jellyfin: upgrade to 12.0

All five installed plugins have 12.0.0.0 targetAbi builds available. The
archived 9p4 SSO Authentication plugin has been removed, since it has no
v12 build and is being replaced by an OIDC plugin later.

Plugins must be updated from the Jellyfin dashboard after the rollout;
the container upgrade does not touch /config/plugins.

applications/authentik/ldap/deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-ldap
+  template:
+    metadata:
+      labels:
+        app: authentik-ldap
+    spec:
+      containers:
+        - name: ldap
+          image: ghcr.io/goauthentik/ldap:2026.8.0
+          ports:
+            - containerPort: 3389
+              name: ldap
+            - containerPort: 6636
+              name: ldaps
+            - containerPort: 9300
+              name: metrics
+          envFrom:
+            - secretRef:
+                name: authentik-ldap-secrets
+          livenessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 256Mi

applications/authentik/ldap/infisicalsecret.yaml

@@ -0,0 +1,24 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: authentik-ldap-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/authentik/authentik-ldap"
+        recursive: false
+  managedSecretReference:
+    secretName: authentik-ldap-secrets
+    secretNamespace: authentik
+    secretType: Opaque

applications/authentik/ldap/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-ldap
+  ports:
+    - name: ldap
+      port: 3389
+      targetPort: 3389
+    - name: metrics
+      port: 9300
+      targetPort: 9300

applications/authentik/ldap/tcproute.yaml

@@ -0,0 +1,25 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: authentik-ldap
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: authentik-ldaps
+  rules:
+    # The gateway terminates TLS on 636, so both listeners hit the plaintext port
+    - backendRefs:
+        - name: authentik-ldap
+          port: 3389
+          kind: Service
+          group: ""
+          weight: 1

applications/gitea/runner/gitea-runner-persistentvolumeclaim.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-runner-pvc
-  namespace: gitea
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  volumeName: gitea-runner-data
-  resources:
-    requests:
-      storage: 20Gi

applications/jellyfin/jellyfin-statefulset.yaml

@@ -20,7 +20,7 @@ spec:
         gpu: "true"
       containers:
       - name: jellyfin
-        image: jellyfin/jellyfin:10.11.11
+        image: jellyfin/jellyfin:12.0
         ports:
         - containerPort: 8096
         resources:

infra/argocd/applications/gitea-runner-application.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gitea-runner
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    # The act_runner chart itself. Values live in this repo, pulled in via the
+    # $values ref below.
+    - repoURL: https://dl.gitea.com/charts/
+      chart: actions
+      targetRevision: 0.1.0
+      helm:
+        # $values resolves to the ref source's repo root, so this path is
+        # relative to the repository, not to the chart.
+        valueFiles:
+          - $values/applications/gitea/runner/values.yaml
+    - repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: gitea
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

infra/argocd/applications/infisical-application.yaml

@@ -17,6 +17,21 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: infisical
+  # A StatefulSet's volumeClaimTemplates are immutable, and the API server
+  # injects fields into them that are not in the manifest: apiVersion, kind,
+  # metadata.creationTimestamp, spec.volumeMode and a status block. ArgoCD
+  # diffs those and reports OutOfSync forever, since no sync can resolve them.
+  # infisical-postgres and infisical-valkey are the only StatefulSets here
+  # using volumeClaimTemplates, which is why this app alone was affected.
+  ignoreDifferences:
+    - group: apps
+      kind: StatefulSet
+      jqPathExpressions:
+        - '.spec.volumeClaimTemplates[]?.apiVersion'
+        - '.spec.volumeClaimTemplates[]?.kind'
+        - '.spec.volumeClaimTemplates[]?.metadata.creationTimestamp'
+        - '.spec.volumeClaimTemplates[]?.spec.volumeMode'
+        - '.spec.volumeClaimTemplates[]?.status'
   syncPolicy:
     automated:
       prune: true

infra/argocd/applications/victoria-metrics-application.yaml

@@ -8,12 +8,18 @@ spec:
   sources:
     - repoURL: https://victoriametrics.github.io/helm-charts/
       chart: victoria-metrics-k8s-stack
-      targetRevision: 0.91.2
+      # Pinned at 0.77.0. 0.91.2 was tried on 2026-08-29 and rolled back:
+      # Grafana crash-looped on "Datasource provisioning error: data source
+      # not found". The chart also moves dashboards and the 35 default VMRules
+      # out of the Helm render and into a runtime sync-job, so the upgrade
+      # needs a values migration and a verified datasource config, not a
+      # version bump.
+      targetRevision: 0.77.0
       helm:
         # Release name kept short to avoid label length >63 chars on alertmanager StatefulSet pods
         releaseName: vm
         valueFiles:
-          - $values/victoria-metrics/values.yaml
+          - $values/applications/victoria-metrics/values.yaml
     - repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
       targetRevision: HEAD
       ref: values

infra/envoy-gateway/authentik/authentik-ldap-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: authentik-ldap-tls
+  namespace: envoy-gateway
+spec:
+  secretName: authentik-ldap-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - ldap.jsme.be

infra/envoy-gateway/authentik/authentik-ldap-gateway-patch.yaml

@@ -0,0 +1,40 @@
+# TCP listeners for the authentik LDAP outpost. kinds must be set explicitly:
+# TCP allows nothing by default and TLS defaults to TLSRoute.
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: authentik-ldap
+    protocol: TCP
+    port: 389
+    allowedRoutes:
+      kinds:
+        - group: gateway.networking.k8s.io
+          kind: TCPRoute
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: authentik-ldaps
+    protocol: TLS
+    port: 636
+    # No hostname: LDAP clients cannot be relied on to send SNI
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - group: ""
+          kind: Secret
+          name: authentik-ldap-tls
+          namespace: envoy-gateway
+    allowedRoutes:
+      kinds:
+        - group: gateway.networking.k8s.io
+          kind: TCPRoute
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik

infra/envoy-gateway/kustomization.yaml

@@ -23,6 +23,7 @@ resources:
 
   # Certificates
   - authentik/authentik-certificate.yaml
+  - authentik/authentik-ldap-certificate.yaml
   - argocd/argocd-certificate.yaml
   - bentopdf/bentopdf-certificate.yaml
   - gitea/gitea-certificate.yaml
@@ -70,6 +71,12 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: authentik/authentik-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: authentik/authentik-ldap-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1