[renovate]

This PR contains the following updates:

Package	Update	Change
kopiur	patch	0.10.15 → 0.10.16

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

home-operations/kopiur (kopiur)

v0.10.16

Compare Source

Features

• npm: update web ui dependencies (#​595) (c5dd711)
• npm: update web ui dependencies (#​599) (b9bfd5a)

Bug Fixes

• npm: update web ui dependencies (#​590) (dd40d67)
• resolve open issues (#​584 #​583 #​582 #​579 #​571 #​552 #​547 #​546 #​545 #​194) (#​598) (1953404)
• rust: update crate schemars (1.2.2 → 1.2.3) (#​592) (c5e5982)
• rust: update crate serde_json (1.0.152 → 1.0.154) (#​593) (b3d9e66)
• rust: update crate tokio (1.53.2 → 1.53.3) (#​596) (4ce5b43)
• rust: update opentelemetry (0.33.0 → 0.33.1) (#​597) (a200a6b)

Miscellaneous Chores

• github-action: update github-actions (#​600) (3cfd2a3)
• mise: update mise tools (#​594) (333677e)
• mise: update tool helm (4.3.0 → 4.3.1) (#​601) (383b99d)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Helm Diff

Chart.yaml:

@@ -2,7 +2,7 @@
   category: Storage
   licenses: AGPL-3.0-only
 apiVersion: v2
-appVersion: 0.10.15
+appVersion: 0.10.16
 description: Kopiur — a Kopia-native Kubernetes backup operator written in Rust. Installs
   the controller, admission webhook, the 8 kopiur.home-operations.com/v1alpha1 CRDs,
   and the RBAC required to run them.
@@ -21,4 +21,4 @@
 sources:
 - https://github.com/home-operations/kopiur
 type: application
-version: 0.10.15
+version: 0.10.16

Values.yaml:

@@ -29,8 +29,11 @@
 # only when the component leaves its own value empty; commonLabels are added to
 # every rendered object.
 global:
-  # -- Concatenated with the top-level imagePullSecrets; reaches controller,
-  # webhook, and mover Jobs.
+  # -- Concatenated with the top-level imagePullSecrets. Set on the controller,
+  # webhook and console pods, and the NAMES are passed to every mover pod
+  # (backup/restore/maintenance Jobs, kopia server, browse sessions). A name
+  # resolves in the pod's own namespace and kopiur never copies Secrets, so the
+  # Secret must exist in each namespace movers run in (see imagePullSecrets).
   imagePullSecrets: []
   # -- Scheduling defaults every kopiur pod inherits unless the component
   # (root = controller, webhook.*) sets its own.
@@ -94,11 +97,17 @@
   # -- Defaults to .Chart.AppVersion when empty.
   tag: ""
   # -- Pin by digest (e.g. "sha256:..."); takes precedence over tag.
-  digest: "sha256:e30e167862571708b6f5c424e4cc69dc72cbdbc17f41e7d6a19752516d53cee9"
+  digest: "sha256:7ff314dedd6c472671232417b743d15280fd8de958caec6a07d695acda1ba973"
   # -- Image pull policy for the controller.
   pullPolicy: IfNotPresent
-# -- Image pull secrets for the controller pod (concatenated with
-# global.imagePullSecrets; also reaches the webhook pod and mover Jobs).
+# -- Image pull secrets (concatenated with global.imagePullSecrets) for the
+# controller, webhook and console pods. Their NAMES are also passed to every
+# mover pod, but a name resolves in the pod's own namespace and kopiur does not
+# copy Secrets: create the Secret in each namespace movers run in — every
+# namespace with a SnapshotPolicy/Snapshot/Restore (backup, restore, verify and
+# browse-session pods run beside the workload), each Repository's namespace
+# (bootstrap, delete, pin, replication, kopia server), the Maintenance CR's
+# namespace, and the operator namespace (ClusterRepository bootstrap/delete).
 imagePullSecrets: []
 #  - name: my-registry-creds
 
@@ -476,7 +485,7 @@
     # -- Defaults to .Chart.AppVersion when empty.
     tag: ""
     # -- Pin by digest (e.g. "sha256:..."); takes precedence over tag.
-    digest: "sha256:57a9f9df7faf436afc34c77170dfdd886292d3b01a4c85f6d912b900c5c0624d"
+    digest: "sha256:f9ba855722929ae5a0ba6a012125bd16058ec4bae2e79c5eeb89a459ab1a2cfc"
     # -- Image pull policy for the webhook.
     pullPolicy: IfNotPresent
   # -- failurePolicy for both webhook configurations: Fail (fail-closed,
@@ -612,7 +621,7 @@
     tag: ""
     # -- Pin the mover image by digest so a re-pulled tag can never change what
     # runs in a data-protection Job. STRONGLY RECOMMENDED in production.
-    digest: "sha256:de7051a0ef2f9c5c2523126c745f3a38579df641081ca6dc619822bf5d116989"
+    digest: "sha256:2d553bc45752c1e1a592f25ad4c44d924167607d2ac6ff79b5b6b0f06f5d76c8"
     # -- Pull policy used on the mover Job pods.
     pullPolicy: IfNotPresent
 # =============================================================================
@@ -652,7 +661,7 @@
     # -- Defaults to .Chart.AppVersion when empty.
     tag: ""
     # -- Pin by digest (e.g. "sha256:..."); takes precedence over tag.
-    digest: "sha256:0ac46de3e5579d90bf92f44db7390a07b0cdadfc8ccee6996b2bd9b05afaf3dd"
+    digest: "sha256:c9cd479909d48fe34604f6a31e046bfaa4d96ff12551ea86e09de80e0b1a3af7"
     # -- Image pull policy for the console.
     pullPolicy: IfNotPresent
   # -- Container port serving the SPA and /api. Rendered into KOPIUR_UI_ADDR as
@@ -742,7 +751,8 @@
     # — bind a role for that (ui.rbac.bindings). Empty (the
     # default) means "whatever groups the proxy asserts". Set, every other
     # group the proxy sends is dropped before it reaches Kubernetes (the user
-    # menu lists them under "Not forwarded"), and the list is enforced twice:
+    # menu names them behind a collapsed "N groups not forwarded" line), and
+    # the list is enforced twice:
     # the console filters inbound groups, and the same list is pinned as
     # `resourceNames` on the impersonate rule so the apiserver enforces it even
     # if the console did not. Use it when your IdP sends many groups and only a