/terraform-provider-azurerm/issues/32473))
- `azurerm_redhat_openshift_cluster` - add support for the `platform_workload_identity_profile` block ([#&#8203;32473](https://github.com/hashicorp/terraform-provider-azurerm/issues/32473))
- `azurerm_role_assignment` - the `condition`, `condition_version`, and `description` properties can now be updated in-place ([#&#8203;32714](https://github.com/hashicorp/terraform-provider-azurerm/issues/32714))
- `azurerm_snapshot` - `create_option` now supports `CopyStart` ([#&#8203;32834](https://github.com/hashicorp/terraform-provider-azurerm/issues/32834))

BUG FIXES:

- `azurerm_cognitive_account_project` - added create/update/delete lock on parent AccountID to make sure operations on parent account are processed in serial (required by Cognitive service) ([#&#8203;33151](https://github.com/hashicorp/terraform-provider-azurerm/issues/33151))
- `azurerm_databricks_workspace` - fix a persistent diff on removal of `managed_disk_cmk_key_vault_key_id` or `managed_services_cmk_key_vault_key_id` ([#&#8203;33136](https://github.com/hashicorp/terraform-provider-azurerm/issues/33136))
- `azurerm_oracle_exadata_infrastructure` - fix an issue that prevented users from deploying with no `zones` set ([#&#8203;33011](https://github.com/hashicorp/terraform-provider-azurerm/issues/33011))

### [`v5.1.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#510-August-13-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.0.1...v5.1.0)

ENHANCEMENTS:

- dependencies: `azurerm_linux_virtual_machine_scale_set` - update to API version `2025-04-01` ([#&#8203;31586](https://github.com/hashicorp/terraform-provider-azurerm/issues/31586))
- dependencies: `azurerm_orchestrated_virtual_machine_scale_set` - update to API version `2025-04-01` ([#&#8203;31586](https://github.com/hashicorp/terraform-provider-azurerm/issues/31586))
- dependencies: `azurerm_virtual_machine_scale_set` - update to API version `2025-04-01` ([#&#8203;31586](https://github.com/hashicorp/terraform-provider-azurerm/issues/31586))
- dependencies: `azurerm_virtual_machine_scale_set_extension` - update to API version `2025-04-01` ([#&#8203;31586](https://github.com/hashicorp/terraform-provider-azurerm/issues/31586))
- dependencies: `azurerm_windows_virtual_machine_scale_set` - update to API version `2025-04-01` ([#&#8203;31586](https://github.com/hashicorp/terraform-provider-azurerm/issues/31586))
- dependencies: `codesigning` - update to API version `2025-10-13` ([#&#8203;31714](https://github.com/hashicorp/terraform-provider-azurerm/issues/31714))
- `azurerm_linux_virtual_machine` - `encryption_at_host_enabled` can now be set to `true` when `os_disk.security_encryption_type` is set to `DiskWithVMGuestState` ([#&#8203;32885](https://github.com/hashicorp/terraform-provider-azurerm/issues/32885))
- `azurerm_linux_virtual_machine_scale_set` - `encryption_at_host_enabled` can now be set to `true` when `os_disk.security_encryption_type` is set to `DiskWithVMGuestState` ([#&#8203;32885](https://github.com/hashicorp/terraform-provider-azurerm/issues/32885))
- `azurerm_managed_devops_pool` - add support for the `CreatorOnly` value to `azure_devops_organization.permission.kind` property ([#&#8203;32753](https://github.com/hashicorp/terraform-provider-azurerm/issues/32753))
- `azurerm_windows_virtual_machine` - `encryption_at_host_enabled` can now be set to `true` when `os_disk.security_encryption_type` is set to `DiskWithVMGuestState` ([#&#8203;32885](https://github.com/hashicorp/terraform-provider-azurerm/issues/32885))
- `azurerm_windows_virtual_machine_scale_set` - `encryption_at_host_enabled` can now be set to `true` when `os_disk.security_encryption_type` is set to `DiskWithVMGuestState` ([#&#8203;32885](https://github.com/hashicorp/terraform-provider-azurerm/issues/32885))

BUG FIXES:

- `azurerm_cdn_frontdoor_batch_ruleset` - parse `rule.actions.route_configuration_override.origin_group.cdn_frontdoor_origin_group_id` case-insensitively and normalize the resulting value to prevent diffs ([#&#8203;32980](https://github.com/hashicorp/terraform-provider-azurerm/issues/32980))
- `azurerm_cdn_frontdoor_route` - parse `cdn_frontdoor_origin_group_id` case-insensitively and normalize the resulting value to prevent diffs ([#&#8203;32980](https://github.com/hashicorp/terraform-provider-azurerm/issues/32980))
- `azurerm_cdn_frontdoor_secret` - fix an incorrect type assertion ([#&#8203;32982](https://github.com/hashicorp/terraform-provider-azurerm/issues/32982))
- `azurerm_dev_center_project` - parse `dev_center_id` case-insensitively and normalize the resulting value to prevent diffs ([#&#8203;32798](https://github.com/hashicorp/terraform-provider-azurerm/issues/32798))
- `azurerm_eventhub` - now prevents the `status` property from being set to `SendDisabled` on create  ([#&#8203;33071](https://github.com/hashicorp/terraform-provider-azurerm/issues/33071))
- `azurerm_storage_container` - add a state migration for the `id` field, fixing the upgrade path from 4.x to 5.x ([#&#8203;32978](https://github.com/hashicorp/terraform-provider-azurerm/issues/32978))
- `azurerm_storage_queue` - extend state migration to handle a malformed `resource_manager_id` ([#&#8203;32979](https://github.com/hashicorp/terraform-provider-azurerm/issues/32979))
- `azurerm_storage_share` - add a state migration for the `id` field, fixing the upgrade path from 4.x to 5.x ([#&#8203;33075](https://github.com/hashicorp/terraform-provider-azurerm/issues/33075))

### [`v5.0.1`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#501-July-30-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.0.0...v5.0.1)

NOTES:

In addition to the bug fixes below, a number of resource documentation pages and the 5.0-upgrade-guide have been updated.

BUG FIXES:

- `azurerm_cdn_frontdoor_origin` - fix a regression that prevented valid values as input to `private_link.private_link_target_id` ([#&#8203;32912](https://github.com/hashicorp/terraform-provider-azurerm/issues/32912))
- `azurerm_storage_queue` - add a state migration for the `id` field, fixing the upgrade path from 4.x to 5.x ([#&#8203;32914](https://github.com/hashicorp/terraform-provider-azurerm/issues/32914))
- `azurerm_storage_table_entity` - add a state migration for the `storage_table_id` field, fixing the upgrade path from 4.x to 5.x ([#&#8203;32929](https://github.com/hashicorp/terraform-provider-azurerm/issues/32929))

### [`v5.0.0`](https://github.com/hashicorp/terraform-provider-azurerm/blob/HEAD/CHANGELOG.md#500-July-27-2026)

[Compare Source](https://github.com/hashicorp/terraform-provider-azurerm/compare/v4.81.0...v5.0.0)

NOTES:

- **Major Version**: Version 5.0 of the Azure Provider is a major version - some behaviours have changed and some deprecated fields/resources have been removed - please refer to [the 5.0 upgrade guide for more information](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/5.0-upgrade-guide).
- When upgrading to v5.0 of the AzureRM Provider, we recommend upgrading to the latest version of Terraform Core ([which can be found here](https://developer.hashicorp.com/terraform/install)).

FEATURES:

- **New Action**: `azurerm_web_app_set_slot_distribution` ([#&#8203;32364](https://github.com/hashicorp/terraform-provider-azurerm/issues/32364))
- **New Datasource** adds `azurerm_kubernetes_automatic_cluster_datasource` ([#&#8203;32881](https://github.com/hashicorp/terraform-provider-azurerm/issues/32881))

ENHANCEMENTS:

- dependencies: `grpc` update to `1.82.1` ([#&#8203;32852](https://github.com/hashicorp/terraform-provider-azurerm/issues/32852))
- dependencies: `loadbalancers` - update to API version `2025-01-01` ([#&#8203;32644](https://github.com/hashicorp/terraform-provider-azurerm/issues/32644))
- `azurerm_cognitive_account_rai_policy` - the `content_filter.severity_threshold` property is now optional ([#&#8203;32100](https://github.com/hashicorp/terraform-provider-azurerm/issues/32100))
- `azurerm_container_registry` - the `trust_policy_enabled` property has been deprecated and removed from the provider ([#&#8203;32752](https://github.com/hashicorp/terraform-provider-azurerm/issues/32752))
- `azurerm_dashboard_grafana` - the `11` value for the `grafana_major_version` property has been deprecated and the property now supports `13` ([#&#8203;32777](https://github.com/hashicorp/terraform-provider-azurerm/issues/32777))
- `azurerm_log_analytics_workspace` - add support for the `internet_ingestion_access_type` and `internet_query_access_type` properties ([#&#8203;32562](https://github.com/hashicorp/terraform-provider-azurerm/issues/32562))
- `azurerm_subnet` - add support for the `network_security_group_id_wo` and `network_security_group_id_wo_version` properties ([#&#8203;32847](https://github.com/hashicorp/terraform-provider-azurerm/issues/32847))
- `azurerm_subnet` - add support for the `route_table_id_wo` and `route_table_id_wo_version` properties ([#&#8203;32847](https://github.com/hashicorp/terraform-provider-azurerm/issues/32847))
- `azurerm_subnet` - export the `network_security_group_id` property ([#&#8203;32847](https://github.com/hashicorp/terraform-provider-azurerm/issues/32847))
- `azurerm_subnet` - export the `route_table_id` property ([#&#8203;32847](https://github.com/hashicorp/terraform-provider-azurerm/issues/32847))
- `azurerm_windows_web_app` - add support for `~24` to `site_config.application_stack.node_version` ([#&#8203;32840](https://github.com/hashicorp/terraform-provider-azurerm/issues/32840))
- `azurerm_windows_web_app_slot` - add support for `~24` to `site_config.application_stack.node_version` ([#&#8203;32840](https://github.com/hashicorp/terraform-provider-azurerm/issues/32840))
- `cdn` - migrate to `go-azure-sdk` ([#&#8203;32849](https://github.com/hashicorp/terraform-provider-azurerm/issues/32849))
- `sentinel` - migrate to `go-azure-sdk` ([#&#8203;32759](https://github.com/hashicorp/terraform-provider-azurerm/issues/32759))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Oslo)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->

