From 514fcd8dd47bb837b93db6dcda2ed9cb6995d7c3 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Fri, 23 Oct 2026 22:58:29 +0200
Subject: [PATCH] longhorn: upgrade to 1.12.1

First step from 1.11.2 to 1.13 now that the cluster runs Kubernetes 1.35. The internal NetworkPolicies that 1.12 enables by default stay off: Calico would enforce them, and the instance-manager policy only admits Longhorn pods while the iSCSI initiator connects from the host.

Also lifts the Renovate hold below 1.11.3, which only existed for Kubernetes 1.33.
---
 apps/templates/longhorn-helm.yaml | 12 +++++++++---
 renovate.json                     |  7 -------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/apps/templates/longhorn-helm.yaml b/apps/templates/longhorn-helm.yaml
index c434be2..52a2170 100644
--- a/apps/templates/longhorn-helm.yaml
+++ b/apps/templates/longhorn-helm.yaml
@@ -20,15 +20,21 @@ spec:
   sources:
     - chart: longhorn
       repoURL: https://charts.longhorn.io/
-      # Stay on 1.11.2 while on Kubernetes 1.33: 1.11.3 and newer need 1.34,
-      # see docs/upgrade-k8s-1.33.md
-      targetRevision: 1.11.2
+      # One minor at a time; each upgrade moves every volume to the new
+      # engine image before the next.
+      targetRevision: 1.12.1
       helm:
         values: |
           persistence:
             defaultClassReplicaCount: 1
           preUpgradeChecker:
             jobEnabled: false
+          # From 1.12 Longhorn adds NetworkPolicies between its components,
+          # and Calico enforces them. The instance-manager one only admits
+          # Longhorn pods, while the iSCSI initiator connects from the host,
+          # so keep them off until that is tested on its own.
+          networkPolicies:
+            restrictInternalTraffic: false
           # Since 1.8 the backup target is a BackupTarget resource instead of
           # the backup-target setting.
           defaultBackupStore:
diff --git a/renovate.json b/renovate.json
index 823638d..b2ca4ec 100644
--- a/renovate.json
+++ b/renovate.json
@@ -46,13 +46,6 @@
     }
   ],
   "packageRules": [
-    {
-      "description": "Longhorn 1.11.3 and newer need Kubernetes 1.34, see docs/upgrade-k8s-1.33.md",
-      "matchPackageNames": [
-        "longhorn"
-      ],
-      "allowedVersions": "<1.11.3"
-    },
     {
       "matchDatasources": [
         "helm"