chore(deps): update helm release metallb to v6

[renovate]

This PR contains the following updates:

Package	Update	Change
metallb (source)	major	3.0.9 -> 6.0.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

--- . Kustomization: flux-system/flux-system HelmRelease: kube-system/metallb

+++ . Kustomization: flux-system/flux-system HelmRelease: kube-system/metallb

@@ -6,13 +6,13 @@

   namespace: kube-system
 spec:
   interval: 1h
   chart:
     spec:
       chart: metallb
-      version: 3.0.9
+      version: 6.0.1
       sourceRef:
         kind: HelmRepository
         name: metallb
         namespace: kube-system
       interval: 1h
   values:

[github-actions]

--- . HelmRelease: kube-system/metallb Service: kube-system/metallb-webhook-service

+++ . HelmRelease: kube-system/metallb Service: kube-system/metallb-webhook-service

@@ -0,0 +1,19 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: metallb-webhook-service
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+spec:
+  ports:
+  - port: 443
+    targetPort: 9443
+  selector:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: controller
+
--- . HelmRelease: kube-system/metallb ServiceAccount: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb ServiceAccount: kube-system/metallb-controller

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: metallb-controller
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: controller
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 
--- . HelmRelease: kube-system/metallb ValidatingWebhookConfiguration: kube-system/metallb-webhook-configuration

+++ . HelmRelease: kube-system/metallb ValidatingWebhookConfiguration: kube-system/metallb-webhook-configuration

@@ -0,0 +1,150 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: metallb-webhook-configuration
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta1-addresspool
+  failurePolicy: Fail
+  name: addresspoolvalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - addresspools
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta2-bgppeer
+  failurePolicy: Fail
+  name: bgppeervalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - bgppeers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta1-ipaddresspool
+  failurePolicy: Fail
+  name: ipaddresspoolvalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - ipaddresspools
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta1-bgpadvertisement
+  failurePolicy: Fail
+  name: bgpadvertisementvalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - bgpadvertisements
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta1-community
+  failurePolicy: Fail
+  name: communityvalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - communities
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta1-bfdprofile
+  failurePolicy: Fail
+  name: bfdprofileyvalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - DELETE
+    resources:
+    - bfdprofiles
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: metallb-webhook-service
+      namespace: kube-system
+      path: /validate-metallb-io-v1beta1-l2advertisement
+  failurePolicy: Fail
+  name: l2advertisementvalidationwebhook.metallb.io
+  rules:
+  - apiGroups:
+    - metallb.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - l2advertisements
+  sideEffects: None
+
--- . HelmRelease: kube-system/metallb RoleBinding: kube-system/metallb-config-watcher

+++ . HelmRelease: kube-system/metallb RoleBinding: kube-system/metallb-config-watcher

@@ -2,15 +2,15 @@

 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: metallb-config-watcher
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
 subjects:
 - kind: ServiceAccount
   name: metallb-controller
 - kind: ServiceAccount
   name: metallb-speaker
 roleRef:
--- . HelmRelease: kube-system/metallb RoleBinding: kube-system/metallb-pod-lister

+++ . HelmRelease: kube-system/metallb RoleBinding: kube-system/metallb-pod-lister

@@ -2,15 +2,15 @@

 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: metallb-pod-lister
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: speaker
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: metallb-pod-lister
 subjects:
--- . HelmRelease: kube-system/metallb Role: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb Role: kube-system/metallb-controller

@@ -0,0 +1,95 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: metallb-controller
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: controller
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  resourceNames:
+  - metallb-memberlist
+  verbs:
+  - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  resourceNames:
+  - metallb-controller
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - ipaddresspools
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - bgppeers
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - metallb.io
+  resources:
+  - bgpadvertisements
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - metallb.io
+  resources:
+  - l2advertisements
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - metallb.io
+  resources:
+  - communities
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - bfdprofiles
+  verbs:
+  - get
+  - list
+  - watch
+
--- . HelmRelease: kube-system/metallb ClusterRole: kube-system/metallb-speaker

+++ . HelmRelease: kube-system/metallb ClusterRole: kube-system/metallb-speaker

@@ -1,38 +1,38 @@

 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: metallb-speaker
-  namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: speaker
 rules:
 - apiGroups:
   - ''
   resources:
   - services
   - endpoints
   - nodes
+  - namespaces
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
   resources:
   - events
   verbs:
   - create
   - patch
 - apiGroups:
-  - policy
-  resourceNames:
-  - metallb-speaker
+  - discovery.k8s.io
   resources:
-  - podsecuritypolicies
+  - endpointslices
   verbs:
-  - use
+  - get
+  - list
+  - watch
 
--- . HelmRelease: kube-system/metallb ClusterRole: kube-system/metallb:controller

+++ . HelmRelease: kube-system/metallb ClusterRole: kube-system/metallb:controller