---------

Co-authored-by: Renovate Bot <renovate@forteapps.net>
Reviewed-on: https://git.forteapps.net/Forte/launchpad/pulls/55
Reviewed-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
Co-authored-by: gitea_admin <admin@forteapps.net>

.gitea/workflows/ai-review.yaml

@@ -23,25 +23,29 @@ jobs:
       REVIEW__INLINE_COMMENT_FALLBACK: "false"
       # LLM configuration
       LLM__PROVIDER: CLAUDE
-      LLM__META__MODEL: claude-sonnet-4-20250514
+      LLM__META__MODEL: claude-sonnet-5-5
+      LLM__META__REASONING__EFFORT: high
       LLM__META__MAX_TOKENS: "4096"
       LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
       LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         submodules: true
         fetch-depth: 0
         token: ${{ secrets.AI_REVIEW_TOKEN }}
 
+    - name: Update submodules to remote
+      run: git submodule update --remote --merge
+
     - name: Run inline review
-      uses: docker://nikitafilonov/ai-review:v0.64.0
+      uses: docker://nikitafilonov/ai-review:v1.1.0
       with:
         args: ai-review run-inline
 
     - name: Run summary review
-      uses: docker://nikitafilonov/ai-review:v0.64.0
+      uses: docker://nikitafilonov/ai-review:v1.1.0
       with:
         args: ai-review run-summary

.gitea/workflows/scan.yaml

@@ -0,0 +1,20 @@
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+    - name: Install TruffleHog
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
+          | sh -s -- -b /usr/local/bin
+    - name: Secret Scanning
+      run: trufflehog git file://. --fail --no-update --results=verified,unknown

.gitmodules

@@ -1,3 +1,5 @@
 [submodule "shared-prompts"]
 	path = shared-prompts
 	url = https://git.forteapps.net/Forte/ai-review-prompts.git
+	branch = main
+

.tofu/platforms/aks/dev/providers.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
   }
 }

.tofu/platforms/aks/modules/cluster/providers.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
     azuread = {
       source  = "hashicorp/azuread"

.tofu/platforms/aks/prod/providers.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
   }
 }

.tofu/platforms/aks/workload/providers.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
     random = {
       source  = "hashicorp/random"

apps/base/dot-ai-stack/dot-ai-stack.yaml

@@ -15,9 +15,6 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
-    notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
-    notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
-    notifications.argoproj.io/subscribe.on-degraded.slack: ""
   labels:
     app.kubernetes.io/name: dot-ai-stack
     app.kubernetes.io/part-of: apps

