From c374bb15491c273e0d11a9c6d980dcfb87af69c2 Mon Sep 17 00:00:00 2001
From: Pavel Busko <pavel.busko@sap.com>
Date: Wed, 16 Sep 2026 11:14:24 +0200
Subject: [PATCH 1/2] Use upstream rep instead of a fork

Co-authored-by: Johannes Dillmann <j.dillmann@sap.com>
---
 helmfile.yaml.gotmpl | 38 ++++++++++++++++++++------------------
 versions.yaml        |  4 ----
 2 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/helmfile.yaml.gotmpl b/helmfile.yaml.gotmpl
index 5757d5ce..040af117 100644
--- a/helmfile.yaml.gotmpl
+++ b/helmfile.yaml.gotmpl
@@ -388,31 +388,33 @@ releases:
           enableInternalEmitter: {{ .Values.installOptionalComponents }}
           enableTcpEmitter: {{ .Values.installOptionalComponents }}
 
-  - name: k8s-rep
+  - name: rep
     namespace: {{ .Values.systemNamespace }}
-    chart: {{ .Values.charts.k8sRep.url }}
-    version: {{ .Values.charts.k8sRep.version }}
+    chart: {{ .Values.charts.diego.url }}
+    version: {{ .Values.charts.diego.version }}
     needs:
       - diego
     set:
-      - name: caCertificate
+      - name: rep.caCertificate
         file: {{ .Values.certsDir }}/ca.crt
     values:
-      - stacks:
-        {{- range $stackName, $stackConfig := .Values.stacks }}
-          {{- if kindIs "map" $stackConfig }}
-          {{ $stackName }}: "{{ $stackConfig.image }}:{{ $stackConfig.tag }}"
+      - rep:
+          enabled: true
+          workloadsNamespace: {{ .Values.workloadsNamespace }}
+          containerProxyVerifySubjectAltName:
+            - gorouter
+            - ssh-proxy
+            - cf-tcp-router
+          loggregator:
+            certificateSecret: all-in-one-tls
+          locket:
+            certificateSecret: all-in-one-tls
+          stacks:
+          {{- range $stackName, $stackConfig := .Values.stacks }}
+            {{- if kindIs "map" $stackConfig }}
+            {{ $stackName }}: "{{ $stackConfig.image }}:{{ $stackConfig.tag }}"
+            {{- end }}
           {{- end }}
-        {{- end }}
-        workloadsNamespace: {{ .Values.workloadsNamespace }}
-        containerProxyVerifySubjectAltName:
-          - gorouter
-          - ssh-proxy
-          - cf-tcp-router
-        loggregator:
-          certificateSecret: all-in-one-tls
-        locket:
-          certificateSecret: all-in-one-tls
 
     hooks:
       - events: ["presync"]
diff --git a/versions.yaml b/versions.yaml
index df9e072e..903b8d99 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -23,10 +23,6 @@ charts:
   istiod:
     url: istio/istiod
     version: 1.29.1
-  k8sRep:
-    url: cloudfoundry-k8s/k8s-rep
-    # renovate: dataSource=github-releases depName=cloudfoundry/k8s-garden-client
-    version: 0.7.0
   logCache:
     url: cloudfoundry-k8s/log-cache
     version: 3.2.13

From 076b190f9ba6e7152db3d7f16fa1311b7e105b92 Mon Sep 17 00:00:00 2001
From: Pavel Busko <pavel.busko@sap.com>
Date: Thu, 24 Sep 2026 16:36:23 +0200
Subject: [PATCH 2/2] bump diego

---
 versions.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/versions.yaml b/versions.yaml
index 903b8d99..4c7b3777 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -16,7 +16,7 @@ charts:
     version: 2.15.21
   diego:
     url: cloudfoundry-k8s/diego
-    version: 2.149.0
+    version: 2.151.0
   istioBase:
     url: istio/base
     version: 1.29.1