@@ -0,0 +1,74 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metallb:controller
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: controller
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - services
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ''
+  resources:
+  - nodes
+  verbs:
+  - list
+- apiGroups:
+  - ''
+  resources:
+  - services/status
+  verbs:
+  - update
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - ''
+  resources:
+  - namespaces
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  - mutatingwebhookconfigurations
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+
--- . HelmRelease: kube-system/metallb Deployment: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb Deployment: kube-system/metallb-controller

@@ -2,74 +2,93 @@

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: metallb-controller
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: controller
 spec:
   replicas: 1
   strategy:
     type: RollingUpdate
   revisionHistoryLimit: 3
   selector:
     matchLabels:
+      app.kubernetes.io/instance: metallb
       app.kubernetes.io/name: metallb
-      app.kubernetes.io/instance: metallb
       app.kubernetes.io/component: controller
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: metallb
         app.kubernetes.io/instance: metallb
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: metallb
         app.kubernetes.io/component: controller
     spec:
+      automountServiceAccountToken: true
       serviceAccountName: metallb-controller
       nodeSelector:
         kubernetes.io/os: linux
       affinity:
         podAffinity: null
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - podAffinityTerm:
               labelSelector:
                 matchLabels:
+                  app.kubernetes.io/instance: metallb
                   app.kubernetes.io/name: metallb
-                  app.kubernetes.io/instance: metallb
                   app.kubernetes.io/component: controller
-              namespaces:
-              - kube-system
               topologyKey: kubernetes.io/hostname
             weight: 1
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
       - name: metallb-controller
-        image: docker.io/bitnami/metallb-controller:0.12.1-debian-11-r3
+        image: docker.io/bitnami/metallb-controller:0.14.5-debian-12-r1
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
+          seLinuxOptions: null
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - --port=7472
-        - --config=metallb-config
-        env: null
+        - --cert-service-name=metallb-webhook-service
+        - --log-level=info
+        - --webhook-mode=enabled
+        env:
+        - name: METALLB_ML_SECRET_NAME
+          value: metallb-memberlist
+        - name: METALLB_DEPLOYMENT
+          value: metallb-controller
         envFrom: null
         ports:
         - name: metrics
           containerPort: 7472
+        - name: webhook-server
+          containerPort: 9443
+          protocol: TCP
+        volumeMounts:
+        - name: cert
+          mountPath: /tmp/k8s-webhook-server/serving-certs
+          readOnly: true
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 10
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 1
@@ -83,9 +102,20 @@

           successThreshold: 1
           timeoutSeconds: 1
           httpGet:
             path: /metrics
             port: metrics
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
+      volumes:
+      - name: cert
+        secret:
+          defaultMode: 420
+          secretName: metallb-webhook-cert
 
--- . HelmRelease: kube-system/metallb NetworkPolicy: kube-system/metallb-speaker

+++ . HelmRelease: kube-system/metallb NetworkPolicy: kube-system/metallb-speaker

@@ -0,0 +1,29 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: metallb-speaker
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: speaker
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: metallb
+      app.kubernetes.io/name: metallb
+      app.kubernetes.io/component: speaker
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 7472
+      protocol: TCP
+    - port: 9443
+      protocol: TCP
+
--- . HelmRelease: kube-system/metallb ClusterRole: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb ClusterRole: kube-system/metallb-controller

@@ -1,43 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: metallb-controller
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/name: metallb
-    app.kubernetes.io/instance: metallb
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - services
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-- apiGroups:
-  - ''
-  resources:
-  - services/status
-  verbs:
-  - update
-- apiGroups:
-  - ''
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
-- apiGroups:
-  - policy
-  resourceNames:
-  - metallb-controller
-  resources:
-  - podsecuritypolicies
-  verbs:
-  - use
-
--- . HelmRelease: kube-system/metallb RoleBinding: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb RoleBinding: kube-system/metallb-controller

@@ -0,0 +1,20 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metallb-controller
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: controller
+subjects:
+- kind: ServiceAccount
+  name: metallb-controller
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: metallb-controller
+
--- . HelmRelease: kube-system/metallb ClusterRoleBinding: kube-system/metallb-speaker

+++ . HelmRelease: kube-system/metallb ClusterRoleBinding: kube-system/metallb-speaker

@@ -1,16 +1,15 @@

 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: metallb-speaker
-  namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: speaker
 subjects:
 - kind: ServiceAccount
   name: metallb-speaker
   namespace: kube-system
 roleRef:
--- . HelmRelease: kube-system/metallb ClusterRoleBinding: kube-system/metallb:controller

+++ . HelmRelease: kube-system/metallb ClusterRoleBinding: kube-system/metallb:controller

@@ -0,0 +1,19 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metallb:controller
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: controller
+subjects:
+- kind: ServiceAccount
+  name: metallb-controller
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: metallb:controller
+
--- . HelmRelease: kube-system/metallb NetworkPolicy: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb NetworkPolicy: kube-system/metallb-controller

@@ -0,0 +1,29 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: metallb-controller
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/instance: metallb
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
+    app.kubernetes.io/component: controller
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: metallb
+      app.kubernetes.io/name: metallb
+      app.kubernetes.io/component: controller
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 7472
+      protocol: TCP
+    - port: 9443
+      protocol: TCP
+
--- . HelmRelease: kube-system/metallb ServiceAccount: kube-system/metallb-speaker

+++ . HelmRelease: kube-system/metallb ServiceAccount: kube-system/metallb-speaker

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: metallb-speaker
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: speaker
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 
--- . HelmRelease: kube-system/metallb Role: kube-system/metallb-config-watcher

+++ . HelmRelease: kube-system/metallb Role: kube-system/metallb-config-watcher

@@ -2,15 +2,15 @@

 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: metallb-config-watcher
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
 rules:
 - apiGroups:
   - ''
   resources:
   - configmaps
   verbs:
--- . HelmRelease: kube-system/metallb Role: kube-system/metallb-pod-lister

+++ . HelmRelease: kube-system/metallb Role: kube-system/metallb-pod-lister

@@ -2,18 +2,82 @@

 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: metallb-pod-lister
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: speaker
 rules:
 - apiGroups:
   - ''
   resources:
   - pods
   verbs:
   - list
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - addresspools
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - bfdprofiles
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - bgppeers
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - l2advertisements
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - bgpadvertisements
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - ipaddresspools
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - metallb.io
+  resources:
+  - communities
+  verbs:
+  - get
+  - list
+  - watch
 
--- . HelmRelease: kube-system/metallb ClusterRoleBinding: kube-system/metallb-controller

+++ . HelmRelease: kube-system/metallb ClusterRoleBinding: kube-system/metallb-controller

@@ -1,20 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: metallb-controller
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/name: metallb
-    app.kubernetes.io/instance: metallb
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-subjects:
-- kind: ServiceAccount
-  name: metallb-controller
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: metallb-controller
-
--- . HelmRelease: kube-system/metallb DaemonSet: kube-system/metallb-speaker

+++ . HelmRelease: kube-system/metallb DaemonSet: kube-system/metallb-speaker

@@ -2,72 +2,78 @@

 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: metallb-speaker
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
     app.kubernetes.io/component: speaker
 spec:
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: metallb
       app.kubernetes.io/name: metallb
-      app.kubernetes.io/instance: metallb
       app.kubernetes.io/component: speaker
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: metallb
         app.kubernetes.io/instance: metallb
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: metallb
         app.kubernetes.io/component: speaker
     spec:
+      automountServiceAccountToken: true
       serviceAccountName: metallb-speaker
       affinity:
         podAffinity: null
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - podAffinityTerm:
               labelSelector:
                 matchLabels:
+                  app.kubernetes.io/instance: metallb
                   app.kubernetes.io/name: metallb
-                  app.kubernetes.io/instance: metallb
                   app.kubernetes.io/component: speaker
-              namespaces:
-              - kube-system
               topologyKey: kubernetes.io/hostname
             weight: 1
         nodeAffinity: null
       nodeSelector:
         kubernetes.io/os: linux
       hostNetwork: true
       securityContext:
         fsGroup: 0
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       terminationGracePeriodSeconds: 2
       containers:
       - name: metallb-speaker
-        image: docker.io/bitnami/metallb-speaker:0.12.1-debian-11-r3
+        image: docker.io/bitnami/metallb-speaker:0.14.5-debian-12-r1
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             add:
             - NET_ADMIN
             - NET_RAW
             - SYS_ADMIN
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsGroup: 0
           runAsUser: 0
+          seLinuxOptions: null
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - --port=7472
-        - --config=metallb-config
+        - --log-level=info
         env:
         - name: METALLB_NODE_NAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: METALLB_HOST
@@ -81,17 +87,14 @@

         - name: METALLB_ML_LABELS
           value: app.kubernetes.io/name=metallb,app.kubernetes.io/instance=metallb,app.kubernetes.io/component=speaker
         - name: METALLB_ML_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        - name: METALLB_ML_SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              name: metallb-memberlist
-              key: secretkey
+        - name: METALLB_ML_SECRET_KEY_PATH
+          value: /etc/memberlist
         envFrom: null
         ports:
         - name: metrics
           containerPort: 7472
         livenessProbe:
           failureThreshold: 3
@@ -109,9 +112,27 @@

           successThreshold: 1
           timeoutSeconds: 1
           httpGet:
             path: /metrics
             port: metrics
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
+        volumeMounts:
+        - name: memberlist-secret
+          mountPath: /etc/memberlist
+          readOnly: true
+      volumes:
+      - name: memberlist-secret
+        secret:
+          secretName: metallb-memberlist
+          defaultMode: 292
+          items:
+          - key: secretkey
+            path: secretkey
 
--- . HelmRelease: kube-system/metallb ConfigMap: kube-system/metallb-config

+++ . HelmRelease: kube-system/metallb ConfigMap: kube-system/metallb-config

@@ -2,15 +2,15 @@

 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: metallb-config
   namespace: kube-system
   labels:
-    app.kubernetes.io/name: metallb
     app.kubernetes.io/instance: metallb
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: metallb
 data:
   config: |
     address-pools:
     - name: default
       protocol: layer2
       addresses: