From 62a8eef590d666981ca716079d94144de95d6630 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Fri, 7 Aug 2026 23:41:59 -0700
Subject: [PATCH] chore(deps): take the drift on the five charts kx owns alone
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The customManagers made 32 pins visible; ten are behind. These are the
five that can move here without anything else moving first.

  argo-cd                9.5.14  -> 10.3.0   app v3.4.2 -> v3.5.0
  kube-prometheus-stack  85.1.2  -> 88.2.0   prometheus-operator v0.93.0
  cloudnative-pg         0.28.2  -> 0.29.0   operator 1.29.1 -> 1.30.0
  trust-manager          v0.22.1 -> v0.24.0
  nats                   2.14.0  -> 2.14.4

The split is not arbitrary. mirror-check holds kx's charts equal to a
pinned eks-gitops commit, so bumping a mirrored chart here alone breaks
that comparison. These five are declared kx-only in stack/upstream.json,
which is exactly why nothing was watching them and exactly why they can
move independently. The other five behind — cilium, opencost,
opentelemetry-collector, reloader, trivy-operator — are mirrored and have
to move on both sides together.

argo-cd crosses a chart major. Chart 10.0.0's single breaking change is
`global.networkPolicy.create` false -> true, which is live here because
cilium runs policyEnforcementMode default. Every rendered policy was
checked against kx's own values: argocd-server is `ingress: - {}`, dex and
commit-server are gated off, all policies are Ingress-only, and
defaultDenyIngress stays false. 10.3.0 carries the same appVersion as
10.2.3, so it is chart-only changes on top of the release that analysis
covered.

Every slice renders: scripts/render-check.sh templates all 33 with the
real pinned versions and values, and passes. yamllint, shellcheck and the
new coverage gate are clean.

Found while rendering, and not fixed here: `grafana/tempo` 1.24.4 is
`deprecated: true` upstream. eks-gitops pins the same chart at the same
version, so it is an org-wide question, and the successor
(`tempo-distributed`) is a different topology rather than a drop-in.
Renovate will go on offering 1.24.x patches and will never say the line is
dead — a currency instrument reporting "current" on a deprecated chart.
---
 stack/core/argo-cd/install.sh                        | 2 +-
 stack/core/trust-manager/install.sh                  | 2 +-
 stack/data/cloudnative-pg/install.sh                 | 2 +-
 stack/data/nats/install.sh                           | 2 +-
 stack/observability/kube-prometheus-stack/install.sh | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/stack/core/argo-cd/install.sh b/stack/core/argo-cd/install.sh
index b507dbe..eeab213 100755
--- a/stack/core/argo-cd/install.sh
+++ b/stack/core/argo-cd/install.sh
@@ -12,6 +12,6 @@ kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
 
 helm upgrade --install argocd argo/argo-cd \
   --namespace argocd \
-  --version 9.5.14 \
+  --version 10.3.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/core/trust-manager/install.sh b/stack/core/trust-manager/install.sh
index 1ab8a0f..cd88fde 100755
--- a/stack/core/trust-manager/install.sh
+++ b/stack/core/trust-manager/install.sh
@@ -11,7 +11,7 @@ kubectl create namespace cert-manager --dry-run=client -o yaml | kubectl apply -
 
 helm upgrade --install trust-manager jetstack/trust-manager \
   --namespace cert-manager \
-  --version v0.22.1 \
+  --version v0.24.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait \
   --hide-notes
diff --git a/stack/data/cloudnative-pg/install.sh b/stack/data/cloudnative-pg/install.sh
index e2306a3..748963e 100755
--- a/stack/data/cloudnative-pg/install.sh
+++ b/stack/data/cloudnative-pg/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace cnpg-system --dry-run=client -o yaml | kubectl apply -f
 
 helm upgrade --install cloudnative-pg cnpg/cloudnative-pg \
   --namespace cnpg-system \
-  --version 0.28.2 \
+  --version 0.29.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/data/nats/install.sh b/stack/data/nats/install.sh
index 6c20a53..cf46278 100755
--- a/stack/data/nats/install.sh
+++ b/stack/data/nats/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace nats --dry-run=client -o yaml | kubectl apply -f -
 
 helm upgrade --install nats nats/nats \
   --namespace nats \
-  --version 2.14.0 \
+  --version 2.14.4 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/observability/kube-prometheus-stack/install.sh b/stack/observability/kube-prometheus-stack/install.sh
index 9e002b5..d5d4723 100755
--- a/stack/observability/kube-prometheus-stack/install.sh
+++ b/stack/observability/kube-prometheus-stack/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace monitoring --dry-run=client -o yaml | kubectl apply -f
 
 helm upgrade --install kube-prometheus-stack prometheus-community/kube-prometheus-stack \
   --namespace monitoring \
-  --version 85.1.2 \
+  --version 88.2.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait