From d9ff973a55b463a24162105c820066854f4e92fd Mon Sep 17 00:00:00 2001 From: Joseph Hanson Date: Wed, 4 Sep 2024 13:35:14 -0500 Subject: [PATCH] moving to the shire Expanding from 1 node to 6 + 2 VMs with GPUs --- .ansible-lint | 9 - .archive/.taskfiles/Ansible/Taskfile.yaml | 52 - .archive/.taskfiles/rook/Taskfile.yaml | 104 - .../.taskfiles/rook/WipeDiskJob.tmpl.yaml | 26 - .../.taskfiles/rook/WipeRookDataJob.tmpl.yaml | 29 - .archive/.taskfiles/rook/pod.yaml | 19 - .../default/jellyfin/app/helmrelease.yaml | 116 -- .../default/jellyfin/app/kustomization.yaml | 8 - .archive/kubernetes/default/jellyfin/ks.yaml | 23 - .../home-assistant/app/externalsecret.yaml | 26 - .../home-assistant/app/helmrelease.yaml | 90 - .../home-assistant/app/kustomization.yaml | 8 - .../home-automation/home-assistant/ks.yaml | 29 - .../home-automation/kustomization.yaml | 9 - .../matter-server/app/helmrelease.yaml | 107 -- .../matter-server/app/kustomization.yaml | 7 - .../home-automation/matter-server/ks.yaml | 28 - .../mosquitto/app/config/mosquitto.conf | 9 - .../mosquitto/app/externalsecret.yaml | 27 - .../mosquitto/app/helmrelease.yaml | 105 - .../mosquitto/app/kustomization.yaml | 14 - .../home-automation/mosquitto/ks.yaml | 28 - .../kubernetes/home-automation/namespace.yaml | 8 - .../kube-system/cilium/app/bgpcrd.yaml | 588 ------ .../cilium/app/bgppeeringpolicy.yaml | 36 - .../kube-system/cilium/app/helmrelease.yaml | 78 - .../cilium/app/netpols/allow-ssh.yaml | 23 - .../cilium/app/netpols/apiserver.yaml | 27 - .../cilium/app/netpols/cilium-health.yaml | 41 - .../cilium/app/netpols/cilium-vxlan.yaml | 26 - .../cilium/app/netpols/core-dns.yaml | 65 - .../kube-system/cilium/app/netpols/etcd.yaml | 27 - .../cilium/app/netpols/fix-apiserver.yml | 15 - .../cilium/app/netpols/hubble-relay.yaml | 50 - .../cilium/app/netpols/hubble-ui.yaml | 75 - .../cilium/app/netpols/kubelet.yaml | 28 - .../cilium/app/netpols/kustomization.yaml | 16 - .../kubernetes/kube-system/cilium/ks.yaml | 17 - .../spegel/app/resources/values.yml | 17 - .../zfs-scrub/app/helmrelease.yaml | 109 -- .../zfs-scrub/app/kustomization.yaml | 12 - .../zfs-scrub/app/resources/zfs-scrub.sh | 20 - .../kubernetes/kube-system/zfs-scrub/ks.yaml | 21 - .../media/immich/app/configmap.yaml | 16 - .../media/immich/app/externalsecret.yaml | 19 - .../kubernetes/media/immich/app/gatus.yaml | 21 - .../media/immich/app/helmrelease.yaml | 97 - .../media/immich/app/kustomization.yaml | 27 - .../app/machine-learning/helmrelease.yaml | 82 - .../app/machine-learning/kustomization.yaml | 11 - .../immich/app/microservices/helmrelease.yaml | 80 - .../app/microservices/kustomization.yaml | 11 - .../media/immich/app/postgresCluster.yaml | 94 - .../media/immich/app/pushsecret.yaml | 40 - .../media/immich/app/resources/init.sql | 4 - .../kubernetes/media/immich/app/service.yaml | 20 - .archive/kubernetes/media/immich/ks.yaml | 30 - .archive/kubernetes/media/kustomization.yaml | 9 - .archive/kubernetes/media/namespace.yaml | 9 - .../app/helmrelease.yaml | 58 - .../alertmanager-silencer/ks.yaml | 21 - .../grafana/app/externalsecret.yaml | 61 - .../grafana/app/helmrelease.yaml | 401 ---- .../grafana/app/kustomization.yaml | 7 - .../kubernetes/observability/grafana/ks.yaml | 29 - .../app/externalsecret.yaml | 22 - .../app/helmrelease.yaml | 190 -- .../app/kustomization.yaml | 16 - .../app/podmonitors/crunchy-postgres.yaml | 34 - .../app/podmonitors/dragonflydb.yaml | 19 - .../app/podmonitors/kustomization.yaml | 7 - .../app/prometheusrules/kustomization.yaml | 6 - .../app/prometheusrules/prometheusrule.yaml | 37 - .../app/resources/alertmanager.yaml | 68 - .../app/scrapeconfigs/kustomization.yaml | 7 - .../app/scrapeconfigs/node-exporter.yaml | 11 - .../app/scrapeconfigs/zfs-exporter.yaml | 11 - .../kube-prometheus-stack/ks.yaml | 29 - .../loki/app/externalsecret.yaml | 28 - .../observability/loki/app/helmrelease.yaml | 138 -- .../observability/loki/app/kustomization.yaml | 7 - .../kubernetes/observability/loki/ks.yaml | 25 - .../thanos/app/externalsecret.yaml | 28 - .../observability/thanos/app/helmrelease.yaml | 120 -- .../thanos/app/kustomization.yaml | 13 - .../thanos/app/resources/cache.yml | 5 - .../kubernetes/observability/thanos/ks.yaml | 25 - .../vector/app/agent/helmrelease.yaml | 103 - .../vector/app/agent/kustomization.yaml | 13 - .../observability/vector/app/agent/rbac.yaml | 22 - .../vector/app/agent/resources/vector.yaml | 25 - .../vector/app/aggregator/externalsecret.yaml | 20 - .../vector/app/aggregator/helmrelease.yaml | 91 - .../vector/app/aggregator/kustomization.yaml | 13 - .../app/aggregator/resources/vector.yaml | 132 -- .../vector/app/kustomization.yaml | 7 - .../kubernetes/observability/vector/ks.yaml | 23 - .../openebs-system/kustomization.yaml | 9 - .../kubernetes/openebs-system/namespace.yaml | 8 - .../openebs/app/helmrelease.yaml | 32 - .../openebs/app/kustomization.yaml | 6 - .../openebs/cluster/kustomization.yaml | 7 - .../openebs/cluster/storageclass.yaml | 16 - .../openebs/cluster/volumesnapshotclass.yaml | 10 - .../kubernetes/openebs-system/openebs/ks.yaml | 21 - .../qbittorrent/app/externalsecret.yaml | 31 - .../qbittorrent/app/helmrelease.yaml | 163 -- .../qbittorrent/app/kustomization.yaml | 10 - .archive/kubernetes/qbittorrent/ks.yaml | 50 - .../qbittorrent/tools/helmrelease.yaml | 146 -- .../qbittorrent/tools/kustomization.yaml | 7 - .../tools/qbtools.secret.sops.yaml | 26 - ...k-ceph-dashboard-password.secret.sops.yaml | 26 - .../rook-ceph/cluster/kustomization.yaml | 6 - .forgejo/workflows/schemas.yaml | 135 -- .gitignore | 3 - .pre-commit-config.yaml | 6 +- .renovate/autoMerge.json5 | 2 +- .sops.yaml | 10 +- .taskfiles/act/Taskfile.yaml | 8 - .taskfiles/talos/Taskfile.yaml | 9 +- .taskfiles/volsync/Taskfile.yaml | 41 +- .taskfiles/volsync/resources/.env | 1 + .taskfiles/volsync/resources/list.tmpl.yaml | 2 +- .../replicationdestination.tmpl.yaml | 4 +- .taskfiles/volsync/resources/wait-for-job.sh | 2 +- .vscode/settings.json | 7 + README.md | 5 +- Taskfile.yaml | 1 - kubernetes/apps/ai/kustomization.yaml | 11 - kubernetes/apps/ai/namespace.yaml | 8 - .../apps/ai/ollama/app/helmrelease.yaml | 88 - .../apps/ai/ollama/app/kustomization.yaml | 8 - kubernetes/apps/ai/ollama/app/pvc.yaml | 12 - kubernetes/apps/ai/ollama/ks.yaml | 32 - .../apps/ai/open-webui/app/helmrelease.yaml | 77 - .../apps/ai/open-webui/app/kustomization.yaml | 8 - kubernetes/apps/ai/open-webui/ks.yaml | 31 - .../stable-diffusion/comfyui/helmrelease.yaml | 82 - .../comfyui/kustomization.yaml | 9 - .../apps/ai/stable-diffusion/comfyui/pvc.yaml | 12 - kubernetes/apps/ai/stable-diffusion/ks.yaml | 33 - kubernetes/apps/cdi/cdi/app/ingress.yaml | 22 - .../apps/cdi/cdi/app/kustomization.yaml | 10 - .../apps/cdi/cdi/app/sp-nfs-zfs-csi.yaml | 23 - .../apps/cdi/cdi/app/sp-openebs-hostpath.yaml | 26 - .../apps/cdi/cdi/app/sp-openebs-zfs.yaml | 27 - kubernetes/apps/cdi/cdi/ks.yaml | 73 - kubernetes/apps/cdi/kustomization.yaml | 9 - kubernetes/apps/cdi/namespace.yaml | 9 - .../apps/cert-manager/cert-manager/ks.yaml | 4 +- kubernetes/apps/cert-manager/namespace.yaml | 1 - .../webhook-dnsimple/app/apiservice.yaml | 3 +- .../webhook-dnsimple/app/helmrelease.yaml | 2 +- .../webhook-dnsimple/app/pki.yaml | 6 +- .../webhook-dnsimple/app/rbac.yaml | 30 +- .../cert-manager/webhook-dnsimple/ks.yaml | 4 +- .../forgejo/app/externalsecret.yaml | 22 - .../ci-runners/forgejo/app/helmrelease.yaml | 103 - .../ci-runners/forgejo/app/kustomization.yaml | 8 - kubernetes/apps/ci-runners/forgejo/ks.yaml | 19 - kubernetes/apps/ci-runners/kustomization.yaml | 9 - kubernetes/apps/ci-runners/namespace.yaml | 5 - .../crunchy-postgres-operator/README.md | 28 - .../cluster/externalsecret.yaml | 38 - .../cluster/gatus.yaml | 21 - .../cluster/kustomization.yaml | 10 - .../cluster/postgrescluster.yaml | 179 -- .../cluster/pushsecret.yaml | 280 --- .../cluster/service.yaml | 19 - .../clustersecretstore.yaml | 20 - .../clustersecretstore/kustomization.yaml | 7 - .../clustersecretstore/rbac.yaml | 31 - .../crunchy-postgres-operator/ks.yaml | 83 - .../operator/helmrelease.yaml | 25 - .../operator/kustomization.yaml | 6 - .../userinit-controller/helmrelease.yaml | 17 - .../userinit-controller/helmrepository.yaml | 10 - .../userinit-controller/kustomization.yaml | 7 - .../database/dragonfly/app/dragonfly.yaml | 29 - .../database/dragonfly/app/kustomization.yaml | 6 - kubernetes/apps/database/dragonfly/ks.yaml | 21 - .../database/emqx/app/externalsecret.yaml | 41 - .../apps/database/emqx/app/helmrelease.yaml | 31 - .../apps/database/emqx/app/kustomization.yaml | 7 - .../apps/database/emqx/cluster/cluster.yaml | 53 - .../apps/database/emqx/cluster/ingress.yaml | 21 - .../database/emqx/cluster/kustomization.yaml | 8 - .../database/emqx/cluster/podmonitor.yaml | 27 - kubernetes/apps/database/emqx/ks.yaml | 46 - kubernetes/apps/database/kustomization.yaml | 11 - kubernetes/apps/database/namespace.yaml | 8 - .../default/atuin/app/externalsecret.yaml | 20 - .../apps/default/atuin/app/helmrelease.yaml | 112 -- .../apps/default/atuin/app/kustomization.yaml | 8 - kubernetes/apps/default/atuin/ks.yaml | 28 - .../default/autobrr/app/externalsecret.yaml | 25 - .../apps/default/autobrr/app/helmrelease.yaml | 86 - .../default/autobrr/app/kustomization.yaml | 9 - kubernetes/apps/default/autobrr/ks.yaml | 27 - .../default/excalidraw/app/helmrelease.yaml | 74 - .../default/excalidraw/app/kustomization.yaml | 7 - kubernetes/apps/default/excalidraw/ks.yaml | 25 - .../default/it-tools/app/helmrelease.yaml | 70 - .../default/it-tools/app/kustomization.yaml | 7 - kubernetes/apps/default/it-tools/ks.yaml | 25 - .../jellyseerr/app/externalsecret.yaml | 26 - .../default/jellyseerr/app/helmrelease.yaml | 93 - .../default/jellyseerr/app/kustomization.yaml | 8 - kubernetes/apps/default/jellyseerr/ks.yaml | 28 - kubernetes/apps/default/kustomization.yaml | 19 +- .../maintainerr/app/kustomization.yaml | 2 +- kubernetes/apps/default/maintainerr/ks.yaml | 8 +- .../default/omegabrr/app/externalsecret.yaml | 55 - .../default/omegabrr/app/helmrelease.yaml | 65 - .../default/omegabrr/app/kustomization.yaml | 8 - kubernetes/apps/default/omegabrr/ks.yaml | 26 - .../default/overseerr/app/helmrelease.yaml | 101 - .../default/overseerr/app/kustomization.yaml | 8 - kubernetes/apps/default/overseerr/ks.yaml | 30 - .../default/prowlarr/app/externalsecret.yaml | 24 - .../default/prowlarr/app/helmrelease.yaml | 106 - .../default/prowlarr/app/kustomization.yaml | 7 - kubernetes/apps/default/prowlarr/ks.yaml | 29 - .../default/radarr/app/externalsecret.yaml | 28 - .../apps/default/radarr/app/helmrelease.yaml | 117 -- .../default/radarr/app/kustomization.yaml | 8 - kubernetes/apps/default/radarr/ks.yaml | 34 - .../default/recyclarr/app/externalsecret.yaml | 30 - .../default/recyclarr/app/helmrelease.yaml | 72 - .../default/recyclarr/app/kustomization.yaml | 14 - .../recyclarr/app/resources/recyclarr.yml | 200 -- kubernetes/apps/default/recyclarr/ks.yaml | 30 - .../default/redlib/app/externalsecret.yaml | 19 - .../apps/default/redlib/app/helmrelease.yaml | 100 - .../default/redlib/app/kustomization.yaml | 7 - kubernetes/apps/default/redlib/ks.yaml | 26 - .../default/sabnzbd/app/externalsecret.yaml | 20 - .../apps/default/sabnzbd/app/helmrelease.yaml | 112 -- .../default/sabnzbd/app/kustomization.yaml | 8 - kubernetes/apps/default/sabnzbd/ks.yaml | 31 - .../default/searxng/app/externalsecret.yaml | 19 - .../apps/default/searxng/app/helmrelease.yaml | 112 -- .../default/searxng/app/kustomization.yaml | 15 - .../searxng/app/resources/limiter.toml | 6 - .../searxng/app/resources/settings.yml | 51 - kubernetes/apps/default/searxng/ks.yaml | 28 - .../default/sonarr/app/externalsecret.yaml | 28 - .../apps/default/sonarr/app/helmrelease.yaml | 117 -- .../default/sonarr/app/kustomization.yaml | 8 - kubernetes/apps/default/sonarr/ks.yaml | 34 - .../default/tautulli/app/helmrelease.yaml | 118 -- .../default/tautulli/app/kustomization.yaml | 7 - kubernetes/apps/default/tautulli/ks.yaml | 30 - .../default/thelounge/app/helmrelease.yaml | 79 - .../default/thelounge/app/kustomization.yaml | 6 - .../default/unpackerr/app/externalsecret.yaml | 30 - .../default/unpackerr/app/helmrelease.yaml | 84 - .../default/unpackerr/app/kustomization.yaml | 7 - kubernetes/apps/default/unpackerr/ks.yaml | 23 - .../democratic-csi/app/externalsecret.yaml | 25 - .../democratic-csi/app/helmrelease.yaml | 119 -- .../democratic-csi/app/kustomization.yaml | 7 - .../democratic-csi/democratic-csi/ks.yaml | 21 - .../apps/democratic-csi/kustomization.yaml | 9 - kubernetes/apps/democratic-csi/namespace.yaml | 8 - .../app/dragonfly-operator-crd.yaml | 1702 ----------------- .../dragonfly-operator/app/helmrelease.yaml | 129 -- .../dragonfly-operator/app/kustomization.yaml | 9 - .../dragonfly-operator/app/rbac.yaml | 230 --- .../dragonfly-operator/ks.yaml | 19 - .../kustomization.yaml | 9 - .../dragonfly-operator-system/namespace.yaml | 10 - kubernetes/apps/flux-system/add-ons/ks.yaml | 4 +- .../{resources/values.yml => helm-values.yml} | 21 +- .../kube-system/cilium/app/kustomization.yaml | 2 +- .../cilium/app/kustomizeconfig.yaml | 2 +- .../apps/kube-system/cilium/config/l2.yaml | 3 +- kubernetes/apps/kube-system/cilium/ks.yaml | 4 +- kubernetes/apps/kube-system/coredns/ks.yaml | 4 +- .../descheduler/app/helmrelease.yaml | 77 - .../descheduler/app/kustomization.yaml | 6 - .../apps/kube-system/descheduler/ks.yaml | 21 - kubernetes/apps/kube-system/fstrim.yaml | 2 +- .../kube-system/fstrim/app/helmrelease.yaml | 2 +- .../kube-system/fstrim/app/kustomization.yaml | 2 +- kubernetes/apps/kube-system/fstrim/ks.yaml | 4 +- .../kubelet-csr-approver/app/helm-values.yaml | 3 - .../kubelet-csr-approver/app/helm-values.yml | 2 + .../app/kustomization.yaml | 2 +- .../kube-system/kubelet-csr-approver/ks.yaml | 2 +- .../apps/kube-system/kustomization.yaml | 4 +- .../metrics-server/app/helmrelease.yaml | 1 - .../apps/kube-system/metrics-server/ks.yaml | 2 +- .../apps/kube-system/multus/app/crd.yaml | 45 - .../kube-system/multus/app/helmrelease.yaml | 214 --- .../kube-system/multus/app/kustomization.yaml | 8 - .../apps/kube-system/multus/app/rbac.yaml | 43 - .../multus/config/kustomization.yaml | 6 - .../multus/config/net-attach-iot.yaml | 32 - kubernetes/apps/kube-system/multus/ks.yaml | 40 - .../node-feature-discovery/ks.yaml | 21 +- .../node-feature-discovery/rules/nvidia.yaml | 16 - .../nvidia-device-plugin/app/helmrelease.yaml | 42 - .../app/kustomization.yaml | 13 - .../app/resources/values.yml | 12 - .../app/runtimeclass.yaml | 6 - .../kube-system/nvidia-device-plugin/ks.yaml | 18 - .../kube-system/reloader/app/helmrelease.yaml | 5 +- kubernetes/apps/kube-system/reloader/ks.yaml | 2 +- kubernetes/apps/kube-system/rocky-nenya.yaml | 2 +- .../kube-system/spegel/app/helm-values.yml | 8 + .../kube-system/spegel/app/helmrelease.yaml | 0 .../kube-system/spegel/app/kustomization.yaml | 2 +- .../spegel/app/kustomizeconfig.yaml | 0 .../apps}/kube-system/spegel/ks.yaml | 2 +- kubernetes/apps/kubevirt/app/ks.yaml | 46 - kubernetes/apps/kubevirt/kustomization.yaml | 10 - .../kubevirt/manager/app/helmrelease.yaml | 83 - .../kubevirt/manager/app/kustomization.yaml | 8 - .../apps/kubevirt/manager/app/rbac.yaml | 110 -- kubernetes/apps/kubevirt/manager/ks.yaml | 22 - kubernetes/apps/kubevirt/namespace.yaml | 10 - .../apps/kubevirt/vms/fj-runner-01-disk1.yaml | 12 - .../apps/kubevirt/vms/fj-runner-01.yaml | 54 - .../apps/kubevirt/vms/fj-runner-02-disk1.yaml | 12 - .../apps/kubevirt/vms/fj-runner-02.yaml | 54 - kubernetes/apps/kubevirt/vms/nixosdv.yaml | 17 - kubernetes/apps/kyverno/kyverno/ks.yaml | 4 +- .../app/config/{config.yaml => config.yml} | 4 - .../network/cloudflared/app/helmrelease.yaml | 2 +- .../cloudflared/app/kustomization.yaml | 2 +- kubernetes/apps/network/cloudflared/ks.yaml | 2 +- kubernetes/apps/network/echo-server/ks.yaml | 2 +- kubernetes/apps/network/external-dns/ks.yaml | 6 +- .../ingress-nginx/external/helmrelease.yaml | 2 +- .../ingress-nginx/internal/helmrelease.yaml | 2 +- kubernetes/apps/network/ingress-nginx/ks.yaml | 4 +- kubernetes/apps/network/kustomization.yaml | 2 +- kubernetes/apps/network/namespace.yaml | 1 - .../gatus/app/externalsecret.yaml | 23 - .../observability/gatus/app/helmrelease.yaml | 131 -- .../gatus/app/kustomization.yaml | 14 - .../apps/observability/gatus/app/rbac.yaml | 22 - .../gatus/app/resources/config.yml | 133 -- kubernetes/apps/observability/gatus/ks.yaml | 29 - .../app/helmrelease.yaml | 146 ++ .../kube-prometheus-stack}/ks.yaml | 13 +- .../apps/observability/kustomization.yaml | 8 +- kubernetes/apps/observability/namespace.yaml | 1 - .../node-exporter/app/helmrelease.yaml | 51 - .../node-exporter/app/kustomization.yaml | 6 - .../apps/observability/node-exporter/ks.yaml | 19 - .../app/helmrelease.yaml | 23 - .../app/kustomization.yaml | 6 - .../prometheus-operator-crds/ks.yaml | 21 - .../smartctl-exporter/app/helmrelease.yaml | 44 - .../smartctl-exporter/app/kustomization.yaml | 16 - .../smartctl-exporter/app/prometheusrule.yaml | 67 - .../app/resources/lokirule.yml | 14 - .../observability/smartctl-exporter/ks.yaml | 21 - .../victoria-metrics/app/helmrelease.yaml | 202 -- .../victoria-metrics/app/kustomization.yaml | 6 - .../observability/victoria-metrics/ks.yaml | 26 - .../apps/openebs-system/kustomization.yaml | 9 - kubernetes/apps/openebs-system/namespace.yaml | 8 - .../openebs/app/helmrelease.yaml | 61 - .../openebs/app/kustomization.yaml | 8 - .../openebs/app/storageclass.yaml | 15 - .../openebs/app/volumesnapshotclass.yaml | 10 - .../apps/openebs-system/openebs/ks.yaml | 21 - .../cross-seed/app/externalsecret.yaml | 38 - .../cross-seed/app/helmrelease.yaml | 92 - .../cross-seed/app/kustomization.yaml | 9 - .../apps/qbittorrent/cross-seed/ks.yaml | 26 - .../qbittorrent/flood/app/externalsecret.yaml | 22 - .../qbittorrent/flood/app/helmrelease.yaml | 98 - .../qbittorrent/flood/app/kustomization.yaml | 10 - kubernetes/apps/qbittorrent/flood/ks.yaml | 29 - .../apps/qbittorrent/kustomization.yaml | 11 - kubernetes/apps/qbittorrent/namespace.yaml | 8 - .../qbittorrent/app/externalsecret.yaml | 20 - .../qbittorrent/app/helmrelease.yaml | 127 -- .../qbittorrent/app/kustomization.yaml | 16 - .../qbittorrent/app/resources/cross-seed.sh | 32 - .../apps/qbittorrent/qbittorrent/ks.yaml | 50 - .../qbittorrent/tools/helmrelease.yaml | 146 -- .../qbittorrent/tools/kustomization.yaml | 7 - .../tools/qbtools.secret.sops.yaml | 26 - .../apps}/rook-ceph/kustomization.yaml | 0 .../apps}/rook-ceph/namespace.yaml | 0 .../rook-ceph/rook-ceph/app/helmrelease.yaml | 6 +- .../rook-ceph/app/kustomization.yaml | 0 ...k-ceph-dashboard-password.secret.sops.yaml | 26 + .../rook-ceph/cluster/helmrelease.yaml | 38 +- .../rook-ceph/cluster}/kustomization.yaml | 0 .../apps}/rook-ceph/rook-ceph/ks.yaml | 4 +- .../external-secrets/app/helmrelease.yaml | 2 +- .../cluster-secrets/kustomization.yaml | 6 - .../cluster-secrets/pgo-s3-creds.yaml | 41 - .../apps/security/external-secrets/ks.yaml | 22 +- .../stores/onepassword/secret.sops.yaml | 18 +- kubernetes/apps/security/namespace.yaml | 1 - .../snapshot-controller/ks.yaml | 2 +- .../apps/volsync-system/volsync/ks.yaml | 2 +- kubernetes/bootstrap/flux/age-key.sops.yaml | 18 +- .../bootstrap/flux/git-deploy-key.sops.yaml | 31 - kubernetes/bootstrap/helmfile.yaml | 44 +- kubernetes/bootstrap/readme.md | 2 +- .../bootstrap/talos/clusterconfig/.gitignore | 8 +- kubernetes/bootstrap/talos/talconfig.yaml | 232 ++- kubernetes/bootstrap/talos/talenv.sops.yaml | 19 +- .../bootstrap/talos/talsecret.sops.yaml | 44 +- kubernetes/flux/cluster-apps.yaml | 2 +- kubernetes/flux/config/cluster.yaml | 6 +- .../flux/repositories/git/kubevirt-cdi.yaml | 17 - .../flux/repositories/git/kubevirt.yaml | 17 - .../flux/repositories/git/kustomization.yaml | 7 - .../flux/repositories/helm/angelnu.yaml | 2 +- .../helm/{emqx.yaml => coredns.yaml} | 4 +- .../flux/repositories/helm/descheduler.yaml | 2 +- .../flux/repositories/helm/kustomization.yaml | 3 +- .../flux/repositories/helm/spegel-org.yaml | 2 +- .../flux/repositories/helm/stevehipwell.yaml | 2 +- .../repositories/helm/victoria-metrics.yaml | 11 - .../flux/repositories/kustomization.yaml | 1 - .../flux/vars/cluster-secrets.sops.yaml | 20 +- kubernetes/flux/vars/cluster-settings.yaml | 2 +- .../templates/gatus/external/configmap.yaml | 2 +- .../gatus/external/kustomization.yaml | 2 +- kubernetes/templates/volsync/claim.yaml | 2 +- kubernetes/templates/volsync/minio.yaml | 12 +- kubernetes/templates/volsync/r2.yaml | 6 +- kubernetes/tools/kbench.yaml | 4 +- kubernetes/tools/wipeone.yaml | 6 +- kubernetes/tools/wiperook.yaml | 22 +- renovate.json5 | 42 +- shell.nix | 2 +- 438 files changed, 658 insertions(+), 15686 deletions(-) delete mode 100644 .ansible-lint delete mode 100644 .archive/.taskfiles/Ansible/Taskfile.yaml delete mode 100644 .archive/.taskfiles/rook/Taskfile.yaml delete mode 100644 .archive/.taskfiles/rook/WipeDiskJob.tmpl.yaml delete mode 100644 .archive/.taskfiles/rook/WipeRookDataJob.tmpl.yaml delete mode 100644 .archive/.taskfiles/rook/pod.yaml delete mode 100644 .archive/kubernetes/default/jellyfin/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/default/jellyfin/app/kustomization.yaml delete mode 100644 .archive/kubernetes/default/jellyfin/ks.yaml delete mode 100644 .archive/kubernetes/home-automation/home-assistant/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/home-automation/home-assistant/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/home-automation/home-assistant/app/kustomization.yaml delete mode 100644 .archive/kubernetes/home-automation/home-assistant/ks.yaml delete mode 100644 .archive/kubernetes/home-automation/kustomization.yaml delete mode 100644 .archive/kubernetes/home-automation/matter-server/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/home-automation/matter-server/app/kustomization.yaml delete mode 100644 .archive/kubernetes/home-automation/matter-server/ks.yaml delete mode 100644 .archive/kubernetes/home-automation/mosquitto/app/config/mosquitto.conf delete mode 100644 .archive/kubernetes/home-automation/mosquitto/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/home-automation/mosquitto/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/home-automation/mosquitto/app/kustomization.yaml delete mode 100644 .archive/kubernetes/home-automation/mosquitto/ks.yaml delete mode 100644 .archive/kubernetes/home-automation/namespace.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/bgpcrd.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/bgppeeringpolicy.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/allow-ssh.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/apiserver.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/cilium-health.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/cilium-vxlan.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/core-dns.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/etcd.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/fix-apiserver.yml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/hubble-relay.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/hubble-ui.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/kubelet.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/app/netpols/kustomization.yaml delete mode 100644 .archive/kubernetes/kube-system/cilium/ks.yaml delete mode 100644 .archive/kubernetes/kube-system/spegel/app/resources/values.yml delete mode 100644 .archive/kubernetes/kube-system/zfs-scrub/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/kube-system/zfs-scrub/app/kustomization.yaml delete mode 100644 .archive/kubernetes/kube-system/zfs-scrub/app/resources/zfs-scrub.sh delete mode 100644 .archive/kubernetes/kube-system/zfs-scrub/ks.yaml delete mode 100644 .archive/kubernetes/media/immich/app/configmap.yaml delete mode 100644 .archive/kubernetes/media/immich/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/media/immich/app/gatus.yaml delete mode 100644 .archive/kubernetes/media/immich/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/media/immich/app/kustomization.yaml delete mode 100644 .archive/kubernetes/media/immich/app/machine-learning/helmrelease.yaml delete mode 100644 .archive/kubernetes/media/immich/app/machine-learning/kustomization.yaml delete mode 100644 .archive/kubernetes/media/immich/app/microservices/helmrelease.yaml delete mode 100644 .archive/kubernetes/media/immich/app/microservices/kustomization.yaml delete mode 100644 .archive/kubernetes/media/immich/app/postgresCluster.yaml delete mode 100644 .archive/kubernetes/media/immich/app/pushsecret.yaml delete mode 100644 .archive/kubernetes/media/immich/app/resources/init.sql delete mode 100644 .archive/kubernetes/media/immich/app/service.yaml delete mode 100644 .archive/kubernetes/media/immich/ks.yaml delete mode 100644 .archive/kubernetes/media/kustomization.yaml delete mode 100644 .archive/kubernetes/media/namespace.yaml delete mode 100644 .archive/kubernetes/observability/alertmanager-silencer/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/alertmanager-silencer/ks.yaml delete mode 100644 .archive/kubernetes/observability/grafana/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/observability/grafana/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/grafana/app/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/grafana/ks.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/crunchy-postgres.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/dragonflydb.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/prometheusrule.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/resources/alertmanager.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/node-exporter.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/zfs-exporter.yaml delete mode 100644 .archive/kubernetes/observability/kube-prometheus-stack/ks.yaml delete mode 100644 .archive/kubernetes/observability/loki/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/observability/loki/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/loki/app/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/loki/ks.yaml delete mode 100644 .archive/kubernetes/observability/thanos/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/observability/thanos/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/thanos/app/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/thanos/app/resources/cache.yml delete mode 100644 .archive/kubernetes/observability/thanos/ks.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/agent/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/agent/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/agent/rbac.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/agent/resources/vector.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/aggregator/externalsecret.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/aggregator/helmrelease.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/aggregator/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/aggregator/resources/vector.yaml delete mode 100644 .archive/kubernetes/observability/vector/app/kustomization.yaml delete mode 100644 .archive/kubernetes/observability/vector/ks.yaml delete mode 100644 .archive/kubernetes/openebs-system/kustomization.yaml delete mode 100644 .archive/kubernetes/openebs-system/namespace.yaml delete mode 100644 .archive/kubernetes/openebs-system/openebs/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/openebs-system/openebs/app/kustomization.yaml delete mode 100644 .archive/kubernetes/openebs-system/openebs/cluster/kustomization.yaml delete mode 100644 .archive/kubernetes/openebs-system/openebs/cluster/storageclass.yaml delete mode 100644 .archive/kubernetes/openebs-system/openebs/cluster/volumesnapshotclass.yaml delete mode 100644 .archive/kubernetes/openebs-system/openebs/ks.yaml delete mode 100644 .archive/kubernetes/qbittorrent/app/externalsecret.yaml delete mode 100644 .archive/kubernetes/qbittorrent/app/helmrelease.yaml delete mode 100644 .archive/kubernetes/qbittorrent/app/kustomization.yaml delete mode 100644 .archive/kubernetes/qbittorrent/ks.yaml delete mode 100644 .archive/kubernetes/qbittorrent/tools/helmrelease.yaml delete mode 100644 .archive/kubernetes/qbittorrent/tools/kustomization.yaml delete mode 100644 .archive/kubernetes/qbittorrent/tools/qbtools.secret.sops.yaml delete mode 100644 .archive/kubernetes/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml delete mode 100644 .archive/kubernetes/rook-ceph/rook-ceph/cluster/kustomization.yaml delete mode 100644 .forgejo/workflows/schemas.yaml delete mode 100644 .taskfiles/act/Taskfile.yaml create mode 100644 .taskfiles/volsync/resources/.env delete mode 100644 kubernetes/apps/ai/kustomization.yaml delete mode 100644 kubernetes/apps/ai/namespace.yaml delete mode 100644 kubernetes/apps/ai/ollama/app/helmrelease.yaml delete mode 100644 kubernetes/apps/ai/ollama/app/kustomization.yaml delete mode 100644 kubernetes/apps/ai/ollama/app/pvc.yaml delete mode 100644 kubernetes/apps/ai/ollama/ks.yaml delete mode 100644 kubernetes/apps/ai/open-webui/app/helmrelease.yaml delete mode 100644 kubernetes/apps/ai/open-webui/app/kustomization.yaml delete mode 100644 kubernetes/apps/ai/open-webui/ks.yaml delete mode 100644 kubernetes/apps/ai/stable-diffusion/comfyui/helmrelease.yaml delete mode 100644 kubernetes/apps/ai/stable-diffusion/comfyui/kustomization.yaml delete mode 100644 kubernetes/apps/ai/stable-diffusion/comfyui/pvc.yaml delete mode 100644 kubernetes/apps/ai/stable-diffusion/ks.yaml delete mode 100644 kubernetes/apps/cdi/cdi/app/ingress.yaml delete mode 100644 kubernetes/apps/cdi/cdi/app/kustomization.yaml delete mode 100644 kubernetes/apps/cdi/cdi/app/sp-nfs-zfs-csi.yaml delete mode 100644 kubernetes/apps/cdi/cdi/app/sp-openebs-hostpath.yaml delete mode 100644 kubernetes/apps/cdi/cdi/app/sp-openebs-zfs.yaml delete mode 100644 kubernetes/apps/cdi/cdi/ks.yaml delete mode 100644 kubernetes/apps/cdi/kustomization.yaml delete mode 100644 kubernetes/apps/cdi/namespace.yaml delete mode 100644 kubernetes/apps/ci-runners/forgejo/app/externalsecret.yaml delete mode 100644 kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml delete mode 100644 kubernetes/apps/ci-runners/forgejo/app/kustomization.yaml delete mode 100644 kubernetes/apps/ci-runners/forgejo/ks.yaml delete mode 100644 kubernetes/apps/ci-runners/kustomization.yaml delete mode 100644 kubernetes/apps/ci-runners/namespace.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/README.md delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/cluster/externalsecret.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/cluster/gatus.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/cluster/kustomization.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/cluster/postgrescluster.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/cluster/pushsecret.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/cluster/service.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore/clustersecretstore.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore/kustomization.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore/rbac.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/ks.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/operator/helmrelease.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/operator/kustomization.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/userinit-controller/helmrelease.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/userinit-controller/helmrepository.yaml delete mode 100644 kubernetes/apps/database/crunchy-postgres-operator/userinit-controller/kustomization.yaml delete mode 100644 kubernetes/apps/database/dragonfly/app/dragonfly.yaml delete mode 100644 kubernetes/apps/database/dragonfly/app/kustomization.yaml delete mode 100644 kubernetes/apps/database/dragonfly/ks.yaml delete mode 100644 kubernetes/apps/database/emqx/app/externalsecret.yaml delete mode 100644 kubernetes/apps/database/emqx/app/helmrelease.yaml delete mode 100644 kubernetes/apps/database/emqx/app/kustomization.yaml delete mode 100644 kubernetes/apps/database/emqx/cluster/cluster.yaml delete mode 100644 kubernetes/apps/database/emqx/cluster/ingress.yaml delete mode 100644 kubernetes/apps/database/emqx/cluster/kustomization.yaml delete mode 100644 kubernetes/apps/database/emqx/cluster/podmonitor.yaml delete mode 100644 kubernetes/apps/database/emqx/ks.yaml delete mode 100644 kubernetes/apps/database/kustomization.yaml delete mode 100644 kubernetes/apps/database/namespace.yaml delete mode 100644 kubernetes/apps/default/atuin/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/atuin/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/atuin/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/atuin/ks.yaml delete mode 100644 kubernetes/apps/default/autobrr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/autobrr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/autobrr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/autobrr/ks.yaml delete mode 100644 kubernetes/apps/default/excalidraw/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/excalidraw/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/excalidraw/ks.yaml delete mode 100644 kubernetes/apps/default/it-tools/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/it-tools/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/it-tools/ks.yaml delete mode 100644 kubernetes/apps/default/jellyseerr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/jellyseerr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/jellyseerr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/jellyseerr/ks.yaml delete mode 100644 kubernetes/apps/default/omegabrr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/omegabrr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/omegabrr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/omegabrr/ks.yaml delete mode 100644 kubernetes/apps/default/overseerr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/overseerr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/overseerr/ks.yaml delete mode 100644 kubernetes/apps/default/prowlarr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/prowlarr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/prowlarr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/prowlarr/ks.yaml delete mode 100644 kubernetes/apps/default/radarr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/radarr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/radarr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/radarr/ks.yaml delete mode 100644 kubernetes/apps/default/recyclarr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/recyclarr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/recyclarr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/recyclarr/app/resources/recyclarr.yml delete mode 100644 kubernetes/apps/default/recyclarr/ks.yaml delete mode 100644 kubernetes/apps/default/redlib/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/redlib/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/redlib/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/redlib/ks.yaml delete mode 100644 kubernetes/apps/default/sabnzbd/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/sabnzbd/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/sabnzbd/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/sabnzbd/ks.yaml delete mode 100644 kubernetes/apps/default/searxng/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/searxng/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/searxng/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/searxng/app/resources/limiter.toml delete mode 100644 kubernetes/apps/default/searxng/app/resources/settings.yml delete mode 100644 kubernetes/apps/default/searxng/ks.yaml delete mode 100644 kubernetes/apps/default/sonarr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/sonarr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/sonarr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/sonarr/ks.yaml delete mode 100644 kubernetes/apps/default/tautulli/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/tautulli/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/tautulli/ks.yaml delete mode 100644 kubernetes/apps/default/thelounge/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/thelounge/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/unpackerr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/unpackerr/app/helmrelease.yaml delete mode 100644 kubernetes/apps/default/unpackerr/app/kustomization.yaml delete mode 100644 kubernetes/apps/default/unpackerr/ks.yaml delete mode 100644 kubernetes/apps/democratic-csi/democratic-csi/app/externalsecret.yaml delete mode 100644 kubernetes/apps/democratic-csi/democratic-csi/app/helmrelease.yaml delete mode 100644 kubernetes/apps/democratic-csi/democratic-csi/app/kustomization.yaml delete mode 100644 kubernetes/apps/democratic-csi/democratic-csi/ks.yaml delete mode 100644 kubernetes/apps/democratic-csi/kustomization.yaml delete mode 100644 kubernetes/apps/democratic-csi/namespace.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/dragonfly-operator-crd.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/helmrelease.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/kustomization.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/rbac.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/dragonfly-operator/ks.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/kustomization.yaml delete mode 100644 kubernetes/apps/dragonfly-operator-system/namespace.yaml rename kubernetes/apps/kube-system/cilium/app/{resources/values.yml => helm-values.yml} (73%) delete mode 100644 kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml delete mode 100644 kubernetes/apps/kube-system/descheduler/app/kustomization.yaml delete mode 100644 kubernetes/apps/kube-system/descheduler/ks.yaml delete mode 100644 kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yaml create mode 100644 kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yml delete mode 100644 kubernetes/apps/kube-system/multus/app/crd.yaml delete mode 100644 kubernetes/apps/kube-system/multus/app/helmrelease.yaml delete mode 100644 kubernetes/apps/kube-system/multus/app/kustomization.yaml delete mode 100644 kubernetes/apps/kube-system/multus/app/rbac.yaml delete mode 100644 kubernetes/apps/kube-system/multus/config/kustomization.yaml delete mode 100644 kubernetes/apps/kube-system/multus/config/net-attach-iot.yaml delete mode 100644 kubernetes/apps/kube-system/multus/ks.yaml delete mode 100644 kubernetes/apps/kube-system/node-feature-discovery/rules/nvidia.yaml delete mode 100644 kubernetes/apps/kube-system/nvidia-device-plugin/app/helmrelease.yaml delete mode 100644 kubernetes/apps/kube-system/nvidia-device-plugin/app/kustomization.yaml delete mode 100644 kubernetes/apps/kube-system/nvidia-device-plugin/app/resources/values.yml delete mode 100644 kubernetes/apps/kube-system/nvidia-device-plugin/app/runtimeclass.yaml delete mode 100644 kubernetes/apps/kube-system/nvidia-device-plugin/ks.yaml create mode 100644 kubernetes/apps/kube-system/spegel/app/helm-values.yml rename {.archive/kubernetes => kubernetes/apps}/kube-system/spegel/app/helmrelease.yaml (100%) rename {.archive/kubernetes => kubernetes/apps}/kube-system/spegel/app/kustomization.yaml (86%) rename {.archive/kubernetes => kubernetes/apps}/kube-system/spegel/app/kustomizeconfig.yaml (100%) rename {.archive/kubernetes => kubernetes/apps}/kube-system/spegel/ks.yaml (96%) delete mode 100644 kubernetes/apps/kubevirt/app/ks.yaml delete mode 100644 kubernetes/apps/kubevirt/kustomization.yaml delete mode 100644 kubernetes/apps/kubevirt/manager/app/helmrelease.yaml delete mode 100644 kubernetes/apps/kubevirt/manager/app/kustomization.yaml delete mode 100644 kubernetes/apps/kubevirt/manager/app/rbac.yaml delete mode 100644 kubernetes/apps/kubevirt/manager/ks.yaml delete mode 100644 kubernetes/apps/kubevirt/namespace.yaml delete mode 100644 kubernetes/apps/kubevirt/vms/fj-runner-01-disk1.yaml delete mode 100644 kubernetes/apps/kubevirt/vms/fj-runner-01.yaml delete mode 100644 kubernetes/apps/kubevirt/vms/fj-runner-02-disk1.yaml delete mode 100644 kubernetes/apps/kubevirt/vms/fj-runner-02.yaml delete mode 100644 kubernetes/apps/kubevirt/vms/nixosdv.yaml rename kubernetes/apps/network/cloudflared/app/config/{config.yaml => config.yml} (60%) delete mode 100644 kubernetes/apps/observability/gatus/app/externalsecret.yaml delete mode 100644 kubernetes/apps/observability/gatus/app/helmrelease.yaml delete mode 100644 kubernetes/apps/observability/gatus/app/kustomization.yaml delete mode 100644 kubernetes/apps/observability/gatus/app/rbac.yaml delete mode 100644 kubernetes/apps/observability/gatus/app/resources/config.yml delete mode 100644 kubernetes/apps/observability/gatus/ks.yaml create mode 100644 kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml rename kubernetes/apps/{default/thelounge => observability/kube-prometheus-stack}/ks.yaml (60%) delete mode 100644 kubernetes/apps/observability/node-exporter/app/helmrelease.yaml delete mode 100644 kubernetes/apps/observability/node-exporter/app/kustomization.yaml delete mode 100644 kubernetes/apps/observability/node-exporter/ks.yaml delete mode 100644 kubernetes/apps/observability/prometheus-operator-crds/app/helmrelease.yaml delete mode 100644 kubernetes/apps/observability/prometheus-operator-crds/app/kustomization.yaml delete mode 100644 kubernetes/apps/observability/prometheus-operator-crds/ks.yaml delete mode 100644 kubernetes/apps/observability/smartctl-exporter/app/helmrelease.yaml delete mode 100644 kubernetes/apps/observability/smartctl-exporter/app/kustomization.yaml delete mode 100644 kubernetes/apps/observability/smartctl-exporter/app/prometheusrule.yaml delete mode 100644 kubernetes/apps/observability/smartctl-exporter/app/resources/lokirule.yml delete mode 100644 kubernetes/apps/observability/smartctl-exporter/ks.yaml delete mode 100644 kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml delete mode 100644 kubernetes/apps/observability/victoria-metrics/app/kustomization.yaml delete mode 100644 kubernetes/apps/observability/victoria-metrics/ks.yaml delete mode 100644 kubernetes/apps/openebs-system/kustomization.yaml delete mode 100644 kubernetes/apps/openebs-system/namespace.yaml delete mode 100644 kubernetes/apps/openebs-system/openebs/app/helmrelease.yaml delete mode 100644 kubernetes/apps/openebs-system/openebs/app/kustomization.yaml delete mode 100644 kubernetes/apps/openebs-system/openebs/app/storageclass.yaml delete mode 100644 kubernetes/apps/openebs-system/openebs/app/volumesnapshotclass.yaml delete mode 100644 kubernetes/apps/openebs-system/openebs/ks.yaml delete mode 100644 kubernetes/apps/qbittorrent/cross-seed/app/externalsecret.yaml delete mode 100644 kubernetes/apps/qbittorrent/cross-seed/app/helmrelease.yaml delete mode 100644 kubernetes/apps/qbittorrent/cross-seed/app/kustomization.yaml delete mode 100644 kubernetes/apps/qbittorrent/cross-seed/ks.yaml delete mode 100644 kubernetes/apps/qbittorrent/flood/app/externalsecret.yaml delete mode 100644 kubernetes/apps/qbittorrent/flood/app/helmrelease.yaml delete mode 100644 kubernetes/apps/qbittorrent/flood/app/kustomization.yaml delete mode 100644 kubernetes/apps/qbittorrent/flood/ks.yaml delete mode 100644 kubernetes/apps/qbittorrent/kustomization.yaml delete mode 100644 kubernetes/apps/qbittorrent/namespace.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/app/externalsecret.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/app/helmrelease.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/app/kustomization.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/app/resources/cross-seed.sh delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/ks.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/tools/kustomization.yaml delete mode 100644 kubernetes/apps/qbittorrent/qbittorrent/tools/qbtools.secret.sops.yaml rename {.archive/kubernetes => kubernetes/apps}/rook-ceph/kustomization.yaml (100%) rename {.archive/kubernetes => kubernetes/apps}/rook-ceph/namespace.yaml (100%) rename {.archive/kubernetes => kubernetes/apps}/rook-ceph/rook-ceph/app/helmrelease.yaml (87%) rename {.archive/kubernetes => kubernetes/apps}/rook-ceph/rook-ceph/app/kustomization.yaml (100%) create mode 100644 kubernetes/apps/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml rename {.archive/kubernetes => kubernetes/apps}/rook-ceph/rook-ceph/cluster/helmrelease.yaml (87%) rename {.archive/kubernetes/observability/alertmanager-silencer/app => kubernetes/apps/rook-ceph/rook-ceph/cluster}/kustomization.yaml (100%) rename {.archive/kubernetes => kubernetes/apps}/rook-ceph/rook-ceph/ks.yaml (96%) delete mode 100644 kubernetes/apps/security/external-secrets/cluster-secrets/kustomization.yaml delete mode 100644 kubernetes/apps/security/external-secrets/cluster-secrets/pgo-s3-creds.yaml delete mode 100644 kubernetes/bootstrap/flux/git-deploy-key.sops.yaml delete mode 100644 kubernetes/flux/repositories/git/kubevirt-cdi.yaml delete mode 100644 kubernetes/flux/repositories/git/kubevirt.yaml delete mode 100644 kubernetes/flux/repositories/git/kustomization.yaml rename kubernetes/flux/repositories/helm/{emqx.yaml => coredns.yaml} (80%) delete mode 100644 kubernetes/flux/repositories/helm/victoria-metrics.yaml diff --git a/.ansible-lint b/.ansible-lint deleted file mode 100644 index 8f92c9a..0000000 --- a/.ansible-lint +++ /dev/null @@ -1,9 +0,0 @@ ---- -skip_list: - - yaml[line-length] - - var-naming -warn_list: - - command-instead-of-shell - - deprecated-command-syntax - - experimental - - no-changed-when diff --git a/.archive/.taskfiles/Ansible/Taskfile.yaml b/.archive/.taskfiles/Ansible/Taskfile.yaml deleted file mode 100644 index ecacebf..0000000 --- a/.archive/.taskfiles/Ansible/Taskfile.yaml +++ /dev/null @@ -1,52 +0,0 @@ ---- -# yaml-language-server: $schema=https://taskfile.dev/schema.json -version: "3" - -vars: - PYTHON_BIN: python3 - -env: - PATH: "{{.ROOT_DIR}}/.venv/bin:$PATH" - VIRTUAL_ENV: "{{.ROOT_DIR}}/.venv" - ANSIBLE_COLLECTIONS_PATH: "{{.ROOT_DIR}}/.venv/galaxy" - ANSIBLE_ROLES_PATH: "{{.ROOT_DIR}}/.venv/galaxy/ansible_roles" - ANSIBLE_VARS_ENABLED: "host_group_vars,community.sops.sops" - -tasks: - - deps: - desc: Set up Ansible dependencies for the environment - cmds: - - task: .venv - - run: - desc: Run an Ansible playbook for configuring a cluster - summary: | - Args: - cluster: Cluster to run command against (required) - playbook: Playbook to run (required) - prompt: Run Ansible playbook '{{.playbook}}' against the '{{.cluster}}' cluster... continue? - deps: ["deps"] - cmd: | - .venv/bin/ansible-playbook \ - --inventory {{.ANSIBLE_DIR}}/{{.cluster}}/inventory/hosts.yaml \ - {{.ANSIBLE_DIR}}/{{.cluster}}/playbooks/{{.playbook}}.yaml {{.CLI_ARGS}} - preconditions: - - { msg: "Argument (cluster) is required", sh: "test -n {{.cluster}}" } - - { msg: "Argument (playbook) is required", sh: "test -n {{.playbook}}" } - - { msg: "Venv not found", sh: "test -d {{.ROOT_DIR}}/.venv" } - - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_DIR}}/{{.cluster}}/inventory/hosts.yaml" } - - { msg: "Playbook not found", sh: "test -f {{.ANSIBLE_DIR}}/{{.cluster}}/playbooks/{{.playbook}}.yaml" } - - .venv: - internal: true - cmds: - - true && {{.PYTHON_BIN}} -m venv {{.ROOT_DIR}}/.venv - - .venv/bin/python3 -m pip install --upgrade pip setuptools wheel - - .venv/bin/python3 -m pip install --upgrade --requirement {{.ANSIBLE_DIR}}/requirements.txt - - .venv/bin/ansible-galaxy install --role-file "{{.ANSIBLE_DIR}}/requirements.yaml" --force - sources: - - "{{.ANSIBLE_DIR}}/requirements.txt" - - "{{.ANSIBLE_DIR}}/requirements.yaml" - generates: - - "{{.ROOT_DIR}}/.venv/pyvenv.cfg" diff --git a/.archive/.taskfiles/rook/Taskfile.yaml b/.archive/.taskfiles/rook/Taskfile.yaml deleted file mode 100644 index df004a1..0000000 --- a/.archive/.taskfiles/rook/Taskfile.yaml +++ /dev/null @@ -1,104 +0,0 @@ ---- -version: "3" - -x-task-vars: &task-vars - node: "{{.node}}" - ceph_disk: "{{.ceph_disk}}" - ts: "{{.ts}}" - jobName: "{{.jobName}}" - -vars: - waitForJobScript: "../_scripts/wait-for-k8s-job.sh" - ts: '{{now | date "150405"}}' - -tasks: - wipe-node-aule: - desc: Trigger a wipe of Rook-Ceph data on node "aule" - cmds: - - task: wipe-disk - vars: - node: "{{.node}}" - ceph_disk: "/dev/disk/by-id/scsi-0HC_Volume_37460833" - - task: wipe-data - vars: - node: "{{.node}}" - vars: - node: aule - - wipe-node-orome: - desc: Trigger a wipe of Rook-Ceph data on node "orome" - cmds: - - task: wipe-disk - vars: - node: "{{.node}}" - ceph_disk: "/dev/disk/by-id/scsi-0HC_Volume_37645333" - - task: wipe-data - vars: - node: "{{.node}}" - vars: - node: orome - - wipe-node-eonwe: - desc: Trigger a wipe of Rook-Ceph data on node "eonwe" - cmds: - - task: wipe-disk - vars: - node: "{{.node}}" - ceph_disk: "/dev/disk/by-id/scsi-0HC_Volume_37460887" - - task: wipe-data - vars: - node: "{{.node}}" - vars: - node: eonwe - - wipe-node-arlen: - desc: Trigger a wipe of Rook-Ceph data on node "arlen" - cmds: - - task: wipe-disk - vars: - node: "{{.node}}" - ceph_disk: "/dev/disk/by-id/scsi-0HC_Volume_37460897" - - task: wipe-data - vars: - node: "{{.node}}" - vars: - node: arlen - - wipe-disk: - desc: Wipe all remnants of rook-ceph from a given disk (ex. task rook:wipe-disk node=aule ceph_disk="/dev/nvme0n1") - silent: true - internal: true - cmds: - - envsubst < <(cat {{.wipeRookDiskJobTemplate}}) | kubectl apply -f - - - bash {{.waitForJobScript}} {{.wipeCephDiskJobName}} default - - kubectl -n default wait job/{{.wipeCephDiskJobName}} --for condition=complete --timeout=1m - - kubectl -n default logs job/{{.wipeCephDiskJobName}} --container list - - kubectl -n default delete job {{.wipeCephDiskJobName}} - vars: - node: '{{ or .node (fail "`node` is required") }}' - ceph_disk: '{{ or .ceph_disk (fail "`ceph_disk` is required") }}' - jobName: 'wipe-disk-{{- .node -}}-{{- .ceph_disk | replace "/" "-" -}}-{{- .ts -}}' - wipeRookDiskJobTemplate: "WipeDiskJob.tmpl.yaml" - env: *task-vars - preconditions: - - sh: test -f {{.waitForJobScript}} - - sh: test -f {{.wipeRookDiskJobTemplate}} - - wipe-data: - desc: Wipe all remnants of rook-ceph from a given disk (ex. task rook:wipe-data node=aule) - silent: true - internal: true - cmds: - - envsubst < <(cat {{.wipeRookDataJobTemplate}}) | kubectl apply -f - - - bash {{.waitForJobScript}} {{.wipeRookDataJobName}} default - - kubectl -n default wait job/{{.wipeRookDataJobName}} --for condition=complete --timeout=1m - - kubectl -n default logs job/{{.wipeRookDataJobName}} --container list - - kubectl -n default delete job {{.wipeRookDataJobName}} - vars: - node: '{{ or .node (fail "`node` is required") }}' - jobName: "wipe-rook-data-{{- .node -}}-{{- .ts -}}" - wipeRookDataJobTemplate: "WipeRookDataJob.tmpl.yaml" - env: *task-vars - preconditions: - - sh: test -f {{.waitForJobScript}} - - sh: test -f {{.wipeRookDataJobTemplate}} diff --git a/.archive/.taskfiles/rook/WipeDiskJob.tmpl.yaml b/.archive/.taskfiles/rook/WipeDiskJob.tmpl.yaml deleted file mode 100644 index 2c5bf35..0000000 --- a/.archive/.taskfiles/rook/WipeDiskJob.tmpl.