apps/base/mcp10x/forte10x-app-credentials-sealed.yaml

@@ -7,7 +7,8 @@ metadata:
   namespace: mcp10x
 spec:
   encryptedData:
-    FLOWCASE_TOKEN: AgAjQ0Jm779LiB2/EBKtIl18Iky/tgl7VvEvkJfr82mbe7JIp99+I8WPIMgmlXsxWBDfwJ/DZoDEAKG5o8mvwc7DtaE7LkpPSXKRIviLrm+7amNdEpwb1zKjCmZ3vNOPXLnCTD3W1od8u106MEvrZpt1N1Pzav/QUElAA4lqyf4AZPuio0H/7jF8QciVHIN4BdofodOmWWCTxP1aVMylat3txlkzuqwkXc1fKBPmOKC1qWepAG7dlQ3xJ2C5Cinz5IqOYnQPO6sm/Gp+c8yQSS+0NpKO3dp93yuwRsOLOMNpCeeYOyzn2ypFIdiBuLA5k85l5WyI9BCvRjP+kzRX+u69XL7p2eMEg+vRVfoOWNetysYCdK+96bWNVVleQEuPAFxsbJWK5eV8jTZk+QeFES8kkXQwUoTMqh+JULgONakxrzc1LmA+FtKNwHWCHalh8pLQ9KeI2i9E5CtotjHfEGLE6T0ibwwOg1ZrL3irQVII8VFm4Rk+dSicbeEMAtIaII023NWuZlonrwIIy+GSVzskhhcjV7t51hylqFA3yfb+RQCzdGYA5fySlJBWhli8IotvqnDmWduPBHGb/+yrdXHsaiDqWuUu6JBUg4JqM+AMa8FkaFh8SbctbGBoycpzLVFn9N2qWviojhC9s1NJ4MiCegvE6IsCLaHidY4UXeeGjUK6Mx6h4x3y/q7ZIrBIpUOJ+8I4Mgvi9sTCogeR+vWtpP9ZZ/31MXELuu/ho3Wn9Q==
+    BENKEN_CLIENT_SECRET: AgBjps8BCn20C8upAaAdb1fG4Qh3eKBbTeFuuWhQb8WoIvHmk+v03mw8i39evkQwlUWvLBWV1mtGiKwpCNhmAAdicRFG6u0m30+21K6ZtYqtKEniPKo/kjPd9nDbtxvIwiaqKs+kvFpqbxKaeqF5THYNxHZBg8gGeSbAkSx+BNIY2iLm8NRBzgC5FME5jbX8pet+DN7tbmsQTtG5f1q+h24aKXjvN5SigPft1BetfleHGlus0hFXpJ7zS4rV7rpSKSiLVV/KtS5YqEDj9uunZKyGT8j93z5xQbj0bCPVF3TU5+RCL6eE/GSgJxM4ePZ2gWZRG4eHDlGK2qE+JaNIng8wWycqLVrbs1kWoP2cdRGq6b8GHwoplAM4h4ud2fac6+5V4alhy8uhRTAX7dUG3UkwOQV/hTRb97pctPwQfltkBpDBhhW3Lfy9whSdqBuD9OqhegTqxCuWXr/P4KVOORUr0V0Iex45oLMqivI3FB2rTq9Lkwpf5YKE14d7RbKWF1G28FCNAcV8vnOIslkztLuu3GgQbVIoIiZGnnYEPofjUxbDZ/Sd1LrGeHEPR+/JJnNhNxv2297UuIIEC8kfiKuwjtLOMVQg51UbESx/+d1XmgLPqkz+jAqEPxvu8u5wO0Dov6vliTbtewJf8+fet3xnFNvyuY5ymmiTla6Gm9XPJscLj5iCzT3VhA/QuhhWXinmE/UnpYP0U4YPl5B/dUA9qT95BA6GBpDXPrDJRWNfpAH1wfG70lEBuBQXgdixYlwvx2JO6OI5+ztBKO0qFkgK
+    FLOWCASE_TOKEN: AgBLN1BWnFs3R2K+Wvb37ABucQWvx8mVVDEhZiIOYYLE8SDdbshxluP4J4IISmHwLX7Q0gYWeypfTCfvMa9c5b9AEjTcpodv4CMhjp5Mq7zUCtTI6pH6QZgLhjGheKCY+RciIK1DBsNk7CZa9MuVUdd1w0/m2C7fwikPPvNDHcNLR7zBBPWVlprgRyMrsdykcm7cmWcyqTwa/55DVPPJsG9x1K2YnjzgWHlX7BoLB/Nx7qX4XVadKEXnV0jVO5isalARxvke32pwebaiFSg8EZMhe4lntOqMSP26y/9RbveeEZS8qxzoR2OmsVrHUpMeppzpVkvQ9sKi2B4Vx8XoiRY6hZR+TmZKTvFa6JKx9gwAOVs53LEUaF7+uOQOrIcFyOXm7Ibj/azf7opqfvGajygRzSUaffTIixj+M5eJnm/iua/BWarW2w4c+ZIKvQ9DhcYpnF9Gj0U7+EWfNZyzlMoLRHsOIyKNUhOeEaSLoVQGyqRY72ZGqs83EPfQYlEu74PGyXPjd11KMhAayluGLadeAH2QDyigpf7REdXAGULNDhkJrqeYMmmGCZCyrvNOoXjYC4jQQEYA4Sd4QJA05q/EW8aFE/++nY8RqhbHqDz6wshAW/WFsTsR4JC6fc5qR+YVSmjKOa7lnk7I9vD7uPEZzCc6ImvA/NxTCfDKCREvLA5G0lYsmiTuxYmBesUgCSVVMxflEl1GXvGpFniZKPyvxIdna9j7XEQjUZsGTiyN1w==
   template:
     metadata:
       creationTimestamp: null

apps/overlays/upc-dev/forte-drop-postgresql/resources/pg-backup-cronjob.yaml

@@ -77,6 +77,12 @@ spec:
               mc rm --recursive --force --older-than 30d "obj/${S3_BUCKET}/_pgbackups/" || true
               echo "backup retention pass complete"
             env:
+            # mc writes its config under $MC_CONFIG_DIR; point it at the shared
+            # emptyDir (writable by uid 65532 via fsGroup). Without this it tries
+            # to mkdir /.mc on the read-only-to-nonroot root fs -> "mkdir /.mc:
+            # permission denied" and every run fails before uploading.
+            - name: MC_CONFIG_DIR
+              value: "/work/.mc"
             - name: S3_ENDPOINT
               valueFrom:
                 secretKeyRef: { name: forte-drop-secrets, key: S3_ENDPOINT }

apps/overlays/upc-dev/forte-drop/forte-drop.yaml

@@ -5,9 +5,9 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
-    notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
+#    notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
-    notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
+#    notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
-    notifications.argoproj.io/subscribe.on-degraded.slack: ""
+#    notifications.argoproj.io/subscribe.on-degraded.slack: ""
   labels:
     app.kubernetes.io/name: forte-drop
     app.kubernetes.io/part-of: apps

apps/overlays/upc-dev/forte-drop/keycloak-client-forte-drop.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keycloak-client-forte-drop
+  namespace: forte-drop
+  labels:
+    keycloak.forteapps.net/client-config: "true"
+  annotations:
+    keycloak.forteapps.net/source-namespace: "forte-drop"
+stringData:
+  client.json: |
+    {
+      "clientId": "forte-drop",
+      "name": "Forte Drop (web)",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "clientAuthenticatorType": "client-secret",
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "publicClient": false,
+      "redirectUris": ["https://drop.forteapps.net/auth/callback"],
+      "webOrigins": ["https://drop.forteapps.net"],
+      "defaultClientScopes": ["openid","email","profile"],
+      "secret": {
+        "namespace": "forte-drop",
+        "name": "forte-drop-oidc-credentials",
+        "keys": {
+          "clientId": "client-id",
+          "clientSecret": "client-secret"
+        }
+      }
+    }

apps/overlays/upc-dev/forte-drop/kustomization.yaml

@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - forte-drop.yaml
+- keycloak-client-forte-drop.yaml
 - forte-drop-pdb.yaml
 - forte-drop-secrets-sealed.yaml

cluster-resources/gitea-backup-cronjob.yaml

@@ -29,7 +29,7 @@ spec:
                   topologyKey: kubernetes.io/hostname
           initContainers:
             - name: gitea-dump
-              image: gitea/gitea:1.25.4
+              image: gitea/gitea:1.27.3
               command:
                 - sh
                 - -c

cluster-resources/letsencrypt-issuer.yaml

@@ -24,8 +24,15 @@ spec:
             name: azuredns-config
             key: client-secret
       selector:
-        dnsNames:
+        # NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
-        - '*.forteapps.net'
+        # matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
+        # named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
+        # instead suffix-matches the zone apex AND every subdomain at any depth, so this single
+        # entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
+        # drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
+        # Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
+        # to match fall through to the http01 solver below.
+        dnsZones:
         - 'forteapps.net'
     # HTTP-01 fallback for non-wildcard certificates
     - http01:
@@ -58,8 +65,15 @@ spec:
             name: azuredns-config
             key: client-secret
       selector:
-        dnsNames:
+        # NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
-        - '*.forteapps.net'
+        # matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
+        # named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
+        # instead suffix-matches the zone apex AND every subdomain at any depth, so this single
+        # entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
+        # drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
+        # Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
+        # to match fall through to the http01 solver below.
+        dnsZones:
         - 'forteapps.net'
     # HTTP-01 fallback for non-wildcard certificates
     - http01:

cluster-resources/policies/auth-sidecar-injector.yaml

@@ -233,6 +233,10 @@ spec:
               value: "{{ regex_replace_all('https?://[^/]*', request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-callback-path\", '') }}"
             - name: AUTH_OIDC_SCOPES
               value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-scopes\" || 'openid,profile,email'  }}"
+            - name: AUTH_OIDC_COOKIE_DOMAIN
+              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-cookie-domain\" || '' }}"
+            - name: AUTH_OIDC_ALLOWED_RETURN_HOSTS
+              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-allowed-return-hosts\" || '' }}"
             - name: AUTH_PUBLIC_PATHS
               value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
             - name: AUTH_OIDC_COOKIE_SECRET

devbox.json

@@ -1,27 +1,27 @@
 {
   "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
   "packages": [
-    "kubectl@1.33.2",
+    "kubectl@1.36.3",
-    "kubernetes-helm@3.18.4",
+    "kubernetes-helm@4.2.4",
-    "k9s@0.50.7",
+    "k9s@0.51.0",
-    "kubeseal@0.30.0",
+    "kubeseal@0.38.4",
-    "argocd@2.14.11",
+    "argocd@3.4.6",
-    "kubecm@0.33.1",
+    "kubecm@0.35.1",
-    "kubectl-tree@0.4.3",
+    "kubectl-tree@0.6.0",
-    "kind@0.29.0",
+    "kind@0.32.0",
-    "kustomize@5.7.0",
+    "kustomize@5.8.1",
-    "kyverno@1.14.3",
+    "kyverno@1.19.0",
-    "syft@1.29.0",
+    "syft@1.51.0",
-    "grype@0.92.2",
+    "grype@0.118.0",
-    "traefik@3.6.7",
+    "traefik@3.7.10",
-    "claude-code@latest",
+    "claude-code@2.1.245",
     "go@latest",
-    "dotnet-sdk@latest",
+    "dotnet-sdk@8.0.424",
-    "opentofu@1.11.6",
+    "opentofu@1.12.5",
-    "_1password@latest",
+    "_1password@2.30.0",
-    "github-cli@latest",
+    "github-cli@2.23.0",
-    "upcloud-cli@3.29.0",
+    "upcloud-cli@3.36.0",
-    "awscli2@2.34.24"
+    "awscli2@2.35.11"
   ],
   "shell": {
     "init_hook": [

docs/DEVELOPER-GUIDE.md

@@ -1469,6 +1469,12 @@ ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the
 | `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
 | `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |
 
+#### Public CLI Client (Device-Code Login)
+
+`forte-cli` is a shared **public** client (no secret) with the RFC 8628 device-authorization grant enabled (`oauth2.device.authorization.grant.enabled: "true"`, `standardFlowEnabled: false`, `directAccessGrantsEnabled: false`). Downloaded skills and CLI tools that log in through the Auth Sidecar (forte-drop first) use it with `<PREFIX>_CLIENT_ID=forte-cli`; nothing per-tool needs to be registered in Keycloak.
+
+It must be defined in `forte-realm.json` (this legacy path): the self-service registrar hardcodes `publicClient: false` / `standardFlowEnabled: true` and drops `attributes`, so a `client-config` Secret cannot produce a public device-code client. It carries no `k8s.secret.sync` attribute (the registrar's secret sync skips it) and is listed in the cleanup CronJob's protected clients.
+
 ### Retrieving Secrets for External Deployments
 
