Pin Bitwarden CLI to compatible 2026.8.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/charlesthomas/bitwarden-cli](https://github.com/charlesthomas/bitwarden-cli) | minor | `2026.8.0` → `2026.9.0` |

---

### Release Notes

<details>
<summary>charlesthomas/bitwarden-cli (ghcr.io/charlesthomas/bitwarden-cli)</summary>

### [`v2026.9.0`](https://github.com/charlesthomas/bitwarden-cli/releases/tag/2026.9.0)

[Compare Source](https://github.com/charlesthomas/bitwarden-cli/compare/2026.8.0...2026.9.0)

2026.9.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44My4wIiwidXBkYXRlZEluVmVyIjoiNDQuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

---------

Co-authored-by: Renovate Bot <bot@renovateapp.com>
Reviewed-on: #13

ansible/requirements-python.txt

@@ -1,3 +1,3 @@
-ansible-core==2.21.2
+ansible-core==2.21.4
 proxmoxer==2.3.0
 requests==2.34.2

ansible/requirements.yml

@@ -3,4 +3,4 @@ collections:
   - name: community.proxmox
     version: "2.0.0"
   - name: community.general
-    version: "13.2.0"
+    version: "13.4.0"

apps/cloud/affine.yaml

@@ -20,8 +20,7 @@ spec:
     spec:
       containers:
         - name: affine
-          image: ghcr.io/toeverything/affine:stable
+          image: ghcr.io/toeverything/affine:0.27.4
-          imagePullPolicy: Always
           command:
             [
               "sh",
@@ -100,8 +99,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: affine-config
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "affine-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cloud/cloudreve.yaml

@@ -16,7 +16,6 @@ spec:
       containers:
         - name: cloudreve
           image: cloudreve/cloudreve:v4
-          imagePullPolicy: Always
           ports:
             - containerPort: 5212
               name: http
@@ -108,8 +107,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: cloudreve-data
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "cloudreve-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cloud/slink.yaml

@@ -99,8 +99,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: slink-data
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "slink-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cronjobs/renovatebot.yaml

@@ -12,7 +12,7 @@ spec:
         spec:
           containers:
             - name: renovate
-              image: renovate/renovate:44.39.3
+              image: renovate/renovate:44.103.7
               args:
                 - ivanch/haven
               env:

apps/default/archivebox.yaml

@@ -129,8 +129,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: archivebox-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "archivebox-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/changedetection.yaml

@@ -120,8 +120,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: changedetection-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "changedetection-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/homepage.yaml

@@ -157,8 +157,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: homepage-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "homepage-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/notepad.yaml

@@ -61,8 +61,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: notepad-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "notepad-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/openwebui.yaml

@@ -74,8 +74,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: openwebui-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "openwebui-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/paperless.yaml

@@ -118,8 +118,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: paperless-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "paperless-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/playwright.yaml

@@ -38,8 +38,7 @@ spec:
           env:
             - name: TZ
               value: America/Sao_Paulo
-          image: mcr.microsoft.com/playwright:v1.62.1-noble
+          image: mcr.microsoft.com/playwright:v1.63.0-noble
-          imagePullPolicy: Always
           name: playwright
           ports:
             - containerPort: 3000

apps/default/searxng.yaml

@@ -63,8 +63,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: searxng-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "searxng-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/stirlingpdf.yaml

@@ -80,8 +80,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: stirlingpdf-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "stirlingpdf-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/uptimekuma.yaml

@@ -20,7 +20,6 @@ spec:
       containers:
         - name: uptimekuma
           image: louislam/uptime-kuma:2
-          imagePullPolicy: Always
           env:
             - name: PUID
               value: "1000"
@@ -76,8 +75,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: uptimekuma-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "uptimekuma-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/vaultwarden.yaml

@@ -17,8 +17,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:latest
+          image: vaultwarden/server:1.37.3
-          imagePullPolicy: Always
           env:
             - name: DOMAIN
               value: "https://vault.haven"
@@ -90,8 +89,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: vaultwarden-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "vaultwarden-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dev/gitea-runner.yaml