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: "${jobName}" - namespace: "default" -spec: - ttlSecondsAfterFinished: 3600 - template: - spec: - automountServiceAccountToken: false - restartPolicy: Never - nodeName: ${node} - containers: - - name: disk-wipe - image: docker.io/library/alpine:3.20.0 - securityContext: - privileged: true - resources: {} - command: ["/bin/sh", "-c"] - args: - - apk add --no-cache sgdisk util-linux parted; - sgdisk --zap-all ${ceph_disk}; - blkdiscard ${ceph_disk}; - dd if=/dev/zero bs=1M count=10000 oflag=direct of=${ceph_disk}; - partprobe ${ceph_disk}; diff --git a/.archive/.taskfiles/rook/WipeRookDataJob.tmpl.yaml b/.archive/.taskfiles/rook/WipeRookDataJob.tmpl.yaml deleted file mode 100644 index 70b1be5..0000000 --- a/.archive/.taskfiles/rook/WipeRookDataJob.tmpl.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: "${jobName}" - namespace: "default" -spec: - ttlSecondsAfterFinished: 3600 - template: - spec: - automountServiceAccountToken: false - restartPolicy: Never - nodeName: ${node} - containers: - - name: disk-wipe - image: docker.io/library/alpine:3.20.0 - securityContext: - privileged: true - resources: {} - command: ["/bin/sh", "-c"] - args: - - rm -rf /mnt/host_var/lib/rook - volumeMounts: - - mountPath: /mnt/host_var - name: host-var - volumes: - - name: host-var - hostPath: - path: /var diff --git a/.archive/.taskfiles/rook/pod.yaml b/.archive/.taskfiles/rook/pod.yaml deleted file mode 100644 index bd32784..0000000 --- a/.archive/.taskfiles/rook/pod.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: my-pod -spec: - containers: - - name: disk-wipe - image: docker.io/library/alpine:3.20.0 - securityContext: - privileged: true - resources: {} - command: ["/bin/sh", "-c"] - args: - - apk add --no-cache sgdisk util-linux parted e2fsprogs; - sgdisk --zap-all /dev/nvme1n1; - blkdiscard /dev/nvme1n1; - dd if=/dev/zero bs=1M count=10000 oflag=direct of=/dev/nvme1n1; - sgdisk /dev/nvme1n1 - partprobe /dev/nvme1n1; diff --git a/.archive/kubernetes/default/jellyfin/app/helmrelease.yaml b/.archive/kubernetes/default/jellyfin/app/helmrelease.yaml deleted file mode 100644 index 8acbb53..0000000 --- a/.archive/kubernetes/default/jellyfin/app/helmrelease.yaml +++ /dev/null @@ -1,116 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: jellyfin - namespace: default -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.1.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - jellyfin: - type: statefulset - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: jellyfin/jellyfin - tag: 10.8.13 - env: - NVIDIA_VISIBLE_DEVICES: "all" - NVIDIA_DRIVER_CAPABILITIES: "compute,video,utility" - DOTNET_SYSTEM_IO_DISABLEFILELOCKING: "true" - JELLYFIN_FFmpeg__probesize: 50000000 - JELLYFIN_FFmpeg__analyzeduration: 50000000 - JELLYFIN_PublishedServerUrl: jelly.hsn.dev - TZ: America/Chicago - probes: - liveness: &probes - enabled: true - custom: true - spec: - httpGet: - path: /health - port: &port 8096 - initialDelaySeconds: 0 - periodSeconds: 10 - timeoutSeconds: 1 - failureThreshold: 3 - readiness: *probes - startup: - enabled: false - resources: - requests: - nvidia.com/gpu: 1 # requesting 1 GPU - cpu: 100m - memory: 512Mi - limits: - nvidia.com/gpu: 1 - memory: 4Gi - pod: - runtimeClassName: nvidia - enableServiceLinks: false - nodeSelector: - nvidia.com/gpu.present: "true" - securityContext: - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - supplementalGroups: [44, 105, 10000] - service: - app: - controller: jellyfin - ports: - http: - port: *port - ingress: - app: - enabled: true - className: external-nginx - annotations: - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" - external-dns.alpha.kubernetes.io/target: external.hsn.dev - hosts: - - host: &host "jelly.hsn.dev" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - existingClaim: jellyfin - enabled: true - transcode: - type: emptyDir - globalMounts: - - path: /transcode - media: - enabled: true - type: nfs - server: 10.1.1.12 - path: /mnt/users/Media - globalMounts: - - path: /media diff --git a/.archive/kubernetes/default/jellyfin/app/kustomization.yaml b/.archive/kubernetes/default/jellyfin/app/kustomization.yaml deleted file mode 100644 index 2eb7698..0000000 --- a/.archive/kubernetes/default/jellyfin/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: default -resources: - - ./helmrelease.yaml - - ../../../../templates/volsync diff --git a/.archive/kubernetes/default/jellyfin/ks.yaml b/.archive/kubernetes/default/jellyfin/ks.yaml deleted file mode 100644 index f0daf55..0000000 --- a/.archive/kubernetes/default/jellyfin/ks.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app jellyfin - namespace: flux-system -spec: - dependsOn: - - name: external-secrets-stores - path: ./kubernetes/apps/default/jellyfin/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 10Gi diff --git a/.archive/kubernetes/home-automation/home-assistant/app/externalsecret.yaml b/.archive/kubernetes/home-automation/home-assistant/app/externalsecret.yaml deleted file mode 100644 index 112299d..0000000 --- a/.archive/kubernetes/home-automation/home-assistant/app/externalsecret.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: home-assistant -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: home-assistant-secret - creationPolicy: Owner - template: - engineVersion: v2 - data: - HASS_ELEVATION: "{{ .hass_elevation }}" - HASS_LATITUDE: "{{ .hass_latitude }}" - HASS_LONGITUDE: "{{ .hass_longitude }}" - dataFrom: - - extract: - key: home-assistant - rewrite: - - regexp: - source: "(.*)" - target: "hass_$1" diff --git a/.archive/kubernetes/home-automation/home-assistant/app/helmrelease.yaml b/.archive/kubernetes/home-automation/home-assistant/app/helmrelease.yaml deleted file mode 100644 index d451a21..0000000 --- a/.archive/kubernetes/home-automation/home-assistant/app/helmrelease.yaml +++ /dev/null @@ -1,90 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: home-assistant -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.1.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - values: - controllers: - home-assistant: - annotations: - reloader.stakater.com/auto: "true" - pod: - annotations: - k8s.v1.cni.cncf.io/networks: | - [{ - "name":"multus-iot", - "namespace": "kube-system", - "ips": ["10.1.3.151/24"] - }] - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - containers: - app: - image: - repository: ghcr.io/home-assistant/home-assistant - tag: 2024.5.5 - env: - TZ: America/Chicago - HASS_HTTP_TRUSTED_PROXY_1: 10.244.0.0/16 - envFrom: - - secretRef: - name: home-assistant-secret - resources: - requests: - cpu: 10m - limits: - memory: 1Gi - service: - app: - controller: home-assistant - ports: - http: - port: 8123 - ingress: - app: - className: internal-nginx - hosts: - - host: &host hass.jahanson.tech - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: [*host] - persistence: - config: - existingClaim: home-assistant - logs: - type: emptyDir - globalMounts: - - path: /config/logs - tts: - type: emptyDir - globalMounts: - - path: /config/tts - tmp: - type: emptyDir diff --git a/.archive/kubernetes/home-automation/home-assistant/app/kustomization.yaml b/.archive/kubernetes/home-automation/home-assistant/app/kustomization.yaml deleted file mode 100644 index be13d2d..0000000 --- a/.archive/kubernetes/home-automation/home-assistant/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ../../../../templates/volsync diff --git a/.archive/kubernetes/home-automation/home-assistant/ks.yaml b/.archive/kubernetes/home-automation/home-assistant/ks.yaml deleted file mode 100644 index 9aacacf..0000000 --- a/.archive/kubernetes/home-automation/home-assistant/ks.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app home-assistant - namespace: flux-system -spec: - targetNamespace: home-automation - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - - name: openebs-system - - name: volsync - path: ./kubernetes/apps/home-automation/home-assistant/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 5Gi diff --git a/.archive/kubernetes/home-automation/kustomization.yaml b/.archive/kubernetes/home-automation/kustomization.yaml deleted file mode 100644 index 3399296..0000000 --- a/.archive/kubernetes/home-automation/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./mosquitto/ks.yaml diff --git a/.archive/kubernetes/home-automation/matter-server/app/helmrelease.yaml b/.archive/kubernetes/home-automation/matter-server/app/helmrelease.yaml deleted file mode 100644 index c7d21f7..0000000 --- a/.archive/kubernetes/home-automation/matter-server/app/helmrelease.yaml +++ /dev/null @@ -1,107 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: &app matter-server -spec: - interval: 15m - chart: - spec: - chart: app-template - version: 3.2.1 - interval: 15m - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - maxHistory: 3 - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - values: - controllers: - matter-server: - type: statefulset - annotations: - reloader.stakater.com/auto: "true" - pod: - annotations: - k8s.v1.cni.cncf.io/networks: | - [{ - "name":"multus-iot", - "namespace": "kube-system", - "ips": ["10.1.3.152/24"] - }] - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - - containers: - app: - image: - repository: ghcr.io/home-assistant-libs/python-matter-server - tag: 6.0.1 - pullPolicy: IfNotPresent - env: - TZ: "America/Chicago" - MATTER_SERVER__INSTANCE_NAME: Matter-Server - MATTER_SERVER__PORT: &port 5580 - MATTER_SERVER__APPLICATION_URL: &host matter.jahanson.tech - MATTER_SERVER__LOG_LEVEL: info - probes: - liveness: - enabled: true - readiness: - enabled: true - startup: - enabled: true - spec: - failureThreshold: 30 - periodSeconds: 5 - resources: - requests: - memory: "100M" - limits: - memory: "500M" - service: - app: - controller: *app - type: LoadBalancer - annotations: - io.cilium/lb-ipam-ips: "10.1.1.37" - ports: - api: - enabled: true - primary: true - protocol: TCP - port: *port - externalTrafficPolicy: Cluster - persistence: - config: - enabled: true - existingClaim: matter-server - advancedMounts: - matter-server: - app: - - path: "/data" - ingress: - app: - className: internal-nginx - hosts: - - host: *host - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: [*host] diff --git a/.archive/kubernetes/home-automation/matter-server/app/kustomization.yaml b/.archive/kubernetes/home-automation/matter-server/app/kustomization.yaml deleted file mode 100644 index a928a56..0000000 --- a/.archive/kubernetes/home-automation/matter-server/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ../../../../templates/volsync diff --git a/.archive/kubernetes/home-automation/matter-server/ks.yaml b/.archive/kubernetes/home-automation/matter-server/ks.yaml deleted file mode 100644 index 177b905..0000000 --- a/.archive/kubernetes/home-automation/matter-server/ks.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app matter-server - namespace: flux-system -spec: - targetNamespace: home-automation - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: openebs-system - - name: volsync - path: ./kubernetes/apps/home-automation/matter-server/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 1Gi diff --git a/.archive/kubernetes/home-automation/mosquitto/app/config/mosquitto.conf b/.archive/kubernetes/home-automation/mosquitto/app/config/mosquitto.conf deleted file mode 100644 index a2b210d..0000000 --- a/.archive/kubernetes/home-automation/mosquitto/app/config/mosquitto.conf +++ /dev/null @@ -1,9 +0,0 @@ -per_listener_settings false -listener 1883 -allow_anonymous false -persistence true -persistence_location /data -autosave_interval 1800 -connection_messages false -autosave_interval 60 -password_file /mosquitto/external_config/mosquitto_pwd diff --git a/.archive/kubernetes/home-automation/mosquitto/app/externalsecret.yaml b/.archive/kubernetes/home-automation/mosquitto/app/externalsecret.yaml deleted file mode 100644 index c48a93a..0000000 --- a/.archive/kubernetes/home-automation/mosquitto/app/externalsecret.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: mosquitto -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: mosquitto-secret - creationPolicy: Owner - template: - engineVersion: v2 - data: - mosquitto_pwd: | - {{ .mosquitto_username }}:{{ .mosquitto_password }} - {{ .mosquitto_zwave_username }}:{{ .mosquitto_zwave_password }} - {{ .mosquitto_home_assistant_username }}:{{ .mosquitto_home_assistant_password }} - dataFrom: - - extract: - key: mosquitto - rewrite: - - regexp: - source: "(.*)" - target: "mosquitto_$1" diff --git a/.archive/kubernetes/home-automation/mosquitto/app/helmrelease.yaml b/.archive/kubernetes/home-automation/mosquitto/app/helmrelease.yaml deleted file mode 100644 index 96b5659..0000000 --- a/.archive/kubernetes/home-automation/mosquitto/app/helmrelease.yaml +++ /dev/null @@ -1,105 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app mosquitto -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.2.1 - interval: 30m - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - - values: - controllers: - mosquitto: - annotations: - reloader.stakater.com/auto: "true" - - pod: - securityContext: - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - - initContainers: - init-config: - image: - repository: public.ecr.aws/docker/library/eclipse-mosquitto - tag: 2.0.18 - command: - - "/bin/sh" - - "-c" - args: - - cp /tmp/secret/* /mosquitto/external_config/; - mosquitto_passwd -U /mosquitto/external_config/mosquitto_pwd; - chmod 0600 /mosquitto/external_config/mosquitto_pwd; - - containers: - app: - image: - repository: public.ecr.aws/docker/library/eclipse-mosquitto - tag: 2.0.18 - probes: - liveness: - enabled: true - readiness: - enabled: true - startup: - enabled: true - spec: - failureThreshold: 30 - periodSeconds: 5 - resources: - requests: - cpu: 5m - memory: 10M - limits: - memory: 10M - - service: - app: - controller: mosquitto - type: LoadBalancer - annotations: - external-dns.alpha.kubernetes.io/hostname: "mqtt.jahanson.tech" - io.cilium/lb-ipam-ips: "10.1.1.36" - externalTrafficPolicy: Local - ports: - mqtt: - enabled: true - port: 1883 - - persistence: - data: - existingClaim: *app - advancedMounts: - mosquitto: - app: - - path: /data - mosquitto-configfile: - type: configMap - name: mosquitto-configmap - advancedMounts: - mosquitto: - app: - - path: /mosquitto/config/mosquitto.conf - subPath: mosquitto.conf - mosquitto-secret: - type: secret - name: mosquitto-secret - advancedMounts: - mosquitto: - init-config: - - path: /tmp/secret - mosquitto-externalconfig: - type: emptyDir - globalMounts: - - path: /mosquitto/external_config diff --git a/.archive/kubernetes/home-automation/mosquitto/app/kustomization.yaml b/.archive/kubernetes/home-automation/mosquitto/app/kustomization.yaml deleted file mode 100644 index 9172dad..0000000 --- a/.archive/kubernetes/home-automation/mosquitto/app/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./externalsecret.yaml - - ../../../../templates/volsync -configMapGenerator: - - name: mosquitto-configmap - files: - - config/mosquitto.conf -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/home-automation/mosquitto/ks.yaml b/.archive/kubernetes/home-automation/mosquitto/ks.yaml deleted file mode 100644 index 9dbb672..0000000 --- a/.archive/kubernetes/home-automation/mosquitto/ks.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &appname mosquitto - namespace: flux-system -spec: - targetNamespace: home-automation - commonMetadata: - labels: - app.kubernetes.io/name: *appname - interval: 10m - path: "./kubernetes/apps/home-automation/mosquitto/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true - dependsOn: - - name: openebs - - name: volsync - - name: external-secrets-stores - postBuild: - substitute: - APP: *appname - VOLSYNC_CLAIM: mosquitto-data - VOLSYNC_CAPACITY: 512Mi diff --git a/.archive/kubernetes/home-automation/namespace.yaml b/.archive/kubernetes/home-automation/namespace.yaml deleted file mode 100644 index 2472a39..0000000 --- a/.archive/kubernetes/home-automation/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: home-automation - labels: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/.archive/kubernetes/kube-system/cilium/app/bgpcrd.yaml b/.archive/kubernetes/kube-system/cilium/app/bgpcrd.yaml deleted file mode 100644 index 30caa21..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/bgpcrd.yaml +++ /dev/null @@ -1,588 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.14.0 - creationTimestamp: null - name: ciliumbgppeeringpolicies.cilium.io -spec: - group: cilium.io - names: - categories: - - cilium - - ciliumbgp - kind: CiliumBGPPeeringPolicy - listKind: CiliumBGPPeeringPolicyList - plural: ciliumbgppeeringpolicies - shortNames: - - bgpp - singular: ciliumbgppeeringpolicy - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v2alpha1 - schema: - openAPIV3Schema: - description: CiliumBGPPeeringPolicy is a Kubernetes third-party resource for - instructing Cilium's BGP control plane to create virtual BGP routers. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Spec is a human readable description of a BGP peering policy - properties: - nodeSelector: - description: "NodeSelector selects a group of nodes where this BGP - Peering Policy applies. \n If empty / nil this policy applies to - all nodes." - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - enum: - - In - - NotIn - - Exists - - DoesNotExist - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - description: MatchLabelsValue represents the value from the - MatchLabels {key,value} pair. - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object - type: object - virtualRouters: - description: A list of CiliumBGPVirtualRouter(s) which instructs the - BGP control plane how to instantiate virtual BGP routers. - items: - description: CiliumBGPVirtualRouter defines a discrete BGP virtual - router configuration. - properties: - exportPodCIDR: - default: false - description: ExportPodCIDR determines whether to export the - Node's private CIDR block to the configured neighbors. - type: boolean - localASN: - description: LocalASN is the ASN of this virtual router. Supports - extended 32bit ASNs - format: int64 - maximum: 4294967295 - minimum: 0 - type: integer - neighbors: - description: Neighbors is a list of neighboring BGP peers for - this virtual router - items: - description: CiliumBGPNeighbor is a neighboring peer for use - in a CiliumBGPVirtualRouter configuration. - properties: - advertisedPathAttributes: - description: AdvertisedPathAttributes can be used to apply - additional path attributes to selected routes when advertising - them to the peer. If empty / nil, no additional path - attributes are advertised. - items: - description: CiliumBGPPathAttributes can be used to - apply additional path attributes to matched routes - when advertising them to a BGP peer. - properties: - communities: - description: Communities defines a set of community - values advertised in the supported BGP Communities - path attributes. If nil / not set, no BGP Communities - path attribute will be advertised. - properties: - large: - description: Large holds a list of the BGP Large - Communities Attribute (RFC 8092) values. - items: - description: BGPLargeCommunity type represents - a value of the BGP Large Communities Attribute - (RFC 8092), as three 4-byte decimal numbers - separated by colons. - pattern: ^([0-9]|[1-9][0-9]{1,8}|[1-3][0-9]{9}|4[01][0-9]{8}|42[0-8][0-9]{7}|429[0-3][0-9]{6}|4294[0-8][0-9]{5}|42949[0-5][0-9]{4}|429496[0-6][0-9]{3}|4294967[01][0-9]{2}|42949672[0-8][0-9]|429496729[0-5]):([0-9]|[1-9][0-9]{1,8}|[1-3][0-9]{9}|4[01][0-9]{8}|42[0-8][0-9]{7}|429[0-3][0-9]{6}|4294[0-8][0-9]{5}|42949[0-5][0-9]{4}|429496[0-6][0-9]{3}|4294967[01][0-9]{2}|42949672[0-8][0-9]|429496729[0-5]):([0-9]|[1-9][0-9]{1,8}|[1-3][0-9]{9}|4[01][0-9]{8}|42[0-8][0-9]{7}|429[0-3][0-9]{6}|4294[0-8][0-9]{5}|42949[0-5][0-9]{4}|429496[0-6][0-9]{3}|4294967[01][0-9]{2}|42949672[0-8][0-9]|429496729[0-5])$ - type: string - type: array - standard: - description: Standard holds a list of "standard" - 32-bit BGP Communities Attribute (RFC 1997) - values defined as numeric values. - items: - description: BGPStandardCommunity type represents - a value of the "standard" 32-bit BGP Communities - Attribute (RFC 1997) as a 4-byte decimal - number or two 2-byte decimal numbers separated - by a colon (<0-65535>:<0-65535>). For example, - no-export community value is 65553:65281. - pattern: ^([0-9]|[1-9][0-9]{1,8}|[1-3][0-9]{9}|4[01][0-9]{8}|42[0-8][0-9]{7}|429[0-3][0-9]{6}|4294[0-8][0-9]{5}|42949[0-5][0-9]{4}|429496[0-6][0-9]{3}|4294967[01][0-9]{2}|42949672[0-8][0-9]|429496729[0-5])$|^([0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]):([0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ - type: string - type: array - wellKnown: - description: WellKnown holds a list "standard" - 32-bit BGP Communities Attribute (RFC 1997) - values defined as well-known string aliases - to their numeric values. - items: - description: "BGPWellKnownCommunity type represents - a value of the \"standard\" 32-bit BGP Communities - Attribute (RFC 1997) as a well-known string - alias to its numeric value. Allowed values - and their mapping to the numeric values: - \n internet = 0x00000000 - (0:0) planned-shut = 0xffff0000 - (65535:0) accept-own = 0xffff0001 - (65535:1) route-filter-translated-v4 = 0xffff0002 - (65535:2) route-filter-v4 = 0xffff0003 - (65535:3) route-filter-translated-v6 = 0xffff0004 - (65535:4) route-filter-v6 = 0xffff0005 - (65535:5) llgr-stale = 0xffff0006 - (65535:6) no-llgr = 0xffff0007 - (65535:7) blackhole = 0xffff029a - (65535:666) no-export = - 0xffffff01\t(65535:65281) no-advertise = - 0xffffff02 (65535:65282) no-export-subconfed - \ = 0xffffff03 (65535:65283) no-peer - \ = 0xffffff04 (65535:65284)" - enum: - - internet - - planned-shut - - accept-own - - route-filter-translated-v4 - - route-filter-v4 - - route-filter-translated-v6 - - route-filter-v6 - - llgr-stale - - no-llgr - - blackhole - - no-export - - no-advertise - - no-export-subconfed - - no-peer - type: string - type: array - type: object - localPreference: - description: LocalPreference defines the preference - value advertised in the BGP Local Preference path - attribute. As Local Preference is only valid for - iBGP peers, this value will be ignored for eBGP - peers (no Local Preference path attribute will - be advertised). If nil / not set, the default - Local Preference of 100 will be advertised in - the Local Preference path attribute for iBGP peers. - format: int64 - maximum: 4294967295 - minimum: 0 - type: integer - selector: - description: Selector selects a group of objects - of the SelectorType resulting into routes that - will be announced with the configured Attributes. - If nil / not set, all objects of the SelectorType - are selected. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - enum: - - In - - NotIn - - Exists - - DoesNotExist - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - description: MatchLabelsValue represents the - value from the MatchLabels {key,value} pair. - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - selectorType: - description: 'SelectorType defines the object type - on which the Selector applies: - For "PodCIDR" - the Selector matches k8s CiliumNode resources - (path attributes apply to routes announced for - PodCIDRs of selected CiliumNodes. Only affects - routes of cluster scope / Kubernetes IPAM CIDRs, - not Multi-Pool IPAM CIDRs. - For "CiliumLoadBalancerIPPool" - the Selector matches CiliumLoadBalancerIPPool - custom resources (path attributes apply to routes - announced for selected CiliumLoadBalancerIPPools). - - For "CiliumPodIPPool" the Selector matches CiliumPodIPPool - custom resources (path attributes apply to routes - announced for allocated CIDRs of selected CiliumPodIPPools).' - enum: - - PodCIDR - - CiliumLoadBalancerIPPool - - CiliumPodIPPool - type: string - required: - - selectorType - type: object - type: array - authSecretRef: - description: AuthSecretRef is the name of the secret to - use to fetch a TCP authentication password for this - peer. - type: string - connectRetryTimeSeconds: - default: 120 - description: ConnectRetryTimeSeconds defines the initial - value for the BGP ConnectRetryTimer (RFC 4271, Section - 8). - format: int32 - maximum: 2147483647 - minimum: 1 - type: integer - eBGPMultihopTTL: - default: 1 - description: EBGPMultihopTTL controls the multi-hop feature - for eBGP peers. Its value defines the Time To Live (TTL) - value used in BGP packets sent to the neighbor. The - value 1 implies that eBGP multi-hop feature is disabled - (only a single hop is allowed). This field is ignored - for iBGP peers. - format: int32 - maximum: 255 - minimum: 1 - type: integer - families: - description: "Families, if provided, defines a set of - AFI/SAFIs the speaker will negotiate with it's peer. - \n If this slice is not provided the default families - of IPv6 and IPv4 will be provided." - items: - description: CiliumBGPFamily represents a AFI/SAFI address - family pair. - properties: - afi: - description: Afi is the Address Family Identifier - (AFI) of the family. - enum: - - ipv4 - - ipv6 - - l2vpn - - ls - - opaque - type: string - safi: - description: Safi is the Subsequent Address Family - Identifier (SAFI) of the family. - enum: - - unicast - - multicast - - mpls_label - - encapsulation - - vpls - - evpn - - ls - - sr_policy - - mup - - mpls_vpn - - mpls_vpn_multicast - - route_target_constraints - - flowspec_unicast - - flowspec_vpn - - key_value - type: string - required: - - afi - - safi - type: object - type: array - gracefulRestart: - description: GracefulRestart defines graceful restart - parameters which are negotiated with this neighbor. - If empty / nil, the graceful restart capability is disabled. - properties: - enabled: - description: Enabled flag, when set enables graceful - restart capability. - type: boolean - restartTimeSeconds: - default: 120 - description: RestartTimeSeconds is the estimated time - it will take for the BGP session to be re-established - with peer after a restart. After this period, peer - will remove stale routes. This is described RFC - 4724 section 4.2. - format: int32 - maximum: 4095 - minimum: 1 - type: integer - required: - - enabled - type: object - holdTimeSeconds: - default: 90 - description: HoldTimeSeconds defines the initial value - for the BGP HoldTimer (RFC 4271, Section 4.2). Updating - this value will cause a session reset. - format: int32 - maximum: 65535 - minimum: 3 - type: integer - keepAliveTimeSeconds: - default: 30 - description: KeepaliveTimeSeconds defines the initial - value for the BGP KeepaliveTimer (RFC 4271, Section - 8). It can not be larger than HoldTimeSeconds. Updating - this value will cause a session reset. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - peerASN: - description: PeerASN is the ASN of the peer BGP router. - Supports extended 32bit ASNs - format: int64 - maximum: 4294967295 - minimum: 0 - type: integer - peerAddress: - description: PeerAddress is the IP address of the peer. - This must be in CIDR notation and use a /32 to express - a single host. - format: cidr - type: string - peerPort: - default: 179 - description: PeerPort is the TCP port of the peer. 1-65535 - is the range of valid port numbers that can be specified. - If unset, defaults to 179. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - peerASN - - peerAddress - type: object - minItems: 1 - type: array - podIPPoolSelector: - description: "PodIPPoolSelector selects CiliumPodIPPools based - on labels. The virtual router will announce allocated CIDRs - of matching CiliumPodIPPools. \n If empty / nil no CiliumPodIPPools - will be announced." - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, - Exists and DoesNotExist. - enum: - - In - - NotIn - - Exists - - DoesNotExist - type: string - values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists or - DoesNotExist, the values array must be empty. This - array is replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - description: MatchLabelsValue represents the value from - the MatchLabels {key,value} pair. - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field is - "key", the operator is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - serviceSelector: - description: "ServiceSelector selects a group of load balancer - services which this virtual router will announce. The loadBalancerClass - for a service must be nil or specify a class supported by - Cilium, e.g. \"io.cilium/bgp-control-plane\". Refer to the - following document for additional details regarding load balancer - classes: \n https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class - \n If empty / nil no services will be announced." - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, - Exists and DoesNotExist. - enum: - - In - - NotIn - - Exists - - DoesNotExist - type: string - values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists or - DoesNotExist, the values array must be empty. This - array is replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - description: MatchLabelsValue represents the value from - the MatchLabels {key,value} pair. - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field is - "key", the operator is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - required: - - localASN - - neighbors - type: object - minItems: 1 - type: array - required: - - virtualRouters - type: object - required: - - metadata - type: object - served: true - storage: true - subresources: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] \ No newline at end of file diff --git a/.archive/kubernetes/kube-system/cilium/app/bgppeeringpolicy.yaml b/.archive/kubernetes/kube-system/cilium/app/bgppeeringpolicy.yaml deleted file mode 100644 index aef9be3..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/bgppeeringpolicy.yaml +++ /dev/null @@ -1,36 +0,0 @@ ---- -apiVersion: cilium.io/v2alpha1 -kind: CiliumBGPPeeringPolicy -# comments courtesy of JJGadgets -# MAKE SURE CRDs ARE INSTALLED IN CLUSTER VIA cilium-config ConfigMap OR Cilium HelmRelease/values.yaml (bgpControlPlane.enabled: true), BEFORE THIS IS APPLIED! -# "CiliumBGPPeeringPolicy" Custom Resource will replace the old MetalLB BGP's "bgp-config" ConfigMap -# "CiliumBGPPeeringPolicy" is used with `bgpControlPlane.enabled: true` which uses GoBGP, NOT the old `bgp.enabled: true` which uses MetalLB -metadata: - name: bgp-loadbalancer-ip-main -spec: - nodeSelector: - matchLabels: - kubernetes.io/os: "linux" # match all Linux nodes, change this to match more granularly if more than 1 PeeringPolicy is to be used throughout cluster - virtualRouters: - - localASN: 64512 - exportPodCIDR: false - serviceSelector: # this replaces address-pools, instead of defining the range of IPs that can be assigned to LoadBalancer services, now services have to match below selectors for their LB IPs to be announced - matchExpressions: - - { - key: thisFakeSelector, - operator: NotIn, - values: ["will-match-and-announce-all-services"], - } - neighbors: - - peerAddress: "10.1.1.1/32" # unlike bgp-config ConfigMap, peerAddress needs to be in CIDR notation - peerASN: 64512 - ---- -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumloadbalancerippool_v2alpha1.json -apiVersion: "cilium.io/v2alpha1" -kind: CiliumLoadBalancerIPPool -metadata: - name: main-pool -spec: - cidrs: - - cidr: 10.45.0.1/24 diff --git a/.archive/kubernetes/kube-system/cilium/app/helmrelease.yaml b/.archive/kubernetes/kube-system/cilium/app/helmrelease.yaml deleted file mode 100644 index 7cc936c..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/helmrelease.yaml +++ /dev/null @@ -1,78 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: cilium - namespace: kube-system -spec: - interval: 30m - chart: - spec: - chart: cilium - version: 1.15.3 - sourceRef: - kind: HelmRepository - name: cilium - namespace: flux-system - maxHistory: 2 - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - uninstall: - keepHistory: false - values: - cluster: - name: homelab - id: 1 - hubble: - relay: - enabled: true - ui: - enabled: true - metrics: - enableOpenMetrics: true - prometheus: - enabled: true - operator: - prometheus: - enabled: true - ipam: - mode: kubernetes - kubeProxyReplacement: true - k8sServiceHost: 127.0.0.1 - k8sServicePort: 7445 - rollOutCiliumPods: true - cgroup: - automount: - enabled: false - hostRoot: /sys/fs/cgroup - bgp: - enabled: false - announce: - loadbalancerIP: true - podCIDR: false - bgpControlPlane: - enabled: true - securityContext: - capabilities: - ciliumAgent: - - CHOWN - - KILL - - NET_ADMIN - - NET_RAW - - IPC_LOCK - - SYS_ADMIN - - SYS_RESOURCE - - DAC_OVERRIDE - - FOWNER - - SETGID - - SETUID - cleanCiliumState: - - NET_ADMIN - - SYS_ADMIN - - SYS_RESOURCE diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/allow-ssh.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/allow-ssh.yaml deleted file mode 100644 index 0a295ed..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/allow-ssh.yaml +++ /dev/null @@ -1,23 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumClusterwideNetworkPolicy -metadata: - name: allow-ssh -spec: - description: "" - nodeSelector: - matchLabels: - # node-access: ssh - node-role.kubernetes.io/control-plane: "true" - ingress: - - fromEntities: - - cluster - - toPorts: - - ports: - - port: "22" - protocol: TCP - - icmps: - - fields: - - type: 8 - family: IPv4 diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/apiserver.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/apiserver.yaml deleted file mode 100644 index 7956dc9..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/apiserver.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumClusterwideNetworkPolicy -metadata: - name: api-server -spec: - nodeSelector: - # apply to master nodes - matchLabels: - node-role.kubernetes.io/control-plane: 'true' - ingress: - # load balancer -> api server - - fromCIDR: - - 167.235.217.82/32 - toPorts: - - ports: - - port: '6443' - protocol: TCP - egress: - # api server -> kubelet - - toEntities: - - remote-node - toPorts: - - ports: - - port: '10250' - protocol: TCP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/cilium-health.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/cilium-health.yaml deleted file mode 100644 index e4c56f8..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/cilium-health.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumClusterwideNetworkPolicy -metadata: - name: cilium-health -specs: - - endpointSelector: - # apply to health endpoints - matchLabels: - reserved:health: '' - ingress: - # cilium agent -> cilium agent - - fromEntities: - - host - - remote-node - toPorts: - - ports: - - port: '4240' - protocol: TCP - - nodeSelector: - # apply to all nodes - matchLabels: {} - ingress: - # cilium agent -> cilium agent - - fromEntities: - - health - - remote-node - toPorts: - - ports: - - port: '4240' - protocol: TCP - egress: - # cilium agent -> cilium agent - - toEntities: - - health - - remote-node - toPorts: - - ports: - - port: '4240' - protocol: TCP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/cilium-vxlan.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/cilium-vxlan.yaml deleted file mode 100644 index 98f0929..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/cilium-vxlan.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumClusterwideNetworkPolicy -metadata: - name: cilium-vxlan -spec: - nodeSelector: - # apply to all nodes - matchLabels: {} - ingress: - # node -> vxlan - - fromEntities: - - remote-node - toPorts: - - ports: - - port: '8472' - protocol: UDP - egress: - # node -> vxlan - - toEntities: - - remote-node - toPorts: - - ports: - - port: '8472' - protocol: UDP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/core-dns.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/core-dns.yaml deleted file mode 100644 index f31c8b7..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/core-dns.yaml +++ /dev/null @@ -1,65 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumnetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumNetworkPolicy -metadata: - name: core-dns - namespace: kube-system -specs: - - nodeSelector: - # apply to master nodes - matchLabels: - node-role.kubernetes.io/control-plane: 'true' - ingress: - # core dns -> api server - - fromEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: coredns - toPorts: - - ports: - - port: '6443' - protocol: TCP - - nodeSelector: - # apply to all nodes - matchLabels: {} - egress: - # kubelet -> core dns probes - - toEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: coredns - toPorts: - - ports: - - port: '8080' - protocol: TCP - - port: '8181' - protocol: TCP - - endpointSelector: - # apply to core dns pods - matchLabels: - io.cilium.k8s.policy.serviceaccount: coredns - ingress: - # kubelet -> core dns probes - - fromEntities: - - host - toPorts: - - ports: - - port: '8080' - protocol: TCP - - port: '8181' - protocol: TCP - egress: - # core dns -> api server - - toEntities: - - kube-apiserver - toPorts: - - ports: - - port: '6443' - protocol: TCP - # core dns -> upstream DNS - - toCIDR: - - 185.12.64.1/32 - - 185.12.64.2/32 - toPorts: - - ports: - - port: '53' - protocol: UDP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/etcd.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/etcd.yaml deleted file mode 100644 index e239332..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/etcd.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumClusterwideNetworkPolicy -metadata: - name: etcd -spec: - nodeSelector: - # apply to master nodes - matchLabels: - node-role.kubernetes.io/control-plane: 'true' - ingress: - # etcd peer -> etcd peer - - fromEntities: - - remote-node - toPorts: - - ports: - - port: '2380' - protocol: TCP - egress: - # etcd peer -> etcd peer - - toEntities: - - remote-node - toPorts: - - ports: - - port: '2380' - protocol: TCP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/fix-apiserver.yml b/.archive/kubernetes/kube-system/cilium/app/netpols/fix-apiserver.yml deleted file mode 100644 index 798ae74..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/fix-apiserver.yml +++ /dev/null @@ -1,15 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: "cilium.io/v2" -kind: CiliumClusterwideNetworkPolicy -metadata: - name: allow-specific-traffic -spec: - endpointSelector: {} - ingress: - - fromEntities: - - host - toPorts: - - ports: - - port: '6443' - protocol: TCP \ No newline at end of file diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/hubble-relay.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/hubble-relay.yaml deleted file mode 100644 index 0473f98..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/hubble-relay.yaml +++ /dev/null @@ -1,50 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumnetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumNetworkPolicy -metadata: - name: hubble-relay - namespace: kube-system -specs: - - nodeSelector: - # apply to all nodes - matchLabels: {} - ingress: - # hubble relay -> hubble agent - - fromEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-relay - toPorts: - - ports: - - port: '4244' - protocol: TCP - egress: - # kubelet -> hubble relay probes - - toEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-relay - toPorts: - - ports: - - port: '4245' - protocol: TCP - - endpointSelector: - # apply to hubble relay pods - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-relay - ingress: - # kubelet -> hubble relay probes - - fromEntities: - - host - toPorts: - - ports: - - port: '4245' - protocol: TCP - egress: - # hubble relay -> hubble agent - - toEntities: - - host - - remote-node - toPorts: - - ports: - - port: '4244' - protocol: TCP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/hubble-ui.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/hubble-ui.yaml deleted file mode 100644 index c4914d0..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/hubble-ui.yaml +++ /dev/null @@ -1,75 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumnetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumNetworkPolicy -metadata: - name: hubble-ui - namespace: kube-system -specs: - - nodeSelector: - # apply to master nodes - matchLabels: - node-role.kubernetes.io/control-plane: '' - ingress: - # hubble ui -> api server - - fromEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-ui - toPorts: - - ports: - - port: '6443' - protocol: TCP - - endpointSelector: - # apply to core dns endpoints - matchLabels: - io.cilium.k8s.policy.serviceaccount: coredns - ingress: - # hubble ui -> core dns - - fromEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-ui - toPorts: - - ports: - - port: '53' - protocol: UDP - - endpointSelector: - # apply to hubble relay endpoints - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-relay - ingress: - # hubble ui -> hubble relay - - fromEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-ui - toPorts: - - ports: - - port: '4245' - protocol: TCP - - endpointSelector: - # apply to hubble ui endpoints - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-ui - egress: - # hubble ui -> api server - - toEntities: - - kube-apiserver - toPorts: - - ports: - - port: '6443' - protocol: TCP - # hubble ui -> hubble relay - - toEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: hubble-relay - toPorts: - - ports: - - port: '4245' - protocol: TCP - # hubble ui -> core dns - - toEndpoints: - - matchLabels: - io.cilium.k8s.policy.serviceaccount: coredns - toPorts: - - ports: - - port: '53' - protocol: UDP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/kubelet.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/kubelet.yaml deleted file mode 100644 index 23d5060..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/kubelet.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/cilium.io/ciliumclusterwidenetworkpolicy_v2.json ---- -apiVersion: cilium.io/v2 -kind: CiliumClusterwideNetworkPolicy -metadata: - name: kubelet -spec: - nodeSelector: - # apply to all nodes - matchLabels: {} - ingress: - # api server -> kubelet - - fromEntities: - - kube-apiserver - toPorts: - - ports: - - port: '10250' - protocol: TCP - egress: - # kubelet -> load balancer - - toCIDR: - - 167.235.217.82/32 - toEntities: - - host - toPorts: - - ports: - - port: '6443' - protocol: TCP diff --git a/.archive/kubernetes/kube-system/cilium/app/netpols/kustomization.yaml b/.archive/kubernetes/kube-system/cilium/app/netpols/kustomization.yaml deleted file mode 100644 index ceec6c3..0000000 --- a/.archive/kubernetes/kube-system/cilium/app/netpols/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: kube-system -resources: - - ./allow-ssh.yaml - - ./apiserver.yaml - - ./cilium-health.yaml - - ./cilium-vxlan.yaml - - ./core-dns.yaml - - ./etcd.yaml - - ./hubble-relay.yaml - - ./hubble-ui.yaml - - ./kubelet.yaml - diff --git a/.archive/kubernetes/kube-system/cilium/ks.yaml b/.archive/kubernetes/kube-system/cilium/ks.yaml deleted file mode 100644 index b9adeed..0000000 --- a/.archive/kubernetes/kube-system/cilium/ks.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: cilium - namespace: flux-system -spec: - interval: 30m - retryInterval: 1m - timeout: 5m - path: "./kubernetes/apps/kube-system/cilium/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false diff --git a/.archive/kubernetes/kube-system/spegel/app/resources/values.yml b/.archive/kubernetes/kube-system/spegel/app/resources/values.yml deleted file mode 100644 index 10b68bc..0000000 --- a/.archive/kubernetes/kube-system/spegel/app/resources/values.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- -spegel: - containerdSock: /run/containerd/containerd.sock - containerdRegistryConfigPath: /etc/cri/conf.d/hosts - registries: - - https://docker.io - - https://ghcr.io - - https://quay.io - - https://mcr.microsoft.com - - https://public.ecr.aws - - https://gcr.io - - https://registry.k8s.io - - https://k8s.gcr.io - - https://lscr.io -service: - registry: - hostPort: 29999 diff --git a/.archive/kubernetes/kube-system/zfs-scrub/app/helmrelease.yaml b/.archive/kubernetes/kube-system/zfs-scrub/app/helmrelease.yaml deleted file mode 100644 index 4d7b31b..0000000 --- a/.archive/kubernetes/kube-system/zfs-scrub/app/helmrelease.yaml +++ /dev/null @@ -1,109 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app zfs-scrub -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.2.1 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - kubanetics: - type: cronjob - cronjob: - schedule: "@weekly" - parallelism: 1 # Set to my total number of nodes - containers: - app: - image: - repository: ghcr.io/aarnaud/talos-debug-tools - tag: latest-6.6.29 - command: ["/bin/bash", "-c"] - args: - - | - # Trim filesystems - chroot /host /usr/local/sbin/zpool scrub nahar - probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false - resources: - requests: - cpu: 25m - limits: - memory: 128Mi - securityContext: - privileged: true - pod: - hostNetwork: true - hostPID: true - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: *app - persistence: - netfs: - type: hostPath - hostPath: /sys - hostPathType: Directory - globalMounts: - - path: /sys - readOnly: true - dev: - type: hostPath - hostPath: /dev - hostPathType: Directory - globalMounts: - - path: /dev - modules: - type: hostPath - hostPath: /lib/modules - hostPathType: "" - globalMounts: - - path: /lib/modules - udev: - type: hostPath - hostPath: /run/udev - hostPathType: "" - globalMounts: - - path: /run/udev - localtime: - type: hostPath - hostPath: /etc/localtime - hostPathType: "" - globalMounts: - - path: /etc/localtime - host: - type: hostPath - hostPath: / - hostPathType: Directory - globalMounts: - - path: /host - efivars: - type: hostPath - hostPath: /sys/firmware/efi/efivars - hostPathType: "" - globalMounts: - - path: /sys/firmware/efi/efivars diff --git a/.archive/kubernetes/kube-system/zfs-scrub/app/kustomization.yaml b/.archive/kubernetes/kube-system/zfs-scrub/app/kustomization.yaml deleted file mode 100644 index 28e28a0..0000000 --- a/.archive/kubernetes/kube-system/zfs-scrub/app/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml -configMapGenerator: - - name: zfs-scrub-configmap - files: - - zfs-scrub.sh=./resources/zfs-scrub.sh -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/kube-system/zfs-scrub/app/resources/zfs-scrub.sh b/.archive/kubernetes/kube-system/zfs-scrub/app/resources/zfs-scrub.sh deleted file mode 100644 index d90d0d9..0000000 --- a/.archive/kubernetes/kube-system/zfs-scrub/app/resources/zfs-scrub.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/env bash -KUBELET_BIN="/usr/local/bin/kubelet" -KUBELET_PID="$(pgrep -f $KUBELET_BIN)" -ZPOOL="nahar" - -if [ -z "${KUBELET_PID}" ]; then - echo "kubelet not found" - exit 1 -fi - -# Enter namespaces and run commands -nsrun() { - nsenter \ - --mount="/host/proc/${KUBELET_PID}/ns/mnt" \ - --net="/host/proc/${KUBELET_PID}/ns/net" \ - -- bash -c "$1" -} - -# Scrub filesystems -nsrun "zpool scrub ${ZPOOL}" diff --git a/.archive/kubernetes/kube-system/zfs-scrub/ks.yaml b/.archive/kubernetes/kube-system/zfs-scrub/ks.yaml deleted file mode 100644 index 0354a48..0000000 --- a/.archive/kubernetes/kube-system/zfs-scrub/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app zfs-scrub - namespace: flux-system -spec: - targetNamespace: kube-system - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/kube-system/zfs-scrub/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/.archive/kubernetes/media/immich/app/configmap.yaml b/.archive/kubernetes/media/immich/app/configmap.yaml deleted file mode 100644 index a7555bc..0000000 --- a/.archive/kubernetes/media/immich/app/configmap.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: immich-app-config - labels: - app.kubernetes.io/name: immich -data: - LOG_LEVEL: verbose - DB_VECTOR_EXTENSION: pgvector - NODE_ENV: production - REDIS_HOSTNAME: dragonfly.database.svc.cluster.local - REDIS_PORT: "6379" - IMMICH_WEB_URL: http://immich-web.media.svc.cluster.local:3000 - IMMICH_SERVER_URL: http://immich-server.media.svc.cluster.local:3001 - IMMICH_MACHINE_LEARNING_URL: http://immich-machine-learning.media.svc.cluster.local:3003 diff --git a/.archive/kubernetes/media/immich/app/externalsecret.yaml b/.archive/kubernetes/media/immich/app/externalsecret.yaml deleted file mode 100644 index d093fd4..0000000 --- a/.archive/kubernetes/media/immich/app/externalsecret.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: immich -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: immich-secret - template: - engineVersion: v2 - data: - DATABASE_URI: "postgresql://{{ .DATABASE_USER }}:{{ .DATABASE_PASSWORD }}@immich-primary-real.media.svc:{{ .DATABASE_PORT }}/{{ .DATABASE_NAME }}" - dataFrom: - - extract: - key: immich diff --git a/.archive/kubernetes/media/immich/app/gatus.yaml b/.archive/kubernetes/media/immich/app/gatus.yaml deleted file mode 100644 index aa97695..0000000 --- a/.archive/kubernetes/media/immich/app/gatus.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: immich-postgres-gatus-ep - labels: - gatus.io/enabled: "true" -data: - config.yaml: | - endpoints: - - name: immich-postgres - group: infrastructure - url: tcp://immich-primary-real.media.svc.cluster.local:5432 - interval: 1m - ui: - hide-url: true - hide-hostname: true - conditions: - - "[CONNECTED] == true" - alerts: - - type: pushover diff --git a/.archive/kubernetes/media/immich/app/helmrelease.yaml b/.archive/kubernetes/media/immich/app/helmrelease.yaml deleted file mode 100644 index 392018e..0000000 --- a/.archive/kubernetes/media/immich/app/helmrelease.yaml +++ /dev/null @@ -1,97 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: &name immich - namespace: default -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.1.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - immich-server: - type: statefulset - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: ghcr.io/immich-app/immich-server - tag: v1.105.1 - command: /bin/sh - args: - - ./start-server.sh - probes: - startup: - enabled: true - spec: - failureThreshold: 30 - periodSeconds: 5 - liveness: - enabled: true - readiness: - enabled: true - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - memory: 4Gi - env: - TZ: America/Chicago - DB_URL: - valueFrom: - secretKeyRef: - name: immich-secret - key: DATABASE_URI - envFrom: - - configMapRef: - name: immich-app-config - service: - app: - controller: immich-server - ports: - http: - port: 3001 - ingress: - app: - enabled: true - className: external-nginx - annotations: - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" - external-dns.alpha.kubernetes.io/target: external.hsn.dev - nginx.ingress.kubernetes.io/proxy-body-size: "0" - hosts: - - host: &host "im.hsn.dev" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - media: - enabled: true - type: nfs - server: 10.1.1.13 - path: /eru/media/immich - globalMounts: - - path: /usr/src/app/upload diff --git a/.archive/kubernetes/media/immich/app/kustomization.yaml b/.archive/kubernetes/media/immich/app/kustomization.yaml deleted file mode 100644 index e2d93ed..0000000 --- a/.archive/kubernetes/media/immich/app/kustomization.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./configmap.yaml - - ./externalsecret.yaml - - ./gatus.yaml - - ./helmrelease.yaml - - ./machine-learning - - ./microservices - - ./postgresCluster.yaml - - ./pushsecret.yaml - - ./service.yaml -configMapGenerator: - - name: immich-databse-init-sql - files: - - init.sql=./resources/init.sql -labels: - - pairs: - app.kubernetes.io/name: immich - app.kubernetes.io/instance: immich - app.kubernetes.io/part-of: immich -generatorOptions: - disableNameSuffixHash: true - annotations: - kustomize.toolkit.fluxcd.io/substitute: disabled diff --git a/.archive/kubernetes/media/immich/app/machine-learning/helmrelease.yaml b/.archive/kubernetes/media/immich/app/machine-learning/helmrelease.yaml deleted file mode 100644 index a481b4c..0000000 --- a/.archive/kubernetes/media/immich/app/machine-learning/helmrelease.yaml +++ /dev/null @@ -1,82 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: immich-machine-learning -spec: - interval: 15m - chart: - spec: - chart: app-template - version: 3.1.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - interval: 15m - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - immich-machine-learning: - annotations: - reloader.stakater.com/auto: "true" - strategy: Recreate - pod: - nodeSelector: - nvidia.com/gpu.present: "true" - runtimeClassName: nvidia - containers: - app: - image: - repository: ghcr.io/immich-app/immich-machine-learning - tag: v1.105.1 - resources: - requests: - cpu: 15m - memory: 250Mi - limits: - memory: 4000Mi - probes: - startup: - enabled: true - spec: - failureThreshold: 30 - periodSeconds: 5 - liveness: - enabled: true - readiness: - enabled: true - envFrom: - - configMapRef: - name: immich-app-config - env: - DB_URL: - valueFrom: - secretKeyRef: - name: immich-secret - key: DATABASE_URI - service: - app: - controller: immich-machine-learning - ports: - http: - port: 3003 - persistence: - media: - enabled: true - type: nfs - server: 10.1.1.13 - path: /eru/media/immich - globalMounts: - - path: /usr/src/app/upload - cache: - enabled: true - type: emptyDir diff --git a/.archive/kubernetes/media/immich/app/machine-learning/kustomization.yaml b/.archive/kubernetes/media/immich/app/machine-learning/kustomization.yaml deleted file mode 100644 index 11efb15..0000000 --- a/.archive/kubernetes/media/immich/app/machine-learning/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -labels: - - pairs: - app.kubernetes.io/name: immich-machine-learning - app.kubernetes.io/instance: immich-machine-learning - app.kubernetes.io/part-of: immich -resources: - - ./helmrelease.yaml diff --git a/.archive/kubernetes/media/immich/app/microservices/helmrelease.yaml b/.archive/kubernetes/media/immich/app/microservices/helmrelease.yaml deleted file mode 100644 index 420f718..0000000 --- a/.archive/kubernetes/media/immich/app/microservices/helmrelease.yaml +++ /dev/null @@ -1,80 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: immich-microservices -spec: - interval: 15m - chart: - spec: - chart: app-template - version: 3.1.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - interval: 15m - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - immich-microservices: - strategy: Recreate - annotations: - reloader.stakater.com/auto: "true" - pod: - nodeSelector: - nvidia.com/gpu.present: "true" - runtimeClassName: nvidia - containers: - app: - image: - repository: ghcr.io/immich-app/immich-server - tag: v1.105.1 - command: /bin/sh - args: - - ./start-microservices.sh - resources: - requests: - cpu: 100m - memory: 250Mi - limits: - memory: 4000Mi - probes: - startup: - enabled: true - spec: - failureThreshold: 30 - periodSeconds: 5 - liveness: - enabled: true - readiness: - enabled: true - envFrom: - - configMapRef: - name: immich-app-config - env: - DB_URL: - valueFrom: - secretKeyRef: - name: immich-secret - key: DATABASE_URI - service: - app: - controller: immich-microservices - enabled: false - persistence: - media: - enabled: true - type: nfs - server: 10.1.1.13 - path: /eru/media/immich - globalMounts: - - path: /usr/src/app/upload diff --git a/.archive/kubernetes/media/immich/app/microservices/kustomization.yaml b/.archive/kubernetes/media/immich/app/microservices/kustomization.yaml deleted file mode 100644 index 3184c84..0000000 --- a/.archive/kubernetes/media/immich/app/microservices/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -labels: - - pairs: - app.kubernetes.io/name: immich-microservices - app.kubernetes.io/instance: immich-microservices - app.kubernetes.io/part-of: immich -resources: - - ./helmrelease.yaml diff --git a/.archive/kubernetes/media/immich/app/postgresCluster.yaml b/.archive/kubernetes/media/immich/app/postgresCluster.yaml deleted file mode 100644 index 0cd139c..0000000 --- a/.archive/kubernetes/media/immich/app/postgresCluster.yaml +++ /dev/null @@ -1,94 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/postgres-operator.crunchydata.com/postgrescluster_v1beta1.json -apiVersion: postgres-operator.crunchydata.com/v1beta1 -kind: PostgresCluster -metadata: - name: &name "${APP}" -spec: - postgresVersion: 16 - dataSource: - pgbackrest: - stanza: db - configuration: - - secret: - name: pgo-s3-creds - global: - repo1-path: "/${APP}/repo1" - repo1-s3-uri-style: path - repo: - name: repo1 - s3: - bucket: "crunchy-postgres" - endpoint: "s3.hsn.dev" - region: "us-east-1" - monitoring: - pgmonitor: - exporter: - # https://github.com/CrunchyData/postgres-operator-examples/blob/main/helm/install/values.yaml - image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.15.0-3 - patroni: - dynamicConfiguration: - synchronous_mode: true - postgresql: - synchronous_commit: "on" - pg_hba: - - hostnossl all all 10.244.0.0/16 md5 - - hostssl all all all md5 - databaseInitSQL: - name: immich-databse-init-sql - key: init.sql - instances: - - name: postgres - metadata: - labels: - app.kubernetes.io/name: pgo-${APP} - replicas: 1 - dataVolumeClaimSpec: - storageClassName: openebs-zfs - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: "kubernetes.io/hostname" - whenUnsatisfiable: "DoNotSchedule" - labelSelector: - matchLabels: - postgres-operator.crunchydata.com/cluster: ${APP} - postgres-operator.crunchydata.com/data: postgres - users: - - name: "immich" - databases: - - "immich" - options: "SUPERUSER" - password: - type: AlphaNumeric - backups: - pgbackrest: - configuration: - - secret: - name: pgo-s3-creds - global: - archive-push-queue-max: 4GiB - repo1-retention-full: "14" - repo1-retention-full-type: time - repo1-path: "/${APP}/repo1" - repo1-s3-uri-style: path - manual: - repoName: repo1 - options: - - --type=full - metadata: - labels: - app.kubernetes.io/name: pgo-${APP}-backup - repos: - - name: repo1 - schedules: - full: "0 1 * * 0" - differential: "0 1 * * 1-6" - s3: - bucket: "crunchy-postgres" - endpoint: "s3.hsn.dev" - region: "us-east-1" diff --git a/.archive/kubernetes/media/immich/app/pushsecret.yaml b/.archive/kubernetes/media/immich/app/pushsecret.yaml deleted file mode 100644 index 6a84b35..0000000 --- a/.archive/kubernetes/media/immich/app/pushsecret.yaml +++ /dev/null @@ -1,40 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/pushsecret_v1alpha1.json -apiVersion: external-secrets.io/v1alpha1 -kind: PushSecret -metadata: - name: immich -spec: - refreshInterval: 1h - secretStoreRefs: - - name: onepassword-connect - kind: ClusterSecretStore - selector: - secret: - name: immich-pguser-immich - data: - - match: - secretKey: dbname - remoteRef: - remoteKey: immich - property: DATABASE_NAME - - match: - secretKey: host - remoteRef: - remoteKey: immich - property: DATABASE_HOST - - match: - secretKey: user - remoteRef: - remoteKey: immich - property: DATABASE_USER - - match: - secretKey: password - remoteRef: - remoteKey: immich - property: DATABASE_PASSWORD - - match: - secretKey: port - remoteRef: - remoteKey: immich - property: DATABASE_PORT diff --git a/.archive/kubernetes/media/immich/app/resources/init.sql b/.archive/kubernetes/media/immich/app/resources/init.sql deleted file mode 100644 index af7e500..0000000 --- a/.archive/kubernetes/media/immich/app/resources/init.sql +++ /dev/null @@ -1,4 +0,0 @@ -\c immich\\ -CREATE EXTENSION vector; -CREATE EXTENSION cube; -CREATE EXTENSION earthdistance; diff --git a/.archive/kubernetes/media/immich/app/service.yaml b/.archive/kubernetes/media/immich/app/service.yaml deleted file mode 100644 index 863dc52..0000000 --- a/.archive/kubernetes/media/immich/app/service.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - labels: - postgres-operator.crunchydata.com/cluster: immich - postgres-operator.crunchydata.com/role: primary - name: immich-primary-real - namespace: media -spec: - internalTrafficPolicy: Cluster - ports: - - name: postgres - port: 5432 - protocol: TCP - targetPort: postgres - selector: - postgres-operator.crunchydata.com/cluster: immich - postgres-operator.crunchydata.com/role: master - type: ClusterIP diff --git a/.archive/kubernetes/media/immich/ks.yaml b/.archive/kubernetes/media/immich/ks.yaml deleted file mode 100644 index 61788fa..0000000 --- a/.archive/kubernetes/media/immich/ks.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app immich - namespace: flux-system -spec: - targetNamespace: media - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: crunchy-postgres-operator - - name: external-secrets-stores - - name: dragonfly - path: ./kubernetes/apps/media/immich/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - DB_NAME: immich - DB_USER: immich diff --git a/.archive/kubernetes/media/kustomization.yaml b/.archive/kubernetes/media/kustomization.yaml deleted file mode 100644 index 6df031b..0000000 --- a/.archive/kubernetes/media/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./immich/ks.yaml diff --git a/.archive/kubernetes/media/namespace.yaml b/.archive/kubernetes/media/namespace.yaml deleted file mode 100644 index 8ff6d8c..0000000 --- a/.archive/kubernetes/media/namespace.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: media - labels: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" - pgo-enabled-hsn.dev: "true" diff --git a/.archive/kubernetes/observability/alertmanager-silencer/app/helmrelease.yaml b/.archive/kubernetes/observability/alertmanager-silencer/app/helmrelease.yaml deleted file mode 100644 index 367734b..0000000 --- a/.archive/kubernetes/observability/alertmanager-silencer/app/helmrelease.yaml +++ /dev/null @@ -1,58 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: alertmanager-silencer -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.3.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - dependsOn: - - name: kube-prometheus-stack - namespace: observability - values: - controllers: - alertmanager-silencer: - type: cronjob - cronjob: - schedule: "@daily" - containers: - app: - image: - repository: ghcr.io/onedr0p/kubanetics - tag: 2024.7.1@sha256:020ec6f00b9cdc0ee247d2fd34d3951ac32718326bb90c38e947eed9d555de6c - env: - SCRIPT_NAME: alertmanager-silencer.sh - ALERTMANAGER_URL: http://alertmanager-operated.observability.svc.cluster.local:9093 - MATCHERS_0: alertname=NodeCPUHighUsage job=node-exporter - MATCHERS_1: alertname=CPUThrottlingHigh container=gc - MATCHERS_2: alertname=CPUThrottlingHigh container=worker - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 25m - limits: - memory: 128Mi - pod: - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true diff --git a/.archive/kubernetes/observability/alertmanager-silencer/ks.yaml b/.archive/kubernetes/observability/alertmanager-silencer/ks.yaml deleted file mode 100644 index e0ef6cd..0000000 --- a/.archive/kubernetes/observability/alertmanager-silencer/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app alertmanager-silencer - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/observability/alertmanager-silencer/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/.archive/kubernetes/observability/grafana/app/externalsecret.yaml b/.archive/kubernetes/observability/grafana/app/externalsecret.yaml deleted file mode 100644 index 1838d31..0000000 --- a/.archive/kubernetes/observability/grafana/app/externalsecret.yaml +++ /dev/null @@ -1,61 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: grafana-secret - namespace: observability -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: grafana-secret - creationPolicy: Owner - template: - engineVersion: v2 - data: - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .authentik_grafana_oauth_client_secret }}" - GF_DATE_FORMATS_USE_BROWSER_LOCALE: "true" - GF_SERVER_ROOT_URL: https://grafana.hsn.dev - GF_DATABASE_NAME: "{{ .grafana_GF_DATABASE_NAME }}" - GF_DATABASE_HOST: "postgres-primary-real.database.svc" - GF_DATABASE_USER: "{{ .grafana_GF_DATABASE_USER }}" - GF_DATABASE_PASSWORD: "{{ .grafana_GF_DATABASE_PASSWORD }}" - GF_DATABASE_SSL_MODE: "require" - GF_DATABASE_TYPE: postgres - GF_ANALYTICS_CHECK_FOR_UPDATES: "false" - GF_ANALYTICS_CHECK_FOR_PLUGIN_UPDATES: "false" - GF_ANALYTICS_REPORTING_ENABLED: "false" - GF_AUTH_ANONYMOUS_ENABLED: "false" - GF_AUTH_BASIC_ENABLED: "false" - GF_AUTH_GENERIC_OAUTH_ENABLED: "true" - GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.hsn.dev/application/o/userinfo/ - GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.hsn.dev/application/o/authorize/ - GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.hsn.dev/application/o/token/ - GF_AUTH_GENERIC_OAUTH_CLIENT_ID: CoV7ae1HxuNzwCbVPf3U7TfYMX2rVqC5T9RAUo5M - GF_AUTH_GENERIC_OAUTH_EMPTY_SCOPES: "false" - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'" - GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email groups - GF_AUTH_OAUTH_AUTO_LOGIN: "true" - GF_EXPLORE_ENABLED: "true" - GF_FEATURE_TOGGLES_ENABLE: publicDashboards - GF_LOG_MODE: console - GF_NEWS_NEWS_FEED_ENABLED: "false" - GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS: natel-discrete-panel,pr0ps-trackmap-panel,panodata-map-panel - GF_SECURITY_COOKIE_SAMESITE: grafana - GF_SECURITY_ANGULAR_SUPPORT_ENABLED: "true" - - dataFrom: - - extract: - key: Authentik - rewrite: - - regexp: - source: "(.*)" - target: "authentik_$1" - - extract: - key: grafana - rewrite: - - regexp: - source: "(.*)" - target: "grafana_$1" diff --git a/.archive/kubernetes/observability/grafana/app/helmrelease.yaml b/.archive/kubernetes/observability/grafana/app/helmrelease.yaml deleted file mode 100644 index ad716cf..0000000 --- a/.archive/kubernetes/observability/grafana/app/helmrelease.yaml +++ /dev/null @@ -1,401 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: grafana -spec: - interval: 30m - chart: - spec: - chart: grafana - version: 8.3.7 - sourceRef: - kind: HelmRepository - name: grafana - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - uninstall: - keepHistory: false - dependsOn: - - name: kube-prometheus-stack - namespace: observability - - name: loki - namespace: observability - values: - replicas: 1 - envFromSecret: grafana-secret - dashboardProviders: - dashboardproviders.yaml: - apiVersion: 1 - providers: - - name: default - orgId: 1 - folder: "" - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/default-folder - - name: ceph - orgId: 1 - folder: Ceph - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/ceph-folder - - name: crunchy-postgres - orgId: 1 - folder: Crunchy-postgres - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/crunchy-postgres-folder - - name: flux - orgId: 1 - folder: Flux - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/flux-folder - - name: kubernetes - orgId: 1 - folder: Kubernetes - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/kubernetes-folder - - name: nginx - orgId: 1 - folder: Nginx - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/nginx-folder - - name: prometheus - orgId: 1 - folder: Prometheus - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/prometheus-folder - - name: thanos - orgId: 1 - folder: Thanos - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/thanos-folder - - name: unifi - orgId: 1 - folder: Unifi - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/unifi-folder - datasources: - datasources.yaml: - apiVersion: 1 - deleteDatasources: - - { name: Alertmanager, orgId: 1 } - - { name: Loki, orgId: 1 } - - { name: Prometheus, orgId: 1 } - datasources: - - name: Prometheus - type: prometheus - uid: prometheus - access: proxy - url: http://thanos-query-frontend.observability.svc.cluster.local:10902 - jsonData: - prometheusType: Thanos - timeInterval: 1m - isDefault: true - - name: Loki - type: loki - uid: loki - access: proxy - url: http://loki-gateway.observability.svc.cluster.local - jsonData: - maxLines: 250 - - name: Alertmanager - type: alertmanager - uid: alertmanager - access: proxy - url: http://alertmanager-operated.observability.svc.cluster.local:9093 - jsonData: - implementation: prometheus - dashboards: - default: - cloudflared: - # renovate: depName="Cloudflare Tunnels (cloudflared)" - gnetId: 17457 - revision: 6 - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - external-dns: - # renovate: depName="External-dns" - gnetId: 15038 - revision: 3 - datasource: Prometheus - minio: - # renovate: depName="MinIO Dashboard" - gnetId: 13502 - revision: 25 - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - node-exporter-full: - # renovate: depName="Node Exporter Full" - gnetId: 1860 - revision: 33 - datasource: Prometheus - postgres: - # renovate: depName="PostgreSQL Database" - gnetId: 9628 - revision: 7 - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - smartctl-exporter: - # renovate: depName="smartctl_exporter" - gnetId: 20204 - revision: 1 - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - spegel: - # renovate: depName="Spegel" - gnetId: 18089 - revision: 1 - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - unpackerr: - # renovate: depName="Unpackerr" - gnetId: 18817 - revision: 1 - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - zfs: - # renovate: depName="ZFS" - gnetId: 7845 - revision: 4 - datasource: Prometheus - dragonflydb: - url: https://raw.githubusercontent.com/dragonflydb/dragonfly/main/tools/local/monitoring/grafana/provisioning/dashboards/dashboard.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - cert-manager: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json - datasource: Prometheus - external-secrets: - url: https://raw.githubusercontent.com/external-secrets/external-secrets/main/docs/snippets/dashboard.json - datasource: Prometheus - node-feature-discovery: - url: https://raw.githubusercontent.com/kubernetes-sigs/node-feature-discovery/master/examples/grafana-dashboard.json - datasource: Prometheus - crunchy-postgres: - pgbackrest: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/pgbackrest.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - pods: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/pod_details.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - postgresql: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/postgresql_details.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - postgresql-overview: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/postgresql_overview.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - postgresql-health: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/postgresql_service_health.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - postgresql-alerts: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/prometheus_alerts.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - query-stats: - url: https://raw.githubusercontent.com/CrunchyData/pgmonitor/development/grafana/containers/query_statistics.json - datasource: - - { name: DS_PROMETHEUS, value: Prometheus } - ceph: - ceph-cluster: - # renovate: depName="Ceph Cluster" - gnetId: 2842 - revision: 17 - datasource: Prometheus - ceph-osd: - # renovate: depName="Ceph - OSD (Single)" - gnetId: 5336 - revision: 9 - datasource: Prometheus - ceph-pools: - # renovate: depName="Ceph - Pools" - gnetId: 5342 - revision: 9 - datasource: Prometheus - flux: - flux-cluster: - url: https://raw.githubusercontent.com/fluxcd/flux2-monitoring-example/main/monitoring/configs/dashboards/cluster.json - datasource: Prometheus - flux-control-plane: - url: https://raw.githubusercontent.com/fluxcd/flux2-monitoring-example/main/monitoring/configs/dashboards/control-plane.json - datasource: Prometheus - kubernetes: - kubernetes-api-server: - # renovate: depName="Kubernetes / System / API Server" - gnetId: 15761 - revision: 16 - datasource: Prometheus - kubernetes-coredns: - # renovate: depName="Kubernetes / System / CoreDNS" - gnetId: 15762 - revision: 17 - datasource: Prometheus - kubernetes-global: - # renovate: depName="Kubernetes / Views / Global" - gnetId: 15757 - revision: 37 - datasource: Prometheus - kubernetes-namespaces: - # renovate: depName="Kubernetes / Views / Namespaces" - gnetId: 15758 - revision: 34 - datasource: Prometheus - kubernetes-nodes: - # renovate: depName="Kubernetes / Views / Nodes" - gnetId: 15759 - revision: 29 - datasource: Prometheus - kubernetes-pods: - # renovate: depName="Kubernetes / Views / Pods" - gNetId: 15760 - revision: 21 - datasource: Prometheus - kubernetes-volumes: - # renovate: depName="K8s / Storage / Volumes / Cluster" - gnetId: 11454 - revision: 14 - datasource: Prometheus - nginx: - nginx: - url: https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/grafana/dashboards/nginx.json - datasource: Prometheus - nginx-request-handling-performance: - url: https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/grafana/dashboards/request-handling-performance.json - datasource: Prometheus - prometheus: - prometheus: - # renovate: depName="Prometheus" - gnetId: 19105 - revision: 3 - datasource: Prometheus - thanos: - thanos-bucket-replicate: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/bucket-replicate.json - datasource: Prometheus - thanos-compact: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/compact.json - datasource: Prometheus - thanos-overview: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/overview.json - datasource: Prometheus - thanos-query: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/query.json - datasource: Prometheus - thanos-query-frontend: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/query-frontend.json - datasource: Prometheus - thanos-receieve: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/receive.json - datasource: Prometheus - thanos-rule: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/rule.json - datasource: Prometheus - thanos-sidecar: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/sidecar.json - datasource: Prometheus - thanos-store: - url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/thanos/dashboards/store.json - datasource: Prometheus - unifi: - unifi-insights: - # renovate: depName="UniFi-Poller: Client Insights - Prometheus" - gnetId: 11315 - revision: 9 - datasource: Prometheus - unifi-network-sites: - # renovate: depName="UniFi-Poller: Network Sites - Prometheus" - gnetId: 11311 - revision: 5 - datasource: Prometheus - unifi-uap: - # renovate: depName="UniFi-Poller: UAP Insights - Prometheus" - gnetId: 11314 - revision: 10 - datasource: Prometheus - unifi-usw: - # renovate: depName="UniFi-Poller: USW Insights - Prometheus" - gnetId: 11312 - revision: 9 - datasource: Prometheus - sidecar: - dashboards: - enabled: true - searchNamespace: ALL - labelValue: "" - label: grafana_dashboard - folderAnnotation: grafana_folder - provider: - disableDelete: true - foldersFromFilesStructure: true - datasources: - enabled: true - searchNamespace: ALL - labelValue: "" - plugins: - - grafana-clock-panel - - grafana-piechart-panel - - grafana-worldmap-panel - - natel-discrete-panel - - pr0ps-trackmap-panel - - vonage-status-panel - serviceMonitor: - enabled: true - ingress: - enabled: true - ingressClassName: external-nginx - annotations: - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" - external-dns.alpha.kubernetes.io/target: external.hsn.dev - hosts: - - &host grafana.hsn.dev - tls: - - hosts: - - *host - persistence: - enabled: false - testFramework: - enabled: false - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: grafana diff --git a/.archive/kubernetes/observability/grafana/app/kustomization.yaml b/.archive/kubernetes/observability/grafana/app/kustomization.yaml deleted file mode 100644 index 4eed917..0000000 --- a/.archive/kubernetes/observability/grafana/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml diff --git a/.archive/kubernetes/observability/grafana/ks.yaml b/.archive/kubernetes/observability/grafana/ks.yaml deleted file mode 100644 index 13a7fe7..0000000 --- a/.archive/kubernetes/observability/grafana/ks.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app grafana - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: crunchy-postgres-operator - - name: external-secrets-stores - path: ./kubernetes/apps/observability/grafana/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - DB_NAME: grafana - DB_USER: grafana diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/externalsecret.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/externalsecret.yaml deleted file mode 100644 index 082069f..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/externalsecret.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: alertmanager -spec: - refreshInterval: 5m - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: alertmanager-secret - template: - templateFrom: - - configMap: - name: alertmanager-config-tpl - items: - - key: alertmanager.yaml - dataFrom: - - extract: - key: pushover diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/helmrelease.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/helmrelease.yaml deleted file mode 100644 index 5b0ec0a..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/helmrelease.yaml +++ /dev/null @@ -1,190 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: kube-prometheus-stack -spec: - interval: 30m - timeout: 15m - chart: - spec: - chart: kube-prometheus-stack - version: 61.6.0 - sourceRef: - kind: HelmRepository - name: prometheus-community - namespace: flux-system - install: - crds: CreateReplace - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - crds: CreateReplace - remediation: - strategy: rollback - retries: 3 - values: - crds: - enabled: true - cleanPrometheusOperatorObjectNames: true - alertmanager: - ingress: - enabled: true - pathType: Prefix - ingressClassName: internal-nginx - hosts: - - &host alertmanager.jahanson.tech - tls: - - hosts: - - *host - alertmanagerSpec: - replicas: 1 - useExistingSecret: true - configSecret: alertmanager-secret - storage: - volumeClaimTemplate: - spec: - storageClassName: openebs-hostpath - resources: - requests: - storage: 1Gi - kubelet: - enabled: true - serviceMonitor: - metricRelabelings: - # Drop high cardinality labels - - action: labeldrop - regex: (uid) - - action: labeldrop - regex: (id|name) - - action: drop - sourceLabels: ["__name__"] - regex: (rest_client_request_duration_seconds_bucket|rest_client_request_duration_seconds_sum|rest_client_request_duration_seconds_count) - kubeApiServer: - enabled: true - serviceMonitor: - metricRelabelings: - # Drop high cardinality labels - - action: drop - sourceLabels: ["__name__"] - regex: (apiserver|etcd|rest_client)_request(|_sli|_slo)_duration_seconds_bucket - - action: drop - sourceLabels: ["__name__"] - regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket) - kubeControllerManager: - enabled: true - endpoints: &cp - - 10.1.1.61 - kubeEtcd: - enabled: true - endpoints: *cp - kubeScheduler: - enabled: true - endpoints: *cp - kubeProxy: - enabled: false - prometheus: - ingress: - enabled: true - ingressClassName: internal-nginx - pathType: Prefix - hosts: - - &host prometheus.jahanson.tech - tls: - - hosts: - - *host - thanosService: - enabled: true - thanosServiceMonitor: - enabled: true - # thanosServiceExternal: - # enabled: true - # type: LoadBalancer - # annotations: - # external-dns.alpha.kubernetes.io/hostname: thanos.jahanson.tech - # io.cilium/lb-ipam-ips: 10.45.0.6 - # externalTrafficPolicy: Cluster - prometheusSpec: - podMetadata: - annotations: - secret.reloader.stakater.com/reload: &secret thanos-objstore-config - replicas: 1 - replicaExternalLabelName: __replica__ - scrapeInterval: 1m # Must match interval in Grafana Helm chart - ruleSelectorNilUsesHelmValues: false - serviceMonitorSelectorNilUsesHelmValues: false - podMonitorSelectorNilUsesHelmValues: false - probeSelectorNilUsesHelmValues: false - scrapeConfigSelectorNilUsesHelmValues: false - enableAdminAPI: true - walCompression: true - enableFeatures: - - auto-gomemlimit - - memory-snapshot-on-shutdown - - new-service-discovery-manager - image: - registry: quay.io - repository: prometheus/prometheus - tag: v2.51.0-dedupelabels - thanos: - image: quay.io/thanos/thanos:${THANOS_VERSION} - version: "${THANOS_VERSION#v}" - objectStorageConfig: - existingSecret: - name: *secret - key: config - retention: 2d - retentionSize: 15GB - externalLabels: - cluster: main - storageSpec: - volumeClaimTemplate: - spec: - storageClassName: openebs-hostpath - resources: - requests: - storage: 20Gi - nodeExporter: - enabled: true - prometheus-node-exporter: - fullnameOverride: node-exporter - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - kubeStateMetrics: - enabled: true - kube-state-metrics: - fullnameOverride: kube-state-metrics - metricLabelsAllowlist: - - pods=[*] - - deployments=[*] - - persistentvolumeclaims=[*] - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - grafana: - enabled: false - forceDeployDashboards: true - sidecar: - dashboards: - annotations: - grafana_folder: Kubernetes - multicluster: - etcd: - enabled: true diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/kustomization.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/kustomization.yaml deleted file mode 100644 index 086bb92..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ./prometheusrules - # - ./scrapeconfigs - - ./podmonitors -configMapGenerator: - - name: alertmanager-config-tpl - files: - - alertmanager.yaml=./resources/alertmanager.yaml -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/crunchy-postgres.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/crunchy-postgres.yaml deleted file mode 100644 index a868a3a..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/crunchy-postgres.yaml +++ /dev/null @@ -1,34 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/podmonitor_v1.json ---- -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: crunchy-postgres-exporter -spec: - selector: - matchLabels: - postgres-operator.crunchydata.com/crunchy-postgres-exporter: 'true' - namespaceSelector: - matchNames: - - database - - media - podMetricsEndpoints: - - port: "exporter" - relabelings: - - sourceLabels: [__meta_kubernetes_pod_container_port_number] - action: keep - regex: "9187" - - sourceLabels: [__meta_kubernetes_namespace] - targetLabel: kubernetes_namespace - - sourceLabels: [__meta_kubernetes_pod_name] - targetLabel: pod - - sourceLabels: [__meta_kubernetes_namespace, __meta_kubernetes_pod_label_postgres_operator_crunchydata_com_cluster] - separator: ":" - targetLabel: pg_cluster - replacement: "$1$2" - - sourceLabels: [__meta_kubernetes_pod_ip] - targetLabel: ip - - sourceLabels: [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_instance] - targetLabel: deployment - - sourceLabels: [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_role] - targetLabel: role diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/dragonflydb.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/dragonflydb.yaml deleted file mode 100644 index 8c8ad96..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/dragonflydb.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/podmonitor_v1.json -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: dragonflydb-metrics - namespace: database -spec: - selector: - matchLabels: - app.kubernetes.io/name: dragonfly - app: dragonfly - podTargetLabels: - - app - namespaceSelector: - matchNames: - - database - podMetricsEndpoints: - - port: admin diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/kustomization.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/kustomization.yaml deleted file mode 100644 index fa86e4a..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/podmonitors/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./crunchy-postgres.yaml - - ./dragonflydb.yaml diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/kustomization.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/kustomization.yaml deleted file mode 100644 index ce216b1..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./prometheusrule.yaml diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/prometheusrule.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/prometheusrule.yaml deleted file mode 100644 index f74d565..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/prometheusrules/prometheusrule.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/prometheusrule_v1.json -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: miscellaneous-rules - labels: - prometheus: k8s - role: alert-rules -spec: - groups: - - name: dockerhub - rules: - - alert: BootstrapRateLimitRisk - annotations: - summary: Kubernetes cluster at risk of being rate limited by dockerhub on bootstrap - expr: count(time() - container_last_seen{image=~"(docker.io).*",container!=""} < 30) > 100 - for: 15m - labels: - severity: critical - - name: oom - rules: - - alert: OOMKilled - annotations: - summary: Container {{ $labels.container }} in pod {{ $labels.namespace }}/{{ $labels.pod }} has been OOMKilled {{ $value }} times in the last 10 minutes. - expr: (kube_pod_container_status_restarts_total - kube_pod_container_status_restarts_total offset 10m >= 1) and ignoring (reason) min_over_time(kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}[10m]) == 1 - labels: - severity: critical - - name: zfs - rules: - - alert: ZfsUnexpectedPoolState - annotations: - summary: ZFS pool {{$labels.zpool}} on {{$labels.instance}} is in a unexpected state {{$labels.state}} - expr: node_zfs_zpool_state{state!="online"} > 0 - for: 15m - labels: - severity: critical diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/resources/alertmanager.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/resources/alertmanager.yaml deleted file mode 100644 index e8be481..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/resources/alertmanager.yaml +++ /dev/null @@ -1,68 +0,0 @@ ---- -global: - resolve_timeout: 5m -route: - group_by: ["alertname", "job"] - group_interval: 10m - group_wait: 1m - receiver: pushover - repeat_interval: 12h - routes: - - receiver: heartbeat - group_interval: 5m - group_wait: 0s - matchers: - - alertname =~ "Watchdog" - repeat_interval: 5m - - receiver: "null" - matchers: - - alertname =~ "InfoInhibitor" - - receiver: pushover - continue: true - matchers: - - severity = "critical" -inhibit_rules: - - equal: ["alertname", "namespace"] - source_matchers: - - severity = "critical" - target_matchers: - - severity = "warning" -receivers: - - name: heartbeat - webhook_configs: - - send_resolved: true - url: "{{ .alertmanager_heartbeat_url }}" - - name: "null" - - name: pushover - pushover_configs: - - html: true - # Compooters are hard - message: |- - {{ "{{-" }} range .Alerts {{ "}}" }} - {{ "{{-" }} if ne .Annotations.description "" {{ "}}" }} - {{ "{{" }} .Annotations.description {{ "}}" }} - {{ "{{-" }} else if ne .Annotations.summary "" {{ "}}" }} - {{ "{{" }} .Annotations.summary {{ "}}" }} - {{ "{{-" }} else if ne .Annotations.message "" {{ "}}" }} - {{ "{{" }} .Annotations.message {{ "}}" }} - {{ "{{-" }} else {{ "}}" }} - Alert description not available - {{ "{{-" }} end {{ "}}" }} - {{ "{{-" }} if gt (len .Labels.SortedPairs) 0 {{ "}}" }} - - {{ "{{-" }} range .Labels.SortedPairs {{ "}}" }} - {{ "{{" }} .Name {{ "}}" }}: {{ "{{" }} .Value {{ "}}" }} - {{ "{{-" }} end {{ "}}" }} - - {{ "{{-" }} end {{ "}}" }} - {{ "{{-" }} end {{ "}}" }} - priority: |- - {{ "{{" }} if eq .Status "firing" {{ "}}" }}1{{ "{{" }} else {{ "}}" }}0{{ "{{" }} end {{ "}}" }} - send_resolved: true - sound: gamelan - title: >- - {{ "{{" }} .CommonLabels.alertname {{ "}}" }} - [{{ "{{" }} .Status | toUpper {{ "}}" }}{{ "{{" }} if eq .Status "firing" {{ "}}" }}:{{ "{{" }} .Alerts.Firing | len {{ "}}" }}{{ "{{" }} end {{ "}}" }}] - token: "{{ .alertmanager_token }}" - url_title: View in Alertmanager - user_key: "{{ .userkey_jahanson }}" diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/kustomization.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/kustomization.yaml deleted file mode 100644 index e599bb7..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./node-exporter.yaml - - ./zfs-exporter.yaml diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/node-exporter.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/node-exporter.yaml deleted file mode 100644 index 68e8bed..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/node-exporter.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/scrapeconfig_v1alpha1.json -apiVersion: monitoring.coreos.com/v1alpha1 -kind: ScrapeConfig -metadata: - name: node-exporter -spec: - staticConfigs: - - targets: - - 10.1.1.1:9100 - metricsPath: /metrics diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/zfs-exporter.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/zfs-exporter.yaml deleted file mode 100644 index a368d6c..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/app/scrapeconfigs/zfs-exporter.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/scrapeconfig_v1alpha1.json -apiVersion: monitoring.coreos.com/v1alpha1 -kind: ScrapeConfig -metadata: - name: zfs-exporter -spec: - staticConfigs: - - targets: - - 10.1.1.13:9134 - metricsPath: /metrics diff --git a/.archive/kubernetes/observability/kube-prometheus-stack/ks.yaml b/.archive/kubernetes/observability/kube-prometheus-stack/ks.yaml deleted file mode 100644 index 7108794..0000000 --- a/.archive/kubernetes/observability/kube-prometheus-stack/ks.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app kube-prometheus-stack - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - - name: openebs - - name: volsync - path: ./kubernetes/apps/observability/kube-prometheus-stack/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 15m - postBuild: - substitute: - # renovate: datasource=docker depName=quay.io/thanos/thanos - THANOS_VERSION: v0.34.1 diff --git a/.archive/kubernetes/observability/loki/app/externalsecret.yaml b/.archive/kubernetes/observability/loki/app/externalsecret.yaml deleted file mode 100644 index bb537a3..0000000 --- a/.archive/kubernetes/observability/loki/app/externalsecret.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: loki -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: loki-secret - creationPolicy: Owner - template: - engineVersion: v2 - data: - S3_HOST: s3.hsn.dev - S3_BUCKET: "{{ .minio_thanos_bucket_name }}" - S3_ACCESS_KEY: "{{ .minio_loki_access_key }}" - S3_SECRET_KEY: "{{ .minio_loki_secret_key }}" - S3_REGION: us-east-1 - dataFrom: - - extract: - key: minio - rewrite: - - regexp: - source: "(.*)" - target: "minio_$1" diff --git a/.archive/kubernetes/observability/loki/app/helmrelease.yaml b/.archive/kubernetes/observability/loki/app/helmrelease.yaml deleted file mode 100644 index 5d2673e..0000000 --- a/.archive/kubernetes/observability/loki/app/helmrelease.yaml +++ /dev/null @@ -1,138 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: loki -spec: - interval: 30m - timeout: 15m - chart: - spec: - chart: loki - version: 6.7.3 - sourceRef: - kind: HelmRepository - name: grafana - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: uninstall - retries: 3 - valuesFrom: - - targetPath: loki.storage.bucketNames.chunks - kind: Secret - name: loki-secret - valuesKey: S3_BUCKET - - targetPath: loki.storage.s3.endpoint - kind: Secret - name: loki-secret - valuesKey: S3_HOST - - targetPath: loki.storage.s3.region - kind: Secret - name: loki-secret - valuesKey: S3_REGION - - targetPath: loki.storage.s3.accessKeyId - kind: Secret - name: loki-secret - valuesKey: S3_ACCESS_KEY - - targetPath: loki.storage.s3.secretAccessKey - kind: Secret - name: loki-secret - valuesKey: S3_SECRET_KEY - values: - deploymentMode: SimpleScalable - loki: - podAnnotations: - secret.reloader.stakater.com/reload: loki-secret - ingester: - chunk_encoding: snappy - storage: - type: s3 - s3: - s3ForcePathStyle: true - insecure: true - schemaConfig: - configs: - - from: "2024-04-01" - store: tsdb - object_store: s3 - schema: v13 - index: - prefix: loki_index_ - period: 24h - structuredConfig: - auth_enabled: false - server: - log_level: info - http_listen_port: 3100 - grpc_listen_port: 9095 - grpc_server_max_recv_msg_size: 8388608 - grpc_server_max_send_msg_size: 8388608 - limits_config: - ingestion_burst_size_mb: 128 - ingestion_rate_mb: 64 - max_query_parallelism: 100 - per_stream_rate_limit: 64M - per_stream_rate_limit_burst: 128M - reject_old_samples: true - reject_old_samples_max_age: 168h - retention_period: 30d - shard_streams: - enabled: true - split_queries_by_interval: 1h - query_scheduler: - max_outstanding_requests_per_tenant: 4096 - frontend: - max_outstanding_per_tenant: 4096 - ruler: - enable_api: true - enable_alertmanager_v2: true - alertmanager_url: http://alertmanager-operated.observability.svc.cluster.local:9093 - storage: - type: local - local: - directory: /rules - rule_path: /rules/fake - analytics: - reporting_enabled: false - backend: - replicas: 1 - persistence: - size: 20Gi - storageClass: openebs-hostpath - gateway: - replicas: 1 - image: - registry: ghcr.io - ingress: - enabled: true - ingressClassName: internal-nginx - hosts: - - host: &host loki.jahanson.tech - paths: - - path: / - pathType: Prefix - tls: - - hosts: [*host] - read: - replicas: 1 - write: - replicas: 1 - persistence: - size: 20Gi - storageClass: openebs-hostpath - sidecar: - image: - repository: ghcr.io/kiwigrid/k8s-sidecar - rules: - searchNamespace: ALL - folder: /rules/fake - lokiCanary: - enabled: false - test: - enabled: false diff --git a/.archive/kubernetes/observability/loki/app/kustomization.yaml b/.archive/kubernetes/observability/loki/app/kustomization.yaml deleted file mode 100644 index 4eed917..0000000 --- a/.archive/kubernetes/observability/loki/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml diff --git a/.archive/kubernetes/observability/loki/ks.yaml b/.archive/kubernetes/observability/loki/ks.yaml deleted file mode 100644 index 173dc11..0000000 --- a/.archive/kubernetes/observability/loki/ks.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app loki - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - - name: openebs - - name: vector - path: ./kubernetes/apps/observability/loki/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 15m diff --git a/.archive/kubernetes/observability/thanos/app/externalsecret.yaml b/.archive/kubernetes/observability/thanos/app/externalsecret.yaml deleted file mode 100644 index 207b5ce..0000000 --- a/.archive/kubernetes/observability/thanos/app/externalsecret.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: thanos -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: thanos-secret - creationPolicy: Owner - template: - engineVersion: v2 - data: - S3_HOST: s3.hsn.dev - S3_BUCKET: "{{ .minio_thanos_bucket_name }}" - S3_ACCESS_KEY: "{{ .minio_thanos_access_key }}" - S3_SECRET_KEY: "{{ .minio_thanos_secret_key }}" - S3_REGION: us-east-1 - dataFrom: - - extract: - key: Minio - rewrite: - - regexp: - source: "(.*)" - target: "minio_$1" diff --git a/.archive/kubernetes/observability/thanos/app/helmrelease.yaml b/.archive/kubernetes/observability/thanos/app/helmrelease.yaml deleted file mode 100644 index 6ff06b0..0000000 --- a/.archive/kubernetes/observability/thanos/app/helmrelease.yaml +++ /dev/null @@ -1,120 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: thanos -spec: - interval: 30m - timeout: 15m - chart: - spec: - chart: thanos - version: 1.17.2 - sourceRef: - kind: HelmRepository - name: stevehipwell - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - valuesFrom: - - targetPath: objstoreConfig.value.config.bucket - kind: Secret - name: thanos-secret - valuesKey: S3_BUCKET - - targetPath: objstoreConfig.value.config.endpoint - kind: Secret - name: thanos-secret - valuesKey: S3_HOST - - targetPath: objstoreConfig.value.config.region - kind: Secret - name: thanos-secret - valuesKey: S3_REGION - - targetPath: objstoreConfig.value.config.access_key - kind: Secret - name: thanos-secret - valuesKey: S3_ACCESS_KEY - - targetPath: objstoreConfig.value.config.secret_key - kind: Secret - name: thanos-secret - valuesKey: S3_SECRET_KEY - values: - objstoreConfig: - value: - type: s3 - config: - insecure: false - additionalEndpoints: - - dnssrv+_grpc._tcp.kube-prometheus-stack-thanos-discovery.observability.svc.cluster.local - additionalReplicaLabels: ["__replica__"] - serviceMonitor: - enabled: true - compact: - enabled: true - extraArgs: - - --compact.concurrency=4 - - --delete-delay=30m - - --retention.resolution-raw=14d - - --retention.resolution-5m=30d - - --retention.resolution-1h=60d - persistence: &persistence - enabled: true - storageClass: openebs-hostpath - size: 10Gi - query: - replicas: 1 - extraArgs: ["--alert.query-url=https://thanos.jahanson.tech"] - queryFrontend: - enabled: true - replicas: 1 - extraEnv: &extraEnv - - name: THANOS_CACHE_CONFIG - valueFrom: - configMapKeyRef: - name: &configMap thanos-cache-configmap - key: cache.yaml - extraArgs: ["--query-range.response-cache-config=$(THANOS_CACHE_CONFIG)"] - ingress: - enabled: true - ingressClassName: internal-nginx - hosts: - - &host thanos.jahanson.tech - tls: - - hosts: [*host] - podAnnotations: &podAnnotations - configmap.reloader.stakater.com/reload: *configMap - rule: - enabled: true - replicas: 1 - extraArgs: ["--web.prefix-header=X-Forwarded-Prefix"] - alertmanagersConfig: - value: |- - alertmanagers: - - api_version: v2 - static_configs: - - dnssrv+_http-web._tcp.alertmanager-operated.observability.svc.cluster.local - rules: - value: |- - groups: - - name: PrometheusWatcher - rules: - - alert: PrometheusDown - annotations: - summary: A Prometheus has disappeared from Prometheus target discovery - expr: absent(up{job="kube-prometheus-stack-prometheus"}) - for: 5m - labels: - severity: critical - persistence: *persistence - storeGateway: - replicas: 1 - extraEnv: *extraEnv - extraArgs: ["--index-cache.config=$(THANOS_CACHE_CONFIG)"] - persistence: *persistence - podAnnotations: *podAnnotations diff --git a/.archive/kubernetes/observability/thanos/app/kustomization.yaml b/.archive/kubernetes/observability/thanos/app/kustomization.yaml deleted file mode 100644 index 9a4c8f2..0000000 --- a/.archive/kubernetes/observability/thanos/app/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./externalsecret.yaml -configMapGenerator: - - name: thanos-cache-configmap - files: - - cache.yaml=./resources/cache.yml -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/observability/thanos/app/resources/cache.yml b/.archive/kubernetes/observability/thanos/app/resources/cache.yml deleted file mode 100644 index df31f34..0000000 --- a/.archive/kubernetes/observability/thanos/app/resources/cache.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -type: REDIS -config: - addr: dragonfly.database.svc.cluster.local:6379 - db: 1 diff --git a/.archive/kubernetes/observability/thanos/ks.yaml b/.archive/kubernetes/observability/thanos/ks.yaml deleted file mode 100644 index 645f8fe..0000000 --- a/.archive/kubernetes/observability/thanos/ks.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app thanos - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - - name: openebs - - name: dragonfly-operator - path: ./kubernetes/apps/observability/thanos/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 15m diff --git a/.archive/kubernetes/observability/vector/app/agent/helmrelease.yaml b/.archive/kubernetes/observability/vector/app/agent/helmrelease.yaml deleted file mode 100644 index ef6de12..0000000 --- a/.archive/kubernetes/observability/vector/app/agent/helmrelease.yaml +++ /dev/null @@ -1,103 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: vector-agent -spec: - interval: 30m - timeout: 15m - chart: - spec: - chart: app-template - version: 3.3.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - dependsOn: - - name: vector-aggregator - namespace: observability - values: - controllers: - vector: - type: daemonset - strategy: RollingUpdate - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: docker.io/timberio/vector - tag: 0.40.0-alpine@sha256:7a81fdd62e056321055a9e4bdec4073d752ecf68f4c192e676b85001721523c2 - env: - PROCFS_ROOT: /host/proc - SYSFS_ROOT: /host/sys - VECTOR_SELF_NODE_NAME: - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - VECTOR_SELF_POD_NAME: - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - VECTOR_SELF_POD_NAMESPACE: - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - args: ["--config", "/etc/vector/vector.yaml"] - securityContext: - privileged: true - serviceAccount: - create: true - name: vector-agent - persistence: - config: - enabled: true - type: configMap - name: vector-agent-configmap - globalMounts: - - path: /etc/vector/vector.yaml - subPath: vector.yaml - readOnly: true - data: - type: emptyDir - globalMounts: - - path: /vector-data-dir - procfs: - type: hostPath - hostPath: /proc - hostPathType: Directory - globalMounts: - - path: /host/proc - readOnly: true - sysfs: - type: hostPath - hostPath: /sys - hostPathType: Directory - globalMounts: - - path: /host/sys - readOnly: true - var-lib: - type: hostPath - hostPath: /var/lib - hostPathType: Directory - globalMounts: - - readOnly: true - var-log: - type: hostPath - hostPath: /var/log - hostPathType: Directory - globalMounts: - - readOnly: true diff --git a/.archive/kubernetes/observability/vector/app/agent/kustomization.yaml b/.archive/kubernetes/observability/vector/app/agent/kustomization.yaml deleted file mode 100644 index cad3d52..0000000 --- a/.archive/kubernetes/observability/vector/app/agent/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./rbac.yaml -configMapGenerator: - - name: vector-agent-configmap - files: - - vector.yaml=./resources/vector.yaml -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/observability/vector/app/agent/rbac.yaml b/.archive/kubernetes/observability/vector/app/agent/rbac.yaml deleted file mode 100644 index a088f8d..0000000 --- a/.archive/kubernetes/observability/vector/app/agent/rbac.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: vector-agent -rules: - - apiGroups: [""] - resources: ["namespaces", "nodes", "pods"] - verbs: ["list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: vector-agent -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: vector-agent -subjects: - - kind: ServiceAccount - name: vector-agent - namespace: observability diff --git a/.archive/kubernetes/observability/vector/app/agent/resources/vector.yaml b/.archive/kubernetes/observability/vector/app/agent/resources/vector.yaml deleted file mode 100644 index f3a7565..0000000 --- a/.archive/kubernetes/observability/vector/app/agent/resources/vector.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -data_dir: /vector-data-dir - -sources: - kubernetes_source: - type: kubernetes_logs - use_apiserver_cache: true - pod_annotation_fields: - container_image: container_image - container_name: container_name - pod_labels: pod_labels - pod_name: pod_name - pod_annotations: "" - namespace_annotation_fields: - namespace_labels: "" - node_annotation_fields: - node_labels: "" - -sinks: - kubernetes: - type: vector - compression: true - version: "2" - address: vector-aggregator.observability.svc.cluster.local:6010 - inputs: ["kubernetes_source"] diff --git a/.archive/kubernetes/observability/vector/app/aggregator/externalsecret.yaml b/.archive/kubernetes/observability/vector/app/aggregator/externalsecret.yaml deleted file mode 100644 index d9fc9f5..0000000 --- a/.archive/kubernetes/observability/vector/app/aggregator/externalsecret.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: vector-aggregator -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: vector-aggregator-secret - template: - engineVersion: v2 - data: - GEOIPUPDATE_ACCOUNT_ID: "{{ .account_id }}" - GEOIPUPDATE_LICENSE_KEY: "{{ .vector_license_key }}" - dataFrom: - - extract: - key: maxmind diff --git a/.archive/kubernetes/observability/vector/app/aggregator/helmrelease.yaml b/.archive/kubernetes/observability/vector/app/aggregator/helmrelease.yaml deleted file mode 100644 index 2de2793..0000000 --- a/.archive/kubernetes/observability/vector/app/aggregator/helmrelease.yaml +++ /dev/null @@ -1,91 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app vector-aggregator -spec: - interval: 30m - timeout: 15m - chart: - spec: - chart: app-template - version: 3.3.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - vector-aggregator: - replicas: 1 - strategy: RollingUpdate - annotations: - reloader.stakater.com/auto: "true" - initContainers: - init-geoip: - image: - repository: ghcr.io/maxmind/geoipupdate - tag: v7.0.1@sha256:80c57598a9ff552953e499cefc589cfe7b563d64262742ea42f2014251b557b0 - env: - GEOIPUPDATE_EDITION_IDS: GeoLite2-City - GEOIPUPDATE_FREQUENCY: "0" - GEOIPUPDATE_VERBOSE: "1" - envFrom: - - secretRef: - name: vector-aggregator-secret - containers: - app: - image: - repository: docker.io/timberio/vector - tag: 0.40.0-alpine@sha256:7a81fdd62e056321055a9e4bdec4073d752ecf68f4c192e676b85001721523c2 - args: ["--config", "/etc/vector/vector.yaml"] - pod: - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: *app - service: - app: - controller: vector-aggregator - type: LoadBalancer - annotations: - external-dns.alpha.kubernetes.io/hostname: vector.jahanson.tech - io.cilium/lb-ipam-ips: 10.1.1.33 - ports: - http: - port: 8686 - journald: - port: 6000 - kubernetes: - port: 6010 - vyos: - port: 6020 - persistence: - config: - enabled: true - type: configMap - name: vector-aggregator-configmap - globalMounts: - - path: /etc/vector/vector.yaml - subPath: vector.yaml - readOnly: true - data: - type: emptyDir - globalMounts: - - path: /vector-data-dir - geoip: - type: emptyDir - globalMounts: - - path: /usr/share/GeoIP diff --git a/.archive/kubernetes/observability/vector/app/aggregator/kustomization.yaml b/.archive/kubernetes/observability/vector/app/aggregator/kustomization.yaml deleted file mode 100644 index e326414..0000000 --- a/.archive/kubernetes/observability/vector/app/aggregator/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml -configMapGenerator: - - name: vector-aggregator-configmap - files: - - vector.yaml=./resources/vector.yaml -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/observability/vector/app/aggregator/resources/vector.yaml b/.archive/kubernetes/observability/vector/app/aggregator/resources/vector.yaml deleted file mode 100644 index 3bfa3e4..0000000 --- a/.archive/kubernetes/observability/vector/app/aggregator/resources/vector.yaml +++ /dev/null @@ -1,132 +0,0 @@ ---- -data_dir: /vector-data-dir -api: - enabled: true - address: 0.0.0.0:8686 - -enrichment_tables: - geoip_table: - type: geoip - path: /usr/share/GeoIP/GeoLite2-City.mmdb - -# -# Sources -# - -sources: - journald_source: - type: vector - version: "2" - address: 0.0.0.0:6000 - - kubernetes_source: - type: vector - version: "2" - address: 0.0.0.0:6010 - - vyos_source: - type: syslog - address: 0.0.0.0:6020 - mode: tcp - -# -# Transforms -# - -transforms: - kubernetes_remap: - type: remap - inputs: ["kubernetes_source"] - source: | - # Standardize 'app' index - .custom_app_name = .pod_labels."app.kubernetes.io/name" || .pod_labels.app || .pod_labels."k8s-app" || "unknown" - # Drop pod_labels - del(.pod_labels) - - # [63950.153039] [wan-local-default-D]IN=eth4 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=60610 PROTO=TCP SPT=53451 DPT=2002 WINDOW=1024 RES=0x00 SYN URGP=0 - vyos_firewall_route: - type: route - inputs: ["vyos_source"] - route: - firewall: | - .facility == "kern" && match!(.message, r'^\[(.*?)\].(.*)') - - vyos_firewall_remap: - type: remap - inputs: ["vyos_firewall_route.firewall"] - source: | - # Parse firewall rule message - split_message, split_err = parse_regex(.message, r'^\[.*\].\[(?P.*?)\](?P.*)') - if split_err != null { - abort - } - # Extract separate fields from message - split_message.fields, split_err = strip_whitespace(split_message.fields) - if split_err != null { - abort - } - .message, parse_err = parse_key_value(split_message.fields, whitespace: "strict") - if parse_err != null { - abort - } - # Add more information about the triggered rule - .message.RULE, parse_err = parse_regex(split_message.rule, r'^ipv4-(?P\w+)-(?P\w+)-(?P\w+)-(?P\w+)$') - if parse_err != null { - abort - } - - vyos_firewall_wan_route: - type: route - inputs: ["vyos_firewall_remap"] - route: - from_wan: .message.RULE.from_zone == "wan" - - vyos_firewall_geoip_remap: - type: remap - inputs: ["vyos_firewall_wan_route.from_wan"] - source: | - .geoip = get_enrichment_table_record!( - "geoip_table", { - "ip": .message.SRC - } - ) - -# -# Sinks -# - -sinks: - journald: - inputs: ["journald_source"] - type: loki - endpoint: http://loki-gateway.observability.svc.cluster.local - encoding: { codec: json } - out_of_order_action: accept - remove_label_fields: true - remove_timestamp: true - labels: - hostname: '{{ host }}' - - kubernetes: - inputs: ["kubernetes_remap"] - type: loki - endpoint: http://loki-gateway.observability.svc.cluster.local - encoding: { codec: json } - out_of_order_action: accept - remove_label_fields: true - remove_timestamp: true - labels: - app: '{{ custom_app_name }}' - namespace: '{{ kubernetes.pod_namespace }}' - node: '{{ kubernetes.pod_node_name }}' - - vyos: - inputs: ["vyos_source", "vyos_firewall_geoip_remap"] - type: loki - endpoint: http://loki-gateway.observability.svc.cluster.local - encoding: { codec: json } - out_of_order_action: accept - remove_label_fields: true - remove_timestamp: true - labels: - hostname: '{{ host }}' diff --git a/.archive/kubernetes/observability/vector/app/kustomization.yaml b/.archive/kubernetes/observability/vector/app/kustomization.yaml deleted file mode 100644 index 54568aa..0000000 --- a/.archive/kubernetes/observability/vector/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./agent - - ./aggregator diff --git a/.archive/kubernetes/observability/vector/ks.yaml b/.archive/kubernetes/observability/vector/ks.yaml deleted file mode 100644 index 86d2bbd..0000000 --- a/.archive/kubernetes/observability/vector/ks.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app vector - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - path: ./kubernetes/apps/observability/vector/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 15m diff --git a/.archive/kubernetes/openebs-system/kustomization.yaml b/.archive/kubernetes/openebs-system/kustomization.yaml deleted file mode 100644 index 011b510..0000000 --- a/.archive/kubernetes/openebs-system/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./openebs/ks.yaml diff --git a/.archive/kubernetes/openebs-system/namespace.yaml b/.archive/kubernetes/openebs-system/namespace.yaml deleted file mode 100644 index 18921b5..0000000 --- a/.archive/kubernetes/openebs-system/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: openebs-system - annotations: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/.archive/kubernetes/openebs-system/openebs/app/helmrelease.yaml b/.archive/kubernetes/openebs-system/openebs/app/helmrelease.yaml deleted file mode 100644 index 4ec773b..0000000 --- a/.archive/kubernetes/openebs-system/openebs/app/helmrelease.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: openebs-zfs -spec: - interval: 30m - chart: - spec: - chart: zfs-localpv - version: 2.6.0 - sourceRef: - kind: HelmRepository - name: openebs-zfs - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - uninstall: - keepHistory: false - values: - zfsNode: - encrKeysDir: /var/openebs/keys - crds: - csi: - volumeSnapshots: - enabled: false diff --git a/.archive/kubernetes/openebs-system/openebs/app/kustomization.yaml b/.archive/kubernetes/openebs-system/openebs/app/kustomization.yaml deleted file mode 100644 index 17cbc72..0000000 --- a/.archive/kubernetes/openebs-system/openebs/app/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/.archive/kubernetes/openebs-system/openebs/cluster/kustomization.yaml b/.archive/kubernetes/openebs-system/openebs/cluster/kustomization.yaml deleted file mode 100644 index 176bb55..0000000 --- a/.archive/kubernetes/openebs-system/openebs/cluster/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./storageclass.yaml - - ./volumesnapshotclass.yaml diff --git a/.archive/kubernetes/openebs-system/openebs/cluster/storageclass.yaml b/.archive/kubernetes/openebs-system/openebs/cluster/storageclass.yaml deleted file mode 100644 index 7f911e5..0000000 --- a/.archive/kubernetes/openebs-system/openebs/cluster/storageclass.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: openebs-zfs - annotations: - storageclass.kubevirt.io/is-default-virt-class: "true" - storageclass.kubernetes.io/is-default-class: "true" -provisioner: zfs.csi.openebs.io -parameters: - recordsize: "128k" - compression: "off" - dedup: "off" - fstype: "zfs" - poolname: "nahar" -allowVolumeExpansion: true diff --git a/.archive/kubernetes/openebs-system/openebs/cluster/volumesnapshotclass.yaml b/.archive/kubernetes/openebs-system/openebs/cluster/volumesnapshotclass.yaml deleted file mode 100644 index 352e7d3..0000000 --- a/.archive/kubernetes/openebs-system/openebs/cluster/volumesnapshotclass.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/snapshot.storage.k8s.io/volumesnapshotclass_v1.json -kind: VolumeSnapshotClass -apiVersion: snapshot.storage.k8s.io/v1 -metadata: - name: openebs-zfs - annotations: - snapshot.storage.kubernetes.io/is-default-class: "true" -driver: zfs.csi.openebs.io -deletionPolicy: Delete diff --git a/.archive/kubernetes/openebs-system/openebs/ks.yaml b/.archive/kubernetes/openebs-system/openebs/ks.yaml deleted file mode 100644 index 690b4cc..0000000 --- a/.archive/kubernetes/openebs-system/openebs/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app openebs - namespace: flux-system -spec: - targetNamespace: openebs-system - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/openebs-system/openebs/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/.archive/kubernetes/qbittorrent/app/externalsecret.yaml b/.archive/kubernetes/qbittorrent/app/externalsecret.yaml deleted file mode 100644 index 51ccfff..0000000 --- a/.archive/kubernetes/qbittorrent/app/externalsecret.yaml +++ /dev/null @@ -1,31 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: qbittorrent - namespace: qbittorrent -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: qbittorrent-secret - creationPolicy: Owner - data: - - secretKey: WIREGUARD_ENDPOINT_IP - remoteRef: - key: ProtonVPN - property: qbittorrent_vpn_endpoint_ip - - secretKey: WIREGUARD_PUBLIC_KEY - remoteRef: - key: ProtonVPN - property: qbittorrent_wireguard_public_key - - secretKey: WIREGUARD_PRIVATE_KEY - remoteRef: - key: ProtonVPN - property: qbittorrent_wireguard_private_key - - secretKey: WIREGUARD_ADDRESSES - remoteRef: - key: ProtonVPN - property: qbittorrent_wireguard_addresses diff --git a/.archive/kubernetes/qbittorrent/app/helmrelease.yaml b/.archive/kubernetes/qbittorrent/app/helmrelease.yaml deleted file mode 100644 index ca3bc97..0000000 --- a/.archive/kubernetes/qbittorrent/app/helmrelease.yaml +++ /dev/null @@ -1,163 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app qbittorrent-protonvpn -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.3.2 - interval: 30m - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - qbittorrent: - annotations: - configmap.reloader.stakater.com/reload: qbittorrent-scripts - secret.reloader.stakater.com/reload: qbittorrent-secret - pod: - securityContext: - fsGroup: 568 - fsGroupChangePolicy: "OnRootMismatch" - containers: - app: - nameOverride: qbittorrent - image: - repository: ghcr.io/onedr0p/qbittorrent - tag: 4.6.6@sha256:e21c95568c9175f40390bacd7f778d8d2af5331d1e663e1a6860140891c65742 - env: - UMASK: "022" - QBITTORRENT__PORT: &port 80 - QBT_Preferences__WebUI__AlternativeUIEnabled: false - QBT_Preferences__WebUI__AuthSubnetWhitelistEnabled: true - QBT_Preferences__WebUI__AuthSubnetWhitelist: |- - 10.244.0.0/16, 10.1.2.0/24 - QBT_Preferences__WebUI__LocalHostAuth: false - QBT_BitTorrent__Session__Interface: wg0 - QBT_BitTorrent__Session__InterfaceName: wg0 - resources: - requests: - cpu: 49m - memory: 1024Mi - limits: - memory: 24Gi - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - - gluetun: - image: - repository: ghcr.io/qdm12/gluetun - tag: latest@sha256:fb448a2eb8755b68106a386d1e5a78c781bf28a0eea0fb712824cd2dc0ec19a7 - env: - VPN_SERVICE_PROVIDER: custom - VPN_TYPE: wireguard - VPN_INTERFACE: wg0 - WIREGUARD_ENDPOINT_PORT: 51820 - VPN_PORT_FORWARDING: on - VPN_PORT_FORWARDING_PROVIDER: protonvpn - FIREWALL_INPUT_PORTS: *port - FIREWALL_OUTBOUND_SUBNETS: 10.32.0.0/16 # Allow access to k8s subnets - envFrom: - - secretRef: - name: qbittorrent-secret - securityContext: - # until I can debug the issues on talos 1.8. - privileged: true - capabilities: - add: - - NET_ADMIN - drop: - - ALL - - port-forward: - image: - repository: ghcr.io/bjw-s/gluetun-qb-port-sync - tag: v0.0.2 - env: - GLUETUN_CONTROL_SERVER_HOST: localhost - GLUETUN_CONTROL_SERVER_PORT: 8000 - QBITTORRENT_HOST: localhost - QBITTORRENT_WEBUI_PORT: *port - CRON_ENABLED: true - CRON_SCHEDULE: "*/5 * * * *" - LOG_TIMESTAMP: false - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - capabilities: - drop: - - ALL - - service: - app: - controller: qbittorrent - type: LoadBalancer - annotations: - io.cilium/lb-ipam-ips: 10.1.1.34 - nameOverride: qbittorrent - ports: - http: - port: *port - # bittorrent port is set by gluetun-qb-port-sync - # So we don't need to set it for forwarding-to from firewall here. - # bittorrent: - # enabled: true - # port: *bittorrentPort - # protocol: TCP - - ingress: - app: - className: "internal-nginx" - hosts: - - host: "qb.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - "qb.jahanson.tech" - - persistence: - config: - existingClaim: qbittorrent - media: - type: nfs - server: 10.1.1.11 - path: /volume1/Media - advancedMounts: - qbittorrent: - app: - - path: /data/nas-media - qbtun: - type: hostPath - hostPath: /dev/net - advancedMounts: - qbittorrent: - gluetun: - - path: /dev/net diff --git a/.archive/kubernetes/qbittorrent/app/kustomization.yaml b/.archive/kubernetes/qbittorrent/app/kustomization.yaml deleted file mode 100644 index 8ad2376..0000000 --- a/.archive/kubernetes/qbittorrent/app/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ../../../../templates/volsync -generatorOptions: - disableNameSuffixHash: true diff --git a/.archive/kubernetes/qbittorrent/ks.yaml b/.archive/kubernetes/qbittorrent/ks.yaml deleted file mode 100644 index 25ac12e..0000000 --- a/.archive/kubernetes/qbittorrent/ks.yaml +++ /dev/null @@ -1,50 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app qbittorrent - namespace: flux-system -spec: - targetNamespace: qbittorrent - commonMetadata: - labels: - app.kubernetes.io/name: *app - interval: 10m - path: "./kubernetes/apps/qbittorrent/qbittorrent/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true - dependsOn: - - name: openebs - - name: volsync - - name: external-secrets-stores - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 2Gi - VOLSYNC_STORAGECLASS: zfs-generic-nfs-csi - VOLSYNC_SNAPSHOTCLASS: zfs-generic-nfs-csi ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app qbittorrent-tools - namespace: flux-system -spec: - targetNamespace: qbittorrent - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/qbittorrent/qbittorrent/tools - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/.archive/kubernetes/qbittorrent/tools/helmrelease.yaml b/.archive/kubernetes/qbittorrent/tools/helmrelease.yaml deleted file mode 100644 index a833568..0000000 --- a/.archive/kubernetes/qbittorrent/tools/helmrelease.yaml +++ /dev/null @@ -1,146 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: qbtools -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.3.2 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - dependsOn: - - name: qbittorrent - namespace: qbittorrent - values: - controllers: - tagging: - type: cronjob - cronjob: &cronJobSpec - schedule: "@hourly" - timeZone: &timeZone America/Chicago - concurrencyPolicy: Forbid - successfulJobsHistory: 1 - failedJobsHistory: 1 - initContainers: - tagging: &container - image: - repository: ghcr.io/buroa/qbtools - tag: v0.16.3@sha256:1eb3be84d7d63bfd0aaffd1e85f1cfd9a5064fd8ce5ed94522672eca0d201e56 - env: - TZ: *timeZone - POD_NAMESPACE: - valueFrom: - fieldRef: - fieldPath: metadata.namespace - args: [ - "tagging", - "--added-on", - "--expired", - "--last-activity", - "--sites", - "--unregistered", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80", - "--config", "/config/config.yaml" - ] - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 25m - limits: - memory: 256M - containers: - unregistered: - <<: *container - args: [ - "prune", - "--exclude-category", "manual", - "--exclude-category", "music", - "--exclude-tag", "added:24h", - "--include-tag", "unregistered", - # "--dry-run", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - expired: - <<: *container - args: [ - "prune", - "--exclude-category", "manual", - "--exclude-category", "music", - "--include-tag", "expired", # defined in config.yaml - "--include-tag", "added:7d", - # "--dry-run", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - pod: - restartPolicy: OnFailure - orphaned: - type: cronjob - cronjob: - <<: *cronJobSpec - schedule: "@daily" - containers: - app: - <<: *container - args: [ - "orphaned", - "--exclude-pattern", "*_unpackerred*", - "--exclude-pattern", "*/manual/*", - # "--dry-run", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - pod: - restartPolicy: OnFailure - reannounce: - containers: - app: - <<: *container - args: [ - "reannounce", - "--process-seeding", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - defaultPodOptions: - securityContext: - runAsNonRoot: true - runAsUser: 568 - runAsGroup: 568 - seccompProfile: { type: RuntimeDefault } - persistence: - secret-file: - type: secret - name: qbtools-secret - globalMounts: - - path: /config/config.yaml - subPath: config.yaml - readOnly: true - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - advancedMounts: - orphaned: - app: - - path: /data/nas-media - subPath: qb/downloads diff --git a/.archive/kubernetes/qbittorrent/tools/kustomization.yaml b/.archive/kubernetes/qbittorrent/tools/kustomization.yaml deleted file mode 100644 index 6b4d0b3..0000000 --- a/.archive/kubernetes/qbittorrent/tools/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./qbtools.secret.sops.yaml - - ./helmrelease.yaml diff --git a/.archive/kubernetes/qbittorrent/tools/qbtools.secret.sops.yaml b/.archive/kubernetes/qbittorrent/tools/qbtools.secret.sops.yaml deleted file mode 100644 index ea848a7..0000000 --- a/.archive/kubernetes/qbittorrent/tools/qbtools.secret.sops.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: qbtools-secret -stringData: - config.yaml: ENC[AES256_GCM,data:NZq8GKG05lEp6lLvE/IMOkt6FrzJ8Hoj3KJ57y5rumsTxqydyxzmrt9IVf34nQ1SgSGKMdI8KgEIVnHBj/4jfYgJZ5+1AfKiTe0DW3NZSK3LkDJcs6Mcwu6f5lbil1vfaS3YgJ2K1pv5ys7GCmE/zMqiNsTpmc1niY/JMOs/0eJaUYNACHl0I1w3fLJVPjnhdK99IhFYo42XywODyVSRdMeFTP6Q7Y4NRNJKA3u9W0ix12yaTdfBk5ia1sIRb9H3Gvl5z/XTvr0X6IzIpfoP46wf/EXLU7Y7Rt5fvnymQgzQr7JtUL90NBkKvqOko4NSl36uEol5jsu9gj9o+FZbA2CnDbZ6mp6BqJIB9HuaWCrgb6ideNTUYL/ASU6Wp17A1CzPDjlm+b6kGZpJKQYFEZ/VO8BEoeW3Yx9D0dG1ep9xFTu6xDKo7JxF4pbMWgWU5I+mE6xiCK7XGrab1latVhcPHBAVoxBrdHvAgwgvs1WmAe0ofP0vPpq6ZHd+kgQg2qHPbkj4viXl1Hf9M9Q7HJm+hlgfCmjaT9m5/1ipzbj9xlu0vG5GFTbf6hcPJXlthaEubHggKD1Idx1k7NUvJzQi/Y6KpUCM4BUOGOgYpGWic7kTSUoqdqKQNAJr77EKOIRGkI+LCPSOWx4atUS8jgS8/tbeXYAb9eBhovGWXZsGyPQt1bpfXmfiBRTqyRC66qPw5+AcruVaJY3C7Aj0f6BhqkDWScBiF3H3ZJj0Wp6wWKh/KCxSqO+AqcB36nVa62zLy6sIZHclwQwgxLzXFiaHxblRWxNuyAASNnrbAutLTsQ4HXCQPaiJ/9LxK+QAow7hryQsikq4XhCRV0TdEYzBpB3eatpB5G02kApvbMRW5kYvR8GHJzF8eqWgcRit4g0Q+kJn5p+UAi1rOP2bh/9lwPadn7TuuW3J9SzUOOmP2eajsicUkqnxsrxQFJbxkztLkPpLGHpd4zI8Y3riHtv2di57/ktUP9acc4kIk2LyYiN6jwKEOc2HTmSE3l2qdBXoy6Rcl/V/Uz1hOE3vOFUNJQL2sRyBf/0R7IKzXRieghR9h17pKYAsvbN9vO02dLevSYsqktowjwA1QXxxR2Vzp15tMV45T/nP5XLe3+f4zfJjRSuNM13ddowXp6smUOZ0Myw=,iv:FszW51oSi/iKN1cquyhF+HwStHgpgmioyopdJriuiOw=,tag:GYaRuyCgXuGVWyxShyH39Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UzFWbHB0bVlGQXV4dEVt - ZUxrcnZ1MlFOY2o2eTl0cDV3T3BKdmNMUXg0CmcyejMzV1loSUNIMEw0K09yc3Ax - NGZOTE1tamV2a05kZm9lNkpoeG9OWm8KLS0tIEVVM01nSjhQYzBOZ0MrY2JpODRz - MGNWSGJmaXdkbUJDOHpCRk9YWUZVSm8KGGHivrtQfHayo6BGbH+Tch3fzVlFNU3s - lLec6VZauGjIXifXBLC5e65SrSO/nZS4xsurrZovOLn3DpeDQu/4+Q== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-08-15T17:21:52Z" - mac: ENC[AES256_GCM,data:V+K/2CEFommRZ7kkJlUSjOIMQL8c3OtnJnPT7heHpkGUm/XJ8JFAhqHc5G6D6bjN6vsXcr7X7b9Tm6OBNPHBCJIekBahySUThHc6IxhQrNVTMu2lNOS9B7+VwZN2oezmEwbpY+5dT+3angWiBy2k5XW/7hmVlz1mQX8tJBTUHOM=,iv:LorlvJFs067H6FI/UPvIgRi9xTReOTfv13IdInFhcAU=,tag:72TTcNC6Fh3SiWlJa2xgzg==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.8.1 diff --git a/.archive/kubernetes/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml b/.archive/kubernetes/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml deleted file mode 100644 index 78c545d..0000000 --- a/.archive/kubernetes/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: rook-ceph-dashboard-password -stringData: - password: ENC[AES256_GCM,data:WWTt7SN6ssndLahsOA1gujEeGAM=,iv:YbHGNN+11wA/MLq9vFVM6v4mhPO58JmwXBDj0Qs7+Wk=,tag:5Xn0tqpiIiEt8ZWZHRTM3w==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzb2ZpaDd0azNHNTJoUTB6 - VVpKbm94ZEprSHplb2UrQnkzTzdGUEFjcGxBCnhxR1BwNmFIOExtMW5GRkVJWTl5 - blQzSmZ0Tm5CWTk3N25nUUM0dFpKUTQKLS0tIEgwSHNlVXNRdHZvcE10VzExU0hE - L0dGK1lFd0ZSQ0lTcEdMNTBkSDJ6WWsKQuiJmRSLbvmgenlu4F2/CQYCCbZTtS/K - nz7NsY2om+mWMvPSvLAp1pOHDAdFW79ggQAiCyslDi9iOkaD8MOnxQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-01-16T23:22:39Z" - mac: ENC[AES256_GCM,data:djsWoz/MuUhEKsM03+iaGV/dZUjRAGkiBEz4hROi+rfNWeHLJG2/xXPSKYYgT3h7JOZGh2Gnz7NXiB7TuixlWrAfT2BUBzd+2o9/hzg3xQzLAjApSfZdyap6oafatKxZAR/JHBSw7s0saVNnop9d/DZK4c1Fb1qNKoTrnWqqrF8=,iv:oitjHdZl07CaoBtNtX/sOPLHu7AS/R4YE4TKBJKrUBw=,tag:Br8mBH+mATEwsLzSZmoVYg==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.8.1 diff --git a/.archive/kubernetes/rook-ceph/rook-ceph/cluster/kustomization.yaml b/.archive/kubernetes/rook-ceph/rook-ceph/cluster/kustomization.yaml deleted file mode 100644 index 17cbc72..0000000 --- a/.archive/kubernetes/rook-ceph/rook-ceph/cluster/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/.forgejo/workflows/schemas.yaml b/.forgejo/workflows/schemas.yaml deleted file mode 100644 index c36e9a0..0000000 --- a/.forgejo/workflows/schemas.yaml +++ /dev/null @@ -1,135 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json -name: "Schemas" - -on: - workflow_dispatch: - schedule: - - cron: "0 0 * * *" # Every day at midnight - push: - branches: ["main"] - paths: [".forgejo/workflows/schemas.yaml"] - -jobs: - publish: - name: Schemas - runs-on: ["ubuntu-x86_64"] - permissions: - contents: read - packages: write - steps: - - name: Checkout - uses: https://github.com/actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Setup Workflow Tools - shell: bash - run: | - curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl" - chmod +x kubectl - mv kubectl /usr/local/bin/ - - curl -LO "https://dl.min.io/client/mc/release/linux-amd64/mc" - chmod +x mc - mv mc /usr/local/bin/ - - - name: Setup Python - run: | - apt-get update - apt-get install -y python3 python3-pip python3-yaml - pip3 install --upgrade pip - - - name: Write kubeconfig - id: kubeconfig - uses: https://github.com/timheuer/base64-to-file@v1 - with: - encodedString: "${{ secrets.KUBECONFIG }}" - fileName: kubeconfig - fileDir: ${{ env.GITHUB_WORKSPACE }} - - name: Write mc - id: mcconfig - uses: https://github.com/timheuer/base64-to-file@v1 - with: - encodedString: "${{ secrets.MCCONFIG }}" - fileName: config.json - fileDir: $HOME/.mc - - - name: Extracting CRDs to yaml and converting to JSON schema - env: - KUBECONFIG: "${{ steps.kubeconfig.outputs.filePath }}" - run: | - # kubeconfig - echo "kubeconfig location: $KUBECONFIG" - # Create temp folder for CRDs - TMP_CRD_DIR=$(mktemp -d) - echo "Temp directory: $TMP_CRD_DIR" - - # Create final schemas directory - SCHEMAS_DIR=$GITHUB_WORKSPACE/crdSchemas - mkdir -p $SCHEMAS_DIR - echo "Schemas directory: $SCHEMAS_DIR" - - # Create array to store CRD kinds and groups - ORGANIZE_BY_GROUP=true - declare -A CRD_GROUPS 2>/dev/null - if [ $? -ne 0 ]; then - # Array creation failed, signal to skip organization by group - ORGANIZE_BY_GROUP=false - fi - - # Extract CRDs from cluster - NUM_OF_CRDS=0 - while read -r crd - do - filename=${crd%% *} - kubectl get crds "$filename" -o yaml > "$TMP_CRD_DIR/$filename.yaml" 2>&1 - echo "Extracted CRD: $filename" - - resourceKind=$(grep "kind:" "$TMP_CRD_DIR/$filename.yaml" | awk 'NR==2{print $2}' | tr '[:upper:]' '[:lower:]') - resourceGroup=$(grep "group:" "$TMP_CRD_DIR/$filename.yaml" | awk 'NR==1{print $2}') - - # Save name and group for later directory organization - CRD_GROUPS["$resourceKind"]="$resourceGroup" - - let ++NUM_OF_CRDS - done < <(kubectl get crds 2>&1 | sed -n '/NAME/,$p' | tail -n +2) - echo numCRDs: $NUM_OF_CRDS - - # Download converter script - curl https://raw.githubusercontent.com/yannh/kubeconform/master/scripts/openapi2jsonschema.py --output $TMP_CRD_DIR/openapi2jsonschema.py 2>/dev/null - - # Convert crds to jsonSchema - cd $SCHEMAS_DIR - python3 $TMP_CRD_DIR/openapi2jsonschema.py $TMP_CRD_DIR/*.yaml - conversionResult=$? - - # Copy and rename files to support kubeval - rm -rf $SCHEMAS_DIR/master-standalone - mkdir -p $SCHEMAS_DIR/master-standalone - cp $SCHEMAS_DIR/*.json $SCHEMAS_DIR/master-standalone - find $SCHEMAS_DIR/master-standalone -name '*json' -exec bash -c ' mv -f $0 ${0/\_/-stable-}' {} \; - - # Organize schemas by group - if [ $ORGANIZE_BY_GROUP == true ]; then - for schema in $SCHEMAS_DIR/*.json - do - crdFileName=$(basename $schema .json) - crdKind=${crdFileName%%_*} - crdGroup=${CRD_GROUPS[$crdKind]} - if [ -z $crdGroup ]; then - crdGroup="uncategorized" - echo "CRD kind $crdKind has no group, moving to $crdGroup" - fi - echo making directory $crdGroup - mkdir -p $crdGroup - mv $schema ./$crdGroup - done - fi - - rm -rf $TMP_CRD_DIR - - - name: Deploy to Cloudflare R2 - shell: bash - run: | - mc cp --recursive $GITHUB_WORKSPACE/crdSchemas/ r2-ks/kubernetes-schema diff --git a/.gitignore b/.gitignore index 04f00ea..d47b9fc 100644 --- a/.gitignore +++ b/.gitignore @@ -16,6 +16,3 @@ kubeconfig* omniconfig.yaml config.xml .idea/ -.env -.secrets -.github diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 28d5065..e94be5e 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -9,7 +9,7 @@ exclude: | repos: - repo: https://github.com/adrienverge/yamllint - rev: v1.35.1 + rev: v1.33.0 hooks: - id: yamllint args: @@ -17,7 +17,7 @@ repos: - ".yamllint.yaml" - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.6.0 + rev: v4.5.0 hooks: - id: trailing-whitespace - id: end-of-file-fixer @@ -29,7 +29,7 @@ repos: - id: check-executables-have-shebangs - repo: https://github.com/Lucas-C/pre-commit-hooks - rev: v1.5.5 + rev: v1.5.4 hooks: - id: forbid-crlf - id: forbid-tabs diff --git a/.renovate/autoMerge.json5 b/.renovate/autoMerge.json5 index 155a148..6afcfd0 100644 --- a/.renovate/autoMerge.json5 +++ b/.renovate/autoMerge.json5 @@ -19,4 +19,4 @@ "ignoreTests": false } ] -} \ No newline at end of file +} diff --git a/.sops.yaml b/.sops.yaml index cf1f0f9..09afbeb 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -5,20 +5,20 @@ creation_rules: input_type: yaml encrypted_regex: ^(token|crt|key|id|secret|secretboxencryptionsecret|ca|bootstraptoken)$ age: >- - age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn - path_regex: kubernetes/.*/talos/.*\.sops\.ya?ml$ age: >- - age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn - path_regex: kubernetes/.*\.sops\.ya?ml encrypted_regex: "^(data|stringData)$" # Homelab age: >- - age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn - path_regex: .*\.sops\.(env|ini|json|toml) # Homelab age: >- - age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn - path_regex: (ansible|terraform|talos)/.*\.sops\.ya?ml # Homelab age: >- - age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn diff --git a/.taskfiles/act/Taskfile.yaml b/.taskfiles/act/Taskfile.yaml deleted file mode 100644 index c48e22f..0000000 --- a/.taskfiles/act/Taskfile.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -version: "3" - -tasks: - run: - desc: Run ACT with custom image - cmds: - - act -P ubuntu-x86_64=catthehacker/ubuntu:act-latest diff --git a/.taskfiles/talos/Taskfile.yaml b/.taskfiles/talos/Taskfile.yaml index ff2577b..77bb10a 100644 --- a/.taskfiles/talos/Taskfile.yaml +++ b/.taskfiles/talos/Taskfile.yaml @@ -7,13 +7,13 @@ tasks: desc: Bootstrap Talos summary: | Args: - cluster: Cluster to run command against (default: homelab) + cluster: Cluster to run command against (default: theshire) controller: Controller node to run command against (required) (IP/DNS) prompt: Bootstrap Talos on the cluster... continue? cmds: - task: bootstrap-etcd vars: &vars - cluster: '{{.cluster | default "homelab"}}' + cluster: '{{.cluster | default "theshire"}}' controller: "{{.controller}}" - task: fetch-kubeconfig vars: *vars @@ -93,7 +93,7 @@ tasks: --env-file {{.KUBERNETES_DIR}}/bootstrap/talos/talenv.sops.yaml \ --config-file {{.KUBERNETES_DIR}}/bootstrap/talos/talconfig.yaml cmds: - - talosctl --context {{.cluster}} upgrade -n {{.node}} --image {{.TALOS_IMAGE }} --preserve # single node talos cluster needs to be preserved + - talosctl --context {{.cluster}} upgrade -n {{.node}} --image {{.TALOS_IMAGE }} requires: vars: - cluster @@ -114,7 +114,7 @@ tasks: yq -r ".kubernetesVersion" {{.KUBERNETES_DIR}}/bootstrap/talos/talconfig.yaml CONTROLPLANE_NODE: sh: | - talosctl --context homelab config info \ + talosctl --context theshire config info \ | grep Endpoints: \ | awk '{split($0,u," "); print u[2]}' \ | sed -E 's/,//' @@ -163,6 +163,7 @@ tasks: --nodes "{{.hostname}}" --file "{{.KUBERNETES_DIR}}/bootstrap/talos/clusterconfig/{{.filename}}" {{ if eq "true" .dry_run }}--dry-run{{ end }} + #--insecure requires: vars: - cluster diff --git a/.taskfiles/volsync/Taskfile.yaml b/.taskfiles/volsync/Taskfile.yaml index 776d5f2..aff3335 100644 --- a/.taskfiles/volsync/Taskfile.yaml +++ b/.taskfiles/volsync/Taskfile.yaml @@ -22,38 +22,35 @@ vars: VOLSYNC_RESOURCES_DIR: "{{.ROOT_DIR}}/.taskfiles/volsync/resources" tasks: - state-*: desc: Suspend or Resume Volsync summary: | - cluster: Cluster to run command against (required) state: resume or suspend (required) + dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env'] cmds: - - flux --context {{.cluster}} {{.state}} kustomization volsync - - flux --context {{.cluster}} -n {{.ns}} {{.state}} helmrelease volsync - - kubectl --context {{.cluster}} -n {{.ns}} scale deployment volsync --replicas {{if eq "suspend" .state}}0{{else}}1{{end}} + - flux --context $CLUSTER {{.state}} kustomization volsync + - flux --context $CLUSTER -n {{.ns}} {{.state}} helmrelease volsync + - kubectl --context $CLUSTER -n {{.ns}} scale deployment volsync --replicas {{if eq "suspend" .state}}0{{else}}1{{end}} env: *env-vars vars: ns: '{{.ns | default "volsync-system"}}' state: '{{index .MATCH 0}}' - requires: - vars: ["cluster"] list: desc: List snapshots for an application summary: | - cluster: Cluster to run command against (required) ns: Namespace the PVC is in (default: default) app: Application to list snapshots for (required) + dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env'] cmds: - - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/list.tmpl.yaml) | kubectl --context {{.cluster}} apply -f - - - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}} - - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m - - kubectl --context {{.cluster}} -n {{.ns}} logs job/{{.job}} --container main - - kubectl --context {{.cluster}} -n {{.ns}} delete job {{.job}} + - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/list.tmpl.yaml) | kubectl --context $CLUSTER apply -f - + - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} $CLUSTER + - kubectl --context $CLUSTER -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m + - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container main + - kubectl --context $CLUSTER -n {{.ns}} delete job {{.job}} env: *env-vars requires: - vars: ["cluster", "app"] + vars: ["app"] vars: ns: '{{.ns | default "default"}}' job: volsync-list-{{.app}} @@ -66,19 +63,19 @@ tasks: unlock: desc: Unlock a Restic repository for an application summary: | - cluster: Cluster to run command against (required) ns: Namespace the PVC is in (default: default) app: Application to unlock (required) + dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env'] cmds: - - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/unlock.tmpl.yaml) | kubectl --context {{.cluster}} apply -f - - - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}} - - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m - - kubectl --context {{.cluster}} -n {{.ns}} logs job/{{.job}} --container minio - - kubectl --context {{.cluster}} -n {{.ns}} logs job/{{.job}} --container r2 - - kubectl --context {{.cluster}} -n {{.ns}} delete job {{.job}} + - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/unlock.tmpl.yaml) | kubectl --context $CLUSTER apply -f - + - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} $CLUSTER + - kubectl --context $CLUSTER -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m + - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container minio + - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container r2 + - kubectl --context $CLUSTER -n {{.ns}} delete job {{.job}} env: *env-vars requires: - vars: ["cluster", "app"] + vars: ["app"] vars: ns: '{{.ns | default "default"}}' job: volsync-unlock-{{.app}} diff --git a/.taskfiles/volsync/resources/.env b/.taskfiles/volsync/resources/.env new file mode 100644 index 0000000..21bfcc5 --- /dev/null +++ b/.taskfiles/volsync/resources/.env @@ -0,0 +1 @@ +CLUSTER=theshire diff --git a/.taskfiles/volsync/resources/list.tmpl.yaml b/.taskfiles/volsync/resources/list.tmpl.yaml index a5b08eb..e1bbc1a 100644 --- a/.taskfiles/volsync/resources/list.tmpl.yaml +++ b/.taskfiles/volsync/resources/list.tmpl.yaml @@ -16,5 +16,5 @@ spec: args: ["snapshots"] envFrom: - secretRef: - name: ${app}-volsync-secret + name: ${app}-volsync-r2-secret resources: {} diff --git a/.taskfiles/volsync/resources/replicationdestination.tmpl.yaml b/.taskfiles/volsync/resources/replicationdestination.tmpl.yaml index 082ac9e..b560e7e 100644 --- a/.taskfiles/volsync/resources/replicationdestination.tmpl.yaml +++ b/.taskfiles/volsync/resources/replicationdestination.tmpl.yaml @@ -8,10 +8,10 @@ spec: trigger: manual: restore-once restic: - repository: ${app}-volsync-secret + repository: ${app}-volsync-r2-secret destinationPVC: ${claim} copyMethod: Direct - storageClassName: openebs-hostpath + storageClassName: ceph-block # storageClassName: ceph-filesystem # accessModes: ["ReadWriteMany"] # IMPORTANT NOTE: diff --git a/.taskfiles/volsync/resources/wait-for-job.sh b/.taskfiles/volsync/resources/wait-for-job.sh index aaf6d17..ab6bafc 100755 --- a/.taskfiles/volsync/resources/wait-for-job.sh +++ b/.taskfiles/volsync/resources/wait-for-job.sh @@ -2,7 +2,7 @@ JOB=$1 NAMESPACE="${2:-default}" -CLUSTER="${3:-homelab}" +CLUSTER="${3:-main}" [[ -z "${JOB}" ]] && echo "Job name not specified" && exit 1 while true; do diff --git a/.vscode/settings.json b/.vscode/settings.json index fc13967..67d6e32 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,6 +1,10 @@ { + "ansible.validation.lint.arguments": "-c .ansible-lint", "files.associations": { "*.json5": "jsonc", + "**/ansible/**/*.yaml": "ansible", + "**/ansible/**/*.sops.yaml": "yaml", + "**/ansible/**/inventory/**/*.yaml": "yaml", "**/kubernetes/**/*.sops.toml": "plaintext" }, "material-icon-theme.folders.associations": { @@ -20,6 +24,7 @@ }, "yaml.schemaStore.enable": true, "yaml.schemas": { + "ansible": "ansible/**/*.yaml", "kubernetes": "kubernetes/**/*.yaml" }, "editor.fontFamily": "FiraCode Nerd Font", @@ -35,5 +40,7 @@ ], "explorer.autoReveal": false, "files.trimTrailingWhitespace": true, + "ansible.python.interpreterPath": "/usr/bin/python3", "sops.defaults.ageKeyFile": "age.key", + "ansible.validation.lint.path": "~/projects/valinor/.venv/bin/ansible-lint" } diff --git a/README.md b/README.md index 3639bcb..628b44f 100644 --- a/README.md +++ b/README.md @@ -1 +1,4 @@ -Kubernetes with talos @ Home +Talos & 6x Dell USFF nodes with 2 Beefy VM works with GPUs. + + +Fancier README to come! :) diff --git a/Taskfile.yaml b/Taskfile.yaml index 3ad3e1e..3bb0a73 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -18,7 +18,6 @@ includes: k8s: .taskfiles/k8s flux: .taskfiles/flux talos: .taskfiles/talos - act: .taskfiles/act tasks: default: diff --git a/kubernetes/apps/ai/kustomization.yaml b/kubernetes/apps/ai/kustomization.yaml deleted file mode 100644 index 02c7ad9..0000000 --- a/kubernetes/apps/ai/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./ollama/ks.yaml - - ./open-webui/ks.yaml - - ./stable-diffusion/ks.yaml diff --git a/kubernetes/apps/ai/namespace.yaml b/kubernetes/apps/ai/namespace.yaml deleted file mode 100644 index 08e0c55..0000000 --- a/kubernetes/apps/ai/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: ai - labels: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/kubernetes/apps/ai/ollama/app/helmrelease.yaml b/kubernetes/apps/ai/ollama/app/helmrelease.yaml deleted file mode 100644 index b112193..0000000 --- a/kubernetes/apps/ai/ollama/app/helmrelease.yaml +++ /dev/null @@ -1,88 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app ollama -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - ollama: - annotations: - reloader.stakater.com/auto: "true" - pod: - nodeSelector: - nvidia.com/gpu.present: "true" - runtimeClassName: nvidia - containers: - app: - image: - repository: docker.io/ollama/ollama - tag: 0.3.8 - env: - - name: OLLAMA_HOST - value: 0.0.0.0 - - name: OLLAMA_ORIGINS - value: "*" - - name: OLLAMA_MODELS - value: &modelPath "/models" - - name: OLLAMA_KEEP_ALIVE - value: "24h" - resources: - requests: - nvidia.com/gpu: 1 # requesting 1 GPU - cpu: 500m - memory: 2Gi - limits: - memory: 16Gi - nvidia.com/gpu: 1 # requesting 1 GPU - service: - app: - controller: ollama - ports: - http: - port: 11434 - ingress: - app: - enabled: true - className: internal-nginx - hosts: - - host: &host "{{ .Release.Name }}.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - models: - enabled: true - existingClaim: ollama-models - advancedMounts: - ollama: - app: - - path: *modelPath - config: - enabled: true - existingClaim: ollama - globalMounts: - - path: /root/.ollama diff --git a/kubernetes/apps/ai/ollama/app/kustomization.yaml b/kubernetes/apps/ai/ollama/app/kustomization.yaml deleted file mode 100644 index 5ca502c..0000000 --- a/kubernetes/apps/ai/ollama/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./pvc.yaml - - ../../../../templates/volsync diff --git a/kubernetes/apps/ai/ollama/app/pvc.yaml b/kubernetes/apps/ai/ollama/app/pvc.yaml deleted file mode 100644 index 6b2734e..0000000 --- a/kubernetes/apps/ai/ollama/app/pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: ollama-models -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 500Gi - storageClassName: openebs-hostpath diff --git a/kubernetes/apps/ai/ollama/ks.yaml b/kubernetes/apps/ai/ollama/ks.yaml deleted file mode 100644 index b9050e9..0000000 --- a/kubernetes/apps/ai/ollama/ks.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app ollama - namespace: flux-system -spec: - targetNamespace: ai - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: nvidia-device-plugin - - name: node-feature-discovery - - name: volsync - - name: openebs - path: ./kubernetes/apps/ai/ollama/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 1Gi - VOLSYNC_STORAGECLASS: openebs-zfs - VOLSYNC_SNAPSHOTCLASS: openebs-zfs diff --git a/kubernetes/apps/ai/open-webui/app/helmrelease.yaml b/kubernetes/apps/ai/open-webui/app/helmrelease.yaml deleted file mode 100644 index ab961cd..0000000 --- a/kubernetes/apps/ai/open-webui/app/helmrelease.yaml +++ /dev/null @@ -1,77 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app open-webui -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - dependsOn: - - name: ollama - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - open-webui: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: ghcr.io/open-webui/open-webui - tag: v0.3.16 - env: - - name: OLLAMA_BASE_URL - value: http://ollama.ai.svc.cluster.local:11434 - - name: ENABLE_RAG_WEB_SEARCH - value: true - - name: RAG_WEB_SEARCH_ENGINE - value: searxng - - name: SEARXNG_QUERY_URL - value: http://searxng.default.svc.cluster.local:8080/search?q= - resources: - requests: - cpu: 500m - memory: 2Gi - limits: - memory: 2Gi - service: - app: - controller: open-webui - ports: - http: - port: 8080 - ingress: - app: - enabled: true - className: internal-nginx - hosts: - - host: &host "chat.