longhorn: upgrade to 1.12.1

First step from 1.11.2 to 1.13 now that the cluster runs Kubernetes 1.35. The internal NetworkPolicies that 1.12 enables by default stay off: Calico would enforce them, and the instance-manager policy only admits Longhorn pods while the iSCSI initiator connects from the host.

Also lifts the Renovate hold below 1.11.3, which only existed for Kubernetes 1.33.

apps/templates/longhorn-helm.yaml

@@ -20,15 +20,21 @@ spec:
   sources:
     - chart: longhorn
       repoURL: https://charts.longhorn.io/
-      # Stay on 1.11.2 while on Kubernetes 1.33: 1.11.3 and newer need 1.34,
-      # see docs/upgrade-k8s-1.33.md
-      targetRevision: 1.11.2
+      # One minor at a time; each upgrade moves every volume to the new
+      # engine image before the next.
+      targetRevision: 1.12.1
       helm:
         values: |
           persistence:
             defaultClassReplicaCount: 1
           preUpgradeChecker:
             jobEnabled: false
+          # From 1.12 Longhorn adds NetworkPolicies between its components,
+          # and Calico enforces them. The instance-manager one only admits
+          # Longhorn pods, while the iSCSI initiator connects from the host,
+          # so keep them off until that is tested on its own.
+          networkPolicies:
+            restrictInternalTraffic: false
           # Since 1.8 the backup target is a BackupTarget resource instead of
           # the backup-target setting.
           defaultBackupStore:

renovate.json

@@ -46,13 +46,6 @@
     }
   ],
   "packageRules": [
-    {
-      "description": "Longhorn 1.11.3 and newer need Kubernetes 1.34, see docs/upgrade-k8s-1.33.md",
-      "matchPackageNames": [
-        "longhorn"
-      ],
-      "allowedVersions": "<1.11.3"
-    },
     {
       "matchDatasources": [
         "helm"