 The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:

docs/REFERENCE.md

@@ -1326,7 +1326,7 @@ storage:
 - Shared configuration and prompts live in the `shared-prompts` Git submodule (→ `Forte/ai-review-prompts`)
 - Review mode: `ONLY_ADDED_WITH_CONTEXT` — reviews only new/changed lines plus surrounding context (token-efficient)
 - Agent mode: disabled (one-shot review, no multi-turn reasoning)
-- LLM: Claude Sonnet (`claude-sonnet-4-20250514`)
+- LLM: Claude Sonnet (`claude-3-opus`)
 
 **Shared Prompts Structure** (submodule: `Forte/ai-review-prompts`):
 ```
@@ -1344,7 +1344,7 @@ shared-prompts/
 ```yaml
 llm:
   provider: CLAUDE
-  model: claude-sonnet-4-20250514
+  model: claude-3-opus
 vcs:
   provider: GITEA
 review:

docs/agents/domain.md

@@ -0,0 +1,36 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root, or
+- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo (most repos):
+
+```
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_

docs/agents/issue-tracker.md

@@ -0,0 +1,39 @@
+# Issue tracker: Gitea
+
+Issues for this repo live in Gitea at `git.forteapps.net/Forte/launchpad`. Use the Gitea API or `tea` CLI.
+
+## Conventions
+
+- **Create an issue**: `tea issue create --title "..." --description "..."`
+  or via API: `curl -X POST "https://git.forteapps.net/api/v1/repos/Forte/launchpad/issues" -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" -d '{"title":"...","body":"..."}'`
+- **Read an issue**: `tea issue view <number>` or API `GET /api/v1/repos/Forte/launchpad/issues/<number>`
+- **List issues**: `tea issue list` or API `GET /api/v1/repos/Forte/launchpad/issues?state=open`
+- **Comment on an issue**: `tea issue comment <number> "..."` or API `POST /api/v1/repos/Forte/launchpad/issues/<number>/comments`
+- **Apply labels**: API `POST /api/v1/repos/Forte/launchpad/issues/<number>/labels` with `{"labels": [<label_id>]}`
+- **Close**: API `PATCH /api/v1/repos/Forte/launchpad/issues/<number>` with `{"state": "closed"}`
+
+Infer the repo from `git remote -v`.
+
+## Pull requests as a triage surface
+
+**PRs as a request surface: no.**
+
+## When a skill says "publish to the issue tracker"
+
+Create a Gitea issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Fetch the issue via API or `tea issue view <number>`.
+
+## Wayfinding operations
+
+Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
+
+- **Map**: a single issue labelled `wayfinder:map`, holding the Destination / Notes / Decisions-so-far / Fog body.
+  - Create: `POST /api/v1/repos/Forte/launchpad/issues` with `{"title":"...","body":"...","labels":[<wayfinder:map label id>]}`
+- **Child ticket**: an issue carrying `Part of #<map>` at the top of its body and a `wayfinder:<type>` label (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
+- **Blocking**: Gitea does not have native issue dependencies. Fall back to a `Blocked by: #<n>, #<n>` line at the top of the child body. A ticket is unblocked when every issue it lists is closed.
+- **Frontier query**: list the map's open children — `GET /api/v1/repos/Forte/launchpad/issues?state=open&labels=wayfinder:research,wayfinder:prototype,wayfinder:grilling,wayfinder:task` — then filter to those whose body starts with `Part of #<map>`. Drop any with an open issue in their `Blocked by` line, or with an assignee. First in map order wins.
+- **Claim**: `PATCH /api/v1/repos/Forte/launchpad/issues/<n>` with `{"assignees":["<username>"]}` — the session's first write.
+- **Resolve**: post the answer as a comment (`POST .../comments`), close the issue (`PATCH` with `{"state":"closed"}`), then append a context pointer (gist + link) to the map's Decisions-so-far by editing the map issue body.

docs/agents/triage-labels.md

@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.

infra/base/cert-manager-application/cert-manager-application.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     repoURL: https://charts.jetstack.io
     chart: cert-manager
-    targetRevision: "v1.14.0"
+    targetRevision: "v1.21.2"
 
     helm:
       values: |

infra/base/fluent-bit/fluent-bit.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://fluent.github.io/helm-charts
     chart: fluent-bit
-    targetRevision: 0.47.10
+    targetRevision: 0.58.3
     helm:
       releaseName: fluent-bit
       valueFiles:

infra/base/gitea-actions/gitea-actions.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://dl.gitea.com/charts
     chart: actions
-    targetRevision: "0.0.5"
+    targetRevision: "0.1.2"
     helm:
       releaseName: gitea-actions
       valueFiles:

infra/base/gitea/gitea.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://dl.gitea.com/charts
     chart: gitea
-    targetRevision: "12.5.0"
+    targetRevision: "12.7.0"
     helm:
       releaseName: gitea
       valueFiles:

infra/base/grafana/grafana.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://grafana.github.io/helm-charts
     chart: grafana
-    targetRevision: "8.0.0"
+    targetRevision: "8.15.0"
     helm:
       releaseName: grafana
       valueFiles:

infra/base/kyverno/kyverno.yaml

@@ -36,7 +36,7 @@ spec:
   source:
     chart: kyverno
     repoURL: https://kyverno.github.io/kyverno/
-    targetRevision: v3.7.0 # Update to latest stable version
+    targetRevision: 3.9.1
     helm:
       releaseName: kyverno
       valuesObject:

infra/base/loki/loki.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://grafana.github.io/helm-charts
     chart: loki
-    targetRevision: "6.0.0"
+    targetRevision: "7.3.0"
     helm:
       releaseName: loki
       valueFiles:

infra/base/opencost/opencost.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://opencost.github.io/opencost-helm-chart
     chart: opencost
-    targetRevision: "1.42.0"
+    targetRevision: "2.5.32"
     helm:
       releaseName: opencost
       valueFiles:

infra/base/prometheus/prometheus.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://prometheus-community.github.io/helm-charts
     chart: prometheus
-    targetRevision: "28.9.0"
+    targetRevision: "28.16.0"
     helm:
       releaseName: prometheus
       valueFiles:

infra/base/renovate/renovate.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: ghcr.io/renovatebot/charts
     chart: renovate
-    targetRevision: "46.109.0"
+    targetRevision: "46.318.0"
     helm:
       releaseName: renovate
       valueFiles:

infra/base/sealedsecrets/sealedsecrets.yaml

@@ -16,8 +16,8 @@ spec:
 
   source:
     chart: sealed-secrets
-    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    repoURL: https://bitnami.github.io/sealed-secrets
-    targetRevision: 2.16.2 # Update to latest stable version
+    targetRevision: 2.20.0
     helm:
       releaseName: sealed-secrets
       parameters:

infra/base/traefik-application/traefik-application.yaml

@@ -24,7 +24,7 @@ spec:
   sources:
   - repoURL: https://traefik.github.io/charts
     chart: traefik
-    targetRevision: "28.0.0"
+    targetRevision: "41.6.0"
     helm:
       releaseName: traefik
       valueFiles:

infra/base/vault/vault.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://helm.releases.hashicorp.com
     chart: vault
-    targetRevision: "0.32.0"
+    targetRevision: "0.34.1"
     helm:
       releaseName: vault
       valueFiles:

infra/overlays/upc-dev/vaultwarden/vaultwarden.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://guerzon.github.io/vaultwarden
     chart: vaultwarden
-    targetRevision: "0.36.4"
+    targetRevision: "0.46.2"
     helm:
       releaseName: vaultwarden
       valueFiles:

infra/values/base/gitea-values.yaml

@@ -31,7 +31,7 @@ gitea:
       ENABLE_PASSWORD_SIGNIN_FORM: false
       AUTO_WATCH_ON_CHANGES: false
       AUTO_WATCH_NEW_REPOS: false
-      ENABLE_NOTIFY_MAIL: false
+      ENABLE_NOTIFY_MAIL: true
       ENABLE_TIMETRACKING: false
 
     openid:

infra/values/base/keycloak-values.yaml

@@ -186,6 +186,35 @@ keycloakConfigCli:
                 }
               }
             ]
+          },
+          {
+            "clientId": "forte-cli",
+            "name": "Forte CLI",
+            "description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
+            "enabled": true,
+            "protocol": "openid-connect",
+            "standardFlowEnabled": false,
+            "directAccessGrantsEnabled": false,
+            "publicClient": true,
+            "redirectUris": [],
+            "webOrigins": [],
+            "attributes": {
+              "oauth2.device.authorization.grant.enabled": "true"
+            },
+            "protocolMappers": [
+              {
+                "name": "audience-forte-drop-mcp",
+                "protocol": "openid-connect",
+                "protocolMapper": "oidc-audience-mapper",
+                "consentRequired": false,
+                "config": {
+                  "included.custom.audience": "https://mcp.drop.forteapps.net/mcp",
+                  "access.token.claim": "true",
+                  "id.token.claim": "false",
+                  "introspection.token.claim": "true"
+                }
+              }
+            ]
           }
         ],
         "browserFlow": "browser-auto-idp",
@@ -290,6 +319,7 @@ extraDeploy:
     namespace: keycloak
   spec:
     schedule: "*/2 * * * *"
+    timeZone: "Europe/Oslo"
     concurrencyPolicy: Forbid
     successfulJobsHistoryLimit: 1
     failedJobsHistoryLimit: 3
@@ -302,7 +332,7 @@ extraDeploy:
             restartPolicy: Never
             containers:
             - name: registrar
-              image: alpine:3.20
+              image: alpine:3.24
               command: [ "/bin/sh", "-c" ]
               args:
               - |
@@ -617,7 +647,9 @@ extraDeploy:
     name: keycloak-client-cleanup
     namespace: keycloak
   spec:
-    schedule: "0 3 * * 0"
+    schedule: "0 3 1 * *"
+    timeZone: "Europe/Oslo"
+    startingDeadlineSeconds: 3600
     concurrencyPolicy: Forbid
     successfulJobsHistoryLimit: 1
     failedJobsHistoryLimit: 3
@@ -630,7 +662,7 @@ extraDeploy:
             restartPolicy: Never
             containers:
             - name: cleanup
-              image: alpine:3.20
+              image: alpine:3.24
               command: [ "/bin/sh", "-c" ]
               args:
               - |
@@ -642,7 +674,7 @@ extraDeploy:
                 ADMIN_USER="admin"
                 ADMIN_PASS=$(cat /secrets/admin-password)
                 DRY_RUN="${DRY_RUN:-true}"
-                MIN_AGE_DAYS="${MIN_AGE_DAYS:-7}"
+                MIN_AGE_DAYS="${MIN_AGE_DAYS:-14}"
                 if [ -z "$CLIENT_ID_PATTERN" ]; then
                   CLIENT_ID_PATTERN='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
                 fi
@@ -668,19 +700,21 @@ extraDeploy:
                 MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))
 
                 # Hardcoded protected clients (never delete these)
-                PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
+                PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
 
                 echo "Fetching clients from realm '${REALM}'..."
                 CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
                   "${KEYCLOAK_URL}/admin/realms/${REALM}/clients")
 
-                CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
+                CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" \
+                  --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
                   [
                     .[]
                     | select(.clientId as $cid | $protected | index($cid) | not)
                     | select(.attributes["k8s.secret.sync"] != "true")
                     | select(.clientId | test($pattern; "i"))
-                    | select((.createdTimestamp // 0) / 1000 < ($now - $min_age))
+                    | select(.attributes["client.secret.creation.time"] != null)
+                    | select((.attributes["client.secret.creation.time"] | tonumber) < ($now - $min_age))
                   ]
                 ')
                 
@@ -728,7 +762,7 @@ extraDeploy:
               - name: DRY_RUN
                 value: "false"
               - name: MIN_AGE_DAYS
-                value: "7"
+                value: "60"
               volumeMounts:
               - name: keycloak-credentials
                 mountPath: /secrets

infra/values/base/loki-values.yaml

@@ -17,7 +17,14 @@ loki:
         period: 24h
       object_store: filesystem # we're storing on filesystem so there's no real persistence here.
       schema: v13
+  compactor:
+    working_directory: /var/loki/compactor
+    retention_enabled: true
+    delete_request_store: filesystem
+    compaction_interval: 10m
+    retention_delete_delay: 2h
   limits_config:
+    retention_period: 168h # 7 days
     reject_old_samples: true
     reject_old_samples_max_age: 168h
     ingestion_rate_mb: 15
@@ -28,6 +35,8 @@ chunksCache:
 resultsCache:
   enabled: false
 singleBinary:
+  persistence:
+    size: 20Gi 
   replicas: 1
   resources:
     requests:

infra/values/base/renovate-values.yaml

@@ -21,6 +21,11 @@ renovate:
           "assignees": ["danijel.simeunovic"],
           "reviewers": ["danijel.simeunovic"]
         },
+        {
+          "matchRepositories": ["**/launchpad"],
+          "assignees": ["danijel.simeunovic"],
+          "reviewers": ["danijel.simeunovic"]
+        },
         {
           "matchRepositories": ["**/forte-helm"],
           "assignees": ["danijel.simeunovic"],

infra/values/upc-dev/homepage-values.yaml

@@ -59,10 +59,6 @@ config:
         href: https://benken.hackathon.forteapps.net
         description: Teknisk kompetanse fra offentlige anbud
         icon: forte
-    - Forte Drop:
-        href: https://drop.forteapps.net
-        description: Self-hosted HTML-drops + MCP for Claude
-        icon: forte
     - Forte Feedback:
         href: https://feedback.forteapps.net
         description: Fortes internal feedback app

renovate.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "group:allNonMajor",
+    ":dependencyDashboard",
+    ":semanticCommits"
+  ],
+  "timezone": "Europe/Oslo",
+  "labels": ["renovate"],
+  "reviewers": ["danijel.simeunovic"],
+
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 4,
+  "minimumReleaseAge": "3 days",
+
+  "ignorePaths": [
+    "**/*-sealed.yaml",
+    "cluster-resources/policies/**",
+    "private/**",
+    ".devbox/**"
+  ],
+
+  "argocd": {
+    "description": "ArgoCD Applications live under infra/, apps/ and the root app-of-apps files. The manager skips any file without an argoproj.io apiVersion, so matching broadly is safe.",
+    "managerFilePatterns": [
+      "/^_app-of-apps-.+\\.yaml$/",
+      "/^apps/.+\\.yaml$/",
+      "/^infra/.+\\.yaml$/"
+    ]
+  },
+
+  "helm-values": {
+    "description": "Values files are named <app>-values.yaml, not the default values.yaml.",
+    "managerFilePatterns": ["/^infra/values/.+\\.ya?ml$/"]
+  },
+
+  "kubernetes": {
+    "description": "Plain manifests with inline image references. Kyverno policies are excluded via ignorePaths - their images are Go templates, not tags.",
+    "managerFilePatterns": [
+      "/^cluster-resources/.+\\.yaml$/",
+      "/^apps/.+/resources/.+\\.yaml$/"
+    ]
+  },
+
+  "packageRules": [
+    {
+      "description": "Every Application carries a second source pointing at this repo at HEAD for $values. HEAD is not a version.",
+      "matchDatasources": ["git-tags"],
+      "matchDepNames": ["/forteapps\\.net/"],
+      "enabled": false
+    },
+    {
+      "description": "Platform chart majors usually carry values-schema or CRD breaks - flag them for a careful read.",
+      "matchFileNames": ["infra/**"],
+      "matchUpdateTypes": ["major"],
+      "labels": ["renovate", "breaking-change"],
+      "minimumReleaseAge": "7 days"
+    },
+    {
+      "description": "Patch-level platform bumps are routine - let them through faster.",
+      "matchFileNames": ["infra/**"],
+      "matchUpdateTypes": ["patch"],
+      "minimumReleaseAge": "1 day"
+    }
+  ]
+}