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - enabled: true - existingClaim: *app - globalMounts: - - path: /app/backend/data diff --git a/kubernetes/apps/ai/open-webui/app/kustomization.yaml b/kubernetes/apps/ai/open-webui/app/kustomization.yaml deleted file mode 100644 index 82c3440..0000000 --- a/kubernetes/apps/ai/open-webui/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ../../../../templates/volsync - - ../../../../templates/gatus/internal diff --git a/kubernetes/apps/ai/open-webui/ks.yaml b/kubernetes/apps/ai/open-webui/ks.yaml deleted file mode 100644 index bb4633d..0000000 --- a/kubernetes/apps/ai/open-webui/ks.yaml +++ /dev/null @@ -1,31 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app open-webui - namespace: flux-system -spec: - targetNamespace: ai - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: volsync - - name: ollama - path: ./kubernetes/apps/ai/open-webui/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 5Gi - VOLSYNC_STORAGECLASS: openebs-zfs - VOLSYNC_SNAPSHOTCLASS: openebs-zfs - GATUS_SUBDOMAIN: chat diff --git a/kubernetes/apps/ai/stable-diffusion/comfyui/helmrelease.yaml b/kubernetes/apps/ai/stable-diffusion/comfyui/helmrelease.yaml deleted file mode 100644 index edb02c3..0000000 --- a/kubernetes/apps/ai/stable-diffusion/comfyui/helmrelease.yaml +++ /dev/null @@ -1,82 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app comfyui -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - comfyui: - annotations: - reloader.stakater.com/auto: "true" - pod: - nodeSelector: - nvidia.com/gpu.present: "true" - runtimeClassName: nvidia - containers: - app: - image: - repository: docker.io/jahanson/comfyui - tag: v0.0.1 - resources: - requests: - nvidia.com/gpu: 1 # requesting 1 GPU - cpu: 500m - memory: 2Gi - limits: - memory: 60Gi - nvidia.com/gpu: 1 # requesting 1 GPU - service: - app: - controller: comfyui - ports: - http: - port: 7860 - ingress: - app: - enabled: true - className: internal-nginx - hosts: - - host: &host "{{ .Release.Name }}.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - models: - enabled: true - existingClaim: stablediffusion-checkpoints - globalMounts: - - path: /data/models - config: - enabled: true - existingClaim: comfyui - globalMounts: - - path: /data/config - output: - enabled: true - type: emptyDir - globalMounts: - - path: /output diff --git a/kubernetes/apps/ai/stable-diffusion/comfyui/kustomization.yaml b/kubernetes/apps/ai/stable-diffusion/comfyui/kustomization.yaml deleted file mode 100644 index 3783d72..0000000 --- a/kubernetes/apps/ai/stable-diffusion/comfyui/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./pvc.yaml - - ../../../../templates/volsync - - ../../../../templates/gatus/internal diff --git a/kubernetes/apps/ai/stable-diffusion/comfyui/pvc.yaml b/kubernetes/apps/ai/stable-diffusion/comfyui/pvc.yaml deleted file mode 100644 index 7634d1c..0000000 --- a/kubernetes/apps/ai/stable-diffusion/comfyui/pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: stablediffusion-checkpoints -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 300Gi - storageClassName: openebs-hostpath diff --git a/kubernetes/apps/ai/stable-diffusion/ks.yaml b/kubernetes/apps/ai/stable-diffusion/ks.yaml deleted file mode 100644 index 02ebbf8..0000000 --- a/kubernetes/apps/ai/stable-diffusion/ks.yaml +++ /dev/null @@ -1,33 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app comfyui - namespace: flux-system -spec: - targetNamespace: ai - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: nvidia-device-plugin - - name: node-feature-discovery - - name: volsync - - name: openebs - path: ./kubernetes/apps/ai/stable-diffusion/comfyui - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 5Gi - VOLSYNC_STORAGECLASS: openebs-zfs - VOLSYNC_SNAPSHOTCLASS: openebs-zfs - GATUS_SUBDOMAIN: comfyui diff --git a/kubernetes/apps/cdi/cdi/app/ingress.yaml b/kubernetes/apps/cdi/cdi/app/ingress.yaml deleted file mode 100644 index 1d16c9d..0000000 --- a/kubernetes/apps/cdi/cdi/app/ingress.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: cdi-uploadproxy - namespace: cdi -spec: - ingressClassName: internal-nginx - rules: - - host: &host "cdi.jahanson.tech" - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: cdi-uploadproxy - port: - number: 443 - tls: - - hosts: - - *host diff --git a/kubernetes/apps/cdi/cdi/app/kustomization.yaml b/kubernetes/apps/cdi/cdi/app/kustomization.yaml deleted file mode 100644 index 796cff9..0000000 --- a/kubernetes/apps/cdi/cdi/app/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Flux-Kustomizations - - ./ingress.yaml - - ./sp-nfs-zfs-csi.yaml - - ./sp-openebs-hostpath.yaml - - ./sp-openebs-zfs.yaml diff --git a/kubernetes/apps/cdi/cdi/app/sp-nfs-zfs-csi.yaml b/kubernetes/apps/cdi/cdi/app/sp-nfs-zfs-csi.yaml deleted file mode 100644 index e0bc6a8..0000000 --- a/kubernetes/apps/cdi/cdi/app/sp-nfs-zfs-csi.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/cdi.kubevirt.io/storageprofile_v1beta1.json -apiVersion: cdi.kubevirt.io/v1beta1 -kind: StorageProfile -metadata: - labels: - app: containerized-data-importer - app.kubernetes.io/component: storage - app.kubernetes.io/managed-by: cdi-controller - cdi.kubevirt.io: "" - name: zfs-generic-nfs-csi -spec: - claimPropertySets: - - accessModes: - - ReadWriteMany - - ReadWriteOnce - volumeMode: Filesystem -status: - cloneStrategy: snapshot - dataImportCronSourceFormat: pvc - provisioner: org.democratic-csi.nfs - snapshotClass: zfs-generic-nfs-csi - storageClass: zfs-generic-nfs-csi diff --git a/kubernetes/apps/cdi/cdi/app/sp-openebs-hostpath.yaml b/kubernetes/apps/cdi/cdi/app/sp-openebs-hostpath.yaml deleted file mode 100644 index 7dab98e..0000000 --- a/kubernetes/apps/cdi/cdi/app/sp-openebs-hostpath.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/cdi.kubevirt.io/storageprofile_v1beta1.json -apiVersion: cdi.kubevirt.io/v1beta1 -kind: StorageProfile -metadata: - labels: - app: containerized-data-importer - app.kubernetes.io/component: storage - app.kubernetes.io/managed-by: cdi-controller - cdi.kubevirt.io: "" - name: openebs-hostpath -spec: - claimPropertySets: - - accessModes: - - ReadWriteOnce - volumeMode: Filesystem -status: - claimPropertySets: - - accessModes: - - ReadWriteOnce - volumeMode: Block - cloneStrategy: copy - dataImportCronSourceFormat: pvc - provisioner: openebs.io/local - snapshotClass: openebs-hostpath - storageClass: openebs-hostpath diff --git a/kubernetes/apps/cdi/cdi/app/sp-openebs-zfs.yaml b/kubernetes/apps/cdi/cdi/app/sp-openebs-zfs.yaml deleted file mode 100644 index 5142093..0000000 --- a/kubernetes/apps/cdi/cdi/app/sp-openebs-zfs.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/cdi.kubevirt.io/storageprofile_v1beta1.json -apiVersion: cdi.kubevirt.io/v1beta1 -kind: StorageProfile -metadata: - labels: - app: containerized-data-importer - app.kubernetes.io/component: storage - app.kubernetes.io/managed-by: cdi-controller - cdi.kubevirt.io: "" - name: openebs-zfs -spec: - claimPropertySets: - - accessModes: - - ReadWriteOnce - volumeMode: Filesystem - snapshotClass: openebs-zfs -status: - claimPropertySets: - - accessModes: - - ReadWriteOnce - volumeMode: Block - cloneStrategy: clone - dataImportCronSourceFormat: pvc - provisioner: openebs.io/local - snapshotClass: openebs-zfs - storageClass: openebs-zfs diff --git a/kubernetes/apps/cdi/cdi/ks.yaml b/kubernetes/apps/cdi/cdi/ks.yaml deleted file mode 100644 index d4965fb..0000000 --- a/kubernetes/apps/cdi/cdi/ks.yaml +++ /dev/null @@ -1,73 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app kubevirt-cdi - namespace: flux-system -spec: - targetNamespace: cdi - dependsOn: - - name: kubevirt - - name: openebs - path: ./deploy - prune: true - sourceRef: - kind: GitRepository - name: kubevirt-cdi - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m - patches: - - patch: | - $patch: delete - apiVersion: v1 - kind: Namespace - metadata: - name: cdi - target: - kind: Namespace - name: cdi - - patch: | - apiVersion: cdi.kubevirt.io/v1beta1 - kind: CDI - metadata: - name: not-used - spec: - cloneStrategyOverride: copy - config: - featureGates: - - HonorWaitForFirstConsumer - customizeComponents: {} - imagePullPolicy: IfNotPresent - infra: - nodeSelector: - kubernetes.io/os: linux - tolerations: - - key: CriticalAddonsOnly - operator: Exists - workload: - nodeSelector: - kubernetes.io/os: linux - target: - group: cdi.kubevirt.io - kind: CDI ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app kubevirt-cdi-addl - namespace: flux-system -spec: - targetNamespace: cdi - dependsOn: - - name: kubevirt-cdi - interval: 10m - path: "./kubernetes/apps/cdi/cdi/app/" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false diff --git a/kubernetes/apps/cdi/kustomization.yaml b/kubernetes/apps/cdi/kustomization.yaml deleted file mode 100644 index 7bc6941..0000000 --- a/kubernetes/apps/cdi/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./cdi/ks.yaml diff --git a/kubernetes/apps/cdi/namespace.yaml b/kubernetes/apps/cdi/namespace.yaml deleted file mode 100644 index 867f241..0000000 --- a/kubernetes/apps/cdi/namespace.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: cdi - labels: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" - cdi.kubevirt.io: "" diff --git a/kubernetes/apps/cert-manager/cert-manager/ks.yaml b/kubernetes/apps/cert-manager/cert-manager/ks.yaml index d12c873..f624b91 100644 --- a/kubernetes/apps/cert-manager/cert-manager/ks.yaml +++ b/kubernetes/apps/cert-manager/cert-manager/ks.yaml @@ -11,7 +11,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true --- # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json @@ -26,7 +26,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false dependsOn: - name: cert-manager diff --git a/kubernetes/apps/cert-manager/namespace.yaml b/kubernetes/apps/cert-manager/namespace.yaml index 0093891..ed78835 100644 --- a/kubernetes/apps/cert-manager/namespace.yaml +++ b/kubernetes/apps/cert-manager/namespace.yaml @@ -5,4 +5,3 @@ metadata: name: cert-manager labels: kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/kubernetes/apps/cert-manager/webhook-dnsimple/app/apiservice.yaml b/kubernetes/apps/cert-manager/webhook-dnsimple/app/apiservice.yaml index 58ee272..14459f3 100644 --- a/kubernetes/apps/cert-manager/webhook-dnsimple/app/apiservice.yaml +++ b/kubernetes/apps/cert-manager/webhook-dnsimple/app/apiservice.yaml @@ -1,3 +1,4 @@ +--- apiVersion: apiregistration.k8s.io/v1 kind: APIService metadata: @@ -13,4 +14,4 @@ spec: service: name: webhook-dnsimple namespace: cert-manager - version: v1alpha1 \ No newline at end of file + version: v1alpha1 diff --git a/kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml b/kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml index fcb704f..5616cbb 100644 --- a/kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml +++ b/kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml @@ -67,4 +67,4 @@ spec: readOnly: true serviceAccount: create: true - name: webhook-dnsimple \ No newline at end of file + name: webhook-dnsimple diff --git a/kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml b/kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml index aef8fbe..3b02736 100644 --- a/kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml +++ b/kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml @@ -57,6 +57,6 @@ spec: issuerRef: name: webhook-dnsimple-ca dnsNames: - - webhook-dnsimple - - webhook-dnsimple.cert-manager - - webhook-dnsimple.cert-manager.svc \ No newline at end of file + - webhook-dnsimple + - webhook-dnsimple.cert-manager + - webhook-dnsimple.cert-manager.svc diff --git a/kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml b/kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml index a578ad3..3b00dc9 100644 --- a/kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml +++ b/kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml @@ -10,9 +10,9 @@ rules: - apiGroups: - acme.hsn.dev resources: - - '*' + - "*" verbs: - - 'create' + - "create" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -77,23 +77,23 @@ subjects: kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: - namespace: "cert-manager" - name: webhook-dnsimple:access-secret + namespace: "cert-manager" + name: webhook-dnsimple:access-secret rules: -- apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "watch"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: webhook-dnsimple:access-secret - namespace: "cert-manager" -subjects: -- kind: ServiceAccount - name: webhook-dnsimple + name: webhook-dnsimple:access-secret namespace: "cert-manager" +subjects: + - kind: ServiceAccount + name: webhook-dnsimple + namespace: "cert-manager" roleRef: - kind: Role - name: webhook-dnsimple:access-secret - apiGroup: rbac.authorization.k8s.io + kind: Role + name: webhook-dnsimple:access-secret + apiGroup: rbac.authorization.k8s.io diff --git a/kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml b/kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml index ae4caf7..7624917 100644 --- a/kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml +++ b/kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml @@ -12,5 +12,5 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab - wait: true \ No newline at end of file + name: theshire + wait: true diff --git a/kubernetes/apps/ci-runners/forgejo/app/externalsecret.yaml b/kubernetes/apps/ci-runners/forgejo/app/externalsecret.yaml deleted file mode 100644 index dec40ab..0000000 --- a/kubernetes/apps/ci-runners/forgejo/app/externalsecret.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: forgejo-runner-secret -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: forgejo-runner-secret - template: - engineVersion: v2 - data: - FORGEJO_INSTANCE_URL: "{{ .forgejo_instance_url }}" - RUNNER_NAME: "{{ .runner_name }}" - RUNNER_TOKEN: "{{ .runner_token }}" - - dataFrom: - - extract: - key: forgejo-runner diff --git a/kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml b/kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml deleted file mode 100644 index dabd835..0000000 --- a/kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml +++ /dev/null @@ -1,103 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app forgejo-runner -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - forgejo-runner: - replicas: 2 - initContainers: - runner-register: - image: - repository: code.forgejo.org/forgejo/runner - tag: 3.5.1 - command: - - "forgejo-runner" - - "register" - - "--no-interactive" - - "--token" - - $(RUNNER_TOKEN) - - "--name" - - $(RUNNER_NAME) - - "--instance" - - $(FORGEJO_INSTANCE_URL) - - "--labels" - - "docker:docker://node:20-bullseye,x86_64:docker://node:20-bullseye,linux:docker://node:20-bullseye,pc:docker://node:20-bullseye,ubuntu-x86_64:docker://node:20-bullseye" - env: - - name: RUNNER_NAME - valueFrom: - secretKeyRef: - name: forgejo-runner-secret - key: RUNNER_NAME - - name: RUNNER_TOKEN - valueFrom: - secretKeyRef: - name: forgejo-runner-secret - key: RUNNER_TOKEN - - name: FORGEJO_INSTANCE_URL - valueFrom: - secretKeyRef: - name: forgejo-runner-secret - key: FORGEJO_INSTANCE_URL - containers: - daemon: - image: - repository: docker - tag: 27.2.0-dind - securityContext: - privileged: true - env: - - name: DOCKER_TLS_CERTDIR - value: /certs - app: - image: - repository: code.forgejo.org/forgejo/runner - tag: 3.5.1 - command: - - "sh" - - "-c" - - "while ! nc -z localhost 2376 - - sabnzbd, - sabnzbd.default, - sabnzbd.default.svc, - sabnzbd.default.svc.cluster, - sabnzbd.default.svc.cluster.local, - sabz.jahanson.tech, - sabnzbd.jahanson.tech - envFrom: - - secretRef: - name: sabnzbd-secret - probes: - liveness: &probes - enabled: true - custom: true - spec: - httpGet: - path: /api?mode=version - port: *port - initialDelaySeconds: 0 - periodSeconds: 10 - timeoutSeconds: 1 - failureThreshold: 3 - readiness: *probes - startup: - enabled: false - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 100m - limits: - memory: 16Gi - pod: - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - supplementalGroups: [10000] - service: - app: - controller: sabnzbd - ports: - http: - port: *port - ingress: - app: - enabled: true - className: internal-nginx - hosts: - - host: &host sabz.jahanson.tech - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - enabled: true - existingClaim: sabnzbd - tmp: - type: emptyDir - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - globalMounts: - - path: /data/nas-media diff --git a/kubernetes/apps/default/sabnzbd/app/kustomization.yaml b/kubernetes/apps/default/sabnzbd/app/kustomization.yaml deleted file mode 100644 index be13d2d..0000000 --- a/kubernetes/apps/default/sabnzbd/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ../../../../templates/volsync diff --git a/kubernetes/apps/default/sabnzbd/ks.yaml b/kubernetes/apps/default/sabnzbd/ks.yaml deleted file mode 100644 index be0964d..0000000 --- a/kubernetes/apps/default/sabnzbd/ks.yaml +++ /dev/null @@ -1,31 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app sabnzbd - namespace: flux-system -spec: - targetNamespace: default - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - - name: openebs - - name: volsync - path: ./kubernetes/apps/default/sabnzbd/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 1Gi - VOLSYNC_STORAGECLASS: openebs-zfs - VOLSYNC_SNAPSHOTCLASS: openebs-zfs diff --git a/kubernetes/apps/default/searxng/app/externalsecret.yaml b/kubernetes/apps/default/searxng/app/externalsecret.yaml deleted file mode 100644 index 982251f..0000000 --- a/kubernetes/apps/default/searxng/app/externalsecret.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: searxng -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: searxng-secret - template: - engineVersion: v2 - data: - SEARXNG_SECRET: "{{ .SEARXNG_SECRET }}" - dataFrom: - - extract: - key: searxng diff --git a/kubernetes/apps/default/searxng/app/helmrelease.yaml b/kubernetes/apps/default/searxng/app/helmrelease.yaml deleted file mode 100644 index bd2e599..0000000 --- a/kubernetes/apps/default/searxng/app/helmrelease.yaml +++ /dev/null @@ -1,112 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: searxng -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - searxng: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: docker.io/searxng/searxng - tag: 2024.7.7-ef103ba80 - envFrom: - - secretRef: - name: searxng-secret - env: - TZ: America/Chicago - SEARXNG_BASE_URL: https://search.jahanson.tech - SEARXNG_URL: https://search.jahanson.tech - SEARXNG_PORT: &port 8080 - probes: - liveness: &probes - enabled: true - custom: true - spec: - httpGet: - path: /stats - port: *port - initialDelaySeconds: 0 - periodSeconds: 10 - timeoutSeconds: 1 - failureThreshold: 3 - readiness: *probes - startup: - enabled: false - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - add: - - CHOWN - - SETGID - - SETUID - - DAC_OVERRIDE - resources: - requests: - cpu: 10m - limits: - memory: 3Gi - service: - app: - controller: searxng - ports: - http: - port: *port - ingress: - app: - enabled: true - className: internal-nginx - hosts: - - host: &host "search.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - type: configMap - name: searxng-configmap - advancedMounts: - searxng: - app: - - path: /etc/searxng/settings.yml - subPath: settings.yml - readOnly: true - - path: /etc/searxng/limiter.toml - subPath: limiter.toml - readOnly: true - tmp: - type: emptyDir - advancedMounts: - searxng: - app: - - path: /etc/searxng diff --git a/kubernetes/apps/default/searxng/app/kustomization.yaml b/kubernetes/apps/default/searxng/app/kustomization.yaml deleted file mode 100644 index cc085e4..0000000 --- a/kubernetes/apps/default/searxng/app/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ../../../../templates/gatus/internal -configMapGenerator: - - name: searxng-configmap - files: - - settings.yml=./resources/settings.yml - - limiter.toml=./resources/limiter.toml -generatorOptions: - disableNameSuffixHash: true diff --git a/kubernetes/apps/default/searxng/app/resources/limiter.toml b/kubernetes/apps/default/searxng/app/resources/limiter.toml deleted file mode 100644 index 190f8df..0000000 --- a/kubernetes/apps/default/searxng/app/resources/limiter.toml +++ /dev/null @@ -1,6 +0,0 @@ -# This configuration file updates the default configuration file -# See https://github.com/searxng/searxng/blob/master/searx/limiter.toml - -[botdetection.ip_limit] -# activate link_token method in the ip_limit method -link_token = true diff --git a/kubernetes/apps/default/searxng/app/resources/settings.yml b/kubernetes/apps/default/searxng/app/resources/settings.yml deleted file mode 100644 index 553e14e..0000000 --- a/kubernetes/apps/default/searxng/app/resources/settings.yml +++ /dev/null @@ -1,51 +0,0 @@ ---- -use_default_settings: true - -server: - limiter: false - image_proxy: true - -redis: - url: redis://dragonfly.database.svc.cluster.local:6379?db=10 - -search: - safe_search: 0 - autocomplete: brave - formats: - - html - - json - -general: - instance_name: HansonSearch - -ui: - static_use_hash: true - default_theme: simple - theme_args: - simple_style: dark - infinite_scroll: true - results_on_new_tab: true - -enabled_plugins: - - Basic Calculator - - Hash plugin - - Hostnames plugin - - Open Access DOI rewrite - - Self Informations - - Tracker URL remover - - Unit converter plugin - -hostnames: - high_priority: - - (.*)\/blog\/(.*) - - (.*\.)?wikipedia.org$ - - (.*\.)?github.com$ - - (.*\.)?reddit.com$ - - (.*\.)?linuxserver.io$ - - (.*\.)?docker.com$ - - (.*\.)?archlinux.org$ - - (.*\.)?stackoverflow.com$ - - (.*\.)?askubuntu.com$ - - (.*\.)?superuser.com$ - replace: - (www\.)?reddit\.com$: red.hsn.dev diff --git a/kubernetes/apps/default/searxng/ks.yaml b/kubernetes/apps/default/searxng/ks.yaml deleted file mode 100644 index 4a4df6a..0000000 --- a/kubernetes/apps/default/searxng/ks.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app searxng - namespace: flux-system -spec: - targetNamespace: default - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: dragonfly - - name: external-secrets-stores - path: ./kubernetes/apps/default/searxng/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - GATUS_SUBDOMAIN: search diff --git a/kubernetes/apps/default/sonarr/app/externalsecret.yaml b/kubernetes/apps/default/sonarr/app/externalsecret.yaml deleted file mode 100644 index 8db1a12..0000000 --- a/kubernetes/apps/default/sonarr/app/externalsecret.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: sonarr -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: sonarr-secret - template: - engineVersion: v2 - data: - PUSHOVER_TOKEN: "{{ .sonarr_token }}" - PUSHOVER_USER_KEY: "{{ .userkey_jahanson }}" - SONARR__AUTH__APIKEY: "{{ .api_key }}" - SONARR__POSTGRES__HOST: "postgres-primary-real.database.svc" - SONARR__POSTGRES__USER: "{{ .SONARR_POSTGRES_USER }}" - SONARR__POSTGRES__PASSWORD: "{{ .SONARR_POSTGRES_PASSWORD }}" - SONARR__POSTGRES__PORT: "5432" - SONARR__POSTGRES__MAINDB: sonarr_main - dataFrom: - - extract: - key: pushover - - extract: - key: sonarr diff --git a/kubernetes/apps/default/sonarr/app/helmrelease.yaml b/kubernetes/apps/default/sonarr/app/helmrelease.yaml deleted file mode 100644 index 7e93811..0000000 --- a/kubernetes/apps/default/sonarr/app/helmrelease.yaml +++ /dev/null @@ -1,117 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: sonarr -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - sonarr: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: ghcr.io/onedr0p/sonarr-develop - tag: 4.0.9.2278 - env: - SONARR__APP__INSTANCENAME: Sonarr - SONARR__APP__THEME: dark - SONARR__AUTH__METHOD: External - SONARR__AUTH__REQUIRED: DisabledForLocalAddresses - SONARR__LOG__DBENABLED: "False" - SONARR__LOG__LEVEL: info - SONARR__SERVER__PORT: &port 80 - SONARR__UPDATE__BRANCH: develop - TZ: America/Chicago - envFrom: - - secretRef: - name: sonarr-secret - probes: - liveness: &probes - enabled: true - custom: true - spec: - httpGet: - path: /ping - port: *port - initialDelaySeconds: 0 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 3 - readiness: *probes - startup: - enabled: false - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 10m - limits: - memory: 16Gi - pod: - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - supplementalGroups: [10000] - service: - app: - controller: sonarr - ports: - http: - port: *port - ingress: - main: - enabled: true - className: internal-nginx - hosts: - - host: &host "{{ .Release.Name }}.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - enabled: true - existingClaim: sonarr - tmp: - type: emptyDir - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - globalMounts: - - path: /data/nas-media - sting-media: - type: nfs - server: 10.1.1.12 - path: /mnt/user/Media/ - globalMounts: - - path: /data/sting-media diff --git a/kubernetes/apps/default/sonarr/app/kustomization.yaml b/kubernetes/apps/default/sonarr/app/kustomization.yaml deleted file mode 100644 index be13d2d..0000000 --- a/kubernetes/apps/default/sonarr/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ../../../../templates/volsync diff --git a/kubernetes/apps/default/sonarr/ks.yaml b/kubernetes/apps/default/sonarr/ks.yaml deleted file mode 100644 index 3590b66..0000000 --- a/kubernetes/apps/default/sonarr/ks.yaml +++ /dev/null @@ -1,34 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app sonarr - namespace: flux-system -spec: - targetNamespace: default - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: crunchy-postgres-operator - - name: external-secrets-stores - - name: volsync - - name: openebs - path: ./kubernetes/apps/default/sonarr/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - DB_NAME: sonarr - DB_USER: sonarr - VOLSYNC_CAPACITY: 15Gi - VOLSYNC_STORAGECLASS: openebs-zfs - VOLSYNC_SNAPSHOTCLASS: openebs-zfs diff --git a/kubernetes/apps/default/tautulli/app/helmrelease.yaml b/kubernetes/apps/default/tautulli/app/helmrelease.yaml deleted file mode 100644 index fa99082..0000000 --- a/kubernetes/apps/default/tautulli/app/helmrelease.yaml +++ /dev/null @@ -1,118 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: tautulli -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - tautulli: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: ghcr.io/tautulli/tautulli - tag: v2.14.4@sha256:4316ed82bd1334852c56460d0dc2c3ff4fc84ac55e71944bcb0f27838ed7a53e - env: - TZ: America/Chicago - command: ["/usr/local/bin/python", "Tautulli.py"] - args: [ - "--config", "/config/config.ini", - "--datadir", "/config", - "--port", "80" - ] - probes: - liveness: &probes - enabled: true - custom: true - spec: - httpGet: - path: /status - port: &port 80 - initialDelaySeconds: 0 - periodSeconds: 10 - timeoutSeconds: 1 - failureThreshold: 3 - readiness: *probes - startup: - enabled: false - securityContext: &securityContext - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 10m - limits: - memory: 1Gi - jbops: - image: - repository: registry.k8s.io/git-sync/git-sync - tag: v4.2.4@sha256:8bfbf28623690fba06c65ec392e42023d28ecfc7e0fbfd4443388d020dc112ea - env: - GITSYNC_REPO: https://github.com/blacktwin/JBOPS - GITSYNC_REF: master - GITSYNC_PERIOD: 24h - GITSYNC_ROOT: /add-ons - securityContext: *securityContext - resources: - requests: - cpu: 10m - limits: - memory: 128Mi - pod: - securityContext: - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - service: - app: - controller: tautulli - ports: - http: - port: *port - ingress: - app: - enabled: true - className: external-nginx - annotations: - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" - external-dns.alpha.kubernetes.io/target: external.hsn.dev - hosts: - - host: &host "t.hsn.dev" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - enabled: true - existingClaim: tautulli - tmp: - type: emptyDir - add-ons: - type: emptyDir diff --git a/kubernetes/apps/default/tautulli/app/kustomization.yaml b/kubernetes/apps/default/tautulli/app/kustomization.yaml deleted file mode 100644 index a928a56..0000000 --- a/kubernetes/apps/default/tautulli/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ../../../../templates/volsync diff --git a/kubernetes/apps/default/tautulli/ks.yaml b/kubernetes/apps/default/tautulli/ks.yaml deleted file mode 100644 index 78c5506..0000000 --- a/kubernetes/apps/default/tautulli/ks.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app tautulli - namespace: flux-system -spec: - targetNamespace: default - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/default/tautulli/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - dependsOn: - - name: openebs - - name: volsync - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 5Gi - VOLSYNC_STORAGECLASS: openebs-zfs - VOLSYNC_SNAPSHOTCLASS: openebs-zfs diff --git a/kubernetes/apps/default/thelounge/app/helmrelease.yaml b/kubernetes/apps/default/thelounge/app/helmrelease.yaml deleted file mode 100644 index ceb4362..0000000 --- a/kubernetes/apps/default/thelounge/app/helmrelease.yaml +++ /dev/null @@ -1,79 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: thelounge -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - interval: 30m - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - - values: - controllers: - thelounge: - type: statefulset - - annotations: - reloader.stakater.com/auto: "true" - - statefulset: - volumeClaimTemplates: - - name: config - accessMode: ReadWriteOnce - size: 1Gi - storageClass: openebs-zfs - globalMounts: - - path: /config - - containers: - app: - image: - repository: ghcr.io/thelounge/thelounge - tag: 4.4.3 - env: - THELOUNGE_HOME: /config - probes: - liveness: - enabled: true - readiness: - enabled: true - startup: - enabled: true - spec: - failureThreshold: 30 - periodSeconds: 5 - resources: - requests: - cpu: 12m - memory: 256M - limits: - memory: 512M - - service: - app: - controller: thelounge - ports: - http: - port: 9000 - - ingress: - app: - className: internal-nginx - hosts: - - host: &host "{{ .Release.Name }}.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host diff --git a/kubernetes/apps/default/thelounge/app/kustomization.yaml b/kubernetes/apps/default/thelounge/app/kustomization.yaml deleted file mode 100644 index 17cbc72..0000000 --- a/kubernetes/apps/default/thelounge/app/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/kubernetes/apps/default/unpackerr/app/externalsecret.yaml b/kubernetes/apps/default/unpackerr/app/externalsecret.yaml deleted file mode 100644 index ef51d83..0000000 --- a/kubernetes/apps/default/unpackerr/app/externalsecret.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: unpackerr -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: unpackerr-secret - template: - engineVersion: v2 - data: - UN_RADARR_0_API_KEY: "{{ .radarr_api_key }}" - UN_SONARR_0_API_KEY: "{{ .sonarr_api_key }}" - dataFrom: - - extract: - key: radarr - rewrite: - - regexp: - source: "(.*)" - target: "radarr_$1" - - extract: - key: sonarr - rewrite: - - regexp: - source: "(.*)" - target: "sonarr_$1" diff --git a/kubernetes/apps/default/unpackerr/app/helmrelease.yaml b/kubernetes/apps/default/unpackerr/app/helmrelease.yaml deleted file mode 100644 index 116dc2b..0000000 --- a/kubernetes/apps/default/unpackerr/app/helmrelease.yaml +++ /dev/null @@ -1,84 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: unpackerr -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - unpackerr: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: ghcr.io/unpackerr/unpackerr - tag: 0.14.5@sha256:dc72256942ce50d1c8a1aeb5aa85b6ae2680a36eefd2182129d8d210fce78044 - env: - TZ: America/Chicago - UN_WEBSERVER_METRICS: "true" - UN_SONARR_0_URL: http://sonarr.default.svc.cluster.local - UN_SONARR_0_PATHS_0: /data/nas-media/qb/downloads/complete/sonarr/ - UN_RADARR_0_URL: http://radarr.default.svc.cluster.local - UN_RADARR_0_PATHS_0: /data/nas-media/qb/downloads/complete/radarr/ - envFrom: - - secretRef: - name: unpackerr-secret - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 10m - limits: - memory: 4Gi - pod: - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - service: - app: - controller: unpackerr - ports: - http: - port: 5656 - serviceMonitor: - app: - serviceName: unpackerr - endpoints: - - port: http - scheme: http - path: /metrics - interval: 1m - scrapeTimeout: 10s - persistence: - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - advancedMounts: - unpackerr: - app: - - path: /data/nas-media diff --git a/kubernetes/apps/default/unpackerr/app/kustomization.yaml b/kubernetes/apps/default/unpackerr/app/kustomization.yaml deleted file mode 100644 index 4eed917..0000000 --- a/kubernetes/apps/default/unpackerr/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml diff --git a/kubernetes/apps/default/unpackerr/ks.yaml b/kubernetes/apps/default/unpackerr/ks.yaml deleted file mode 100644 index ce3a15b..0000000 --- a/kubernetes/apps/default/unpackerr/ks.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app unpackerr - namespace: flux-system -spec: - targetNamespace: default - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - path: ./kubernetes/apps/default/unpackerr/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/kubernetes/apps/democratic-csi/democratic-csi/app/externalsecret.yaml b/kubernetes/apps/democratic-csi/democratic-csi/app/externalsecret.yaml deleted file mode 100644 index ef0668b..0000000 --- a/kubernetes/apps/democratic-csi/democratic-csi/app/externalsecret.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: democratic-csi -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: democratic-csi-secret - creationPolicy: Owner - template: - engineVersion: v2 - data: - CSI_USERNAME: "{{ .dcsi_username }}" - CSI_PRIVATEKEY: "{{ .dcsi_privatekey }}" - dataFrom: - - extract: - key: democratic-csi - rewrite: - - regexp: - source: "(.*)" - target: "dcsi_$1" diff --git a/kubernetes/apps/democratic-csi/democratic-csi/app/helmrelease.yaml b/kubernetes/apps/democratic-csi/democratic-csi/app/helmrelease.yaml deleted file mode 100644 index d292bfd..0000000 --- a/kubernetes/apps/democratic-csi/democratic-csi/app/helmrelease.yaml +++ /dev/null @@ -1,119 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: nfs-zfs-dataset - namespace: democratic-csi -spec: - interval: 30m - chart: - spec: - chart: democratic-csi - version: 0.14.6 - sourceRef: - name: democratic-csi - kind: HelmRepository - namespace: flux-system - valuesFrom: - - targetPath: driver.config.sshConnection.username - kind: Secret - name: democratic-csi-secret - valuesKey: CSI_USERNAME - - targetPath: driver.config.sshConnection.privateKey - kind: Secret - name: democratic-csi-secret - valuesKey: CSI_PRIVATEKEY - values: - csiDriver: - # should be globally unique for a given cluster - name: "org.democratic-csi.nfs" - fsGroupPolicy: File - storageClasses: - - name: zfs-generic-nfs-csi - defaultClass: false - reclaimPolicy: Delete - volumeBindingMode: Immediate - allowVolumeExpansion: true - parameters: - # for block-based storage can be ext3, ext4, xfs - # for nfs should be nfs - fsType: nfs - - # if true, volumes created from other snapshots will be - # zfs send/received instead of zfs cloned - # detachedVolumesFromSnapshots: "false" - - # if true, volumes created from other volumes will be - # zfs send/received instead of zfs cloned - # detachedVolumesFromVolumes: "false" - - mountOptions: - - noatime - - nfsvers=4.2 - secrets: - provisioner-secret: - controller-publish-secret: - node-stage-secret: - node-publish-secret: - controller-expand-secret: - volumeSnapshotClasses: - - name: zfs-generic-nfs-csi - parameters: - # if true, snapshots will be created with zfs send/receive - detachedSnapshots: "true" - secrets: - snapshotter-secret: - driver: - config: - # please see the most up-to-date example of the corresponding config here: - # https://github.com/democratic-csi/democratic-csi/tree/master/examples - # YOU MUST COPY THE DATA HERE INLINE! - driver: zfs-generic-nfs - sshConnection: - host: 10.1.1.13 - port: 22 - - zfs: - # can be used to override defaults if necessary - # the example below is useful for NixOS - cli: - sudoEnabled: true - paths: - zfs: /run/current-system/sw/bin/zfs - zpool: /run/current-system/sw/bin/zpool - sudo: /run/wrappers/bin/sudo - chroot: /run/current-system/sw/bin/chroot - - # can be used to set arbitrary values on the dataset/zvol - # can use handlebars templates with the parameters from the storage class/CO - #datasetProperties: - # "org.freenas:description": "{{ parameters.[csi.storage.k8s.io/pvc/namespace] }}/{{ parameters.[csi.storage.k8s.io/pvc/name] }}" - # "org.freenas:test": "{{ parameters.foo }}" - # "org.freenas:test2": "some value" - - datasetParentName: eru/k8s/homelab - # do NOT make datasetParentName and detachedSnapshotsDatasetParentName overlap - # they may be siblings, but neither should be nested in the other - # do NOT comment this option out even if you don't plan to use snapshots, just leave it with dummy value - detachedSnapshotsDatasetParentName: tanks/k8s/homelab-snapshots - - datasetEnableQuotas: true - datasetEnableReservation: false - datasetPermissionsMode: "0777" - datasetPermissionsUser: 0 - datasetPermissionsGroup: 0 - #datasetPermissionsAcls: - #- "-m everyone@:full_set:allow" - #- "-m u:kube:full_set:allow" - - nfs: - # # https://docs.oracle.com/cd/E23824_01/html/821-1448/gayne.html - # # https://www.hiroom2.com/2016/05/18/ubuntu-16-04-share-zfs-storage-via-nfs-smb/ - shareStrategy: "setDatasetProperties" - shareStrategySetDatasetProperties: - properties: - # sharenfs: "rw,no_subtree_check,no_root_squash" - sharenfs: "on" - # share: "" - shareHost: "10.1.1.13" diff --git a/kubernetes/apps/democratic-csi/democratic-csi/app/kustomization.yaml b/kubernetes/apps/democratic-csi/democratic-csi/app/kustomization.yaml deleted file mode 100644 index 4eed917..0000000 --- a/kubernetes/apps/democratic-csi/democratic-csi/app/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml diff --git a/kubernetes/apps/democratic-csi/democratic-csi/ks.yaml b/kubernetes/apps/democratic-csi/democratic-csi/ks.yaml deleted file mode 100644 index 42764f2..0000000 --- a/kubernetes/apps/democratic-csi/democratic-csi/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app democratic-csi - namespace: flux-system -spec: - targetNamespace: democratic-csi - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/democratic-csi/democratic-csi/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/kubernetes/apps/democratic-csi/kustomization.yaml b/kubernetes/apps/democratic-csi/kustomization.yaml deleted file mode 100644 index 5c873ed..0000000 --- a/kubernetes/apps/democratic-csi/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./democratic-csi/ks.yaml diff --git a/kubernetes/apps/democratic-csi/namespace.yaml b/kubernetes/apps/democratic-csi/namespace.yaml deleted file mode 100644 index 17db4dd..0000000 --- a/kubernetes/apps/democratic-csi/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: democratic-csi - annotations: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/dragonfly-operator-crd.yaml b/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/dragonfly-operator-crd.yaml deleted file mode 100644 index cc183bf..0000000 --- a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/dragonfly-operator-crd.yaml +++ /dev/null @@ -1,1702 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.11.1 - creationTimestamp: null - name: dragonflies.dragonflydb.io -spec: - group: dragonflydb.io - names: - kind: Dragonfly - listKind: DragonflyList - plural: dragonflies - singular: dragonfly - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Dragonfly is the Schema for the dragonflies API - properties: - apiVersion: - description: - "APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" - type: string - kind: - description: - "Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" - type: string - metadata: - type: object - spec: - description: DragonflySpec defines the desired state of Dragonfly - properties: - aclFromSecret: - description: (Optional) Acl file Secret to pass to the container - properties: - key: - description: - The key of the secret to select from. Must be a - valid secret key. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - affinity: - description: (Optional) Dragonfly pod affinity - properties: - nodeAffinity: - description: - Describes node affinity scheduling rules for the - pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the affinity expressions specified by - this field, but it may choose a node that violates one or - more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node matches - the corresponding matchExpressions; the node(s) with the - highest sum are the most preferred. - items: - description: - An empty preferred scheduling term matches - all objects with implicit weight 0 (i.e. it's a no-op). - A null preferred scheduling term matches no objects (i.e. - is also a no-op). - properties: - preference: - description: - A node selector term, associated with the - corresponding weight. - properties: - matchExpressions: - description: - A list of node selector requirements - by node's labels. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: - A list of node selector requirements - by node's fields. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - x-kubernetes-map-type: atomic - weight: - description: - Weight associated with matching the corresponding - nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the affinity requirements specified by this - field are not met at scheduling time, the pod will not be - scheduled onto the node. If the affinity requirements specified - by this field cease to be met at some point during pod execution - (e.g. due to an update), the system may or may not try to - eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: - Required. A list of node selector terms. - The terms are ORed. - items: - description: - A null or empty node selector term matches - no objects. The requirements of them are ANDed. The - TopologySelectorTerm type implements a subset of the - NodeSelectorTerm. - properties: - matchExpressions: - description: - A list of node selector requirements - by node's labels. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: - A list of node selector requirements - by node's fields. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - x-kubernetes-map-type: atomic - type: array - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: - Describes pod affinity scheduling rules (e.g. co-locate - this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the affinity expressions specified by - this field, but it may choose a node that violates one or - more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: - The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: - Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: - weight associated with matching the corresponding - podAffinityTerm, in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the affinity requirements specified by this - field are not met at scheduling time, the pod will not be - scheduled onto the node. If the affinity requirements specified - by this field cease to be met at some point during pod execution - (e.g. due to a pod label update), the system may or may - not try to eventually evict the pod from its node. When - there are multiple elements, the lists of nodes corresponding - to each podAffinityTerm are intersected, i.e. all terms - must be satisfied. - items: - description: - Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on which a pod of the set of - pods is running - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied to the - union of the namespaces selected by this field and - the ones listed in the namespaces field. null selector - and null or empty namespaces list means "this pod's - namespace". An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list of namespace - names that the term applies to. The term is applied - to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. null or - empty namespaces list and null namespaceSelector means - "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where - co-located is defined as running on a node whose value - of the label with key topologyKey matches that of - any node on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: - Describes pod anti-affinity scheduling rules (e.g. - avoid putting this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the anti-affinity expressions specified - by this field, but it may choose a node that violates one - or more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: - The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: - Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: - weight associated with matching the corresponding - podAffinityTerm, in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the anti-affinity requirements specified by - this field are not met at scheduling time, the pod will - not be scheduled onto the node. If the anti-affinity requirements - specified by this field cease to be met at some point during - pod execution (e.g. due to a pod label update), the system - may or may not try to eventually evict the pod from its - node. When there are multiple elements, the lists of nodes - corresponding to each podAffinityTerm are intersected, i.e. - all terms must be satisfied. - items: - description: - Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on which a pod of the set of - pods is running - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied to the - union of the namespaces selected by this field and - the ones listed in the namespaces field. null selector - and null or empty namespaces list means "this pod's - namespace". An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list of namespace - names that the term applies to. The term is applied - to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. null or - empty namespaces list and null namespaceSelector means - "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where - co-located is defined as running on a node whose value - of the label with key topologyKey matches that of - any node on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - annotations: - additionalProperties: - type: string - description: (Optional) Annotations to add to the Dragonfly pods. - type: object - args: - description: - (Optional) Dragonfly container args to pass to the container - Refer to the Dragonfly documentation for the list of supported args - items: - type: string - type: array - authentication: - description: (Optional) Dragonfly Authentication mechanism - properties: - clientCaCertSecret: - description: - (Optional) If specified, the Dragonfly instance will - check if the client certificate is signed by this CA. Server - TLS must be enabled for this. - properties: - key: - description: - The key of the secret to select from. Must be - a valid secret key. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the Secret or its key must be - defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - passwordFromSecret: - description: - (Optional) Dragonfly Password from Secret as a reference - to a specific key - properties: - key: - description: - The key of the secret to select from. Must be - a valid secret key. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the Secret or its key must be - defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - env: - description: (Optional) Env variables to add to the Dragonfly pods. - items: - description: - EnvVar represents an environment variable present in - a Container. - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: - 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: - Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - description: - "Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs." - properties: - apiVersion: - description: - Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - description: - "Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported." - properties: - containerName: - description: - "Container name: required for volumes, - optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: "Required: resource to select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: - The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - image: - description: Image is the Dragonfly image to use - type: string - labels: - additionalProperties: - type: string - description: (Optional) Labels to add to the Dragonfly pods. - type: object - nodeSelector: - additionalProperties: - type: string - description: (Optional) Dragonfly pod node selector - type: object - priorityClassName: - description: (Optional) Dragonfly pod priority class name - type: string - replicas: - description: - Replicas is the total number of Dragonfly instances including - the master - format: int32 - type: integer - resources: - description: - (Optional) Dragonfly container resource limits. Any container - limits can be specified. - properties: - claims: - description: - "Claims lists the names of resources, defined in - spec.resourceClaims, that are used by this container. \n This - is an alpha field and requires enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. It can only be set - for containers." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: - Name must match the name of one entry in pod.spec.resourceClaims - of the Pod where this field is used. It makes that resource - available inside a container. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - type: object - serviceAccountName: - description: (Optional) Dragonfly pod service account name - type: string - serviceSpec: - description: (Optional) Dragonfly Service configuration - properties: - annotations: - additionalProperties: - type: string - description: (Optional) Dragonfly Service Annotations - type: object - type: - description: (Optional) Dragonfly Service type - type: string - type: object - snapshot: - description: (Optional) Dragonfly Snapshot configuration - properties: - cron: - description: (Optional) Dragonfly snapshot schedule - type: string - dir: - description: - (Optional) The path to the snapshot directory This - can also be an S3 URI with the prefix `s3://` when using S3 - as the snapshot backend - type: string - persistentVolumeClaimSpec: - description: (Optional) Dragonfly PVC spec - properties: - accessModes: - description: - "accessModes contains the desired access modes - the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1" - items: - type: string - type: array - dataSource: - description: - "dataSource field can be used to specify either: - * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) If the provisioner - or an external controller can support the specified data - source, it will create a new volume based on the contents - of the specified data source. When the AnyVolumeDataSource - feature gate is enabled, dataSource contents will be copied - to dataSourceRef, and dataSourceRef contents will be copied - to dataSource when dataSourceRef.namespace is not specified. - If the namespace is specified, then dataSourceRef will not - be copied to dataSource." - properties: - apiGroup: - description: - APIGroup is the group for the resource being - referenced. If APIGroup is not specified, the specified - Kind must be in the core API group. For any other third-party - types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource being referenced - type: string - name: - description: Name is the name of resource being referenced - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - description: - "dataSourceRef specifies the object from which - to populate the volume with data, if a non-empty volume - is desired. This may be any object from a non-empty API - group (non core object) or a PersistentVolumeClaim object. - When this field is specified, volume binding will only succeed - if the type of the specified object matches some installed - volume populator or dynamic provisioner. This field will - replace the functionality of the dataSource field and as - such if both fields are non-empty, they must have the same - value. For backwards compatibility, when namespace isn't - specified in dataSourceRef, both fields (dataSource and - dataSourceRef) will be set to the same value automatically - if one of them is empty and the other is non-empty. When - namespace is specified in dataSourceRef, dataSource isn't - set to the same value and must be empty. There are three - important differences between dataSource and dataSourceRef: - * While dataSource only allows two specific types of objects, - dataSourceRef allows any non-core object, as well as PersistentVolumeClaim - objects. * While dataSource ignores disallowed values (dropping - them), dataSourceRef preserves all values, and generates - an error if a disallowed value is specified. * While dataSource - only allows local objects, dataSourceRef allows objects - in any namespaces. (Beta) Using this field requires the - AnyVolumeDataSource feature gate to be enabled. (Alpha) - Using the namespace field of dataSourceRef requires the - CrossNamespaceVolumeDataSource feature gate to be enabled." - properties: - apiGroup: - description: - APIGroup is the group for the resource being - referenced. If APIGroup is not specified, the specified - Kind must be in the core API group. For any other third-party - types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource being referenced - type: string - name: - description: Name is the name of resource being referenced - type: string - namespace: - description: - Namespace is the namespace of resource being - referenced Note that when a namespace is specified, - a gateway.networking.k8s.io/ReferenceGrant object is - required in the referent namespace to allow that namespace's - owner to accept the reference. See the ReferenceGrant - documentation for details. (Alpha) This field requires - the CrossNamespaceVolumeDataSource feature gate to be - enabled. - type: string - required: - - kind - - name - type: object - resources: - description: - "resources represents the minimum resources the - volume should have. If RecoverVolumeExpansionFailure feature - is enabled users are allowed to specify resource requirements - that are lower than previous value but must still be higher - than capacity recorded in the status field of the claim. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources" - properties: - claims: - description: - "Claims lists the names of resources, defined - in spec.resourceClaims, that are used by this container. - \n This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. \n This field - is immutable. It can only be set for containers." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - properties: - name: - description: - Name must match the name of one entry - in pod.spec.resourceClaims of the Pod where this - field is used. It makes that resource available - inside a container. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Requests describes the minimum amount of - compute resources required. If Requests is omitted for - a container, it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - type: object - selector: - description: - selector is a label query over volumes to consider - for binding. - properties: - matchExpressions: - description: - matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a selector - that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: - key is the label key that the selector - applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: - values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists or - DoesNotExist, the values array must be empty. - This array is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field is - "key", the operator is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - description: - "storageClassName is the name of the StorageClass - required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1" - type: string - volumeMode: - description: - volumeMode defines what type of volume is required - by the claim. Value of Filesystem is implied when not included - in claim spec. - type: string - volumeName: - description: - volumeName is the binding reference to the PersistentVolume - backing this claim. - type: string - type: object - type: object - tlsSecretRef: - description: - (Optional) Dragonfly TLS secret to used for TLS Connections - to Dragonfly. Dragonfly instance must have access to this secret - and be in the same namespace - properties: - name: - description: - name is unique within a namespace to reference a - secret resource. - type: string - namespace: - description: - namespace defines the space within which the secret - name must be unique. - type: string - type: object - x-kubernetes-map-type: atomic - tolerations: - description: (Optional) Dragonfly pod tolerations - items: - description: - The pod this Toleration is attached to tolerates any - taint that matches the triple using the matching - operator . - properties: - effect: - description: - Effect indicates the taint effect to match. Empty - means match all taint effects. When specified, allowed values - are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: - Key is the taint key that the toleration applies - to. Empty means match all taint keys. If the key is empty, - operator must be Exists; this combination means to match all - values and all keys. - type: string - operator: - description: - Operator represents a key's relationship to the - value. Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod - can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: - TolerationSeconds represents the period of time - the toleration (which must be of effect NoExecute, otherwise - this field is ignored) tolerates the taint. By default, it - is not set, which means tolerate the taint forever (do not - evict). Zero and negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: - Value is the taint value the toleration matches - to. If the operator is Exists, the value should be empty, - otherwise just a regular string. - type: string - type: object - type: array - topologySpreadConstraints: - description: (Optional) Dragonfly pod topologySpreadConstraints - items: - description: The pod this TopologySpreadConstraints is attached - properties: - maxSkew: - description: - the degree to which Pods may be unevenly distributed. - You must specify this field and the number must be greater than zero. - Its semantics differ according to the value of whenUnsatisfiable - format: int32 - type: integer - minDomains: - description: - (Optional) indicates a minimum number of eligible domains. - This field is optional. A domain is a particular instance of a topology. - An eligible domain is a domain whose nodes match the node selector - format: int32 - type: integer - topologyKey: - description: - the key of node labels. Nodes that have a label with this key and - identical values are considered to be in the same topology. We call each - instance of a topology (in other words, a pair) a domain. - The scheduler will try to put a balanced number of pods into each domain. - Also, we define an eligible domain as a domain whose nodes meet the - requirements of nodeAffinityPolicy and nodeTaintsPolicy. - type: string - whenUnsatisfiable: - description: - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to still schedule it while prioritizing - nodes that minimize the skew. - type: string - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: - field is a beta-level field and enabled by default in 1.27. - You can disable it by disabling the MatchLabelKeysInPodTopologySpread - items: - type: string - type: array - nodeAffinityPolicy: - description: - indicates how we will treat Pod's nodeAffinity/nodeSelector - when calculating pod topology spread skew. Options are Honor or Ignore - type: string - nodeTaintsPolicy: - description: indicates how we will treat node taints when calculating pod topology spread skew. Honor or Ignore - type: string - type: object - type: array - type: object - status: - description: DragonflyStatus defines the observed state of Dragonfly - properties: - isRollingUpdate: - description: - IsRollingUpdate is true if the Dragonfly instance is - being updated - type: boolean - phase: - description: - 'Status of the Dragonfly Instance It can be one of the - following: - "ready": The Dragonfly instance is ready to serve requests - - "configuring-replication": The controller is updating the master - of the Dragonfly instance - "resources-created": The Dragonfly instance - resources were created but not yet configured' - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/helmrelease.yaml b/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/helmrelease.yaml deleted file mode 100644 index c6d2102..0000000 --- a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/helmrelease.yaml +++ /dev/null @@ -1,129 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app dragonfly-operator -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - serviceAccount: - create: false - name: dragonfly-operator-controller-manager - controllers: - dragonfly-operator: - containers: - rbac-proxy: - image: - repository: gcr.io/kubebuilder/kube-rbac-proxy - tag: v0.16.0 - args: - - "--secure-listen-address=0.0.0.0:8443" - - "--upstream=http://127.0.0.1:8080/" - - "--logtostderr=true" - - "--v=0" - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 5m - memory: 64Mi - limits: - cpu: 500m - memory: 128Mi - app: - image: - repository: docker.dragonflydb.io/dragonflydb/operator - tag: v1.1.7 - args: - - "--health-probe-bind-address=:8081" - - "--metrics-bind-address=127.0.0.1:8080" - - "--leader-elect" - command: - - "/manager" - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - probes: - liveness: - enabled: true - custom: true - spec: - httpGet: - path: /healthz - port: &port 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - timeoutSeconds: 1 - failureThreshold: 3 - readiness: - enabled: true - custom: true - spec: - httpGet: - path: /readyz - port: *port - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 1 - failureThreshold: 3 - startup: - enabled: false - resources: - requests: - cpu: 10m - memory: 64Mi - limits: - cpu: 500m - memory: 128Mi - annotations: - reloader.stakater.com/auto: "true" - pod: - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/arch - operator: In - values: - - amd64 - - arm64 - - ppc64le - - s390x - - key: kubernetes.io/os - operator: In - values: - - linux - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: *app - service: - app: - controller: dragonfly-operator - ports: - http: - port: *port diff --git a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/kustomization.yaml b/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/kustomization.yaml deleted file mode 100644 index b925202..0000000 --- a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: dragonfly-operator-system -resources: - - ./dragonfly-operator-crd.yaml - - ./rbac.yaml - - ./helmrelease.yaml diff --git a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/rbac.yaml b/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/rbac.yaml deleted file mode 100644 index 397e1e3..0000000 --- a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/rbac.yaml +++ /dev/null @@ -1,230 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: controller-manager-sa - app.kubernetes.io/name: serviceaccount - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-controller-manager - namespace: dragonfly-operator-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: leader-election-role - app.kubernetes.io/name: role - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-leader-election-role - namespace: dragonfly-operator-system -rules: - - apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - creationTimestamp: null - name: dragonfly-operator-manager-role -rules: - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - apps - resources: - - statefulsets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - dragonflydb.io - resources: - - dragonflies - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - dragonflydb.io - resources: - - dragonflies/finalizers - verbs: - - update - - apiGroups: - - dragonflydb.io - resources: - - dragonflies/status - verbs: - - get - - patch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: metrics-reader - app.kubernetes.io/name: clusterrole - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-metrics-reader -rules: - - nonResourceURLs: - - /metrics - verbs: - - get ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: proxy-role - app.kubernetes.io/name: clusterrole - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-proxy-role -rules: - - apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create - - apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: leader-election-rolebinding - app.kubernetes.io/name: rolebinding - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-leader-election-rolebinding - namespace: dragonfly-operator-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: dragonfly-operator-leader-election-role -subjects: - - kind: ServiceAccount - name: dragonfly-operator-controller-manager - namespace: dragonfly-operator-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: manager-rolebinding - app.kubernetes.io/name: clusterrolebinding - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-manager-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: dragonfly-operator-manager-role -subjects: - - kind: ServiceAccount - name: dragonfly-operator-controller-manager - namespace: dragonfly-operator-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: dragonfly-operator - app.kubernetes.io/instance: proxy-rolebinding - app.kubernetes.io/name: clusterrolebinding - app.kubernetes.io/part-of: dragonfly-operator - name: dragonfly-operator-proxy-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: dragonfly-operator-proxy-role -subjects: - - kind: ServiceAccount - name: dragonfly-operator-controller-manager - namespace: dragonfly-operator-system diff --git a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/ks.yaml b/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/ks.yaml deleted file mode 100644 index dda3b80..0000000 --- a/kubernetes/apps/dragonfly-operator-system/dragonfly-operator/ks.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app dragonfly-operator - namespace: flux-system -spec: - targetNamespace: dragonfly-operator-system - commonMetadata: - labels: - app.kubernetes.io/name: *app - interval: 10m - path: "./kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true diff --git a/kubernetes/apps/dragonfly-operator-system/kustomization.yaml b/kubernetes/apps/dragonfly-operator-system/kustomization.yaml deleted file mode 100644 index ed1a27c..0000000 --- a/kubernetes/apps/dragonfly-operator-system/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./dragonfly-operator/ks.yaml diff --git a/kubernetes/apps/dragonfly-operator-system/namespace.yaml b/kubernetes/apps/dragonfly-operator-system/namespace.yaml deleted file mode 100644 index ec6c281..0000000 --- a/kubernetes/apps/dragonfly-operator-system/namespace.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - labels: - app.kubernetes.io/instance: system - app.kubernetes.io/name: namespace - app.kubernetes.io/part-of: dragonfly-operator - control-plane: controller-manager - name: dragonfly-operator-system diff --git a/kubernetes/apps/flux-system/add-ons/ks.yaml b/kubernetes/apps/flux-system/add-ons/ks.yaml index ef8ec66..48860ed 100644 --- a/kubernetes/apps/flux-system/add-ons/ks.yaml +++ b/kubernetes/apps/flux-system/add-ons/ks.yaml @@ -13,7 +13,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true --- # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json @@ -30,5 +30,5 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true diff --git a/kubernetes/apps/kube-system/cilium/app/resources/values.yml b/kubernetes/apps/kube-system/cilium/app/helm-values.yml similarity index 73% rename from kubernetes/apps/kube-system/cilium/app/resources/values.yml rename to kubernetes/apps/kube-system/cilium/app/helm-values.yml index 774d110..906f64a 100644 --- a/kubernetes/apps/kube-system/cilium/app/resources/values.yml +++ b/kubernetes/apps/kube-system/cilium/app/helm-values.yml @@ -1,31 +1,32 @@ --- autoDirectNodeRoutes: true bandwidthManager: - bbr: true enabled: true + bbr: true bpf: masquerade: true tproxy: true cgroup: - autoMount: + automount: enabled: false hostRoot: /sys/fs/cgroup cluster: id: 1 - name: homelab + name: theshire cni: exclusive: false -devices: bond+ -# socketLB: - # enabled: false # supposed to be default off, but it's enabled anyway, and looks fun lol # TODO: 2024-06-02: temporarily turned off to attempt fixing endpoint creation timeout - # hostNamespaceOnly: true # KubeVirt compatibility +containerRuntime: + integration: containerd +# devices: eno+|enp+ enableRuntimeDeviceDetection: true endpointRoutes: enabled: true +hubble: + enable: false envoy: - enabled: false + enable: false ipam: - mode: "kubernetes" + mode: kubernetes ipv4NativeRoutingCIDR: 10.244.0.0/16 k8sServiceHost: 127.0.0.1 k8sServicePort: 7445 @@ -38,7 +39,7 @@ loadBalancer: mode: dsr localRedirectPolicy: true operator: - replicas: 1 + rollOutPods: true rollOutCiliumPods: true routingMode: native securityContext: diff --git a/kubernetes/apps/kube-system/cilium/app/kustomization.yaml b/kubernetes/apps/kube-system/cilium/app/kustomization.yaml index 1d9e11c..579cb37 100644 --- a/kubernetes/apps/kube-system/cilium/app/kustomization.yaml +++ b/kubernetes/apps/kube-system/cilium/app/kustomization.yaml @@ -7,7 +7,7 @@ resources: configMapGenerator: - name: cilium-helm-values files: - - values.yaml=./resources/values.yml + - values.yaml=./helm-values.yml configurations: - kustomizeconfig.yaml generatorOptions: diff --git a/kubernetes/apps/kube-system/cilium/app/kustomizeconfig.yaml b/kubernetes/apps/kube-system/cilium/app/kustomizeconfig.yaml index 1fcad09..58f92ba 100644 --- a/kubernetes/apps/kube-system/cilium/app/kustomizeconfig.yaml +++ b/kubernetes/apps/kube-system/cilium/app/kustomizeconfig.yaml @@ -4,4 +4,4 @@ nameReference: version: v1 fieldSpecs: - path: spec/valuesFrom/name - kind: HelmRelease \ No newline at end of file + kind: HelmRelease diff --git a/kubernetes/apps/kube-system/cilium/config/l2.yaml b/kubernetes/apps/kube-system/cilium/config/l2.yaml index 05c09ec..a756c7f 100644 --- a/kubernetes/apps/kube-system/cilium/config/l2.yaml +++ b/kubernetes/apps/kube-system/cilium/config/l2.yaml @@ -6,7 +6,8 @@ metadata: name: l2-policy spec: loadBalancerIPs: true - interfaces: ["^bond+"] + # interfaces: ["^enp.*|^eth.*|^ens.*|^eno.*"] + interfaces: ["^eno+|^enp+"] nodeSelector: matchLabels: kubernetes.io/os: linux diff --git a/kubernetes/apps/kube-system/cilium/ks.yaml b/kubernetes/apps/kube-system/cilium/ks.yaml index b4985e6..0ad4ac7 100644 --- a/kubernetes/apps/kube-system/cilium/ks.yaml +++ b/kubernetes/apps/kube-system/cilium/ks.yaml @@ -14,7 +14,7 @@ spec: prune: false sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true interval: 30m retryInterval: 1m @@ -37,7 +37,7 @@ spec: prune: false # never should be deleted sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/kube-system/coredns/ks.yaml b/kubernetes/apps/kube-system/coredns/ks.yaml index 1878af1..613a533 100644 --- a/kubernetes/apps/kube-system/coredns/ks.yaml +++ b/kubernetes/apps/kube-system/coredns/ks.yaml @@ -10,11 +10,11 @@ spec: commonMetadata: labels: app.kubernetes.io/name: *app - path: ./kubernetes/apps/kube-system/coredns/app + path: ./kubernetes/kube-system/coredns/app prune: false # never should be deleted sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml b/kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml deleted file mode 100644 index 5d2e66c..0000000 --- a/kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml +++ /dev/null @@ -1,77 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: descheduler -spec: - interval: 30m - chart: - spec: - chart: descheduler - version: 0.30.1 - sourceRef: - kind: HelmRepository - name: descheduler - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - uninstall: - keepHistory: false - values: - replicas: 1 - kind: Deployment - deschedulerPolicyAPIVersion: descheduler/v1alpha2 - deschedulerPolicy: - profiles: - - name: Default - pluginConfig: - - name: DefaultEvictor - args: - evictFailedBarePods: true - evictLocalStoragePods: true - evictSystemCriticalPods: true - nodeFit: true - - name: RemovePodsViolatingInterPodAntiAffinity - - name: RemovePodsViolatingNodeAffinity - args: - nodeAffinityType: - - requiredDuringSchedulingIgnoredDuringExecution - - name: RemovePodsViolatingNodeTaints - - name: RemovePodsViolatingTopologySpreadConstraint - args: - constraints: - - DoNotSchedule - - ScheduleAnyway - - name: LowNodeUtilization - args: - targetThresholds: - cpu: 50 - memory: 50 - pods: 50 - thresholds: - cpu: 20 - memory: 20 - pods: 20 - useDeviationThresholds: true - plugins: - balance: - enabled: - - RemovePodsViolatingTopologySpreadConstraint - - LowNodeUtilization - deschedule: - enabled: - - RemovePodsViolatingInterPodAntiAffinity - - RemovePodsViolatingNodeAffinity - - RemovePodsViolatingNodeTaints - service: - enabled: true - serviceMonitor: - enabled: true - leaderElection: - enabled: true diff --git a/kubernetes/apps/kube-system/descheduler/app/kustomization.yaml b/kubernetes/apps/kube-system/descheduler/app/kustomization.yaml deleted file mode 100644 index 2d7deac..0000000 --- a/kubernetes/apps/kube-system/descheduler/app/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml \ No newline at end of file diff --git a/kubernetes/apps/kube-system/descheduler/ks.yaml b/kubernetes/apps/kube-system/descheduler/ks.yaml deleted file mode 100644 index 4d91e2a..0000000 --- a/kubernetes/apps/kube-system/descheduler/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app descheduler - namespace: flux-system -spec: - targetNamespace: kube-system - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/kube-system/descheduler/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m \ No newline at end of file diff --git a/kubernetes/apps/kube-system/fstrim.yaml b/kubernetes/apps/kube-system/fstrim.yaml index 1f279c1..ccc2d42 100644 --- a/kubernetes/apps/kube-system/fstrim.yaml +++ b/kubernetes/apps/kube-system/fstrim.yaml @@ -32,4 +32,4 @@ spec: path: /proc - name: netfs hostPath: - path: /sys \ No newline at end of file + path: /sys diff --git a/kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml b/kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml index e47b5fe..ba2af77 100644 --- a/kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml +++ b/kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml @@ -9,7 +9,7 @@ spec: chart: spec: chart: app-template - version: 3.4.0 + version: 3.3.2 sourceRef: kind: HelmRepository name: bjw-s diff --git a/kubernetes/apps/kube-system/fstrim/app/kustomization.yaml b/kubernetes/apps/kube-system/fstrim/app/kustomization.yaml index 2d7deac..17cbc72 100644 --- a/kubernetes/apps/kube-system/fstrim/app/kustomization.yaml +++ b/kubernetes/apps/kube-system/fstrim/app/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ./helmrelease.yaml \ No newline at end of file + - ./helmrelease.yaml diff --git a/kubernetes/apps/kube-system/fstrim/ks.yaml b/kubernetes/apps/kube-system/fstrim/ks.yaml index c1a9992..6d00782 100644 --- a/kubernetes/apps/kube-system/fstrim/ks.yaml +++ b/kubernetes/apps/kube-system/fstrim/ks.yaml @@ -14,8 +14,8 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m - timeout: 5m \ No newline at end of file + timeout: 5m diff --git a/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yaml b/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yaml deleted file mode 100644 index 92451d3..0000000 --- a/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yaml +++ /dev/null @@ -1,3 +0,0 @@ ---- -providerRegex: ^shadowfax$ -bypassDnsResolution: true diff --git a/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yml b/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yml new file mode 100644 index 0000000..b88c2a1 --- /dev/null +++ b/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yml @@ -0,0 +1,2 @@ +--- +providerRegex: ^bilbo|^frodo|^sam$ diff --git a/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomization.yaml b/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomization.yaml index 9f1c424..5052c75 100644 --- a/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomization.yaml +++ b/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomization.yaml @@ -7,6 +7,6 @@ resources: configMapGenerator: - name: kubelet-csr-approver-helm-values files: - - values.yaml=./helm-values.yaml + - values.yaml=./helm-values.yml configurations: - kustomizeconfig.yaml diff --git a/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml b/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml index 8e7c1da..d857935 100644 --- a/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml +++ b/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml @@ -14,7 +14,7 @@ spec: prune: false # never should be deleted sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/kube-system/kustomization.yaml b/kubernetes/apps/kube-system/kustomization.yaml index d5bf8c9..dc37a56 100644 --- a/kubernetes/apps/kube-system/kustomization.yaml +++ b/kubernetes/apps/kube-system/kustomization.yaml @@ -7,12 +7,10 @@ resources: - ./namespace.yaml # Flux-Kustomizations - ./cilium/ks.yaml - - ./coredns/ks.yaml - - ./descheduler/ks.yaml - ./dnsimple-webhook-rbac.yaml - ./fstrim/ks.yaml - ./kubelet-csr-approver/ks.yaml - ./metrics-server/ks.yaml - ./node-feature-discovery/ks.yaml - - ./nvidia-device-plugin/ks.yaml - ./reloader/ks.yaml + - ./spegel/ks.yaml diff --git a/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml b/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml index b3d7dcb..2ad2803 100644 --- a/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml +++ b/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml @@ -20,7 +20,6 @@ spec: metrics: enabled: true args: - - --kubelet-insecure-tls - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --kubelet-use-node-status-port - --metric-resolution=15s diff --git a/kubernetes/apps/kube-system/metrics-server/ks.yaml b/kubernetes/apps/kube-system/metrics-server/ks.yaml index 6c0925a..7adca6a 100644 --- a/kubernetes/apps/kube-system/metrics-server/ks.yaml +++ b/kubernetes/apps/kube-system/metrics-server/ks.yaml @@ -13,5 +13,5 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true diff --git a/kubernetes/apps/kube-system/multus/app/crd.yaml b/kubernetes/apps/kube-system/multus/app/crd.yaml deleted file mode 100644 index 24b2c58..0000000 --- a/kubernetes/apps/kube-system/multus/app/crd.yaml +++ /dev/null @@ -1,45 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: network-attachment-definitions.k8s.cni.cncf.io -spec: - group: k8s.cni.cncf.io - scope: Namespaced - names: - plural: network-attachment-definitions - singular: network-attachment-definition - kind: NetworkAttachmentDefinition - shortNames: - - net-attach-def - versions: - - name: v1 - served: true - storage: true - schema: - openAPIV3Schema: - description: 'NetworkAttachmentDefinition is a CRD schema specified by the Network Plumbing - Working Group to express the intent for attaching pods to one or more logical or physical - networks. More information available at: https://github.com/k8snetworkplumbingwg/multi-net-spec' - type: object - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this represen - tation of an object. Servers should convert recognized schemas to the - latest internal value, and may reject unrecognized values. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: 'NetworkAttachmentDefinition spec defines the desired state of a network attachment' - type: object - properties: - config: - description: 'NetworkAttachmentDefinition config is a JSON-formatted CNI configuration' - type: string diff --git a/kubernetes/apps/kube-system/multus/app/helmrelease.yaml b/kubernetes/apps/kube-system/multus/app/helmrelease.yaml deleted file mode 100644 index 5b9e994..0000000 --- a/kubernetes/apps/kube-system/multus/app/helmrelease.yaml +++ /dev/null @@ -1,214 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: multus -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - interval: 30m - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - - values: - configMaps: - daemon-config: - data: - daemon-config.json: | - { - "cniVersion": "0.3.1", - "logToStderr": true, - "logLevel": "error", - "binDir": "/opt/cni/bin", - "chrootDir": "/hostroot", - "cniConfigDir": "/host/etc/cni/net.d", - "confDir": "/host/etc/cni/net.d", - "multusAutoconfigDir": "/host/etc/cni/net.d", - "multusConfigFile": "auto", - "socketDir": "/host/run/multus/" - } - - controllers: - uninstall: - type: job - - annotations: - # This is what defines this resource as a hook. Without this line, the - # job is considered part of the release. - helm.sh/hook: pre-delete, pre-upgrade - helm.sh/hook-weight: "-5" - helm.sh/hook-delete-policy: hook-succeeded - - pod: - hostNetwork: true - - containers: - uninstall: - image: - repository: alpine - tag: 3.20.2 - - command: - - /bin/sh - - -c - - args: - - | - rm -rf /host/etc/cni/net.d/*multus* - rm -rf /host/opt/cni/bin/*multus* - - multus: - type: daemonset - - annotations: - reloader.stakater.com/auto: "true" - - pod: - hostNetwork: true - hostPID: true - - containers: - multus-daemon: - image: &image - repository: ghcr.io/k8snetworkplumbingwg/multus-cni - tag: v4.1.0-thick - env: - MULTUS_NODE_NAME: - valueFrom: - fieldRef: - fieldPath: spec.nodeName - resources: - requests: - cpu: "5m" - memory: "96Mi" - limits: - memory: "500Mi" - securityContext: - privileged: true - - initContainers: - cni-plugins-installer: - image: - repository: ghcr.io/angelnu/cni-plugins - tag: 1.5.1 - resources: - requests: - cpu: "10m" - memory: "15Mi" - securityContext: - capabilities: - drop: - - ALL - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: FallbackToLogsOnError - - multus-shim-installer: - image: *image - command: - - /bin/sh - - -c - args: | - set -x - cp -f /usr/src/multus-cni/bin/multus-shim /host/opt/cni/bin/multus-shim - resources: - requests: - cpu: "10m" - memory: "15Mi" - securityContext: - capabilities: - drop: - - ALL - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: FallbackToLogsOnError - - persistence: - cni: - type: hostPath - hostPath: /etc/cni/net.d - advancedMounts: - uninstall: - uninstall: - - path: /host/etc/cni/net.d - multus: - multus-daemon: - - path: /host/etc/cni/net.d - - cnibin: - type: hostPath - hostPath: /opt/cni/bin - advancedMounts: - uninstall: - uninstall: - - path: /host/opt/cni/bin - multus: - cni-plugins-installer: - - path: /host/opt/cni/bin - multus-shim-installer: - - path: /host/opt/cni/bin - multus-daemon: - # multus-daemon expects that cnibin path must be identical between pod and container host. - # e.g. if the cni bin is in '/opt/cni/bin' on the container host side, then it should be - # mount to '/opt/cni/bin' in multus-daemon, not to any other directory, like '/opt/bin' or - # '/usr/bin'. - - path: /opt/cni/bin - - config: - type: configMap - name: multus-daemon-config - advancedMounts: - multus: - multus-daemon: - - path: /etc/cni/net.d/multus.d - hostroot: - type: hostPath - hostPath: / - advancedMounts: - multus: - multus-daemon: - - path: /hostroot - mountPropagation: HostToContainer - host-run: - type: hostPath - hostPath: /run - advancedMounts: - multus: - multus-daemon: - - path: /host/run - host-var-lib-cni-multus: - type: hostPath - hostPath: /var/lib/cni/multus - advancedMounts: - multus: - multus-daemon: - - path: /var/lib/cni/multus - host-var-lib-kubelet: - type: hostPath - hostPath: /var/lib/kubelet - advancedMounts: - multus: - multus-daemon: - - path: /var/lib/kubelet - host-run-k8s-cni-cncf-io: - type: hostPath - hostPath: /run/k8s.cni.cncf.io - advancedMounts: - multus: - multus-daemon: - - path: /run/k8s.cni.cncf.io - host-run-netns: - type: hostPath - hostPath: /var/run/netns/ - advancedMounts: - multus: - multus-daemon: - - path: /run/netns/ - mountPropagation: HostToContainer - - serviceAccount: - create: true diff --git a/kubernetes/apps/kube-system/multus/app/kustomization.yaml b/kubernetes/apps/kube-system/multus/app/kustomization.yaml deleted file mode 100644 index f6a66c9..0000000 --- a/kubernetes/apps/kube-system/multus/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./rbac.yaml - - ./crd.yaml diff --git a/kubernetes/apps/kube-system/multus/app/rbac.yaml b/kubernetes/apps/kube-system/multus/app/rbac.yaml deleted file mode 100644 index 4a54cf4..0000000 --- a/kubernetes/apps/kube-system/multus/app/rbac.yaml +++ /dev/null @@ -1,43 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: multus -rules: - - apiGroups: ["k8s.cni.cncf.io"] - resources: - - '*' - verbs: - - '*' - - apiGroups: - - "" - resources: - - pods - - pods/status - verbs: - - get - - list - - update - - watch - - apiGroups: - - "" - - events.k8s.io - resources: - - events - verbs: - - create - - patch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: multus -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: multus -subjects: - - kind: ServiceAccount - name: multus - namespace: kube-system diff --git a/kubernetes/apps/kube-system/multus/config/kustomization.yaml b/kubernetes/apps/kube-system/multus/config/kustomization.yaml deleted file mode 100644 index 2c6f4b1..0000000 --- a/kubernetes/apps/kube-system/multus/config/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./net-attach-iot.yaml \ No newline at end of file diff --git a/kubernetes/apps/kube-system/multus/config/net-attach-iot.yaml b/kubernetes/apps/kube-system/multus/config/net-attach-iot.yaml deleted file mode 100644 index 7a9e200..0000000 --- a/kubernetes/apps/kube-system/multus/config/net-attach-iot.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/k8s.cni.cncf.io%2Fnetworkattachmentdefinition_v1.json -apiVersion: "k8s.cni.cncf.io/v1" -kind: NetworkAttachmentDefinition -metadata: - name: multus-iot -spec: - config: |- - { - "cniVersion": "0.3.1", - "name": "multus-iot", - "plugins": [ - { - "type": "macvlan", - "master": "bond0.30", - "mode": "bridge", - "capabilities": { - "ips": true - }, - "ipam": { - "type": "static", - "routes": [ - { "dst": "10.1.2.0/24", "gw": "10.1.3.1" } - ] - } - }, - { - "capabilities": { "mac": true }, - "type": "tuning" - } - ] - } diff --git a/kubernetes/apps/kube-system/multus/ks.yaml b/kubernetes/apps/kube-system/multus/ks.yaml deleted file mode 100644 index 520ee79..0000000 --- a/kubernetes/apps/kube-system/multus/ks.yaml +++ /dev/null @@ -1,40 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &appname multus - namespace: flux-system -spec: - targetNamespace: kube-system - commonMetadata: - labels: - app.kubernetes.io/name: *appname - interval: 10m - path: "./kubernetes/apps/kube-system/multus/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &appname multus-config - namespace: flux-system -spec: - targetNamespace: kube-system - commonMetadata: - labels: - app.kubernetes.io/name: *appname - interval: 10m - path: "./kubernetes/apps/kube-system/multus/config" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true - dependsOn: - - name: multus \ No newline at end of file diff --git a/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml b/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml index 80a1ac9..2783add 100644 --- a/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml +++ b/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml @@ -15,24 +15,5 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: node-feature-discovery-rules - namespace: flux-system - labels: - substitution.flux.home.arpa/enabled: "true" -spec: - interval: 10m - path: "./kubernetes/apps/kube-system/node-feature-discovery/rules" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true - dependsOn: - - name: node-feature-discovery diff --git a/kubernetes/apps/kube-system/node-feature-discovery/rules/nvidia.yaml b/kubernetes/apps/kube-system/node-feature-discovery/rules/nvidia.yaml deleted file mode 100644 index 354e5f5..0000000 --- a/kubernetes/apps/kube-system/node-feature-discovery/rules/nvidia.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# yaml-language-server: $schema=https://ks.hsn.dev/nfd.k8s-sigs.io/nodefeaturerule_v1alpha1.json ---- -apiVersion: nfd.k8s-sigs.io/v1alpha1 -kind: NodeFeatureRule -metadata: - name: nvidia-device -spec: - rules: - - # NVIDIA GPU - name: nvidia.com/gpu - labels: - nvidia.com/gpu.present: "true" - matchFeatures: - - feature: pci.device - matchExpressions: - vendor: { op: In, value: ["10de"] } diff --git a/kubernetes/apps/kube-system/nvidia-device-plugin/app/helmrelease.yaml b/kubernetes/apps/kube-system/nvidia-device-plugin/app/helmrelease.yaml deleted file mode 100644 index 6f01dcc..0000000 --- a/kubernetes/apps/kube-system/nvidia-device-plugin/app/helmrelease.yaml +++ /dev/null @@ -1,42 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: nvidia-device-plugin -spec: - interval: 30m - chart: - spec: - chart: nvidia-device-plugin - version: 0.16.2 - sourceRef: - kind: HelmRepository - name: nvdp - namespace: flux-system - metadata: - annotations: - reloader.stakater.com/auto: "true" - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - podAnnotations: - configmap.reloader.stakater.com/reload: nvidia-helm-values - config: - name: nvidia-helm-values - runtimeClassName: "nvidia" - gfd: - enabled: true - nfd: - enabled: false - resources: - requests: - cpu: 100m - limits: - memory: 512Mi diff --git a/kubernetes/apps/kube-system/nvidia-device-plugin/app/kustomization.yaml b/kubernetes/apps/kube-system/nvidia-device-plugin/app/kustomization.yaml deleted file mode 100644 index c325a94..0000000 --- a/kubernetes/apps/kube-system/nvidia-device-plugin/app/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./runtimeclass.yaml -configMapGenerator: - - name: nvidia-helm-values - files: - - values.yaml=./resources/values.yml -generatorOptions: - disableNameSuffixHash: true diff --git a/kubernetes/apps/kube-system/nvidia-device-plugin/app/resources/values.yml b/kubernetes/apps/kube-system/nvidia-device-plugin/app/resources/values.yml deleted file mode 100644 index cdf9eca..0000000 --- a/kubernetes/apps/kube-system/nvidia-device-plugin/app/resources/values.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -version: v1 -flags: - migStrategy: "single" - plugin: - deviceListStrategy: "envvar" - deviceIDStrategy: "uuid" -sharing: - timeSlicing: - resources: - - name: nvidia.com/gpu - replicas: 3 diff --git a/kubernetes/apps/kube-system/nvidia-device-plugin/app/runtimeclass.yaml b/kubernetes/apps/kube-system/nvidia-device-plugin/app/runtimeclass.yaml deleted file mode 100644 index 7ba6add..0000000 --- a/kubernetes/apps/kube-system/nvidia-device-plugin/app/runtimeclass.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: node.k8s.io/v1 -kind: RuntimeClass -metadata: - name: nvidia -handler: nvidia diff --git a/kubernetes/apps/kube-system/nvidia-device-plugin/ks.yaml b/kubernetes/apps/kube-system/nvidia-device-plugin/ks.yaml deleted file mode 100644 index d3de8b2..0000000 --- a/kubernetes/apps/kube-system/nvidia-device-plugin/ks.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: nvidia-device-plugin - namespace: flux-system - labels: - substitution.flux.home.arpa/enabled: "true" -spec: - targetNamespace: kube-system - interval: 10m - path: "./kubernetes/apps/kube-system/nvidia-device-plugin/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true diff --git a/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml b/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml index 6dbbf0e..abb6778 100644 --- a/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml +++ b/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml @@ -10,7 +10,7 @@ spec: chart: spec: chart: reloader - version: 1.0.121 + version: 1.0.116 sourceRef: kind: HelmRepository name: stakater @@ -19,6 +19,7 @@ spec: values: reloader: reloadStrategy: annotations + deployment: resources: requests: @@ -26,4 +27,4 @@ spec: memory: 63Mi limits: cpu: 45m - memory: 200Mi + memory: 100Mi diff --git a/kubernetes/apps/kube-system/reloader/ks.yaml b/kubernetes/apps/kube-system/reloader/ks.yaml index 20fcb2c..b0b41d7 100644 --- a/kubernetes/apps/kube-system/reloader/ks.yaml +++ b/kubernetes/apps/kube-system/reloader/ks.yaml @@ -13,5 +13,5 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true diff --git a/kubernetes/apps/kube-system/rocky-nenya.yaml b/kubernetes/apps/kube-system/rocky-nenya.yaml index 9e53cd7..1ec0df2 100644 --- a/kubernetes/apps/kube-system/rocky-nenya.yaml +++ b/kubernetes/apps/kube-system/rocky-nenya.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Pod metadata: name: rocky-nenya - namespace: kube-system + namespace: kube-system spec: # nodeName: nenya containers: diff --git a/kubernetes/apps/kube-system/spegel/app/helm-values.yml b/kubernetes/apps/kube-system/spegel/app/helm-values.yml new file mode 100644 index 0000000..7b137f3 --- /dev/null +++ b/kubernetes/apps/kube-system/spegel/app/helm-values.yml @@ -0,0 +1,8 @@ +--- +spegel: + appendMirrors: true + containerdSock: /run/containerd/containerd.sock + containerdRegistryConfigPath: /etc/cri/conf.d/hosts +service: + registry: + hostPort: 29999 diff --git a/.archive/kubernetes/kube-system/spegel/app/helmrelease.yaml b/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml similarity index 100% rename from .archive/kubernetes/kube-system/spegel/app/helmrelease.yaml rename to kubernetes/apps/kube-system/spegel/app/helmrelease.yaml diff --git a/.archive/kubernetes/kube-system/spegel/app/kustomization.yaml b/kubernetes/apps/kube-system/spegel/app/kustomization.yaml similarity index 86% rename from .archive/kubernetes/kube-system/spegel/app/kustomization.yaml rename to kubernetes/apps/kube-system/spegel/app/kustomization.yaml index 84c4d60..3d2a9fb 100644 --- a/.archive/kubernetes/kube-system/spegel/app/kustomization.yaml +++ b/kubernetes/apps/kube-system/spegel/app/kustomization.yaml @@ -7,6 +7,6 @@ resources: configMapGenerator: - name: spegel-helm-values files: - - values.yaml=./resources/values.yml + - values.yaml=./helm-values.yml configurations: - kustomizeconfig.yaml diff --git a/.archive/kubernetes/kube-system/spegel/app/kustomizeconfig.yaml b/kubernetes/apps/kube-system/spegel/app/kustomizeconfig.yaml similarity index 100% rename from .archive/kubernetes/kube-system/spegel/app/kustomizeconfig.yaml rename to kubernetes/apps/kube-system/spegel/app/kustomizeconfig.yaml diff --git a/.archive/kubernetes/kube-system/spegel/ks.yaml b/kubernetes/apps/kube-system/spegel/ks.yaml similarity index 96% rename from .archive/kubernetes/kube-system/spegel/ks.yaml rename to kubernetes/apps/kube-system/spegel/ks.yaml index bbfbdb3..7902bf8 100644 --- a/.archive/kubernetes/kube-system/spegel/ks.yaml +++ b/kubernetes/apps/kube-system/spegel/ks.yaml @@ -14,7 +14,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/kubevirt/app/ks.yaml b/kubernetes/apps/kubevirt/app/ks.yaml deleted file mode 100644 index 4d837e1..0000000 --- a/kubernetes/apps/kubevirt/app/ks.yaml +++ /dev/null @@ -1,46 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app kubevirt - namespace: flux-system -spec: - targetNamespace: kubevirt - dependsOn: - - name: openebs - path: ./deploy - prune: true - sourceRef: - kind: GitRepository - name: kubevirt - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m - patches: - # namespace is managed separately by main ks, no need for this ks to also manage it, KubeVirt bundles namespace into kubevirt-operator.yaml - - patch: | - $patch: delete - apiVersion: v1 - kind: Namespace - metadata: - name: kubevirt - target: - kind: Namespace - name: kubevirt - - patch: | - apiVersion: kubevirt.io/v1 - kind: KubeVirt - metadata: - name: not-used - spec: - configuration: - developerConfiguration: - featureGates: - - CPUNodeDiscovery - - ExpandDisks - vmStateStorageClass: openebs-hostpath - target: - group: kubevirt.io - kind: KubeVirt diff --git a/kubernetes/apps/kubevirt/kustomization.yaml b/kubernetes/apps/kubevirt/kustomization.yaml deleted file mode 100644 index 861aec9..0000000 --- a/kubernetes/apps/kubevirt/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./manager/ks.yaml - - ./app/ks.yaml diff --git a/kubernetes/apps/kubevirt/manager/app/helmrelease.yaml b/kubernetes/apps/kubevirt/manager/app/helmrelease.yaml deleted file mode 100644 index f9393ea..0000000 --- a/kubernetes/apps/kubevirt/manager/app/helmrelease.yaml +++ /dev/null @@ -1,83 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app kubevirt-manager -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - maxHistory: 2 - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - values: - controllers: - kubevirt-manager: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: docker.io/kubevirtmanager/kubevirt-manager - tag: 1.4.1 - env: - TZ: America/Chicago - resources: - requests: - cpu: 5m - memory: 50Mi - limits: - memory: 150Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - pod: - securityContext: - runAsUser: 10000 - runAsGroup: 30000 - serviceAccount: - create: true - name: kubevirt-manager - service: - app: - controller: kubevirt-manager - ports: - http: - port: 8001 - ingress: - app: - className: internal-nginx - hosts: - - host: &host "kubevirt.jahanson.tech" - paths: - - path: / - pathType: Prefix - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - cache: - type: emptyDir - globalMounts: - - path: /var/cache/nginx - run: - type: emptyDir - globalMounts: - - path: /var/run diff --git a/kubernetes/apps/kubevirt/manager/app/kustomization.yaml b/kubernetes/apps/kubevirt/manager/app/kustomization.yaml deleted file mode 100644 index cc3d944..0000000 --- a/kubernetes/apps/kubevirt/manager/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./rbac.yaml - - ../../../../templates/gatus/internal diff --git a/kubernetes/apps/kubevirt/manager/app/rbac.yaml b/kubernetes/apps/kubevirt/manager/app/rbac.yaml deleted file mode 100644 index 8b8f22c..0000000 --- a/kubernetes/apps/kubevirt/manager/app/rbac.yaml +++ /dev/null @@ -1,110 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: kubevirt-manager -rules: - - apiGroups: [""] - resources: ["nodes", "namespaces"] - verbs: ["get", "list"] - - apiGroups: [""] - resources: ["customresourcedefinitions"] - verbs: ["get", "list"] - - apiGroups: [""] - resources: ["persistentvolumeclaims", "persistentvolumes", "services", "secrets", "serviceaccounts", "configmaps", "deployments"] - verbs: ["*"] - - apiGroups: ["rbac.authorization.k8s.io"] - resources: ["rolebindings"] - verbs: ["*"] - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["*"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["get", "list"] - - apiGroups: ["k8s.cni.cncf.io"] - resources: ["network-attachment-definitions"] - verbs: ["get", "list"] - - apiGroups: ["kubevirt.io"] - resources: ["virtualmachines", "virtualmachineinstances"] - verbs: ["*"] - - apiGroups: ["subresources.kubevirt.io"] - resources: ["*"] - verbs: ["get", "list", "update", "patch"] - - apiGroups: ["instancetype.kubevirt.io"] - resources: ["*"] - verbs: ["*"] - - apiGroups: ["cdi.kubevirt.io"] - resources: ["*"] - verbs: ["*"] - - apiGroups: ["pool.kubevirt.io"] - resources: ["*"] - verbs: ["*"] - - apiGroups: ["scheduling.k8s.io"] - resources: ["priorityclasses"] - verbs: ["get", "list"] - - apiGroups: ["autoscaling"] - resources: ["horizontalpodautoscalers"] - verbs: ["*"] - - apiGroups: ["cluster.x-k8s.io"] - resources: ["clusters", "machinedeployments"] - verbs: ["*"] - - apiGroups: ["controlplane.cluster.x-k8s.io"] - resources: ["kubeadmcontrolplanes"] - verbs: ["*"] - - apiGroups: ["infrastructure.cluster.x-k8s.io"] - resources: ["kubevirtmachinetemplates", "kubevirtclusters"] - verbs: ["*"] - - apiGroups: ["bootstrap.cluster.x-k8s.io"] - resources: ["kubeadmconfigtemplates"] - verbs: ["*"] - - apiGroups: ["addons.cluster.x-k8s.io"] - resources: ["clusterresourcesets"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubevirt-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubevirt-manager -subjects: - - kind: ServiceAccount - name: kubevirt-manager - namespace: kubevirt ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: kubevirt-manager-kccm -rules: - - apiGroups: ["kubevirt.io"] - resources: ["virtualmachines"] - verbs: ["get", "list", "watch"] - - apiGroups: ["kubevirt.io"] - resources: ["virtualmachineinstances"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: [""] - resources: ["pods"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["services"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubevirt-manager-kccm -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubevirt-manager-kccm -subjects: - - kind: ServiceAccount - name: kubevirt-manager - namespace: kubevirt diff --git a/kubernetes/apps/kubevirt/manager/ks.yaml b/kubernetes/apps/kubevirt/manager/ks.yaml deleted file mode 100644 index 1c8736d..0000000 --- a/kubernetes/apps/kubevirt/manager/ks.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app kubevirt-manager - namespace: flux-system -spec: - targetNamespace: kubevirt - path: ./kubernetes/apps/kubevirt/manager/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - GATUS_SUBDOMAIN: kubevirt diff --git a/kubernetes/apps/kubevirt/namespace.yaml b/kubernetes/apps/kubevirt/namespace.yaml deleted file mode 100644 index cbde5f5..0000000 --- a/kubernetes/apps/kubevirt/namespace.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: kubevirt - labels: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" - pod-security.kubernetes.io/enforce: "privileged" - kubevirt.io: "" diff --git a/kubernetes/apps/kubevirt/vms/fj-runner-01-disk1.yaml b/kubernetes/apps/kubevirt/vms/fj-runner-01-disk1.yaml deleted file mode 100644 index f5d2980..0000000 --- a/kubernetes/apps/kubevirt/vms/fj-runner-01-disk1.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: fj-runner-01-disk1 -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 160Gi - storageClassName: "openebs-hostpath" diff --git a/kubernetes/apps/kubevirt/vms/fj-runner-01.yaml b/kubernetes/apps/kubevirt/vms/fj-runner-01.yaml deleted file mode 100644 index a7e756c..0000000 --- a/kubernetes/apps/kubevirt/vms/fj-runner-01.yaml +++ /dev/null @@ -1,54 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kubevirt.io/virtualmachine_v1.json -apiVersion: kubevirt.io/v1 -kind: VirtualMachine -metadata: - name: fj-runner-01 - namespace: default -spec: - running: false - template: - spec: - architecture: amd64 - domain: - clock: - timezone: "America/Chicago" - cpu: - cores: 4 - sockets: 1 - threads: 2 - devices: - disks: - - disk: - bus: sata - name: disk1 - - cdrom: - bus: sata - name: nixosiso - interfaces: - - bridge: {} - name: net1 - networkInterfaceMultiqueue: true - firmware: - # this sets the bootloader type - bootloader: - efi: - secureBoot: false - machine: - type: q35 - resources: - requests: - memory: 8Gi - networks: - - name: net1 - pod: {} - nodeSelector: - kubernetes.io/hostname: shadowfax - # priorityClassName: vm-standard - volumes: - - name: disk1 - persistentVolumeClaim: - claimName: fj-runner-01-disk1 - - name: nixosiso - dataVolume: - name: "nixos-minimal" diff --git a/kubernetes/apps/kubevirt/vms/fj-runner-02-disk1.yaml b/kubernetes/apps/kubevirt/vms/fj-runner-02-disk1.yaml deleted file mode 100644 index 4d2f56f..0000000 --- a/kubernetes/apps/kubevirt/vms/fj-runner-02-disk1.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: fj-runner-02-disk1 -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 160Gi - storageClassName: local-hostpath-nvme1 diff --git a/kubernetes/apps/kubevirt/vms/fj-runner-02.yaml b/kubernetes/apps/kubevirt/vms/fj-runner-02.yaml deleted file mode 100644 index d4409ea..0000000 --- a/kubernetes/apps/kubevirt/vms/fj-runner-02.yaml +++ /dev/null @@ -1,54 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kubevirt.io/virtualmachine_v1.json -apiVersion: kubevirt.io/v1 -kind: VirtualMachine -metadata: - name: fj-runner-02 - namespace: default -spec: - running: false - template: - spec: - architecture: amd64 - domain: - clock: - timezone: "America/Chicago" - cpu: - cores: 4 - sockets: 1 - threads: 2 - devices: - disks: - - disk: - bus: sata - name: disk1 - - cdrom: - bus: sata - name: nixosiso - interfaces: - - bridge: {} - name: net1 - networkInterfaceMultiqueue: true - firmware: - # this sets the bootloader type - bootloader: - efi: - secureBoot: false - machine: - type: q35 - resources: - requests: - memory: 8Gi - networks: - - name: net1 - pod: {} - nodeSelector: - kubernetes.io/hostname: shadowfax - priorityClassName: vm-standard - volumes: - - name: disk1 - persistentVolumeClaim: - claimName: fj-runner-02-disk1 - - dataVolume: - name: "nixos-minimal" - name: nixosiso diff --git a/kubernetes/apps/kubevirt/vms/nixosdv.yaml b/kubernetes/apps/kubevirt/vms/nixosdv.yaml deleted file mode 100644 index 820f20d..0000000 --- a/kubernetes/apps/kubevirt/vms/nixosdv.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/cdi.kubevirt.io/datavolume_v1beta1.json -apiVersion: cdi.kubevirt.io/v1beta1 -kind: DataVolume -metadata: - name: "nixos-minimal" -spec: - storage: - resources: - requests: - storage: 2Gi - storageClassName: "openebs-hostpath" - accessModes: - - "ReadWriteOnce" - source: - http: - url: "https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso" diff --git a/kubernetes/apps/kyverno/kyverno/ks.yaml b/kubernetes/apps/kyverno/kyverno/ks.yaml index 115f887..1f549bc 100644 --- a/kubernetes/apps/kyverno/kyverno/ks.yaml +++ b/kubernetes/apps/kyverno/kyverno/ks.yaml @@ -10,7 +10,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true interval: 30m retryInterval: 1m @@ -29,7 +29,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/network/cloudflared/app/config/config.yaml b/kubernetes/apps/network/cloudflared/app/config/config.yml similarity index 60% rename from kubernetes/apps/network/cloudflared/app/config/config.yaml rename to kubernetes/apps/network/cloudflared/app/config/config.yml index 85dbeea..3e54975 100644 --- a/kubernetes/apps/network/cloudflared/app/config/config.yaml +++ b/kubernetes/apps/network/cloudflared/app/config/config.yml @@ -3,10 +3,6 @@ originRequest: http2Origin: true ingress: - - hostname: hsn.dev - service: https://ingress-nginx-controller.network.svc.cluster.local:443 - originRequest: - originServerName: external.hsn.dev - hostname: "*.hsn.dev" service: https://ingress-nginx-controller.network.svc.cluster.local:443 originRequest: diff --git a/kubernetes/apps/network/cloudflared/app/helmrelease.yaml b/kubernetes/apps/network/cloudflared/app/helmrelease.yaml index a8c427a..eb568a9 100644 --- a/kubernetes/apps/network/cloudflared/app/helmrelease.yaml +++ b/kubernetes/apps/network/cloudflared/app/helmrelease.yaml @@ -28,7 +28,7 @@ spec: values: controllers: cloudflared: - replicas: 1 + replicas: 2 strategy: RollingUpdate annotations: reloader.stakater.com/auto: "true" diff --git a/kubernetes/apps/network/cloudflared/app/kustomization.yaml b/kubernetes/apps/network/cloudflared/app/kustomization.yaml index 4dbb6ac..f80372b 100644 --- a/kubernetes/apps/network/cloudflared/app/kustomization.yaml +++ b/kubernetes/apps/network/cloudflared/app/kustomization.yaml @@ -9,6 +9,6 @@ resources: configMapGenerator: - name: cloudflared-configmap files: - - config.yaml=./config/config.yaml + - config.yaml=./config/config.yml generatorOptions: disableNameSuffixHash: true diff --git a/kubernetes/apps/network/cloudflared/ks.yaml b/kubernetes/apps/network/cloudflared/ks.yaml index 851ab89..46bcdf0 100644 --- a/kubernetes/apps/network/cloudflared/ks.yaml +++ b/kubernetes/apps/network/cloudflared/ks.yaml @@ -19,7 +19,7 @@ spec: prune: false sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/network/echo-server/ks.yaml b/kubernetes/apps/network/echo-server/ks.yaml index a3022b6..db8b7fc 100644 --- a/kubernetes/apps/network/echo-server/ks.yaml +++ b/kubernetes/apps/network/echo-server/ks.yaml @@ -13,5 +13,5 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true diff --git a/kubernetes/apps/network/external-dns/ks.yaml b/kubernetes/apps/network/external-dns/ks.yaml index 95e680b..9c21433 100644 --- a/kubernetes/apps/network/external-dns/ks.yaml +++ b/kubernetes/apps/network/external-dns/ks.yaml @@ -14,7 +14,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true dependsOn: - name: external-secrets-stores @@ -34,7 +34,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true dependsOn: - - name: external-secrets-stores \ No newline at end of file + - name: external-secrets-stores diff --git a/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml b/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml index c0a8904..c88a006 100644 --- a/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml +++ b/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml @@ -22,7 +22,7 @@ spec: valuesKey: MAXMIND_LICENSE_KEY values: controller: - replicaCount: 1 + replicaCount: 2 updateStrategy: type: RollingUpdate allowSnippetAnnotations: true diff --git a/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml b/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml index 20d3e40..ef658ea 100644 --- a/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml +++ b/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml @@ -20,7 +20,7 @@ spec: fullnameOverride: nginx-internal controller: - replicaCount: 1 + replicaCount: 2 updateStrategy: type: RollingUpdate diff --git a/kubernetes/apps/network/ingress-nginx/ks.yaml b/kubernetes/apps/network/ingress-nginx/ks.yaml index 6468d64..d460450 100644 --- a/kubernetes/apps/network/ingress-nginx/ks.yaml +++ b/kubernetes/apps/network/ingress-nginx/ks.yaml @@ -13,7 +13,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true dependsOn: - name: cert-manager-issuers @@ -32,7 +32,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true dependsOn: - name: cert-manager-issuers diff --git a/kubernetes/apps/network/kustomization.yaml b/kubernetes/apps/network/kustomization.yaml index 3b22344..d97b83e 100644 --- a/kubernetes/apps/network/kustomization.yaml +++ b/kubernetes/apps/network/kustomization.yaml @@ -9,4 +9,4 @@ resources: - ./cloudflared/ks.yaml - ./echo-server/ks.yaml - ./external-dns/ks.yaml - - ./ingress-nginx/ks.yaml \ No newline at end of file + - ./ingress-nginx/ks.yaml diff --git a/kubernetes/apps/network/namespace.yaml b/kubernetes/apps/network/namespace.yaml index ea1e9e6..4d78d7b 100644 --- a/kubernetes/apps/network/namespace.yaml +++ b/kubernetes/apps/network/namespace.yaml @@ -5,4 +5,3 @@ metadata: name: network labels: kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/kubernetes/apps/observability/gatus/app/externalsecret.yaml b/kubernetes/apps/observability/gatus/app/externalsecret.yaml deleted file mode 100644 index 8683a2a..0000000 --- a/kubernetes/apps/observability/gatus/app/externalsecret.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: gatus -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: gatus-secret - template: - engineVersion: v2 - data: - CUSTOM_PUSHOVER_TOKEN: "{{ .gatus_token }}" - CUSTOM_PUSHOVER_USER_KEY: "{{ .userkey_jahanson }}" - DATABASE_URI: "postgresql://{{ .pg_username }}:{{ .pg_password }}@postgres-primary-real.database.svc:{{ .pg_port }}/{{ .pg_database }}" - dataFrom: - - extract: - key: pushover - - extract: - key: gatus \ No newline at end of file diff --git a/kubernetes/apps/observability/gatus/app/helmrelease.yaml b/kubernetes/apps/observability/gatus/app/helmrelease.yaml deleted file mode 100644 index 5cf380d..0000000 --- a/kubernetes/apps/observability/gatus/app/helmrelease.yaml +++ /dev/null @@ -1,131 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: gatus -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - values: - controllers: - gatus: - annotations: - reloader.stakater.com/auto: "true" - initContainers: - init-config: - image: - repository: ghcr.io/kiwigrid/k8s-sidecar - tag: 1.27.6@sha256:db85bd5532530d288736b35e63baceacbf570bf863d85a0404b33c1e1631f63b - env: - FOLDER: /config - LABEL: gatus.io/enabled - NAMESPACE: ALL - RESOURCE: both - UNIQUE_FILENAMES: true - METHOD: WATCH - restartPolicy: Always - resources: &resources - requests: - cpu: 10m - limits: - memory: 256Mi - containers: - app: - image: - repository: ghcr.io/twin/gatus - tag: v5.12.1@sha256:3cc4e90534c05599f07fbdf15580401aa7771fac15f51d1dc8f7de265d70d12f - env: - TZ: America/Chicago - GATUS_CONFIG_PATH: /config - GATUS_DELAY_START_SECONDS: 5 - CUSTOM_WEB_PORT: &port 80 - envFrom: - - secretRef: - name: gatus-secret - probes: - liveness: &probes - enabled: true - custom: true - spec: - httpGet: - path: /health - port: *port - initialDelaySeconds: 0 - periodSeconds: 10 - timeoutSeconds: 1 - failureThreshold: 3 - readiness: *probes - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: *resources - pod: - dnsConfig: - options: - - { name: ndots, value: "1" } - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - service: - app: - controller: gatus - ports: - http: - port: *port - serviceMonitor: - app: - serviceName: gatus - endpoints: - - port: http - scheme: http - path: /metrics - interval: 1m - scrapeTimeout: 10s - ingress: - app: - className: external-nginx - annotations: - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" - external-dns.alpha.kubernetes.io/target: external.hsn.dev - hosts: - - host: &host status.hsn.dev - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: [*host] - serviceAccount: - create: true - name: gatus - persistence: - config: - type: emptyDir - config-file: - type: configMap - name: gatus-configmap - globalMounts: - - path: /config/config.yaml - subPath: config.yaml - readOnly: true \ No newline at end of file diff --git a/kubernetes/apps/observability/gatus/app/kustomization.yaml b/kubernetes/apps/observability/gatus/app/kustomization.yaml deleted file mode 100644 index 9dfa188..0000000 --- a/kubernetes/apps/observability/gatus/app/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ./rbac.yaml -configMapGenerator: - - name: gatus-configmap - files: - - config.yaml=./resources/config.yml -generatorOptions: - disableNameSuffixHash: true \ No newline at end of file diff --git a/kubernetes/apps/observability/gatus/app/rbac.yaml b/kubernetes/apps/observability/gatus/app/rbac.yaml deleted file mode 100644 index 6ac3c80..0000000 --- a/kubernetes/apps/observability/gatus/app/rbac.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: gatus -rules: - - apiGroups: [""] - resources: ["configmaps", "secrets"] - verbs: ["get", "watch", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: gatus -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: gatus -subjects: - - kind: ServiceAccount - name: gatus - namespace: observability \ No newline at end of file diff --git a/kubernetes/apps/observability/gatus/app/resources/config.yml b/kubernetes/apps/observability/gatus/app/resources/config.yml deleted file mode 100644 index 60917cb..0000000 --- a/kubernetes/apps/observability/gatus/app/resources/config.yml +++ /dev/null @@ -1,133 +0,0 @@ ---- -# Note: Gatus vars should be escaped with $${VAR_NAME} to avoid interpolation by Flux -web: - port: $${CUSTOM_WEB_PORT} -storage: - type: postgres - path: $${DATABASE_URI} - caching: true -metrics: true -debug: false -ui: - title: Status | Gatus - header: Status -alerting: - pushover: - application-token: $${CUSTOM_PUSHOVER_TOKEN} - user-key: $${CUSTOM_PUSHOVER_USER_KEY} - default-alert: - description: health-check failed - send-on-resolved: true - failure-threshold: 5 - success-threshold: 2 -connectivity: - checker: - target: 1.1.1.1:53 - interval: 1m -endpoints: - - name: status - group: external - url: https://status.hsn.dev - interval: 1m - client: - dns-resolver: tcp://1.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - # - name: Umami - # group: external - # url: https://umi.hsn.dev/script.js - # interval: 1m - # client: - # dns-resolver: tcp://1.1.1.1:53 - # conditions: - # - "[STATUS] == 200" - # alerts: - # - type: pushover - - name: Nextcloud External - group: external - url: https://nc.hsn.dev - interval: 1m - ui: - hide-url: true - hide-hostname: true - client: - dns-resolver: tcp://1.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - - name: flux-webhook - group: external - url: https://flux-receiver.hsn.dev - interval: 1m - client: - dns-resolver: tcp://1.1.1.1:53 - conditions: - - "[STATUS] == 404" - alerts: - - type: pushover - - name: Elessar - group: internal - url: https://elessar.jahanson.tech - interval: 1m - client: - dns-resolver: tcp://10.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - - name: Sting - group: internal - url: http://sting.jahanson.tech - interval: 1m - client: - dns-resolver: tcp://10.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - - name: Gandalf - group: internal - url: https://gandalf.jahanson.tech:8443 - interval: 1m - client: - dns-resolver: tcp://10.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - - name: Gollum - group: internal - url: http://gollum.jahanson.tech - interval: 1m - client: - dns-resolver: tcp://10.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - - name: Nextcloud Internal - group: internal - url: https://nc.hsn.dev - interval: 1m - ui: - hide-url: true - hide-hostname: true - client: - dns-resolver: tcp://10.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover - - name: Home Assistant - group: internal - url: https://hass.jahanson.tech - interval: 1m - client: - dns-resolver: tcp://10.1.1.1:53 - conditions: - - "[STATUS] == 200" - alerts: - - type: pushover diff --git a/kubernetes/apps/observability/gatus/ks.yaml b/kubernetes/apps/observability/gatus/ks.yaml deleted file mode 100644 index b0e1058..0000000 --- a/kubernetes/apps/observability/gatus/ks.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app gatus - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: crunchy-postgres-operator - - name: external-secrets-stores - path: ./kubernetes/apps/observability/gatus/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - DB_NAME: gatus - DB_USER: gatus diff --git a/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml b/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml new file mode 100644 index 0000000..3ac2d30 --- /dev/null +++ b/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml @@ -0,0 +1,146 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kube-prometheus-stack +spec: + interval: 30m + timeout: 15m + chart: + spec: + chart: kube-prometheus-stack + version: 62.3.1 + sourceRef: + kind: HelmRepository + name: prometheus-community + namespace: flux-system + interval: 30m + install: + crds: Skip + upgrade: + crds: Skip + values: + crds: + enabled: false + cleanPrometheusOperatorObjectNames: true + + ### + ### Component values + ### + alertmanager: + enabled: false + + kubeApiServer: + enabled: true + serviceMonitor: + metricRelabelings: + # Drop high cardinality labels + - action: drop + sourceLabels: ["__name__"] + regex: (apiserver|etcd|rest_client)_request(|_sli|_slo)_duration_seconds_bucket + - action: drop + sourceLabels: ["__name__"] + regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket) + + kubeControllerManager: + enabled: false + + kubeEtcd: + enabled: false + + kubelet: + enabled: true + serviceMonitor: + metricRelabelings: + # Drop high cardinality labels + - action: labeldrop + regex: (uid) + - action: labeldrop + regex: (id|name) + - action: drop + sourceLabels: ["__name__"] + regex: (rest_client_request_duration_seconds_bucket|rest_client_request_duration_seconds_sum|rest_client_request_duration_seconds_count) + + kubeProxy: + enabled: false + + kubeScheduler: + enabled: false + + kubeStateMetrics: + enabled: false + + nodeExporter: + enabled: false + + grafana: + enabled: false + forceDeployDashboards: true + sidecar: + dashboards: + annotations: + grafana_folder: Kubernetes + + ### + ### Prometheus operator values + ### + prometheusOperator: + resources: + requests: + cpu: 35m + memory: 273M + limits: + memory: 326M + + prometheusConfigReloader: + # resource config for prometheusConfigReloader + resources: + requests: + cpu: 5m + memory: 32M + limits: + memory: 32M + + ### + ### Prometheus instance values + ### + prometheus: + ingress: + enabled: true + ingressClassName: internal-nginx + annotations: + external-dns.alpha.kubernetes.io/target: internal.jahanson.tech + hosts: + - prometheus.jahanson.tech + pathType: Prefix + + prometheusSpec: + enableAdminAPI: true + enableFeatures: + - auto-gomaxprocs + - memory-snapshot-on-shutdown + - new-service-discovery-manager + podMonitorSelectorNilUsesHelmValues: false + probeSelectorNilUsesHelmValues: false + replicas: 1 + replicaExternalLabelName: "__replica__" # must match with thanos value `.query.replicaLabel[0]` + resources: + requests: + cpu: 100m + limits: + memory: 1500M + retention: 14d + retentionSize: 50GB + ruleSelectorNilUsesHelmValues: false + scrapeConfigSelectorNilUsesHelmValues: false + scrapeInterval: 1m # Must match interval in Grafana Helm chart + serviceMonitorSelectorNilUsesHelmValues: false + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: ceph-block + resources: + requests: + storage: 55Gi + walCompression: true diff --git a/kubernetes/apps/default/thelounge/ks.yaml b/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml similarity index 60% rename from kubernetes/apps/default/thelounge/ks.yaml rename to kubernetes/apps/observability/kube-prometheus-stack/ks.yaml index 07273d6..93d157f 100644 --- a/kubernetes/apps/default/thelounge/ks.yaml +++ b/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml @@ -3,17 +3,20 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: - name: &appname thelounge + name: &appname kube-prometheus-stack namespace: flux-system spec: - targetNamespace: default + targetNamespace: observability commonMetadata: labels: app.kubernetes.io/name: *appname interval: 10m - path: "./kubernetes/apps/default/thelounge/app" + path: "./kubernetes/apps/observability/kube-prometheus-stack/app" prune: true sourceRef: kind: GitRepository - name: homelab - wait: false + name: theshire + wait: true + dependsOn: + # - name: alertmanager + - name: rook-ceph-cluster diff --git a/kubernetes/apps/observability/kustomization.yaml b/kubernetes/apps/observability/kustomization.yaml index 29e5438..62b598c 100644 --- a/kubernetes/apps/observability/kustomization.yaml +++ b/kubernetes/apps/observability/kustomization.yaml @@ -1,13 +1,9 @@ --- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization +# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: # Pre Flux-Kustomizations - ./namespace.yaml # Flux-Kustomizations - - ./gatus/ks.yaml - - ./node-exporter/ks.yaml - - ./prometheus-operator-crds/ks.yaml - # - ./smartctl-exporter/ks.yaml - # - ./victoria-metrics/ks.yaml + - ./kube-prometheus-stack/ks.yaml diff --git a/kubernetes/apps/observability/namespace.yaml b/kubernetes/apps/observability/namespace.yaml index f062e93..ce3a5bd 100644 --- a/kubernetes/apps/observability/namespace.yaml +++ b/kubernetes/apps/observability/namespace.yaml @@ -5,4 +5,3 @@ metadata: name: observability labels: kustomize.toolkit.fluxcd.io/prune: disabled - pgo-enabled-hsn.dev: "true" \ No newline at end of file diff --git a/kubernetes/apps/observability/node-exporter/app/helmrelease.yaml b/kubernetes/apps/observability/node-exporter/app/helmrelease.yaml deleted file mode 100644 index b4c6c54..0000000 --- a/kubernetes/apps/observability/node-exporter/app/helmrelease.yaml +++ /dev/null @@ -1,51 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: node-exporter -spec: - interval: 30m - chart: - spec: - chart: prometheus-node-exporter - version: 4.39.0 - sourceRef: - kind: HelmRepository - name: prometheus-community - namespace: flux-system - interval: 30m - values: - fullnameOverride: node-exporter - - image: - registry: quay.io - repository: prometheus/node-exporter - - prometheus: - monitor: - enabled: true - jobLabel: app.kubernetes.io/instance - - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: nodename - - resources: - requests: - cpu: 23m - memory: 64M - limits: - memory: 64M - - hostNetwork: false diff --git a/kubernetes/apps/observability/node-exporter/app/kustomization.yaml b/kubernetes/apps/observability/node-exporter/app/kustomization.yaml deleted file mode 100644 index 17cbc72..0000000 --- a/kubernetes/apps/observability/node-exporter/app/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/kubernetes/apps/observability/node-exporter/ks.yaml b/kubernetes/apps/observability/node-exporter/ks.yaml deleted file mode 100644 index 8d3acfa..0000000 --- a/kubernetes/apps/observability/node-exporter/ks.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app node-exporter - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - interval: 10m - path: "./kubernetes/apps/observability/node-exporter/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false diff --git a/kubernetes/apps/observability/prometheus-operator-crds/app/helmrelease.yaml b/kubernetes/apps/observability/prometheus-operator-crds/app/helmrelease.yaml deleted file mode 100644 index 9028610..0000000 --- a/kubernetes/apps/observability/prometheus-operator-crds/app/helmrelease.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: prometheus-operator-crds -spec: - interval: 30m - chart: - spec: - chart: prometheus-operator-crds - version: 14.0.0 - sourceRef: - kind: HelmRepository - name: prometheus-community - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 diff --git a/kubernetes/apps/observability/prometheus-operator-crds/app/kustomization.yaml b/kubernetes/apps/observability/prometheus-operator-crds/app/kustomization.yaml deleted file mode 100644 index 17cbc72..0000000 --- a/kubernetes/apps/observability/prometheus-operator-crds/app/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml b/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml deleted file mode 100644 index 8d43906..0000000 --- a/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app prometheus-operator-crds - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/observability/prometheus-operator-crds/app - prune: false # never should be deleted - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/kubernetes/apps/observability/smartctl-exporter/app/helmrelease.yaml b/kubernetes/apps/observability/smartctl-exporter/app/helmrelease.yaml deleted file mode 100644 index e670bec..0000000 --- a/kubernetes/apps/observability/smartctl-exporter/app/helmrelease.yaml +++ /dev/null @@ -1,44 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app smartctl-exporter -spec: - interval: 30m - chart: - spec: - chart: prometheus-smartctl-exporter - version: 0.10.0 - sourceRef: - kind: HelmRepository - name: prometheus-community - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - uninstall: - keepHistory: false - dependsOn: - - name: kube-prometheus-stack - namespace: observability - values: - fullnameOverride: *app - config: - devices: - - /dev/sda - serviceMonitor: - enabled: true - prometheusRules: - enabled: false - tolerations: - - key: node-role.kubernetes.io/control-plane - effect: NoSchedule - operator: Exists - nodeSelector: - # only control plane nodes - node-role.kubernetes.io/control-plane: "" \ No newline at end of file diff --git a/kubernetes/apps/observability/smartctl-exporter/app/kustomization.yaml b/kubernetes/apps/observability/smartctl-exporter/app/kustomization.yaml deleted file mode 100644 index f12e081..0000000 --- a/kubernetes/apps/observability/smartctl-exporter/app/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./prometheusrule.yaml -configMapGenerator: - - name: smartctl-exporter-loki-rules - files: - - smartctl-exporter.yaml=./resources/lokirule.yml - options: - labels: - loki_rule: "true" -generatorOptions: - disableNameSuffixHash: true \ No newline at end of file diff --git a/kubernetes/apps/observability/smartctl-exporter/app/prometheusrule.yaml b/kubernetes/apps/observability/smartctl-exporter/app/prometheusrule.yaml deleted file mode 100644 index 771b799..0000000 --- a/kubernetes/apps/observability/smartctl-exporter/app/prometheusrule.yaml +++ /dev/null @@ -1,67 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/prometheusrule_v1.json -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: smartctl-exporter-rules -spec: - groups: - - name: smartctl-exporter.rules - rules: - - alert: SmartDeviceHighTemperature - annotations: - summary: Mounted drive {{ $labels.device }} on device {{ $labels.instance }} - has a temperature higher than 65°C. - expr: smartctl_device_temperature > 65 - for: 15m - labels: - severity: critical - - alert: SmartDeviceTestFailed - annotations: - summary: Mounted drive {{ $labels.device }} on device {{ $labels.instance }} - did not pass its SMART test. - expr: | - ( - smartctl_device_smart_status != 1 - or - smartctl_device_status != 1 - ) - for: 15m - labels: - severity: critical - - alert: SmartDeviceCriticalWarning - annotations: - summary: Mounted drive {{ $labels.device }} on device {{ $labels.instance }} - is in a critical state. - expr: smartctl_device_critical_warning != 0 - for: 15m - labels: - severity: critical - # - # Ref: https://github.com/prometheus-community/helm-charts/blob/main/charts/prometheus-smartctl-exporter/rules/rules.txt - # - - alert: SmartDeviceMediaErrors - annotations: - summary: Mounted drive {{ $labels.device }} on device {{ $labels.instance }} - has media errors. - expr: smartctl_device_media_errors != 0 - for: 15m - labels: - severity: critical - - alert: SmartDeviceAvailableSpareUnderThreadhold - annotations: - summary: Device {{ $labels.device }} on instance {{ $labels.instance }} - is under available spare threashold. - expr: smartctl_device_available_spare_threshold > smartctl_device_available_spare - for: 15m - labels: - severity: critical - - alert: SmartDeviceInterfaceSlow - annotations: - summary: Device {{ $labels.device }} on instance {{ $labels.instance }} - interface is slower then it should be. - expr: | - smartctl_device_interface_speed{speed_type="current"} != on(device, instance, namespace, pod) smartctl_device_interface_speed{speed_type="max"} - for: 15m - labels: - severity: critical \ No newline at end of file diff --git a/kubernetes/apps/observability/smartctl-exporter/app/resources/lokirule.yml b/kubernetes/apps/observability/smartctl-exporter/app/resources/lokirule.yml deleted file mode 100644 index 6ee7be2..0000000 --- a/kubernetes/apps/observability/smartctl-exporter/app/resources/lokirule.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -groups: - - name: smart - rules: - - alert: SMARTFailure - expr: | - sum by (hostname) (count_over_time({hostname=~".+"} | json | _SYSTEMD_UNIT = "smartmontools.service" !~ "(?i)previous self-test completed without error" !~ "(?i)Prefailure" |~ "(?i)(error|fail)"[2m])) > 0 - for: 2m - labels: - severity: critical - category: logs - annotations: - hostname: "{{ $labels.hostname }}" - summary: "{{ $labels.hostname }} has reported SMART failures" diff --git a/kubernetes/apps/observability/smartctl-exporter/ks.yaml b/kubernetes/apps/observability/smartctl-exporter/ks.yaml deleted file mode 100644 index f9d9da8..0000000 --- a/kubernetes/apps/observability/smartctl-exporter/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app smartctl-exporter - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/observability/smartctl-exporter/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m \ No newline at end of file diff --git a/kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml b/kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml deleted file mode 100644 index 6b57d54..0000000 --- a/kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml +++ /dev/null @@ -1,202 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: victoria-metrics -spec: - interval: 30m - chart: - spec: - chart: victoria-metrics-k8s-stack - version: 0.25.8 - sourceRef: - kind: HelmRepository - name: victoria-metrics - namespace: flux-system - values: - fullnameOverride: victoria-metrics - - # VM Operator deployment - victoria-metrics-operator: - enabled: true - operator: - # disable_prometheus_converter: false # Ensure we keep enabled the converter to sync prom rules to VM rules - enable_converter_ownership: true # Required to allow VM to remove VM rules it imports if a prometheus rule is deleted - - # Single-binary vm cluster - vmsingle: - enabled: true - spec: - extraArgs: - dedup.minScrapeInterval: 30s - maxLabelsPerTimeseries: "90" - search.minStalenessInterval: 5m - vmalert.proxyURL: http://vmalert-victoria-metrics.observability.svc.cluster.local:8080 - retentionPeriod: 1y - storage: - storageClassName: "openebs-zfs" - resources: - requests: - storage: "50Gi" - accessModes: - - ReadWriteOnce - ingress: - enabled: true - ingressClassName: internal-nginx - hosts: - - vm.jahanson.tech - - # VM Alerting (however, this just watches & passes alerts to alertmanager) - vmalert: - enabled: true - spec: - replicaCount: 1 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 150m - memory: 256Mi - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: vmalert - extraArgs: - external.url: https://vmalert.jahanson.tech - notifiers: - - url: http://alertmanager.observability.svc.cluster.local:9093 - ingress: - enabled: true - ingressClassName: internal-nginx - hosts: - - vmalert.jahanson.tech - - # VM Data scraping - vmagent: - enabled: true - spec: - replicaCount: 1 - shardCount: 2 - scrapeInterval: 30s - externalLabels: - cluster: main - resources: - requests: - cpu: 50m - memory: 256Mi - limits: - cpu: 400m - memory: 512Mi - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: vmagent - additionalScrapeConfigs: - name: vm-additional-scrape-configs - key: prometheus-additional.yaml - ingress: - enabled: true - ingressClassName: internal-nginx - hosts: - - vmagent.jahanson.tech - - # Extra slack templates - monzoTemplate: - enabled: false - - # Scrape configs - kubelet: - enabled: true - spec: - interval: 30s - # drop high cardinality label and useless metrics for cadvisor and kubelet - metricRelabelConfigs: - - action: labeldrop - regex: (uid|pod_uid|id) - - action: labeldrop - regex: (name) - - action: drop - source_labels: [__name__] - regex: (rest_client_request_duration_seconds_bucket|rest_client_request_duration_seconds_sum|rest_client_request_duration_seconds_count) - - action: drop - source_labels: [__name__] - regex: (container_tasks_state|container_memory_failures_total) - - action: drop - source_labels: [__name__] - regex: (container_blkio_device_usage_total) - - action: drop - source_labels: [__name__] - regex: (prober_probe_duration_seconds_bucket) - relabelConfigs: - - action: labelmap - regex: __meta_kubernetes_node_label_(.+) - - sourceLabels: [__metrics_path__] - targetLabel: metrics_path - - targetLabel: "job" - replacement: "kubelet" - # kubeApiServer: - # enabled: false - # kubeControllerManager: - # enabled: false - # kubeProxy: - # enabled: false - # kubeScheduler: - # enabled: false - # kubeEtcd: - # enabled: false - - # Enable deployment of kube-state-metrics - # kube-state-metrics: - # enabled: false - - # Enable deployment of prometheus-node-exporter - # prometheus-node-exporter: - # enabled: false - - # Enable deployment of grafana - # defaultDashboardsEnabled: false - # grafana: - # enabled: false - - # Enable deployment of alertmanager - # alertmanager: - # enabled: false - - # Prepared sets of default rules - # Adjust to what scraping functions you have enabled - # i.e. if you dont have kubeapisever setup & enabled, disable - # the kubeApiserver rules below - defaultRules: - create: true - rules: - etcd: false - general: true - k8s: true - kubeApiserver: true - kubeApiserverAvailability: true - kubeApiserverBurnrate: true - kubeApiserverHistogram: true - kubeApiserverSlos: true - kubelet: true - kubePrometheusGeneral: true - kubePrometheusNodeRecording: true - kubernetesApps: true - kubernetesResources: true - kubernetesStorage: true - kubernetesSystem: true - kubeScheduler: false - kubeStateMetrics: true - network: true - node: true - vmagent: true - vmsingle: false - vmhealth: true - alertmanager: false diff --git a/kubernetes/apps/observability/victoria-metrics/app/kustomization.yaml b/kubernetes/apps/observability/victoria-metrics/app/kustomization.yaml deleted file mode 100644 index 17cbc72..0000000 --- a/kubernetes/apps/observability/victoria-metrics/app/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/kubernetes/apps/observability/victoria-metrics/ks.yaml b/kubernetes/apps/observability/victoria-metrics/ks.yaml deleted file mode 100644 index 85590ef..0000000 --- a/kubernetes/apps/observability/victoria-metrics/ks.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app victoria-metrics-stack - namespace: flux-system -spec: - targetNamespace: observability - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - path: ./kubernetes/apps/observability/victoria-metrics/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app diff --git a/kubernetes/apps/openebs-system/kustomization.yaml b/kubernetes/apps/openebs-system/kustomization.yaml deleted file mode 100644 index 334dd68..0000000 --- a/kubernetes/apps/openebs-system/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./openebs/ks.yaml \ No newline at end of file diff --git a/kubernetes/apps/openebs-system/namespace.yaml b/kubernetes/apps/openebs-system/namespace.yaml deleted file mode 100644 index f79a519..0000000 --- a/kubernetes/apps/openebs-system/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: openebs-system - annotations: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" \ No newline at end of file diff --git a/kubernetes/apps/openebs-system/openebs/app/helmrelease.yaml b/kubernetes/apps/openebs-system/openebs/app/helmrelease.yaml deleted file mode 100644 index 9372ccd..0000000 --- a/kubernetes/apps/openebs-system/openebs/app/helmrelease.yaml +++ /dev/null @@ -1,61 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: openebs -spec: - interval: 30m - chart: - spec: - chart: openebs - version: 4.1.0 - sourceRef: - kind: HelmRepository - name: openebs - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - values: - localpv-provisioner: - localpv: - image: - registry: quay.io/ - repository: openebs/provisioner-localpv - hostpathClass: - enabled: true - name: openebs-hostpath - isDefaultClass: true - basePath: /var/mnt/nvme1 - openebs-crds: - csi: - volumeSnapshots: - enabled: false - keep: false - zfs-localpv: - enabled: true - zfsNode: - encrKeysDir: /var/openebs/keys - zfsPlugin: - image: - registry: quay.io/ - repository: openebs/zfs-driver - lvm-localpv: - enabled: false - mayastor: - enabled: false - engines: - local: - lvm: - enabled: false - zfs: - enabled: true - replicated: - mayastor: - enabled: false diff --git a/kubernetes/apps/openebs-system/openebs/app/kustomization.yaml b/kubernetes/apps/openebs-system/openebs/app/kustomization.yaml deleted file mode 100644 index 0a88421..0000000 --- a/kubernetes/apps/openebs-system/openebs/app/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml - - ./storageclass.yaml - - ./volumesnapshotclass.yaml diff --git a/kubernetes/apps/openebs-system/openebs/app/storageclass.yaml b/kubernetes/apps/openebs-system/openebs/app/storageclass.yaml deleted file mode 100644 index f2bfe7e..0000000 --- a/kubernetes/apps/openebs-system/openebs/app/storageclass.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: openebs-zfs - annotations: - storageclass.kubernetes.io/is-default-class: "true" -provisioner: zfs.csi.openebs.io -parameters: - recordsize: "128k" - compression: "off" - dedup: "off" - fstype: "zfs" - poolname: "nahar" -allowVolumeExpansion: true diff --git a/kubernetes/apps/openebs-system/openebs/app/volumesnapshotclass.yaml b/kubernetes/apps/openebs-system/openebs/app/volumesnapshotclass.yaml deleted file mode 100644 index 352e7d3..0000000 --- a/kubernetes/apps/openebs-system/openebs/app/volumesnapshotclass.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/snapshot.storage.k8s.io/volumesnapshotclass_v1.json -kind: VolumeSnapshotClass -apiVersion: snapshot.storage.k8s.io/v1 -metadata: - name: openebs-zfs - annotations: - snapshot.storage.kubernetes.io/is-default-class: "true" -driver: zfs.csi.openebs.io -deletionPolicy: Delete diff --git a/kubernetes/apps/openebs-system/openebs/ks.yaml b/kubernetes/apps/openebs-system/openebs/ks.yaml deleted file mode 100644 index 690b4cc..0000000 --- a/kubernetes/apps/openebs-system/openebs/ks.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app openebs - namespace: flux-system -spec: - targetNamespace: openebs-system - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/openebs-system/openebs/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/kubernetes/apps/qbittorrent/cross-seed/app/externalsecret.yaml b/kubernetes/apps/qbittorrent/cross-seed/app/externalsecret.yaml deleted file mode 100644 index 249d7ee..0000000 --- a/kubernetes/apps/qbittorrent/cross-seed/app/externalsecret.yaml +++ /dev/null @@ -1,38 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cross-seed -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: cross-seed-secret - template: - engineVersion: v2 - data: - config.js: | - module.exports = { - action: "inject", - apiKey: "{{.CROSS_SEED_API_KEY}}", - dataCategory: "cross-seed", - delay: 30, - duplicateCategories: true, - includeEpisodes: true, - includeNonVideos: true, - includeSingleEpisodes: true, - linkDir: "/data/nas-media/qb/downloads/complete/cross-seed", - linkType: "hardlink", - matchMode: "safe", - outputDir: "/config", - port: 80, - qbittorrentUrl: "http://qbittorrent.qbittorrent.svc.cluster.local", - skipRecheck: true, - torrentDir: "/qbittorrent/qBittorrent/BT_backup", - torznab: [] - }; - dataFrom: - - extract: - key: cross-seed diff --git a/kubernetes/apps/qbittorrent/cross-seed/app/helmrelease.yaml b/kubernetes/apps/qbittorrent/cross-seed/app/helmrelease.yaml deleted file mode 100644 index 0f36325..0000000 --- a/kubernetes/apps/qbittorrent/cross-seed/app/helmrelease.yaml +++ /dev/null @@ -1,92 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: cross-seed -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - dependsOn: - - name: qbittorrent - namespace: qbittorrent - values: - controllers: - cross-seed: - nameOverride: cross-seed - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: ghcr.io/cross-seed/cross-seed - tag: 6.0.0-32@sha256:df3e63c3564d3f61a62ca966acc043d438fecbbc80bf8b4de0dec5170bce9cd7 - env: - TZ: America/Chicago - args: ["daemon"] - probes: - liveness: - enabled: true - readiness: - enabled: true - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 10m - limits: - memory: 512Mi - defaultPodOptions: - securityContext: - runAsNonRoot: true - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - supplementalGroups: [10000] - seccompProfile: { type: RuntimeDefault } - service: - app: - controller: cross-seed - ports: - http: - port: 80 - persistence: - config: - type: emptyDir - secret-file: - type: secret - name: cross-seed-secret - globalMounts: - - path: /config/config.js - subPath: config.js - readOnly: true - qbittorrent: - existingClaim: qbittorrent - globalMounts: - - path: /qbittorrent/qBittorrent/BT_backup - subPath: qBittorrent/BT_backup - readOnly: true - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - globalMounts: - - path: /data/nas-media diff --git a/kubernetes/apps/qbittorrent/cross-seed/app/kustomization.yaml b/kubernetes/apps/qbittorrent/cross-seed/app/kustomization.yaml deleted file mode 100644 index 3351d8d..0000000 --- a/kubernetes/apps/qbittorrent/cross-seed/app/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml -generatorOptions: - disableNameSuffixHash: true diff --git a/kubernetes/apps/qbittorrent/cross-seed/ks.yaml b/kubernetes/apps/qbittorrent/cross-seed/ks.yaml deleted file mode 100644 index 4c355f1..0000000 --- a/kubernetes/apps/qbittorrent/cross-seed/ks.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app cross-seed - namespace: flux-system -spec: - targetNamespace: qbittorrent - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - path: ./kubernetes/apps/qbittorrent/cross-seed/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app diff --git a/kubernetes/apps/qbittorrent/flood/app/externalsecret.yaml b/kubernetes/apps/qbittorrent/flood/app/externalsecret.yaml deleted file mode 100644 index 4fa2a6c..0000000 --- a/kubernetes/apps/qbittorrent/flood/app/externalsecret.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: flood - namespace: qbittorrent -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: flood-secret - data: - - secretKey: FLOOD_OPTION_QBUSER - remoteRef: - key: flood - property: username - - secretKey: FLOOD_OPTION_QBPASS - remoteRef: - key: flood - property: password diff --git a/kubernetes/apps/qbittorrent/flood/app/helmrelease.yaml b/kubernetes/apps/qbittorrent/flood/app/helmrelease.yaml deleted file mode 100644 index 2ea4e27..0000000 --- a/kubernetes/apps/qbittorrent/flood/app/helmrelease.yaml +++ /dev/null @@ -1,98 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app flood - namespace: default -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - dependsOn: - - name: qbittorrent - namespace: qbittorrent - values: - defaultPodOptions: - securityContext: - fsGroup: 568 - runAsGroup: 568 - runAsNonRoot: true - runAsUser: 568 - seccompProfile: - type: RuntimeDefault - controllers: - flood: - annotations: - reloader.stakater.com/auto: "true" - containers: - app: - image: - repository: jesec/flood - tag: master@sha256:3d20df051209bff2905dec4e8328c1c464d5375e730ef7d81ca21422e2ccf06a - envFrom: - - secretRef: - name: flood-secret - env: - FLOOD_OPTION_RUNDIR: /data - FLOOD_OPTION_AUTH: none - FLOOD_OPTION_QBURL: http://qbittorrent.qbittorrent.svc.cluster.local - # FLOOD_OPTION_QBUSER is required but not used. - # FLOOD_OPTION_QBPASS is required but not used. - resources: - requests: - memory: 250Mi - cpu: 15m - limits: - memory: 512Mi - probes: - liveness: - enabled: true - readiness: - enabled: true - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - service: - app: - controller: *app - ports: - http: - port: 3000 - ingress: - app: - enabled: true - className: "internal-nginx" - hosts: - - host: &host "flood.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - *host - persistence: - config: - enabled: true - existingClaim: *app - globalMounts: - - path: /data diff --git a/kubernetes/apps/qbittorrent/flood/app/kustomization.yaml b/kubernetes/apps/qbittorrent/flood/app/kustomization.yaml deleted file mode 100644 index 47667ae..0000000 --- a/kubernetes/apps/qbittorrent/flood/app/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: default -resources: - - ./helmrelease.yaml - - ./externalsecret.yaml - - ../../../../templates/gatus/internal - - ../../../../templates/volsync diff --git a/kubernetes/apps/qbittorrent/flood/ks.yaml b/kubernetes/apps/qbittorrent/flood/ks.yaml deleted file mode 100644 index 4d80a30..0000000 --- a/kubernetes/apps/qbittorrent/flood/ks.