feat(helm): update volsync ( 0.11.0 → 0.16.0 )

[parsec-renovate]

This PR contains the following updates:

Package	Update	Change
volsync (source)	minor	0.11.0 → 0.16.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

backube/volsync (volsync)

v0.16.0

Compare Source

Changed

• Restic updated to v0.18.1
• Rclone updated to v1.74.2
• controller-runtime updated to v0.23.2, migrated to events.EventRecorder
• Krew plugin now released for macOS
• Restic supports Azure workload identity env vars
• Dropped unnecessary perl package from container image, replaced with python3
• Removed unused Syncthing insecureAllowOldTLSVersions option

Fixed

• rsync-tls now properly munges/unmunges symlinks during sync
• Rclone getfacl no longer follows symlinks

Security

• rsync-tls enforces TLS 1.3 as minimum version
• rsync-tls Prevent stunnel DH param regeneration on every run
• rsync-tls sets ciphers per OpenShift TLS profile compliance
• Controller metrics endpoint checks central OpenShift TLS profile

v0.15.0

Compare Source

Changed

• moverVolumes updated to allow NFS type volumeMounts
• Rclone updated to v1.73.1
• kube-rbac-proxy container no longer used. Built in auth for metrics
  provided by controller-runtime

Fixed

• Exclude lost+found for Rclone

v0.14.0

Compare Source

Changed

• Updated release to build on golang 1.24
• Syncthing updated to v1.30.0
• Rclone updated to v1.71.2
• Rclone --checksum, --transfers and --stats parameters can now be
  overridden by RCLONE_ env vars in the rclone config secret
• addition of moverVolumes for advanced users to allow mounting
  of secrets or PVCs to their mover pod

v0.13.1

Compare Source

Fixed

• Increase timeout for issue with restic repository initialization
  when restic cat config takes > 10 seconds

Changed

• Minio used for e2e tests migrated to minio helm charts from bitnami

v0.13.0

Compare Source

Changed

• Restic updated to v0.18.0
• Syncthing updated to v1.29.7

Fixed

• Fix restic cache PVC name collision if replicationsource and
  replicationdestination have the same name and are in the same
  namespace

Security

• kube-rbac-proxy upgraded to v0.19.2

v0.12.1

Compare Source

Security

• Update golang.org/x/crypto to v0.36.0 for CVE-2025-22869
• Update golang.org/x/oauth2 to v0.28.0 for CVE-2025-22868

v0.12.0

Compare Source

Changed

• imagePullSecrets in helm charts will be copied from volsync controller
  namespace to the mover namespace so mover jobs can use them
• Updated release to build on golang 1.23
• Syncthing updated to v1.29.2
• kube-rbac-proxy image configurable in helm chart values
• mover scripts updated to use sync -f to only sync the target filesystem at
  the end of mover tasks
• Updates the ensure_initialized function in the restic mover script to
  follow restic recommendations

Fixed

• All movers should return error if not able to EnsurePVCFromSrc
• Fix for mover job/service name length too long (>63 chars) if the
  replicationsource or replicationdestination CR name is too long

Security

• kube-rbac-proxy upgraded to 0.18.2

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

--- kubernetes/apps/storage/volsync/app Kustomization: flux-system/volsync HelmRelease: storage/volsync

+++ kubernetes/apps/storage/volsync/app Kustomization: flux-system/volsync HelmRelease: storage/volsync

@@ -13,13 +13,13 @@

     spec:
       chart: volsync
       sourceRef:
         kind: HelmRepository
         name: backube
         namespace: flux-system
-      version: 0.11.0
+      version: 0.12.0
   dependsOn:
   - name: snapshot-controller
     namespace: storage
   install:
     remediation:
       retries: 3

[github-actions]

--- HelmRelease: storage/volsync Deployment: storage/volsync

+++ HelmRelease: storage/volsync Deployment: storage/volsync

@@ -25,21 +25,24 @@

         app.kubernetes.io/instance: volsync
     spec:
       serviceAccountName: volsync
       securityContext:
         runAsNonRoot: true
         runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: kube-rbac-proxy
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
-        image: quay.io/brancz/kube-rbac-proxy:v0.18.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.18.2
         args:
         - --secure-listen-address=0.0.0.0:8443
         - --upstream=http://127.0.0.1:8080/
         - --logtostderr=true
         - --tls-min-version=VersionTLS12
         - --v=0
@@ -59,20 +62,25 @@

         args:
         - --health-probe-bind-address=:8081
         - --metrics-bind-address=127.0.0.1:8080
         - --leader-elect
         - --rclone-container-image=ghcr.io/onedr0p/volsync:0.11.0
         - --restic-container-image=ghcr.io/onedr0p/volsync:0.11.0
-        - --rsync-container-image=quay.io/backube/volsync:0.11.0
-        - --rsync-tls-container-image=quay.io/backube/volsync:0.11.0
-        - --syncthing-container-image=quay.io/backube/volsync:0.11.0
+        - --rsync-container-image=quay.io/backube/volsync:0.12.0
+        - --rsync-tls-container-image=quay.io/backube/volsync:0.12.0
+        - --syncthing-container-image=quay.io/backube/volsync:0.12.0
         - --scc-name=volsync-privileged-mover
         command:
         - /manager
         image: ghcr.io/onedr0p/volsync:0.11.0
         imagePullPolicy: IfNotPresent
+        env:
+        - name: VOLSYNC_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
         livenessProbe:
           httpGet:
             path: /healthz
             port: 8081
           initialDelaySeconds: 15
           periodSeconds: 20