@@ -41,8 +41,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-amd64-pvc
   namespace: dev
-  annotations:
-    nfs.io/storage-path: "gitea-runner-amd64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -57,8 +55,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-arm64-pvc
   namespace: dev
-  annotations:
-    nfs.io/storage-path: "gitea-runner-arm64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dns/adguard-sync.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: adguardsync-pvc
   namespace: dns
-  annotations:
-    nfs.io/storage-path: "adguardsync-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -32,8 +30,7 @@ spec:
     spec:
       containers:
         - name: adguardsync
-          image: ghcr.io/bakito/adguardhome-sync:latest
+          image: ghcr.io/bakito/adguardhome-sync:v0.9.3
-          imagePullPolicy: Always
           ports:
             - containerPort: 8080
               protocol: TCP

apps/dns/adguard.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: adguardhome-pvc
   namespace: dns
-  annotations:
-    nfs.io/storage-path: "adguardhome-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -42,8 +40,7 @@ spec:
                       - arm64
       containers:
         - name: adguardhome
-          image: adguard/adguardhome:latest
+          image: adguard/adguardhome:v0.107.79
-          imagePullPolicy: Always
           ports:
             - containerPort: 53
               protocol: TCP

apps/infra/beszel-agent.yaml

@@ -22,8 +22,7 @@ spec:
                 secretKeyRef:
                   name: beszel-key
                   key: SECRET-KEY
-          image: henrygd/beszel-agent:0.19.0
+          image: henrygd/beszel-agent:0.20.0
-          imagePullPolicy: Always
           name: beszel-agent
           ports:
             - containerPort: 45876

apps/infra/beszel.yaml

@@ -26,8 +26,7 @@ spec:
                       - amd64
       containers:
         - name: beszel
-          image: ghcr.io/henrygd/beszel/beszel:0.19.0
+          image: ghcr.io/henrygd/beszel/beszel:0.20.0
-          imagePullPolicy: Always
           ports:
             - containerPort: 8090
               name: beszel-port
@@ -66,8 +65,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: beszel-config
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "beszel-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/infra/bitwarden-cli.yaml

@@ -1,3 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bitwarden-cli-ca
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+data:
+  # Public CA certificate used by the internal-ca ClusterIssuer. Keep this in
+  # sync if the issuer CA is rotated.
+  haven-ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFBzCCAu+gAwIBAgIUGFrjEo+WOxJpMnJqU/RQ881kWI8wDQYJKoZIhvcNAQEL
+    BQAwEzERMA8GA1UEAwwISGF2ZW4gQ0EwHhcNMjUwOTA3MTUxNTE3WhcNMzUwOTA1
+    MTUxNTE3WjATMREwDwYDVQQDDAhIYXZlbiBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+    ggIPADCCAgoCggIBAK+8DxQfCYdRfGnJoEu0CiSuw64lnUFryvzy3GPkfGEEzc3f
+    ZiH6pUUIpQnrbVc1wdq3ojEOveGyLIqWxkljz8gEaMDJwB7udOxfbgv0QFI4cFKs
+    QzB+g3VVf74mYHvqfGB1suxmdVJ8YxcW3rQl7XD94PLxfoZuQ8IKKjskaQnYXUGH
+    wi6YBmIjpxr23lvT5cTbd5YgTFYVXDzM8nWtmnd2Wa9WkNZtKaHQKIeiNEpUPV0+
+    KSHVQC7vdmGmbUZXWpK2jmLFWfYaI0vXUal0CyMv1QidTd5LsDCI4Y+dx4mSBLuu
+    ip5V4Wm1DxttyaKUZM2vhzHEsDSVHz/xqx9nJeoJJuP+OirQVETD3FcN5PNVkWXu
+    EHQAqUciBh1CMJKKT74SE5oTT1/Eni9N2uYlvXsOs3ne6TTjZYxcL6VU+aqyYvvF
+    oMo3DX2a5nZvht4E1BtCd4I/RlnOw5QBAvWbFJqpbo/DTAGo/WBgv7jXCGail+uQ
+    r7iLoKFnhGq0WB9d2UUg6qDRD11I1nZANkv4t3Z2HFbG4XxdpttPm7JjxlcC3gGa
+    AfE3rChmAQPWPLSn6msOcfA+l5OD9SoSYU9nHy81T2q06Kfg/VWDdz7Wvi+WNZ20
+    gcfZPUZQsLlgZeyjmoA27D7ayO5uxjTWCi35kIgKcDDutyHctPRQs5zlTD35AgMB
+    AAGjUzBRMB0GA1UdDgQWBBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAfBgNVHSMEGDAW
+    gBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+    DQEBCwUAA4ICAQAWAqQgFYEH14J2pwKptLb/K2C2oT9XLVnArQ5PKOzyWWhfZXsr
+    3YB707XJ7ju12n5gBgjCK4R66IG/iYNfHdBfhb9M1BVJ3T035RH8d6lhlZbxC02s
+    ZIMrQxDVFRrWm7gxcQiMILfPl2hJmsLf9XIUTBzPWFj9E+wExXrDYdiZXU+a/9qP
+    JvLKZA7T2lSBu+XtccySVLHXoxZ/A/c7Gp8XYJ2srZ2tXGN+j1dXiSMWHD/fpdxs
+    3GDKFnOOz2NTjHhYvBR94sOx3UkA3Pz+ufcHFBWWh23iGOPDDjh0vqAKItz2G0Kb
+    9B99XVnHWHamaZ2tV40x7lVn1mo9ImFVtxW2XDQ/NkRB9PuT2ryGE67Ey/Zfoq5M
+    0gZXIMtuMS25dTB8gQ8PKlXluIf4EbaDXhFk5xFHz5NP0E5Um4SxJP8H30/+UUPd
+    bu/TMcNiiAgxaTLBbE3nw/L7bYfH+5KuTLlp17H0UEtSI1GosgGYooov+Zbj4ZF8
+    Ko108LKAFDGe8/uQVeuo00CrEqXwVRtCCkv+LBcCJDicoyqWbp4GCBp+IVN0nxWX
+    xIRYVtQZCmA3hSH3rwt0/2dBxkcta4YkHZUEZ+EXaFl3z1tcbErOhBvupBvnBuZP
+    Rp2yvEJuuY6M1j+CZrfCm7qMipXTGPQ11Q7hf6jJ0xzxjTkV9TyV1ptPPQ==
+    -----END CERTIFICATE-----
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -19,7 +60,7 @@ spec:
         kubernetes.io/arch: amd64
       containers:
         - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0  # 2026.9.0 requires Vaultwarden's unimplemented user-key-ID backfill API
           imagePullPolicy: IfNotPresent
           # Override the baked entrypoint so --disable-origin-protection is
           # actually passed (it was commented out in the image's entrypoint.sh,
@@ -63,11 +104,14 @@ spec:
               echo 'Running `bw serve` on port 8087'
               bw serve --hostname 0.0.0.0 --disable-origin-protection
           env:
+            # Bitwarden CLI is Node-based and needs the internal issuer CA to
+            # verify the HTTPS certificate for vault.haven.
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/ssl/certs/haven-ca.crt
+            # Use the in-cluster ingress. The public endpoint currently
+            # returns 502 from inside the cluster.
             - name: BW_HOST
-              valueFrom:
+              value: https://vault.haven
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_HOST
             - name: BW_USER
               valueFrom:
                 secretKeyRef:
@@ -78,6 +122,11 @@ spec:
                 secretKeyRef:
                   name: bitwarden-cli
                   key: BW_PASSWORD
+          volumeMounts:
+            - name: haven-ca
+              mountPath: /etc/ssl/certs/haven-ca.crt
+              subPath: haven-ca.crt
+              readOnly: true
           ports:
             - name: http
               containerPort: 8087
@@ -104,6 +153,10 @@ spec:
             requests:
               cpu: 50m
               memory: 128Mi
+      volumes:
+        - name: haven-ca
+          configMap:
+            name: bitwarden-cli-ca
 ---
 apiVersion: v1
 kind: Service

apps/infra/code-config.yaml

@@ -82,8 +82,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: code-config
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "code-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/infra/file-nginx.yaml

@@ -19,6 +19,8 @@ spec:
     metadata:
       labels:
         app: file-nginx
+      annotations:
+        checksum/file-nginx-conf: "4235705a54e5003a340f1a4e164c3e3239fd4327d9aa9ecf0c640a3655def3c9"
     spec:
       containers:
         - name: nginx
@@ -83,11 +85,19 @@ data:
         server_name  _;
 
         root   /usr/share/nginx/data/file-nginx;
-        index  index.html;
 
         autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+
+        location = /index.html {
+            # The legacy static page is now the live directory browser.
+            return 302 /;
+        }
 
         location / {
+            # Bypass the static welcome page so every directory is browsable.
+            index __directory_listing__;
             try_files $uri $uri/ =404;
         }
     }

