From b19c776728a26b22e0e34615fbb84cf2731998d0 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Fri, 23 Oct 2026 23:06:08 +0200
Subject: [PATCH] longhorn: upgrade to 1.13.0

1.13 needs Kubernetes 1.34 or later. It adds a longhorn-global-manager Deployment, set to one replica on this single node, and by default lets the CSI controller read every Secret for provisioner-secret StorageClass parameters; neither StorageClass uses those, so that grant stays off.
---
 apps/templates/longhorn-helm.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/apps/templates/longhorn-helm.yaml b/apps/templates/longhorn-helm.yaml
index 52a2170..73110a3 100644
--- a/apps/templates/longhorn-helm.yaml
+++ b/apps/templates/longhorn-helm.yaml
@@ -22,7 +22,7 @@ spec:
       repoURL: https://charts.longhorn.io/
       # One minor at a time; each upgrade moves every volume to the new
       # engine image before the next.
-      targetRevision: 1.12.1
+      targetRevision: 1.13.0
       helm:
         values: |
           persistence:
@@ -35,6 +35,14 @@ spec:
           # so keep them off until that is tested on its own.
           networkPolicies:
             restrictInternalTraffic: false
+          # From 1.13 the CSI controller may read every Secret in the cluster,
+          # for provisioner-secret StorageClass parameters. Neither
+          # StorageClass here uses those.
+          csi:
+            allowControllerSecretAccess: false
+          # New in 1.13, three replicas by default; this cluster has one node.
+          longhornGlobalManager:
+            replicas: 1
           # Since 1.8 the backup target is a BackupTarget resource instead of
           # the backup-target setting.
           defaultBackupStore: