Update Helm release reloader to v2.2.14

[renovate]

This PR contains the following updates:

Package	Update	Change
reloader	patch	2.2.12 → 2.2.14

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 12am and before 2am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

reloader (helm) 2.2.12 -> 2.2.14

Risk: 🟢 Safe

The Deep Dive

Update Scope

PR #2579 updates the Stakater Reloader Helm dependency from 2.2.12 to 2.2.14 and, because there is no Kustomize image override, rolls the deployed controller image from ghcr.io/stakater/reloader:v1.4.17 to v1.4.19 (rendered Deployment, Kustomization). The applied objects otherwise change only chart/app/version labels: RBAC rules and bindings, selectors, replica count, probes, environment, arguments, security context, and service account remain unchanged (chart comparison).

Performance & Stability

• Safer controller concurrency and shutdown: The v1.4.18 runtime bundled by this chart makes controller-initialization and selected-namespace state concurrency-safe, drains informer/worker queues during shutdown, waits for controller goroutines after leader loss, and replaces several unchecked runtime-object assertions with errors or empty results (upstream E2E/refactor PR). These hardening changes activate automatically with the new image; the leader-election-specific path is inactive here because the rendered controller has no HA flag and remains a single replica (proposed Deployment).
• Expanded automated coverage without a dependency-platform shift: Upstream added broad Ginkgo E2E coverage for workloads, annotation modes, namespace filtering, CSI, Argo Rollouts, and create/delete handling while retaining the existing runtime Kubernetes client versions and published Linux architectures (v1.4.18 release, upstream E2E/refactor PR).

Features & UX

• Pod user namespaces are now chart-configurable: Chart 2.2.13 adds reloader.deployment.hostUsers; setting it explicitly to false opts the Reloader pod into Kubernetes user namespaces (upstream PR). It is not activated by this PR because the local values only override naming and the new default is null, so no hostUsers field is rendered (local values).
• The resource-ignore annotation key can be customized: Chart 2.2.13 adds reloader.custom_annotations.ignore, which supplies --ignore-annotation when an operator chooses a non-default key (upstream PR). The local values leave custom_annotations unset, so existing reloader.stakater.com/ignore behavior remains automatic and unchanged (local values).

Security

• Three Go runtime vulnerabilities are removed: The image moves from Go 1.26.3 to 1.26.4, fixing CVE-2026-42504 (CVSS 7.5, MIME-header CPU denial of service), CVE-2026-42507 (CVSS 5.3, net/textproto error-content injection), and CVE-2026-27145 (CVSS 6.5, X.509 hostname-verification CPU denial of service). Upstream explicitly closed its image-scan report as fixed in v1.4.19 (Reloader issue); binary-mode vulnerability checks found the affected symbols in v1.4.17 and no longer reported them in v1.4.19.
• A vulnerable test/build module is not shipped: The v1.4.19 source graph lists github.com/moby/spdystream v0.5.0, affected by CVE-2026-35469 (CVSS 8.7), through the added E2E tooling, but it is absent from the produced manager binary and Reloader does not accept SPDY connections; therefore this PR does not introduce that runtime exposure (upstream security update PR, v1.4.19 Dockerfile).
• Later advisories are pre-existing context: Both current and proposed images remain on toolchain/library versions affected by CVE-2026-39822 and CVE-2026-42505, and no Reloader release newer than v1.4.19 currently packages the later Go fixes (release list). Because these affect both sides of the update, they do not make this PR riskier.

Key Fixes

• ignoreConfigMaps now actually stops the ConfigMap controller: The chart emits canonical lowercase --resources-to-ignore=configmaps and the app normalizes casing, fixing a regression that otherwise started a ConfigMap watcher without matching RBAC and produced forbidden errors (upstream fix). This deployment does not set ignoreConfigMaps and the rendered arguments remain only --log-level=info, so the fix is available but does not alter its active watch behavior (proposed Deployment).
• Ignored namespaces are reported accurately at startup: When --namespaces-to-ignore is used in global mode, the startup message now names the excluded namespaces instead of claiming every namespace is watched (upstream fix). This deployment passes no ignored-namespace argument, so its effective namespace scope and startup message are unchanged (proposed Deployment).

Hazards & Risks

None identified. The patch introduces no migration, default activation, API/annotation compatibility break, permission expansion, selector replacement, or known candidate-specific regression (chart comparison, applied Kustomization). Post-release reports about namespace-selector rendering and invalid-regex annotations also reproduce in v1.4.17/2.2.12, so they are pre-existing rather than caused by this update (namespace-selector issue, regex fix PR).

Sources

• Reloader chart 2.2.13 release
• Reloader chart 2.2.14 release
• Reloader chart 2.2.12 to 2.2.14 comparison
• Reloader v1.4.18 release
• Reloader v1.4.19 release
• Reloader Go runtime CVE report
• Infra PR 2579

---

🟢 Verdict: Safe

renovate:safe: this is a routine chart/controller patch for the deployed configuration—optional features stay disabled, applied permissions and controller flags do not change, no candidate-specific regression was found, and v1.4.19 removes three Go runtime vulnerabilities (upstream security confirmation).