[mortyops]

This PR contains the following updates:

Package	Update	Change	Pending
ghcr.io/siderolabs/kubelet	patch	v1.36.5 → v1.36.6	v1.37.2 (+2)
registry.k8s.io/kube-apiserver	patch	v1.36.5 → v1.36.6	v1.37.2 (+2)
registry.k8s.io/kube-controller-manager	patch	v1.36.5 → v1.36.6	v1.37.2 (+2)
registry.k8s.io/kube-proxy	patch	v1.36.5 → v1.36.6	v1.37.2 (+2)
registry.k8s.io/kube-scheduler	patch	v1.36.5 → v1.36.6	v1.37.2 (+2)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

siderolabs/kubelet (ghcr.io/siderolabs/kubelet)

v1.36.6

Compare Source

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a routine patch bump of the Kubernetes control-plane group from v1.36.5 to v1.36.6 across two files. The change is a single-version bump in scope for its constraint, with no structural edits.

Change-by-Change Findings

kubernetes/apps/base/system-upgrade/tuppr/upgrades/kubernetesupgrade.yaml

• version: v1.36.5 → v1.36.6 — the Tuppr KubernetesUpgrade CR's target version is updated. This is the single source of truth for the tuppr operator's TalosUpgrade CR; the operator will apply a rebootMode: powercycle upgrade to all Talos nodes once the cluster is ready.
• The healthChecks: block (targeting a ReplicationSource VolSync resource) is unchanged and correctly targets a rendered workload, not the HelmRelease.

talos/machineconfig.yaml.j2

• Six image tags updated from :v1.36.5 to :v1.36.6 (kubelet, kube-apiserver, kube-controller-manager, kube-proxy, kube-scheduler). These are the six version pins in the Talos machine config that tuppr drives.
• No other fields in the Talos template are touched — no kernel args, no extensions, no allowedVersions pin changes.

Standards Compliance

• Renovate group bump: The PR title fix(container): update kubernetes group matches the repo's commit convention (type(scope): description). The group is kubernetes (control-plane + kubelet), and all six images are bumped together — consistent with the renovate/kubernetes branch pattern seen in prior PRs (PR 1790).
• No plaintext secrets: No secrets are introduced. The ref+op://Home-Lab/talos/CLUSTER_SERVICEACCOUNT_KEY reference in the Talos template is pre-existing.
• No postRenderer with bash: Not applicable — this is a Talos machine config, not a HelmRelease.
• No talos/clusterconfig/ or talos/talconfig.yaml: The changed file is talos/machineconfig.yaml.j2, which is a Jinja2 template applied via just talos apply-node, not Flux. The PR body does not claim automatic deployment.
• No allowDefaultDeny CCNP issues: Not applicable — no networking manifests changed.
• No security.cephx.csi or rgw_sigv4_insecure changes: Not applicable — no Ceph manifests touched.

Unknowns / Needs Verification

• The siderolabs/kubelet compare metadata could not be fetched (no enrichment). The release notes in the PR body are empty for kubelet. This is a minor gap — the bump is a patch (5→6) within the same minor (1.36), which is low-risk. No action needed.
• The tuppr operator's TalosUpgrade CR will apply a powercycle reboot to all three Talos nodes. The repo's convention is to reboot nodes one at a time with HEALTH_OK between them. This PR does not change that workflow — it only updates the target version. The operator's rebootMode: powercycle is a separate concern from the version pin.

Required Checks

No must_check items were provided in the PR classification. The pr_kind is app_code with no risk flags, so no mandatory review questions were triggered.

Verdict

Approve. A clean, in-scope patch bump with no structural changes, no secrets, and no deviation from repository conventions.

[mortyops]

--- KubernetesUpgrade system-upgrade/kubernetes
+++ KubernetesUpgrade system-upgrade/kubernetes
@@ -16,5 +16,5 @@
     expr: status.ceph.health in ['HEALTH_OK']
     kind: CephCluster
   kubernetes:
-    version: v1.36.5
+    version: v1.36.6