[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/charts/kopiur	minor	0.7.4 → 0.8.0

---

Release Notes

home-operations/kopiur (ghcr.io/home-operations/charts/kopiur)

v0.8.0

Compare Source

⚠ BREAKING CHANGES

• SnapshotPolicy deletion cascade + auto-adoption of discovered snapshots (#​272)

Features

• deps: update rust crate tokio (1.52.4 → 1.53.0) (#​264) (6cab0c6)
• mass-deletion protection (cascade guard, per-repo breaker, batched deletes) (#​265) (038ea6d)
• SnapshotPolicy deletion cascade + auto-adoption of discovered snapshots (#​272) (9da8c26)

Bug Fixes

• deps: update rust crate anyhow (1.0.103 → 1.0.104) (#​269) (4d81496)
• deps: update rust crate clap (4.6.1 → 4.6.2) (#​257) (c238df1)
• deps: update rust crate futures (0.3.32 → 0.3.33) (#​268) (926b52d)
• deps: update rust crate serde (1.0.228 → 1.0.229) (#​270) (5fbd713)
• deps: update rust crate thiserror (2.0.18 → 2.0.19) (#​271) (d83730f)
• deps: update rust crate tokio (1.52.3 → 1.52.4) (#​261) (accf6ae)
• writable backup source (#​254), stuck deletion finalizer (#​255), kopia epoch parameters (#​258) (#​263) (94f9a15)

Miscellaneous Chores

• krew: kopiur 0.7.5 manifest (16d7390)
• mise: Update tool aqua:astral-sh/uv (0.11.28 → 0.11.29) (#​256) (f822335)
• mise: Update tool cosign (3.1.1 → 3.1.2) (#​267) (649ba2e)

v0.7.5

Compare Source

Bug Fixes

• readme: update readme admonition (987957c)
• secctx: SecurityContextCompatible is verified, not asserted; inherit merges with explicit (#​259) (cbfd97d)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[peanut-o-clock]

konflate — summary

Note

+0 added · 11 changed · −0 removed — 11 resources · 2 apps · 8 CRDs

Blast radius

• Kustomization kopiur-system/kopiur — 18 dependents (Kustomization kopiur-system/kopiur-repository +17 more)

Image changes

image	from	to
ghcr.io/home-operations/kopiur-controller	sha256:4dc4caf26f08…	sha256:fd86628fb049…
ghcr.io/home-operations/kopiur-mover	sha256:8a2a396c37f2…	sha256:22e902bc10cb…
ghcr.io/home-operations/kopiur-webhook	sha256:e9f70f8a7328…	sha256:3b323ef6cb41…

View the full rendered diff →

_{konflate · rendered 7f1a50a · advisory, not a gate}

[dsluo]

@claude impact?

[claude]

Claude finished @dsluo's task in 1m 49s —— View job

---

Renovate review: kopiur 0.7.4 → 0.8.0

• Gather context (PR diff, changelog, konflate rendered diff)
• Analyze breaking change: SnapshotPolicy deletion cascade + auto-adoption of discovered snapshots (fix(github-release): update uv ( 0.7.21 → 0.7.22 ) - autoclosed #272)
• Check repo's kopiur config for exposure
• Post impact summary

Verdict: ⚠ review required — not because of the change itself, but because of blast radius

Update type: minor (container/OCI chart)

Why this isn't "just a patch bump"

This repo doesn't consume kopiur through one HelmRelease — every backed-up app wires into it via the shared kubernetes/components/kopiur/ Kustomize component (snapshotpolicy.yaml, restore.yaml, snapshotschedule.yaml, pvc.yaml). Grepping for components/kopiur usage turns up 16 apps currently importing it (social/continuwuity, observability/victoria, observability/grafana, media/{sonarr,seerr,sabnzbd,recyclarr,radarr,qbittorrent,jellyfin,bazarr}, maker/orcaslicer, finance/actual, documents/paperless, ai/memini, ai-sandbox/openclaw), all pointed at the single ClusterRepository/homelab (NFS at storage.lan, kubernetes/apps/kopiur-system/kopiur/repository/clusterrepository.yaml:26). This lines up with konflate's own blast-radius note above (18 dependents on the kopiur Kustomization). Single-node cluster, no HA fallback if backups misbehave.

Breaking change

• SnapshotPolicy deletion cascade + auto-adoption of discovered snapshots (home-operations/kopiur#272) — flagged ⚠ BREAKING CHANGES in the 0.8.0 changelog. This touches the exact CRD every one of the 16 apps above relies on (kubernetes/components/kopiur/snapshotpolicy.yaml:1-36, retention: keepLatest: 3, keepHourly: 24, keepDaily: 7, keepWeekly: 4).
  • I was not able to fetch the upstream commit/PR diff to confirm exact semantics in this run (outbound gh/WebFetch/GitHub MCP calls weren't authorized in this session) — so I can't give a line-level "here's exactly what changed" citation. Treat the summary below as changelog-text-level, not verified against the diff.
  • From the changelog wording: deleting a SnapshotPolicy now appears to cascade (previously-orphaned resources it manages get cleaned up together), and previously-unmanaged/pre-existing VolumeSnapshots get auto-adopted into policy management on discovery. Practically: after this upgrade, deleting or recreating a SnapshotPolicy (e.g. via just newapp churn, app removal, or a rename) could now clean up snapshot data as a side effect in a way 0.7.x didn't, and any snapshots kopiur discovers that it didn't create itself could get pulled under its retention/deletion rules.
  • No current app config in this repo sets any explicit toggle for this behavior — it'll take whatever the new default is.

Mitigating factor

• Mass-deletion protection (cascade guard, per-repo breaker, batched deletes) (#265) landed in the same 0.8.0 release — this is explicitly a safety net against exactly the "cascade wipes out more than intended" scenario. Its presence alongside fix(github-release): update uv ( 0.7.21 → 0.7.22 ) - autoclosed #272 suggests the maintainers built the cascade change with a guard for it, not as an unguarded default.

Recommended actions

• Given the 16-app blast radius and single-node/no-HA setup, don't rely on this analysis alone — before merging, skim the actual kopiur 0.8.0 release PR(s) for fix(github-release): update uv ( 0.7.21 → 0.7.22 ) - autoclosed #272/fix(helm): update rook-ceph-cluster ( v1.17.5 → v1.17.6 ) #265 directly on GitHub to confirm: (a) whether cascade-delete is on by default or opt-in, and (b) whether "auto-adoption" could pull in snapshots you don't want kopiur managing.
• After merging, watch controller logs / SnapshotPolicy status conditions for the first reconcile cycle across a few apps, and confirm no unexpected VolumeSnapshot deletions occur.
• Not a reason to block indefinitely — just don't auto-merge this one; a quick manual read of the upstream PR is warranted given what's at stake (backup data) before clicking merge.