apps/infra/wg-easy.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: wg-easy-pvc
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "wg-easy-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -20,7 +18,10 @@ metadata:
   namespace: infra
 spec:
   strategy:
-    type: Recreate
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
   replicas: 1
   selector:
     matchLabels:
@@ -38,12 +39,11 @@ spec:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
-                      - nexus
+                      - polaris
               weight: 100
       containers:
         - name: wg-easy
-          image: ghcr.io/wg-easy/wg-easy:latest
+          image: ghcr.io/wg-easy/wg-easy:15.4.0
-          imagePullPolicy: Always
           ports:
             - containerPort: 51820
               protocol: UDP
@@ -54,15 +54,11 @@ spec:
           env:
             - name: LANG
               value: en
-            - name: WG_HOST
-              value: vpn.ivanch.me
             - name: WG_MTU
               value: "1420"
             - name: UI_TRAFFIC_STATS
               value: "true"
-            - name: UI_CHART_TYPE
+            - name: INSECURE
-              value: "0"
-            - name: WG_ENABLE_ONE_TIME_LINKS
               value: "true"
             - name: UI_ENABLE_SORT_CLIENTS
               value: "true"
@@ -78,14 +74,37 @@ spec:
             limits:
               cpu: 2000m
               memory: 1Gi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 51821
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 51821
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 2
           volumeMounts:
             - name: wg-easy-volume
               mountPath: /etc/wireguard
+            - name: kernel-modules
+              mountPath: /lib/modules
+              readOnly: true
       restartPolicy: Always
       volumes:
         - name: wg-easy-volume
           persistentVolumeClaim:
             claimName: wg-easy-pvc
+        - name: kernel-modules
+          hostPath:
+            path: /lib/modules
+            type: Directory
 ---
 apiVersion: v1
 kind: Service
@@ -124,3 +143,14 @@ spec:
                 name: wg-easy-svc
                 port:
                   number: 51821
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: wg-easy-pdb
+  namespace: infra
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: wg-easy

apps/monitoring/grafana.yaml

@@ -64,8 +64,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: grafana-pvc
   namespace: monitoring
-  annotations:
-    nfs.io/storage-path: "grafana-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/monitoring/kube-state-metrics.yaml

@@ -86,7 +86,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
           imagePullPolicy: IfNotPresent
           args:
             - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets

apps/monitoring/loki.yaml

@@ -5,6 +5,8 @@ metadata:
   namespace: monitoring
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: loki
@@ -36,8 +38,9 @@ spec:
           configMap:
             name: loki-config
         - name: loki-storage
-          emptyDir:
+          nfs:
-            medium: Memory
+            server: nexus.haven
+            path: /export/sandbox/loki
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -79,7 +82,12 @@ data:
 
     limits_config:
       allow_structured_metadata: true
-      retention_period: 0
+      retention_period: 72h
+      max_query_lookback: 72h
+      # Global per-tenant cap: <= 0.1 MB/s sustained keeps this sandbox disk bounded.
+      ingestion_rate_strategy: global
+      ingestion_rate_mb: 0.1
+      ingestion_burst_size_mb: 0.5
 
     ingester:
       lifecycler:
@@ -92,7 +100,12 @@ data:
       chunk_target_size: 1536000
 
     compactor:
-      retention_enabled: false
+      working_directory: /tmp/loki/compactor
+      compaction_interval: 10m
+      retention_enabled: true
+      retention_delete_delay: 2h
+      retention_delete_worker_count: 10
+      delete_request_store: filesystem
 ---
 apiVersion: v1
 kind: Service

apps/monitoring/prometheus.yaml

@@ -7,6 +7,8 @@ metadata:
     app: prometheus
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: prometheus
@@ -22,7 +24,9 @@ spec:
           args:
             - "--config.file=/etc/prometheus/prometheus.yml"
             - "--storage.tsdb.path=/prometheus"
-            - "--storage.tsdb.retention.time=1d"
+            - "--storage.tsdb.retention.time=2d"
+            # Keep a generous buffer on the 117 GiB sandbox filesystem; WAL may exceed this briefly.
+            - "--storage.tsdb.retention.size=8GB"
             - "--web.enable-lifecycle"
           ports:
             - containerPort: 9090
@@ -44,16 +48,15 @@ spec:
           persistentVolumeClaim:
             claimName: prometheus-pvc
         - name: prometheus-storage
-          persistentVolumeClaim:
+          nfs:
-            claimName: prometheus-storage-pvc
+            server: nexus.haven
+            path: /export/sandbox/prometheus
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: prometheus-pvc
   namespace: monitoring
-  annotations:
-    nfs.io/storage-path: "prometheus-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

renovate.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "prHourlyLimit": 0,
   "kubernetes": {
     "managerFilePatterns": [
       "/\\.yaml$/"