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app flood - namespace: flux-system -spec: - targetNamespace: qbittorrent - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: external-secrets-stores - - name: qbittorrent - - name: volsync - path: ./kubernetes/apps/qbittorrent/flood/app - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 2Gi diff --git a/kubernetes/apps/qbittorrent/kustomization.yaml b/kubernetes/apps/qbittorrent/kustomization.yaml deleted file mode 100644 index 5106afe..0000000 --- a/kubernetes/apps/qbittorrent/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # Pre Flux-Kustomizations - - ./namespace.yaml - # Flux-Kustomizations - - ./cross-seed/ks.yaml - - ./flood/ks.yaml - - ./qbittorrent/ks.yaml diff --git a/kubernetes/apps/qbittorrent/namespace.yaml b/kubernetes/apps/qbittorrent/namespace.yaml deleted file mode 100644 index f771b45..0000000 --- a/kubernetes/apps/qbittorrent/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: qbittorrent - labels: - kustomize.toolkit.fluxcd.io/prune: disabled - volsync.backube/privileged-movers: "true" diff --git a/kubernetes/apps/qbittorrent/qbittorrent/app/externalsecret.yaml b/kubernetes/apps/qbittorrent/qbittorrent/app/externalsecret.yaml deleted file mode 100644 index 288892c..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/app/externalsecret.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: qbittorrent - namespace: qbittorrent -spec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - target: - name: qbittorrent-secret - template: - engineVersion: v2 - data: - CROSS_SEED_API_KEY: "{{ .CROSS_SEED_API_KEY }}" - dataFrom: - - extract: - key: cross-seed diff --git a/kubernetes/apps/qbittorrent/qbittorrent/app/helmrelease.yaml b/kubernetes/apps/qbittorrent/qbittorrent/app/helmrelease.yaml deleted file mode 100644 index 056ec6f..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/app/helmrelease.yaml +++ /dev/null @@ -1,127 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: &app qbittorrent -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - interval: 30m - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - retries: 3 - strategy: rollback - values: - controllers: - qbittorrent: - annotations: - configmap.reloader.stakater.com/reload: qbittorrent-scripts - secret.reloader.stakater.com/reload: qbittorrent-secret - pod: - securityContext: - fsGroup: 568 - fsGroupChangePolicy: "OnRootMismatch" - containers: - app: - nameOverride: qbittorrent - image: - repository: ghcr.io/onedr0p/qbittorrent - tag: 4.6.6@sha256:2fd0eba46205055c3f758411a79d5fa175df324f707dab9ad9a3a5be2ab92071 - env: - UMASK: "022" - QBITTORRENT__PORT: &port 80 - QBITTORRENT__BT_PORT: &bittorrentPort 50413 - QBT_Preferences__WebUI__AlternativeUIEnabled: false - QBT_Preferences__WebUI__AuthSubnetWhitelistEnabled: true - QBT_Preferences__WebUI__AuthSubnetWhitelist: |- - 10.244.0.0/16, 10.1.2.0/24 - QBT_Preferences__WebUI__LocalHostAuth: false - CROSS_SEED_HOST: cross-seed.qbittorrent.svc.cluster.local - CROSS_SEED_PORT: 80 - CROSS_SEED_SLEEP_INTERVAL: 0 - envFrom: - - secretRef: - name: qbittorrent-secret - resources: - requests: - cpu: 49m - memory: 1024Mi - limits: - memory: 24Gi - securityContext: - runAsUser: 568 - runAsGroup: 568 - runAsNonRoot: true - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - - service: - app: - controller: *app - type: LoadBalancer - annotations: - io.cilium/lb-ipam-ips: 10.1.1.34 - nameOverride: *app - ports: - http: - port: *port - bittorrent: - enabled: true - port: *bittorrentPort - protocol: TCP - - ingress: - app: - className: "internal-nginx" - hosts: - - host: "qb.jahanson.tech" - paths: - - path: / - service: - identifier: app - port: http - tls: - - hosts: - - "qb.jahanson.tech" - - persistence: - config: - existingClaim: qbittorrent - scripts: - type: configMap - name: qbittorrent-scripts - defaultMode: 0775 - globalMounts: - - path: /scripts/cross-seed.sh - subPath: cross-seed.sh - readOnly: true - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - advancedMounts: - qbittorrent: - app: - - path: /data/nas-media - qbtun: - type: hostPath - hostPath: /dev/net - advancedMounts: - qbittorrent: - gluetun: - - path: /dev/net diff --git a/kubernetes/apps/qbittorrent/qbittorrent/app/kustomization.yaml b/kubernetes/apps/qbittorrent/qbittorrent/app/kustomization.yaml deleted file mode 100644 index 0f2d15c..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/app/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./externalsecret.yaml - - ./helmrelease.yaml - - ../../../../templates/volsync -configMapGenerator: - - name: qbittorrent-scripts - files: - - cross-seed.sh=./resources/cross-seed.sh -generatorOptions: - disableNameSuffixHash: true - annotations: - kustomize.toolkit.fluxcd.io/substitute: disabled diff --git a/kubernetes/apps/qbittorrent/qbittorrent/app/resources/cross-seed.sh b/kubernetes/apps/qbittorrent/qbittorrent/app/resources/cross-seed.sh deleted file mode 100644 index 34fc5bb..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/app/resources/cross-seed.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/usr/bin/env bash - -export CROSS_SEED_HOST=${CROSS_SEED_HOST:-cross-seed.default.svc.cluster.local} -export CROSS_SEED_PORT=${CROSS_SEED_PORT:-80} -export CROSS_SEED_API_KEY=${CROSS_SEED_API_KEY:-unset} -export CROSS_SEED_SLEEP_INTERVAL=${CROSS_SEED_SLEEP_INTERVAL:-30} - -SEARCH_PATH=$1 - -# Update permissions on the search path -chmod -R 750 "${SEARCH_PATH}" - -# Search for cross-seed -response=$( - curl \ - --silent \ - --output /dev/null \ - --write-out "%{http_code}" \ - --request POST \ - --data-urlencode "path=${SEARCH_PATH}" \ - --header "X-Api-Key: ${CROSS_SEED_API_KEY}" \ - "http://${CROSS_SEED_HOST}:${CROSS_SEED_PORT}/api/webhook" -) - -if [[ "${response}" != "204" ]]; then - printf "Failed to search cross-seed for '%s'\n" "${SEARCH_PATH}" - exit 1 -fi - -printf "Successfully searched cross-seed for '%s'\n" "${SEARCH_PATH}" - -sleep "${CROSS_SEED_SLEEP_INTERVAL}" diff --git a/kubernetes/apps/qbittorrent/qbittorrent/ks.yaml b/kubernetes/apps/qbittorrent/qbittorrent/ks.yaml deleted file mode 100644 index 25ac12e..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/ks.yaml +++ /dev/null @@ -1,50 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app qbittorrent - namespace: flux-system -spec: - targetNamespace: qbittorrent - commonMetadata: - labels: - app.kubernetes.io/name: *app - interval: 10m - path: "./kubernetes/apps/qbittorrent/qbittorrent/app" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true - dependsOn: - - name: openebs - - name: volsync - - name: external-secrets-stores - postBuild: - substitute: - APP: *app - VOLSYNC_CAPACITY: 2Gi - VOLSYNC_STORAGECLASS: zfs-generic-nfs-csi - VOLSYNC_SNAPSHOTCLASS: zfs-generic-nfs-csi ---- -# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app qbittorrent-tools - namespace: flux-system -spec: - targetNamespace: qbittorrent - commonMetadata: - labels: - app.kubernetes.io/name: *app - path: ./kubernetes/apps/qbittorrent/qbittorrent/tools - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml b/kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml deleted file mode 100644 index 23694f0..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml +++ /dev/null @@ -1,146 +0,0 @@ ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: qbtools -spec: - interval: 30m - chart: - spec: - chart: app-template - version: 3.4.0 - sourceRef: - kind: HelmRepository - name: bjw-s - namespace: flux-system - install: - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - remediation: - strategy: rollback - retries: 3 - dependsOn: - - name: qbittorrent - namespace: qbittorrent - values: - controllers: - tagging: - type: cronjob - cronjob: &cronJobSpec - schedule: "@hourly" - timeZone: &timeZone America/Chicago - concurrencyPolicy: Forbid - successfulJobsHistory: 1 - failedJobsHistory: 1 - initContainers: - tagging: &container - image: - repository: ghcr.io/buroa/qbtools - tag: v0.16.10@sha256:fec06dd13ec90694110ca912eb9003d3a46d29be83944538599b35fc78dcbf18 - env: - TZ: *timeZone - POD_NAMESPACE: - valueFrom: - fieldRef: - fieldPath: metadata.namespace - args: [ - "tagging", - "--added-on", - "--expired", - "--last-activity", - "--sites", - "--unregistered", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80", - "--config", "/config/config.yaml" - ] - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: { drop: ["ALL"] } - resources: - requests: - cpu: 25m - limits: - memory: 256M - containers: - unregistered: - <<: *container - args: [ - "prune", - "--exclude-category", "manual", - "--exclude-category", "music", - "--exclude-tag", "added:24h", - "--include-tag", "unregistered", - "--dry-run", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - expired: - <<: *container - args: [ - "prune", - "--exclude-category", "manual", - "--exclude-category", "music", - "--include-tag", "expired", # defined in config.yaml - "--include-tag", "added:7d", - "--dry-run", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - pod: - restartPolicy: OnFailure - orphaned: - type: cronjob - cronjob: - <<: *cronJobSpec - schedule: "@daily" - containers: - app: - <<: *container - args: [ - "orphaned", - "--exclude-pattern", "*_unpackerred*", - "--exclude-pattern", "*/manual/*", - # "--dry-run", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - pod: - restartPolicy: OnFailure - reannounce: - containers: - app: - <<: *container - args: [ - "reannounce", - "--process-seeding", - "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local", - "--port", "80" - ] - defaultPodOptions: - securityContext: - runAsNonRoot: true - runAsUser: 568 - runAsGroup: 568 - seccompProfile: { type: RuntimeDefault } - persistence: - secret-file: - type: secret - name: qbtools-secret - globalMounts: - - path: /config/config.yaml - subPath: config.yaml - readOnly: true - media: - type: nfs - server: 10.1.1.13 - path: /eru/media - advancedMounts: - orphaned: - app: - - path: /data/nas-media - subPath: qb/downloads diff --git a/kubernetes/apps/qbittorrent/qbittorrent/tools/kustomization.yaml b/kubernetes/apps/qbittorrent/qbittorrent/tools/kustomization.yaml deleted file mode 100644 index 6b4d0b3..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/tools/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./qbtools.secret.sops.yaml - - ./helmrelease.yaml diff --git a/kubernetes/apps/qbittorrent/qbittorrent/tools/qbtools.secret.sops.yaml b/kubernetes/apps/qbittorrent/qbittorrent/tools/qbtools.secret.sops.yaml deleted file mode 100644 index ea848a7..0000000 --- a/kubernetes/apps/qbittorrent/qbittorrent/tools/qbtools.secret.sops.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: qbtools-secret -stringData: - config.yaml: ENC[AES256_GCM,data:NZq8GKG05lEp6lLvE/IMOkt6FrzJ8Hoj3KJ57y5rumsTxqydyxzmrt9IVf34nQ1SgSGKMdI8KgEIVnHBj/4jfYgJZ5+1AfKiTe0DW3NZSK3LkDJcs6Mcwu6f5lbil1vfaS3YgJ2K1pv5ys7GCmE/zMqiNsTpmc1niY/JMOs/0eJaUYNACHl0I1w3fLJVPjnhdK99IhFYo42XywODyVSRdMeFTP6Q7Y4NRNJKA3u9W0ix12yaTdfBk5ia1sIRb9H3Gvl5z/XTvr0X6IzIpfoP46wf/EXLU7Y7Rt5fvnymQgzQr7JtUL90NBkKvqOko4NSl36uEol5jsu9gj9o+FZbA2CnDbZ6mp6BqJIB9HuaWCrgb6ideNTUYL/ASU6Wp17A1CzPDjlm+b6kGZpJKQYFEZ/VO8BEoeW3Yx9D0dG1ep9xFTu6xDKo7JxF4pbMWgWU5I+mE6xiCK7XGrab1latVhcPHBAVoxBrdHvAgwgvs1WmAe0ofP0vPpq6ZHd+kgQg2qHPbkj4viXl1Hf9M9Q7HJm+hlgfCmjaT9m5/1ipzbj9xlu0vG5GFTbf6hcPJXlthaEubHggKD1Idx1k7NUvJzQi/Y6KpUCM4BUOGOgYpGWic7kTSUoqdqKQNAJr77EKOIRGkI+LCPSOWx4atUS8jgS8/tbeXYAb9eBhovGWXZsGyPQt1bpfXmfiBRTqyRC66qPw5+AcruVaJY3C7Aj0f6BhqkDWScBiF3H3ZJj0Wp6wWKh/KCxSqO+AqcB36nVa62zLy6sIZHclwQwgxLzXFiaHxblRWxNuyAASNnrbAutLTsQ4HXCQPaiJ/9LxK+QAow7hryQsikq4XhCRV0TdEYzBpB3eatpB5G02kApvbMRW5kYvR8GHJzF8eqWgcRit4g0Q+kJn5p+UAi1rOP2bh/9lwPadn7TuuW3J9SzUOOmP2eajsicUkqnxsrxQFJbxkztLkPpLGHpd4zI8Y3riHtv2di57/ktUP9acc4kIk2LyYiN6jwKEOc2HTmSE3l2qdBXoy6Rcl/V/Uz1hOE3vOFUNJQL2sRyBf/0R7IKzXRieghR9h17pKYAsvbN9vO02dLevSYsqktowjwA1QXxxR2Vzp15tMV45T/nP5XLe3+f4zfJjRSuNM13ddowXp6smUOZ0Myw=,iv:FszW51oSi/iKN1cquyhF+HwStHgpgmioyopdJriuiOw=,tag:GYaRuyCgXuGVWyxShyH39Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UzFWbHB0bVlGQXV4dEVt - ZUxrcnZ1MlFOY2o2eTl0cDV3T3BKdmNMUXg0CmcyejMzV1loSUNIMEw0K09yc3Ax - NGZOTE1tamV2a05kZm9lNkpoeG9OWm8KLS0tIEVVM01nSjhQYzBOZ0MrY2JpODRz - MGNWSGJmaXdkbUJDOHpCRk9YWUZVSm8KGGHivrtQfHayo6BGbH+Tch3fzVlFNU3s - lLec6VZauGjIXifXBLC5e65SrSO/nZS4xsurrZovOLn3DpeDQu/4+Q== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-08-15T17:21:52Z" - mac: ENC[AES256_GCM,data:V+K/2CEFommRZ7kkJlUSjOIMQL8c3OtnJnPT7heHpkGUm/XJ8JFAhqHc5G6D6bjN6vsXcr7X7b9Tm6OBNPHBCJIekBahySUThHc6IxhQrNVTMu2lNOS9B7+VwZN2oezmEwbpY+5dT+3angWiBy2k5XW/7hmVlz1mQX8tJBTUHOM=,iv:LorlvJFs067H6FI/UPvIgRi9xTReOTfv13IdInFhcAU=,tag:72TTcNC6Fh3SiWlJa2xgzg==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.8.1 diff --git a/.archive/kubernetes/rook-ceph/kustomization.yaml b/kubernetes/apps/rook-ceph/kustomization.yaml similarity index 100% rename from .archive/kubernetes/rook-ceph/kustomization.yaml rename to kubernetes/apps/rook-ceph/kustomization.yaml diff --git a/.archive/kubernetes/rook-ceph/namespace.yaml b/kubernetes/apps/rook-ceph/namespace.yaml similarity index 100% rename from .archive/kubernetes/rook-ceph/namespace.yaml rename to kubernetes/apps/rook-ceph/namespace.yaml diff --git a/.archive/kubernetes/rook-ceph/rook-ceph/app/helmrelease.yaml b/kubernetes/apps/rook-ceph/rook-ceph/app/helmrelease.yaml similarity index 87% rename from .archive/kubernetes/rook-ceph/rook-ceph/app/helmrelease.yaml rename to kubernetes/apps/rook-ceph/rook-ceph/app/helmrelease.yaml index 916efb8..bbb37b3 100644 --- a/.archive/kubernetes/rook-ceph/rook-ceph/app/helmrelease.yaml +++ b/kubernetes/apps/rook-ceph/rook-ceph/app/helmrelease.yaml @@ -1,6 +1,6 @@ --- # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 +apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: rook-ceph-operator @@ -10,7 +10,7 @@ spec: chart: spec: chart: rook-ceph - version: v1.14.2 + version: v1.15.0 sourceRef: kind: HelmRepository name: rook-ceph @@ -30,7 +30,7 @@ spec: values: csi: provisioner: - image: registry.k8s.io/sig-storage/csi-provisioner:v4.0.1 + image: registry.k8s.io/sig-storage/csi-provisioner:v5.0.2 cephFSKernelMountOptions: ms_mode=prefer-crc enableLiveness: true serviceMonitor: diff --git a/.archive/kubernetes/rook-ceph/rook-ceph/app/kustomization.yaml b/kubernetes/apps/rook-ceph/rook-ceph/app/kustomization.yaml similarity index 100% rename from .archive/kubernetes/rook-ceph/rook-ceph/app/kustomization.yaml rename to kubernetes/apps/rook-ceph/rook-ceph/app/kustomization.yaml diff --git a/kubernetes/apps/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml b/kubernetes/apps/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml new file mode 100644 index 0000000..b8c53f9 --- /dev/null +++ b/kubernetes/apps/rook-ceph/rook-ceph/app/rook-ceph-dashboard-password.secret.sops.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +kind: Secret +metadata: + name: rook-ceph-dashboard-password +stringData: + password: ENC[AES256_GCM,data:5AzZOH8yd3PqieJ3AWMys4xOGu8=,iv:VPikjUWKO3RNSE+UZzUPDQcTYJi9EidxUucT5+xogdQ=,tag:cA2E3aOhtqus3u4X2CQ/Cw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WVNxRkFxTm9lWmZqYXcw + SlFVNjhveWU2OVZIM0VnMU9qcm9RcjlZeGhFCmsyTGtubWFsdU4xTG9DREhOdkRU + Z0MrVFdzZEw0T0h4RGpvTm9uYUsybmcKLS0tIGVmWmwrV2FieDF3OXc2Rm9FVTRB + RHFiSFptTjlHTDd4QU9mVFBXVkw0SmcKpJnJHKbnqKeDqJ9huXKF4ZV+/fhQgyXO + zq3TcV4e/5ZQ2ygxOh+E9CkV9fk0gmHcIMCg86OZtH2aUIiJDPF0uw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-07-15T16:01:56Z" + mac: ENC[AES256_GCM,data:8fHRQCoV96iiJQJNbiXnaTujH4GEaRK3Tiqh/BTyuw9FJWm54XPpIoBzHIJ7mIgkMtGcSZ/LrLde/0CUFlhNp5X15cVi2VA5VZEgt4ZJ0s8nSsb38Io8RQj6v3d25XqtbITlLIH7yJWHhAnYE5wdEX9anNKVGkT0PXg+xtXe5ro=,iv:YyD3AQeooIOhC6c7Z1nm4s1Un1sIgnrovu6Uf2bjv4g=,tag:H/FHhEdWH3tad1PSZBZYYg==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.8.1 diff --git a/.archive/kubernetes/rook-ceph/rook-ceph/cluster/helmrelease.yaml b/kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml similarity index 87% rename from .archive/kubernetes/rook-ceph/rook-ceph/cluster/helmrelease.yaml rename to kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml index a02aed2..1a0c685 100644 --- a/.archive/kubernetes/rook-ceph/rook-ceph/cluster/helmrelease.yaml +++ b/kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml @@ -1,6 +1,6 @@ --- # yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json -apiVersion: helm.toolkit.fluxcd.io/v2beta2 +apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: rook-ceph-cluster @@ -10,7 +10,7 @@ spec: chart: spec: chart: rook-ceph-cluster - version: v1.14.2 + version: v1.15.0 sourceRef: kind: HelmRepository name: rook-ceph @@ -49,8 +49,11 @@ spec: bdev_enable_discard = true bdev_async_discard = true osd_class_update_on_start = false - osd_pool_default_size = 1 cephClusterSpec: + mgr: + modules: + - name: pg_autoscaler + enabled: true network: provider: host connections: @@ -64,33 +67,35 @@ spec: storage: useAllNodes: true useAllDevices: false - deviceFilter: "nvme2n1" + deviceFilter: "nvme0n1" resources: mgr: requests: - cpu: 500m + cpu: 10m memory: 512Mi limits: cpu: 2000m memory: 2Gi mon: requests: - cpu: 500m + cpu: 10m memory: 1Gi limits: cpu: 4000m memory: 4Gi osd: requests: - cpu: 500m - memory: 4Gi + cpu: 10m + memory: 1Gi limits: cpu: 4000m - memory: 8Gi + memory: 3Gi cephBlockPools: - name: ceph-blockpool spec: failureDomain: host + replicated: + size: 3 storageClass: enabled: true name: ceph-block @@ -116,16 +121,20 @@ spec: - name: ceph-filesystem spec: metadataPool: + replicated: + size: 3 dataPools: - failureDomain: host + replicated: + size: 3 name: data0 metadataServer: activeCount: 1 activeStandby: true resources: requests: - cpu: 1000m - memory: 4Gi + cpu: 10m + memory: 1Gi limits: memory: 4Gi storageClass: @@ -153,14 +162,19 @@ spec: spec: metadataPool: failureDomain: host + replicated: + size: 3 dataPool: failureDomain: host + erasureCoded: + dataChunks: 2 + codingChunks: 1 preservePoolsOnDelete: true gateway: port: 80 resources: requests: - cpu: 1000m + cpu: 10m memory: 1Gi limits: memory: 2Gi diff --git a/.archive/kubernetes/observability/alertmanager-silencer/app/kustomization.yaml b/kubernetes/apps/rook-ceph/rook-ceph/cluster/kustomization.yaml similarity index 100% rename from .archive/kubernetes/observability/alertmanager-silencer/app/kustomization.yaml rename to kubernetes/apps/rook-ceph/rook-ceph/cluster/kustomization.yaml diff --git a/.archive/kubernetes/rook-ceph/rook-ceph/ks.yaml b/kubernetes/apps/rook-ceph/rook-ceph/ks.yaml similarity index 96% rename from .archive/kubernetes/rook-ceph/rook-ceph/ks.yaml rename to kubernetes/apps/rook-ceph/rook-ceph/ks.yaml index c8342f2..ce6fcef 100644 --- a/.archive/kubernetes/rook-ceph/rook-ceph/ks.yaml +++ b/kubernetes/apps/rook-ceph/rook-ceph/ks.yaml @@ -14,7 +14,7 @@ spec: prune: false # never should be deleted sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m @@ -35,7 +35,7 @@ spec: prune: false # never should be deleted sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/security/external-secrets/app/helmrelease.yaml b/kubernetes/apps/security/external-secrets/app/helmrelease.yaml index 11c47cc..6a141b9 100644 --- a/kubernetes/apps/security/external-secrets/app/helmrelease.yaml +++ b/kubernetes/apps/security/external-secrets/app/helmrelease.yaml @@ -10,7 +10,7 @@ spec: chart: spec: chart: external-secrets - version: 0.10.2 + version: 0.10.0 interval: 30m sourceRef: kind: HelmRepository diff --git a/kubernetes/apps/security/external-secrets/cluster-secrets/kustomization.yaml b/kubernetes/apps/security/external-secrets/cluster-secrets/kustomization.yaml deleted file mode 100644 index 1f608cc..0000000 --- a/kubernetes/apps/security/external-secrets/cluster-secrets/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./pgo-s3-creds.yaml diff --git a/kubernetes/apps/security/external-secrets/cluster-secrets/pgo-s3-creds.yaml b/kubernetes/apps/security/external-secrets/cluster-secrets/pgo-s3-creds.yaml deleted file mode 100644 index daba91e..0000000 --- a/kubernetes/apps/security/external-secrets/cluster-secrets/pgo-s3-creds.yaml +++ /dev/null @@ -1,41 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/clusterexternalsecret_v1beta1.json -apiVersion: external-secrets.io/v1beta1 -kind: ClusterExternalSecret -metadata: - name: pgo-s3-creds -spec: - externalSecretName: pgo-s3-creds - - namespaceSelector: - matchLabels: - pgo-enabled-hsn.dev: "true" - - refreshTime: "1m" - - externalSecretSpec: - secretStoreRef: - kind: ClusterSecretStore - name: onepassword-connect - - target: - name: pgo-s3-creds - creationPolicy: Owner - template: - engineVersion: v2 - data: - s3.conf: | - [global] - repo1-s3-key={{ .pgo_crunchy_postgres_access_key }} - repo1-s3-key-secret={{ .pgo_crunchy_postgres_secret_key }} - - dataFrom: - - extract: - key: pgo-s3-creds - rewrite: - - regexp: - source: "[-]" - target: "_" - - regexp: - source: "(.*)" - target: "pgo_$1" diff --git a/kubernetes/apps/security/external-secrets/ks.yaml b/kubernetes/apps/security/external-secrets/ks.yaml index 12583cb..f3cf7c8 100644 --- a/kubernetes/apps/security/external-secrets/ks.yaml +++ b/kubernetes/apps/security/external-secrets/ks.yaml @@ -11,7 +11,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true --- # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json @@ -26,25 +26,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: true dependsOn: - name: external-secrets ---- -# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: external-secrets-cluster-secrets - namespace: flux-system -spec: - interval: 10m - path: "./kubernetes/apps/security/external-secrets/cluster-secrets" - prune: true - sourceRef: - kind: GitRepository - name: homelab - wait: true - dependsOn: - - name: external-secrets - - name: external-secrets-stores diff --git a/kubernetes/apps/security/external-secrets/stores/onepassword/secret.sops.yaml b/kubernetes/apps/security/external-secrets/stores/onepassword/secret.sops.yaml index e3f99d7..b5f59d1 100644 --- a/kubernetes/apps/security/external-secrets/stores/onepassword/secret.sops.yaml +++ b/kubernetes/apps/security/external-secrets/stores/onepassword/secret.sops.yaml @@ -4,24 +4,24 @@ metadata: name: onepassword-connect-token namespace: security stringData: - token: ENC[AES256_GCM,data:QxB/aN8td7/dqGV1RCnTam7+Q9cKiZUBaj9D2hcpZxVDqA0MSPCelxTdKyerZUKNTd26vx1XGms2NEVaDsM9Vw115/JB8X7RVEFIIJHoy/9ikhFL3gUAEkC1fPBq75kDdbDqygBcxTvx5W6WMfSQcyRnEzyaVxLpxDMAYtLRq2EEoaWSMl5y2UGeLDexv/L7FVP5COIwUedJdxc5c6L9oHpU2tumFXigGFVlDpcYUMOOPirvx+R1RNQWS14eGEvKTzrCDicS4Strvgscb9n+sJrqHZaq9Ym0YYNTtrqODPsozR97whT+UQwprHoSJhOtuKglFsszOfRGQoz3pAbLGOX08cZWSLOPw+rxFcJeRTlnVvgG+zDP3XdjWvQ9eSRKe5tfA17lHjoZLWSgA39lIwhVB5wjKsHMyWdwBBnGi/rb2IPdo/hf12ww/dGZbU9fqML6vvZ/p4or37S8BJI/OVxqN+1zOdY5841hjswvj/Ors3Vuhnz6EGPXOFs8kOXtrOD5VXygRaUBeRph8agqIg/ulJGGO56Fojz6lsnixUafb5WeWYIV1GRCq3WP646ko2FLx0KvJsT4YxhWFW8bZrRpS3xnEWiXdKwjQgXnccuni7ywW/xU53rDUfWwvTQ1j/p3jJeiKwqZ7w9kZk6o0Bz3tTIHRPOjnyhcLXHnhWxAxjMOHBHrOaSSvjoCo4AiG3rBSfWwYP7pv0mTsWtJDF3s0R0hY+skYsUa5C1NcaLeUKS/fxxjnGS0XmAOrFZ3eJiw2iuFhJzTB6griFlyCFIvaUdnJZEP2eCXzP5irngfDkdG3retxeqGbAqQJ9oXUmR/YBnvrUBqiDWQPLWWZkni3w==,iv:5nlZDxvy5MB4+lDLvAl1TYThf6DS8I9i/skcDgAk7Gs=,tag:na0sMJLIKYggiALNtLMYzQ==,type:str] + token: ENC[AES256_GCM,data:8hwYIhWteAjI8uorCHT4BV4Jp5Xw2GIi44bEvHj77dzF/lJed9Uz+zPi0eWTkvklZGQm2ZT6p2sI4UP0j+PRrgpdTBmyi8c4Vj0CCPF74hBQyTdVnpYEYNdINgZBAYBAQb4sRWNLHtJ3CYwqNTUFM1I8E2UUtt484E833wLkeHJNnZpYOOgDTQmgSu2QkD2g9FeXjjZHLQ0RhHwafzxfgcf5gxkF0ImE+kZkRgbjBHjKE+yIc3bfpr4gH26tXUwniVB86+N87LSyfIxjXeQnm4bewnlwtJ1IEwQyufU9W6rpGy9581bqLMKHm9m/ABIwtTVpCuYSmT3HWJi2l4fGQUjTw+/pwGGAi5Dv80/0ZTjEKOEe5JLdlvzDTNBtyurlA/iQs6h8EcUIP1o9nQ5iRddfeATrFo9uvDLvExVAo3xpanGI5N4ht50XZ/bSxhbJPKjSMRuR+YhX5hzVfbkZPgbqnNDDQsDct7A/TtsjmFWUo8Yq0BFojyXntVC0OGZtSJRy28MdO79zcsfGfewNfiUC7Au92AkVIhG/QG3aZl2DKBIlmo/cVv5LYvT8hVFt0CBA8kBN2JsMkYk3WoJ5hxtORNiaPpZHYfi2YZ/c+R90UH6CogVgaHbAFbGk5ljnYS0y924Gq7lm8uCEo9EPlJdLZzU4GlVmlLpg7+KPH21I0Nk03tmF0cvsXb1RqV/+FkzLfpNzy1aJUfzfXdUtLM8TS2UXYNlEtprJc7gnwIy5MBVMGtBhuJ32UwCmw6FKaAqb1wmpN6PoSHs+kde6IcknlRq/zNgQTf4JmbiysBfRWNTWQkQca0ldVYFENjBYlXObPL2CkIVhoqVDP4LGr1cy2w==,iv:POTdDElcc73BdePxMH8Hh25FrLlRvxQRUJxNidKvOI8=,tag:zm9QUdRtbHsvB760nEUPRQ==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + - recipient: age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZHo5aWdxVndCUkdCSEc4 - dkFkeGQ5ZkY2Rk4wM0RuaGxvU2g3K1JGTEJNCnJpYm1DbXBQOTdGSjVITU8xaE5D - RGRoYjVHWVh5Rno4THIvMmlZWWJVWncKLS0tIEVQNmQ1TTA2V0VjdWw2SU9WbUNt - VkJYWGZnMEJOdlkweS82RjFQdGtHekkK1LCJ2Ww1Ar1fXcepNTldf/hiBVbYdGRf - NwCgEa18sMHVVx1XdhBT67bhQewIr6yYHk4jX8y22ScS9GTx9syD4g== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXcjhjK0VGeW5IcEtERUZ1 + c1Z3cDFZSk9DSStGQTZYOVJ4ZzNXZU53d3dNCndpZ3lXc1Jjb1RRUUI5Y3JjZzh0 + WGJvRHU5SStIOTBoVmEwN3BwdWpLRzgKLS0tIDJZNFJtUis2b0c3QnROUitKWi9R + Y1EvNC9UaGpvVmJIMHpTY1NiNWhHVUkKcK1eZc8u7nzSptujFovG2wk9L4RAEJrZ + Hridg1dfyzB07MHFSEJjJ7++sQXfb7ejWolF6CUkUfkoBRABBbNHfg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-04T15:57:16Z" - mac: ENC[AES256_GCM,data:ts36iBxIjPOZX0/ok9ReTpbVWYCheUcc4gi/euWVbju+b1DPighNCNCTC00ML+XvIz8UxkF6+xFl51pe+Ly8ckNb7PlMg7tsv3WmWAn6jRXSR2phrioD9pKGiIhUvi3mmESE9Vh86vz6Iqu0HjvE5IF5MCkVIL4WRbjWChBjeDs=,iv:9vLtxB3w8gg91o4wzvNuhd3v4ORtqvtT7n42ijVadSo=,tag:c7Julm3rUYMBrGymaXhVFA==,type:str] + lastmodified: "2024-07-14T17:20:14Z" + mac: ENC[AES256_GCM,data:ZW7BoxV719vb/tOS9sPTIh8WXT873Gj05A+jZbEA1KlMDR8uM2ntOM1snE4J9NrJedkXNZdsopuBj1+DXDUJWhxtq2WrCKCw00jseP6t//cOZiD+J+hdNdSY/mdCRWrkq6698Z81hU7mdeNXGGOMobEGy6lSqx4hvaL/PvTXWto=,iv:+OGR+hsJrH1h+snFsVSBnI6lAbxIUPJ8asTWxzq0sfQ=,tag:zgmKXoziT/YMnl1S72mvsA==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.8.1 diff --git a/kubernetes/apps/security/namespace.yaml b/kubernetes/apps/security/namespace.yaml index f27af20..2a072ae 100644 --- a/kubernetes/apps/security/namespace.yaml +++ b/kubernetes/apps/security/namespace.yaml @@ -6,4 +6,3 @@ metadata: labels: kustomize.toolkit.fluxcd.io/prune: disabled volsync.backube/privileged-movers: "true" - pgo-enabled-hsn.dev: "true" diff --git a/kubernetes/apps/volsync-system/snapshot-controller/ks.yaml b/kubernetes/apps/volsync-system/snapshot-controller/ks.yaml index c4a0ce3..9144d97 100644 --- a/kubernetes/apps/volsync-system/snapshot-controller/ks.yaml +++ b/kubernetes/apps/volsync-system/snapshot-controller/ks.yaml @@ -14,7 +14,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire wait: false interval: 30m retryInterval: 1m diff --git a/kubernetes/apps/volsync-system/volsync/ks.yaml b/kubernetes/apps/volsync-system/volsync/ks.yaml index 9ad9450..7079dec 100644 --- a/kubernetes/apps/volsync-system/volsync/ks.yaml +++ b/kubernetes/apps/volsync-system/volsync/ks.yaml @@ -15,7 +15,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire dependsOn: - name: snapshot-controller wait: false diff --git a/kubernetes/bootstrap/flux/age-key.sops.yaml b/kubernetes/bootstrap/flux/age-key.sops.yaml index 3434982..80a2d5e 100644 --- a/kubernetes/bootstrap/flux/age-key.sops.yaml +++ b/kubernetes/bootstrap/flux/age-key.sops.yaml @@ -5,24 +5,24 @@ metadata: name: sops-age namespace: flux-system stringData: - age.agekey: ENC[AES256_GCM,data:f+9hVYtS9xNgh3KSpC7HtIzSWnFEEtKNijhT4NWi9Yx3dlRuX50vhc8exLYcjcIbytCwMtTCI4xAjUk4TkxlGaj5DzhU/rdvE+c=,iv:uzhwlqMG1F2rb4XM00EXCI8mpCcKMTn1a2KPH/NGYqo=,tag:Ao+cLYINlL1AfJGFR9EG/A==,type:str] + age.agekey: ENC[AES256_GCM,data:8L4sA+w2MgvnU0NtOV9BYknpSldy0a44pWZMBx2ApbuEpR3wdrS+BSERkBdsMplpbGP3brnsroT+g+O61288In4KIi7KN7NGM8A=,iv:h0FObEI4kdVtZmmsDGPv6ObWYt5A234ko5yxuDKrC0E=,tag:9n3M8bS+UXxK84xVyg/NPA==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + - recipient: age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5cVRSZUZjR1Y2Q0U2RUJC - M05wdVdhWU1oTjZBeTliNDR1V29KN3hKMFN3ClJJQkx2RTRSL2V4ZjR2QmJQUGph - ZUo3UlpPaVc4YjdJbGRkaVhTQmpHVGsKLS0tIFlYMHY2a1FjZ2xobUpKNnRwSDhV - eE1VUmwxNjU0SVAvaWF1dVNKMlV6ZzAKrxZ1g+mkSBNECmd+sf5Z4L7xVDaFw1g/ - hUoFCpjo7fiGS0ru7lhkLzBAwRflWDkpjn75W/18ULaF69bsF9swPQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWDdNdVBzZHpaMUZ3K25G + NlJob25tL0hQRy9sUFhycUt2Y3hjNG5mSlZRCjdvL3dJMHhCdU5VWXFGSXpibzhr + Y2IrdFdiMEo2V2NtR2k3NmxJUVBZQ0UKLS0tIEFNYlJ1S1hLeWUrYytXUVR1aHpI + T2tRMEtZMTN2N0Q3QzFjSEJPSVEzUEkKDi1Qs4BoV4p5W4/V0ZnzHKq9LC7Facow + 1RBbZInKHgeEZRLxvpFNSNnlwXIm2kA7U+uVojSn9ogoRitWvKWXYA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-01-11T22:06:47Z" - mac: ENC[AES256_GCM,data:Sg8eZvpifFdLezfcQ8FFwCUzQpCzx+iOrje2E2fVM4AcIcVR/i3zrdCOzJ252W7Fe6mreVpZA0rKKePCEH1A6ZSvjnPKpMvAdhei7BMyIkDs/8VDJMjZOJOWmtLNIwCYIbkwA+cOnFfufnRdSp7/NsqVo+8STOcr4qWAyfDenVQ=,iv:FHFTiD1NtBHslxuTwdmxw3Xb31F9xK6hhKdw0szXfkk=,tag:MbNsGc1ZW1biUOEDFRTSMQ==,type:str] + lastmodified: "2024-07-14T17:22:04Z" + mac: ENC[AES256_GCM,data:kJvNLW5Bi1fcEPQt0jibZ/T82PHdTDU3UatLDjM2uIq7EFWriG25w/WFlCCOeJHKQl7lbUccp71najmsGxUC6Jp0vVpbwfzVSqS9M04eKQNyTTjId9/3jxw0Z3OmIm8WaXf3gN/5DD2vDESMRJqr7ngNyEtxK1I1vwQVTKYSrJY=,iv:7OEaCmL/DY9d+GA/nM7a+Hl4zNrmTdtQSVNstOnOUt8=,tag:LOYiR2ZTB9tUn/mO5wu8MA==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.8.1 diff --git a/kubernetes/bootstrap/flux/git-deploy-key.sops.yaml b/kubernetes/bootstrap/flux/git-deploy-key.sops.yaml deleted file mode 100644 index 779a162..0000000 --- a/kubernetes/bootstrap/flux/git-deploy-key.sops.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: git-deploy-key - namespace: flux-system -stringData: - #ENC[AES256_GCM,data:+GbB2yDDUQ4804/B/XphECCkAErDIe+JwXkhuXWDJw==,iv:EFYG8fEaGJt6ZVftO9px4cykuopjQcqNRTLPcT0vK+M=,tag:mPuA+9y+AZDA39/k1a4jmw==,type:comment] - identity: ENC[AES256_GCM,data:v17NqkLtELWHwB2Q5z3rqIxmsrGs4MOOgJr6+ZAjQ4wjBRZBkhDGuOKErkjAMboKyIBK0WpZkT55s3PGJpf9hUnGC/ecR70zAu72vUzPLkAfRtuufE+3O7JxaCuaOUHDeQhwm734vRnMVGLxfyeoDGuhA7XxgwCNAKuDb2JsJ/aYSrmTaO2BIPnV/WnC7iEAWAU92paTnlKJbs1yt0cBec+l4jqi4z+wn0MBYoxkwbFSwhU/G8ls/pgZCebhDyr0bBsFoSImPCDpAMo3uDe9Qc8B3eDMvsaS8Z3wxLbi4TuM1tBuFLteBb6xb2WyYZAOEc4BIwmfdu4SVC51puYT2oWdxZgkQ1vlohSrRqeGmIf7AYkEiZpBrydGzftg3B8KjwurV16I8P+/jjwT2mDpVUmM4Kn/Ragb5zbRST3Q/upxsoaFwcBDNJrPM4arizWehG0k2p53MxddTIXuq2pvf8tqU5ZirvE8k4mCgz51JNoywjUai9fgdvEMRn9ovkO6Fd753ITDuniHdt3ZcKdCfHE5bC60bUKYTQmS,iv:NDF02vwyHT92i/twKnjrGihcEiz7FftXbXg9oIItvXE=,tag:ci/aPzQhaeeyPvolPNmFvA==,type:str] - #ENC[AES256_GCM,data:x6ZbaxSmg8cybQLBN60EMMz3b7wcB6zAgcRcPQVr/Y7boCjbVlfdNumSu1/+f2OPJLZLpK+URTqAIhtwDlEwPRabe3MMpQfE3ifKobKPmvws4pvbdPeHG1UEPpGeqh3VJLN8,iv:65mO126WzjKiEJYhjpZnaWftQ2YMnRhak8E2J7X2CfE=,tag:Zof3hhjPzrmOPNWSWkGaEg==,type:comment] - known_hosts: ENC[AES256_GCM,data:l/ARsf+jcjqEm9Jv9AgtrNqyKn6tonkNTjkUrGtol0a3leJoCnO8SXrJrwlOWvaD5IjZIqPO0tJlKfUYRwP4DGW/HRZ6H9leWWKR9eLu8X6ANlm7jr/MRn5D4Fmx,iv:uY0CTgfuVMzpevI2FVhWPU1MK4yWlD2MbJ+qBDW9hO0=,tag:aXXcO+Rx/kWgRgDgDr+4fQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTeS83SmdkZ2daM05UVkpO - RG1jM1lNVDREUGdQZmFuREdOaVIzQkd6MzN3CmdaQnRDbUJwTG9tZ2treFJ2RFFU - NkVWUlVVNlVJd2xSRkU0bUUzZDY0ZGMKLS0tIG8wRzZCZ29Pc0tNb3dVcnVyYWl6 - MmVnNzdNWU83MGl6TzFwNFYydHQ0WFkKMy8Ew8clnoYcNR9qicauSBlLDp8N8qvg - jAMftEoS6bUhSozWW4zCpcRK6hCTi8X+IsHe0niTotGRUZgPgdXUWg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-05-14T13:32:24Z" - mac: ENC[AES256_GCM,data:/QVk4SvDFbN2D3zqt+dlQBzPvnq1R+bbzLC9o5b28a9F3z2wtz8lwGh8OwSLJBcllPyqJNaouo5xYHESol/64Hw3D5MTHVbFDbP19t2IUGAzUUAgVjB31ytYXGGZeNcDCCUmIK669zwXSHuNsupXIvAcR5t3/LdvCk4HycnZumY=,iv:LdzNdMAQvq6bX/vT/IkFe7U7cMKpYdyCfNMdTJs4Qdw=,tag:ehlCqNXROdk8wKrP9kB0Rw==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.8.1 diff --git a/kubernetes/bootstrap/helmfile.yaml b/kubernetes/bootstrap/helmfile.yaml index b3778de..59dbb6b 100644 --- a/kubernetes/bootstrap/helmfile.yaml +++ b/kubernetes/bootstrap/helmfile.yaml @@ -1,5 +1,5 @@ --- -# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/helmfile.json +# yaml-language-server: $schema=https://json.schemastore.org/helmfile helmDefaults: wait: true waitForJobs: true @@ -10,6 +10,8 @@ helmDefaults: repositories: - name: cilium url: https://helm.cilium.io + - name: coredns + url: https://coredns.github.io/helm - name: postfinance url: https://postfinance.github.io/kubelet-csr-approver @@ -22,17 +24,37 @@ releases: namespace: kube-system chart: cilium/cilium version: 1.16.1 - values: ["../apps/kube-system/cilium/app/resources/values.yml"] - wait: true + values: + - ../apps/kube-system/cilium/app/helm-values.yml + needs: + - observability/prometheus-operator-crds + - name: coredns + namespace: kube-system + chart: coredns/coredns + version: 1.32.0 + values: + - ../apps/kube-system/coredns/app/helm-values.yml + needs: + - observability/prometheus-operator-crds + - kube-system/cilium - name: kubelet-csr-approver namespace: kube-system chart: postfinance/kubelet-csr-approver version: 1.2.2 - values: ["../apps/kube-system/kubelet-csr-approver/app/helm-values.yaml"] - needs: ["cilium"] - # - name: spegel - # namespace: kube-system - # chart: oci://ghcr.io/spegel-org/helm-charts/spegel - # version: v0.0.23 - # values: ["../apps/kube-system/spegel/app/resources/values.yml"] - # wait: true + values: + - ../apps/kube-system/kubelet-csr-approver/app/helm-values.yml + needs: + - observability/prometheus-operator-crds + - kube-system/cilium + - kube-system/coredns + - name: spegel + namespace: kube-system + chart: oci://ghcr.io/spegel-org/helm-charts/spegel + version: v0.0.23 + values: + - ../apps/kube-system/spegel/app/helm-values.yml + needs: + - observability/prometheus-operator-crds + - kube-system/cilium + - kube-system/coredns + - kube-system/kubelet-csr-approver diff --git a/kubernetes/bootstrap/readme.md b/kubernetes/bootstrap/readme.md index 992f448..3d8b73f 100644 --- a/kubernetes/bootstrap/readme.md +++ b/kubernetes/bootstrap/readme.md @@ -18,7 +18,7 @@ talosctl bootstrap --nodes=10.1.1.61 ### Install Cilium & Spegel ```sh -helmfile apply -f kubernetes/bootstrap/helmfile.yaml +helmfile apply -f kubernetes/bootstrap/talos/apps/helmfile.yaml ``` ## Flux Prep diff --git a/kubernetes/bootstrap/talos/clusterconfig/.gitignore b/kubernetes/bootstrap/talos/clusterconfig/.gitignore index 9659ab1..5eca777 100644 --- a/kubernetes/bootstrap/talos/clusterconfig/.gitignore +++ b/kubernetes/bootstrap/talos/clusterconfig/.gitignore @@ -1,2 +1,8 @@ +theshire-bilbo.yaml +theshire-frodo.yaml +theshire-sam.yaml +theshire-pippin.yaml +theshire-merry.yaml +theshire-rosie.yaml talosconfig -homelab-shadowfax.yaml +theshire-gandalf-01.yaml diff --git a/kubernetes/bootstrap/talos/talconfig.yaml b/kubernetes/bootstrap/talos/talconfig.yaml index 451226a..a73d8e4 100644 --- a/kubernetes/bootstrap/talos/talconfig.yaml +++ b/kubernetes/bootstrap/talos/talconfig.yaml @@ -1,91 +1,139 @@ --- -# yaml-language-server: $schema=https://ks.hsn.dev/talhelper-schema.json -clusterName: homelab +# yaml-language-server: $schema=https://ks.hsn.dev/talconfig.json +clusterName: theshire -talosVersion: v1.8.0-alpha.1 +talosVersion: v1.7.6 kubernetesVersion: 1.30.2 -endpoint: "https://${clusterEndpointIP}:6443" +endpoint: "https://10.1.1.57:6444" -additionalApiServerCertSans: &san - - ${clusterEndpointIP} - - "127.0.0.1" # KubePrism +additionalApiServerCertSans: + - 10.1.1.57 -additionalMachineCertSans: *san +additionalMachineCertSans: + - 10.1.1.57 nodes: - - hostname: shadowfax + - hostname: bilbo disableSearchDomain: true - ipAddress: 10.1.1.61 + ipAddress: 10.1.1.62 controlPlane: true installDiskSelector: - busPath: /pci0000:20/0000:20:01.2/0000:2c:00.0/nvme/nvme4/nvme4n1 - machineDisks: - - device: /dev/disk/by-id/nvme-SOLIDIGM_SSDPFKNU020TZ_PHEH3142017H2P0C - partitions: - - mountpoint: /var/mnt/nvme1 + busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/ networkInterfaces: - - interface: bond0 - dhcp: false - addresses: - - 10.1.1.61 - bond: - mode: active-backup - lacpRate: fast - miimon: 100 - deviceSelectors: - - hardwareAddr: 04:42:1a:ef:35:74 - driver: ixgbe - - hardwareAddr: 04:42:1a:ef:35:75 - driver: ixgbe - vlans: - - &vlan-iot - vlanId: 30 - mtu: 1500 - dhcp: true - dhcpOptions: - routeMetric: 4096 - kernelModules: - - name: nvidia - - name: nvidia_uvm - - name: nvidia_drm - - name: nvidia_modeset - schematic: - customization: - systemExtensions: - officialExtensions: - - siderolabs/amd-ucode - - siderolabs/nonfree-kmod-nvidia - - siderolabs/nvidia-container-toolkit - # Need talos 1.8 for nvidia and zfs to coexist - # https://github.com/siderolabs/extensions/issues/380 - - siderolabs/zfs - + - interface: eno1 + dhcp: true patches: - |- machine: sysctls: - net.core.bpf_jit_harden: 1 vm.nr_hugepages: "1024" - - &kubelet_extra_mounts |- - machine: - kubelet: - extraMounts: - - destination: /var/mnt/nvme1 - type: bind - source: /var/mnt/nvme1 - options: - - rbind - - rshared - - rw - # disables new feature that forwards kube-dns to host-dns 10.96.0.10 --> 10.96.0.9 + + - hostname: frodo + disableSearchDomain: true + ipAddress: 10.1.1.63 + controlPlane: true + installDiskSelector: + busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/ + networkInterfaces: + - interface: eno1 + dhcp: true + patches: - |- machine: - features: - hostDNS: - enabled: true - forwardKubeDNSToHost: false + sysctls: + vm.nr_hugepages: "1024" + - hostname: sam + disableSearchDomain: true + ipAddress: 10.1.1.64 + controlPlane: true + installDiskSelector: + busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/ + networkInterfaces: + - interface: eno1 + dhcp: true + patches: + - |- + machine: + sysctls: + vm.nr_hugepages: "1024" + + - hostname: pippin + disableSearchDomain: true + ipAddress: 10.1.1.65 + controlPlane: false + installDiskSelector: + busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/ + networkInterfaces: + - interface: eno1 + dhcp: true + patches: + - |- + machine: + sysctls: + vm.nr_hugepages: "1024" + + - hostname: merry + disableSearchDomain: true + ipAddress: 10.1.1.66 + controlPlane: false + installDiskSelector: + busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/ + networkInterfaces: + - interface: eno1 + dhcp: true + patches: + - |- + machine: + sysctls: + vm.nr_hugepages: "1024" + + - hostname: rosie + disableSearchDomain: true + ipAddress: 10.1.1.67 + controlPlane: false + installDiskSelector: + busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/ + networkInterfaces: + - interface: eno1 + dhcp: true + patches: + - |- + machine: + sysctls: + vm.nr_hugepages: "1024" + - hostname: gandalf-01 + disableSearchDomain: true + ipAddress: 10.1.1.68 + controlPlane: false + installDiskSelector: + busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host6/target6:0:0/6:0:0:1/ + networkInterfaces: + - interface: enp5s0 + dhcp: true + patches: + - |- + machine: + sysctls: + vm.nr_hugepages: "1024" +worker: + schematic: + customization: + extraKernelArgs: + - net.ifnames=1 + systemExtensions: + officialExtensions: + - siderolabs/intel-ucode + - siderolabs/i915-ucode controlPlane: + schematic: + customization: + extraKernelArgs: + - net.ifnames=1 + systemExtensions: + officialExtensions: + - siderolabs/intel-ucode + - siderolabs/i915-ucode patches: # Disable search domain everywhere - |- @@ -116,6 +164,21 @@ controlPlane: enabled: true port: 7445 + # hostDNS configuration + - |- + machine: + features: + hostDNS: + enabled: true + resolveMemberNames: true + forwardKubeDNSToHost: false + + # coreDNS configuration + - |- + cluster: + coreDNS: + disabled: true + # Cluster configuration - |- cluster: @@ -142,6 +205,22 @@ controlPlane: advertisedSubnets: - 10.1.1.0/24 + # Configure containerd + - |- + machine: + files: + - op: create + path: /etc/cri/conf.d/20-customization.part + content: | + [plugins] + [plugins."io.containerd.grpc.v1.cri"] + enable_unprivileged_ports = true + enable_unprivileged_icmp = true + [plugins."io.containerd.grpc.v1.cri".containerd] + discard_unpacked_layers = false + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] + discard_unpacked_layers = false + # Disable default API server admission plugins. - |- - op: remove @@ -170,21 +249,6 @@ controlPlane: nodeIP: validSubnets: - 10.1.1.0/24 - extraMounts: - - destination: /var/openebs/keys - type: bind - source: /var/openebs/keys - options: - - bind - - rshared - - rw - - destination: /var/openebs/local - type: bind - source: /var/openebs/local - options: - - bind - - rshared - - rw # Custom sysctls - |- @@ -197,7 +261,7 @@ controlPlane: net.core.wmem_max: "2500000" # Configure nfs mount options - - | + - |- machine: files: - op: overwrite diff --git a/kubernetes/bootstrap/talos/talenv.sops.yaml b/kubernetes/bootstrap/talos/talenv.sops.yaml index e531a59..74ec21e 100644 --- a/kubernetes/bootstrap/talos/talenv.sops.yaml +++ b/kubernetes/bootstrap/talos/talenv.sops.yaml @@ -1,22 +1,21 @@ -CLUSTER: ENC[AES256_GCM,data:2U1tPNOF/w==,iv:BE6ZEuh9SJirZ48ICFuf7RqnJhfOOu6PjEXwLDPG6vU=,tag:zk5eyFqcOmui6d70LQ7WtA==,type:str] -clusterEndpointIP: ENC[AES256_GCM,data:1gDw0FqQQZ9/,iv:OQ64In7KPn0nqWran1U2/oEHkHSyQsZNM8/beAN1C1M=,tag:diqiZHPcGZ7DVgZGFKJyJw==,type:str] +CLUSTER: ENC[AES256_GCM,data:umawZ1n1Sdc=,iv:NUC2lO+edizITkQYC2YtVYQkesPWDj7drFyyaHoyiKI=,tag:bmWfCArxFM9BCdZZgoFzMA==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + - recipient: age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzanFETE1WblA4cE1xTHVi - R2p3UkZPMmNDRmdjRTRxeWFWUzUxdkRlRkdnCldJTUZRNndOQkp4TlNtUDNjdVg5 - ZVY4UkJKNCtjTlpKaFkxMXI1b2RiNDgKLS0tIG5Hc2tJMCtWUm85emNwS2xwS0hn - WUlNeVV1T2YxbjJCRU9ubVJheHNBTnMKzgZCLTz1Qo/91EFcHXxdKGosdRKKN/tB - VsfaNH/b5S2N8FN1wQ03Dn2nqwCqwiPAoNo8La/7ZHjzvNiXTCOFmQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzZm9HeXI2dVN3cERya0lo + dnc0bXAxMEtITkxvM1Rka25vM3NiLzdaVmxNCkFFNW9CbnUxV0dhR2h0REVzbVBr + aGJhMlROWVV6aUFDWmU3MmtTejhLUjAKLS0tIHMvWmNkNVQ0OVJIdzV3Zkw1U1Nv + ekxtU1hrYmJuUkN6aVFnYkdDZ3ZtWk0K86+0Wqzsp9x3I/ZYvq11xMaHS0CR9+yD + Bwp1XZnn4taDz1H93+erJ+dgnjX/STg5KvGqPJQSi7COEZ7EJEJcyA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-08-08T13:48:53Z" - mac: ENC[AES256_GCM,data:SA9jJSCbgApT4qJfFNU/RVHhOX7ZdipQ6OmvBa4YqKEriUPD00ddp0musyQobdM3jrTK6P231FzwxYuAOQ+Y+xgWf+ylLyy/zcsVvdJbIzNPTsKwtC5J5zfhyvQK8fnRNP/3sP16X+jJ41iWF3yrPQ7nG7fGidsUPmpGDnGXKZg=,iv:dpHPBXm0OBeDGxbyMAu0qufoCahJb6u7d5KuHoP2d58=,tag:Mrnb8kGacrRvac5HF/BSvg==,type:str] + lastmodified: "2024-08-18T03:36:22Z" + mac: ENC[AES256_GCM,data:fiMzhJfGfmQaJgfDh5+jagPPc51vAe9cfpi4oCIouNDjWrCCjn5ZvaXgIqc19i9ZZhfRINaVag5fZXAm/9D2IIdzyB1jmrA3noCJiJ8ex4noHmmFTrTWdM41/Gth7LCcnrFdhnVKhr50/Zv8hMhFIYwW/iMZx0s7OW2QhHuM+y4=,iv:yofGL0biVVt4kXEA2ZY6O03Rh/CLxd++kVIMFDufjpA=,tag:9Jn8u2D+72dU6XvvkzjVIw==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/kubernetes/bootstrap/talos/talsecret.sops.yaml b/kubernetes/bootstrap/talos/talsecret.sops.yaml index b95bdc1..c3b7f15 100644 --- a/kubernetes/bootstrap/talos/talsecret.sops.yaml +++ b/kubernetes/bootstrap/talos/talsecret.sops.yaml @@ -1,43 +1,43 @@ cluster: - id: ENC[AES256_GCM,data:UHPqS+IVqzbdmn1pE5bQhXOhGx6gR4/2oVB8Lk0a0ymWNExcDcF7g3yk5zQ=,iv:1jK+boXIDiQP+ly0CDdrIs21rhB8B/ew48/wGYfWlFY=,tag:GxnhoCpYRliDSfojWrPw2Q==,type:str] - secret: ENC[AES256_GCM,data:u8RwNAXrXVszAwVQL4N6o4nKWzjYeZwWkVS9mWFerj8lNHkXnONLb0O0irA=,iv:eKk1GRYbyQ1bzAgEBvbflhhI5WbUbcmtrj+JeEnXCTo=,tag:IgfY/AxtVYBCRkIE0To04A==,type:str] + id: ENC[AES256_GCM,data:V2YtYIv8A9WWvTuoF2/CR1NO8+1q2Equ8ZOUaucPfF6U9qhvUP+uv4S4jtA=,iv:EEKxybmjxwgQUQQmMjJjILqXF9dQIEd12IVNRPFZrWQ=,tag:Ptbux1JgNVoK7Pz1nrKKCw==,type:str] + secret: ENC[AES256_GCM,data:oNHFs9rSfa4eE1sWH5Ic+LhJy/LhlZKsrFUUAKLD01rc4eMIBxQJ2nr57HQ=,iv:/525So7ZKc5wnLcipQTZRQfe9sR94geO/g31vPZWHdU=,tag:he6ZefVTkKtcAfCZVKK/kw==,type:str] secrets: - bootstraptoken: ENC[AES256_GCM,data:NMKM2mMaufiLmTPVszoDQqKBvO4d7v4=,iv:KZCuFzUorMTa1EzxWuXtrcGFaEkg2farNEEKWXbP+n8=,tag:eEtHLLyx9X9IjPk8O+yPDw==,type:str] - secretboxencryptionsecret: ENC[AES256_GCM,data:HPj0tqieFtIiGJlR0pxh9jCAZmcOA/5w1qLqQp+IVmByBzBsCBbjhhaUSzU=,iv:LVjdw4wmbdibdNzHDx/BXgHuUkFxDsaJbb+cG8xkNiA=,tag:ioRDsL49FaGbMDsYn6UWug==,type:str] + bootstraptoken: ENC[AES256_GCM,data:eWRUQ6SjtVuOq9LWh5MrSno7vde4utY=,iv:n/5EtJsGSLBlVIApWyX//xt+XVEF982JxHq3yEX6OS4=,tag:OUkRcbJ4dnyWLbnMq/bnMw==,type:str] + secretboxencryptionsecret: ENC[AES256_GCM,data:NjluwnnjBMy59BIkwPLgxotehJ0IQcRf/GJZcTpZ92GHHUyFjB3Wf44oyi4=,iv:OLeP/Vb1g/csSMo+49KGYCIO+7+Ipe/KOMWWOnMc9QI=,tag:qV6xtBCd3xX4TcHj4qgsZQ==,type:str] trustdinfo: - token: ENC[AES256_GCM,data:A4HR27GCWE0KFgsWAx3ajY31sIv/RKY=,iv:ujNjMMxPgfGiP5NxfLfGSS2z6bUfZ/UMKR+lTFfsu3g=,tag:/ZR+1ZzWfkiyV/uxph/zgg==,type:str] + token: ENC[AES256_GCM,data:Ip2PW71VTN/dkxC+/RQicvUlGISgMAI=,iv:fZZUn2Ftd5FzALuWteGKOyIpGIUEG6FdW1zuqAj8jd8=,tag:zdpbA6xxSDrqG727WZY6hg==,type:str] certs: etcd: - crt: ENC[AES256_GCM,data:LbDNA8Rnh2uim4pZ1tGm/qTJWsiYNvQY0p230lXm3BtbKOn4SMf+J/ro9eKIdkJPT4xckkndJ44ufWgwNhoDIGTDb0E1O3GmrHE7N2rKs8st3Co4iM9e8nuWghHclKGF7r2tUk4tuu0mQhC7CEIAMCYJ7HPqN8QGfW2TwzQyVwAsrh3yIUXWNnUdl/qkU0sjELRpA6Nu4xlJ8iEF0DR2jvlJtyUNXQ0SxZTZiQ12viICgvEaZzr7TRT1JpeKEGa5QSpkkXc0cqADtxEcf94TgPKdj5pS/Q8rePKNOiWpRqXv7PXMZZJcX1LTYEA5xMZgLTdIYQC6+jC/EcVOcgzHekgbIdbdnKFEHTFA2XCHur+BJR2TG+qXaziWK8BffKL4QXWc5Bwqqjs1OGCSLLiQZ25riM7ny/StUVF5HsvUFu8Z4bJoOZzqeBTrstzpoaVI79NuHm1zTqTxy0CqsAAn0w6ZE0rMn3v6Iw/ilyjQ/OUgHsKlnVrJGFMX8n6beAAHOai715KnpPfB1ZC0TRCkFY9w0l09T8DQjnnWAEsPpJkvfwD8pinGMZYCWGzUwVgDUqXt1UZh/9Clkc8tQJZf+g5v2nJbdY1xR0Kd5hJMzICaIXd0UrjpAKaECnZzKsO07FdqRlUV5iwAzOZ16RBRIa0ANIMd3LpccCe/edc/FK6jYXyqu8gFdaRPH+ceXFFQRItL6Vr+/NCtJzmYitN1RucubikTwHSQwe7ENK/BnnlNr2Ss6+EmeQ70nFModmJMRjD7GHVdf0HThI6juDQmV/LxXjo5ctcvpSK0FRVAG+qXiPYdqoWeiVeaOT9qxaBxwXRJRF8NnXYm1tznZMWdDQlm0iYS5FAHnWuO6Pbw1W7ocJBeqUAtGQ1MdYEry+yY6uff+7N2CJR/HiUIIskFPJ37j9iu5M0I2GmKOKNC3fWTYgESxu4VKa9zZv3JZSiGvPMNXJdFAOUuaEw7X5v7gqxoiNOK++m85ClkAyF5Dq8MFaYRpziDf/ZwLf4HdqZMih7x5A==,iv:X6cLCa7hfvT/BweU/ayRLUgyld2EMwCh/2NDqOIS+lo=,tag:97eVcBdCwQikwomD5WTQ2A==,type:str] - key: ENC[AES256_GCM,data:wdioeg95TLAG6gI3UdbPVtsuoRtLOTgR9PIDL+CSsWqXc4lsvSLP5aCIy1xRS5llukLRVup+UPE4P4JAUktfeZ+B1CRQgYX0kCbjyzXNRe7uT6YXQmrlP+YiSokHF2DFeFq8Kk75Ga56EphNy9wRTbKTSFXZI2/Ms/fTwistaOUjw3J+pweSHZehJY5x712RnYutYkR/b1qbMOt/lsKHcpZY8kXCZ9fyC4YG89eq6JdQBxmY10XFRDrQ7JY4gO9UpQj4rMFK5QARD1l7ugc8rn+G8RRdprufx+pJG4VBXRwb/I+Cs8jn7e6ycy9mWx/WJOMkr0C8nU2pc9l36fAD/BV+QG69XWfaiQngdAl3j5t9Dc0Qd1i87XhiIvdKRkHQh2fUR5xHLDJTDb62JcwvBg==,iv:J1l2/Dbul3xXE/oheb7Nno2Uq9XeioNd/Qm9GWRsRWA=,tag:WsdFmB4Qjp4AuweYzfJMAA==,type:str] + crt: ENC[AES256_GCM,data:0t4MrS/OKZKaGiMXGxXA6v876hliU5NtY1GSXBfsiZg7UR2nxu1JbxgKijga7zOrMrX8MgbG20ybEtIFO4aSPR9PJTKzE6YgjLyjcP4bRdxmDagcPfZpXU0Ps73yA8A5HnpmfJuLoUzLBGc4GDHPA4xB2633/2bfz5sEiJQWuEIx2jTrkiYHZ1f68ZRtEjPjUVP7T/4OL7+mUe2olIhOcHNwDNcBiIsYZd0xu4F3pWyCQAmTug1TzyIgZrbaM1ohp/z0S0PXXhOv6BWPHuoA0IMfijVlffqVi1fmTF3SUU/4zp8k+DXlUIe6fGooMj2o4uLGjyFNq7b+kFe6pniJUFpBLv+iV6tlXAzUz6krLSHTAp+dtUeFRfvl2fo16157iyuCJ+1UNPzgRdHCd+T1GRCyW1EA5eEhF+MZwmvPHz+hrt9Lsn1WTCkxWQJ2Lt43kpQ0tNoYAXo/K0r1+Uqi/FQqIer4wwzElQWgsnnJhr4Id/cUmxb2CmPNt1+3XbCIJl89sEOYgIIaIGvA7i3bDLEMxDYty+ahRgzED7WNxj9Yxy4MxNbAFL+4WacXwfr1zx9QrzgKYof+2atYUlVY5dCZLwBTE1DNsh3m+OYPS4PDtnG6wNBkR56sOPG/Y+uik/iWcursPGMhdsdZJ/tSVmXChqaY+CXsC4tximxwZ8yraWBibEcmQ8vSBlkiTBtMTqujUsJKqkF0ADDKUiMtipTHD2l9pVDkjPtcwZiAamkGWPnSIKTZCFXJ9gUSwORzvkHdGkSrALfr05H+QuyOq5VIDRU4Qbb8TE34Bjs/QD0mybe0E+WrE+G1kB16Xi2a6HQVyMg+RTsoy+bOsE02B1Qh/qoki9ZZ50P/WnWRuGqfS1ElQDrMMG+7JDbPFIqKM7POMwl+RdE0HbY3F9YbxsX+WdgOzBH69fvk09dLzQ7bKyKJOtTlyKwXBilj+cXFmMVWODHw1DZ6Hyc2Il4tJeksIRuwqSBoSGTthmCPUZOzjmp48JCSlLbMku+N8cg7fJclmg==,iv:lERKTgwy/JwPPr3lpIi+XGCzAIyJm7vp56h3YAznrvg=,tag:rNwN25vdVwtN3gwJpOwe1w==,type:str] + key: ENC[AES256_GCM,data:eOpuui6FWL+DXaWG+tu2XohYdLz/DvaZVffvu6McFwlnmAB/vnRYdnkko/4OdOhzFg63JdnGeNuPz5k4R+pIGo3xwdXhOEjs+niCrCWKjs4xbvw3rd5hhqEZEMB0cNzA0AdnysDZLcyS1J4FrORVKO5cfbnmKUPnO9RP3Wcul7dmU8p1+z7i4huViPrapr6yrp6mima49G8CHS7EtvhsxRTcVr19RzNAY5z3284SyO3oxao245aOqhINwGhfxLQethrrtII/A8wlOHp1tbd94CNo2ulfT6tbI9/8YGZIwvudrqWUTm5pHJp/ujX51yaD6UcxLcdlqSbEavYJLzTsEP9VjCosD9oLmMmiM5AOYUJkLn7sQNyF6sunYqA6GHgTTEmwuaRo0F9flfCXYHztfg==,iv:1jy+OyiN/OkhLj9B/sLnIqpgehDPHVp6yNvFSoRgNwU=,tag:3femQl3Sd1N3UnGCw7tWFw==,type:str] k8s: - crt: ENC[AES256_GCM,data:LFZKmfsXZ8dLvE/LnNDeUT56RhzdYkFEKdyneNuvnpO2itqLzfkkAxX6f+ul+q/jar4QfGCs2IbQeJBhiEbNwE7ElIjxkyuCUlwvW/6HqT5WZxeIEJDfHpEBxJJQ+WPBaV2ekk6APVCgBY0FaC9QqMre+JJH5C+aC3y/iQGe9TG9u3xjN8Dn7P8CF0OVCFnmonLQhMdlGl7Kwk/qRdQuvXL5EN1dH54JJ3B0wq27jKxB55XFij75Fvu/d4rJM6AEvcsWS8mFD/BqAocTpB3WqSbX7ZUNrcmZLuhJLCZ0vX3nnFqu3gc28mu9TTxlVAyDtSA6ph+pTanQMmKbkHFVoRivQtvvs7fGG/s4xQ/8CxSxMg6Ce3On0UUjh0mzu7lWbrcXo48irhvm67z0Surcgf4BAMd6teHFpN7MPh3CHRh+WA5vwYJyq6ENcGauOsbw7NgDDUvyrToxFsz3uuwUyc5G64p9m7w4F3cJc4ujMmHhhxXDcy5qelwXVtjXnBVO+GQv3ldIL9ByFqFP33gY0gEQc0ZG/DYKEf87fBMik4k6whqkU8ATwhRuyMcDzt8L8NYRdtyep2oNX9Loequ/d7P0eF/DXK35+oFswyLY/sQt0dmT5UtZe7p9/LgS62mhmMKGqlOfsiJfuVfcyjLPjFJtL2BrsbjrSE+V/qgbWqCQ6OYiNLyYbsVQSKxRicxOGGCOEWO5DLYaT5psLqihU7d5rJ4pux0VlxBAJOs1YyQDgvUjUlakHJmTODRWQBsGrr69OVjLBlMFQyEz7RJAm+36il9JMallxOYyHxnp9VuiBzzYfgdNjI6gbFqw94GAFO0+sGD0HIa2BQEQaLZOS75v5b1EhXkcXTgyApW2a8ipydUsKoRczBsyzO1YqXZRaWzkrFq6yQF76HC0OJz04rZN8VKKSRZdH6sRUa+Hs+h8ZS7qGRgp5p/Z6TY90BM392CMcgyyL26xNRgUfgMRz9aqdgBYMxnWpyP3NErsId1PcEArrDZhHu0AFT8PGyoQMwtwJTLab56IJgGuKoeKt5PDPTEWCJy7438aYg==,iv:2BEqN19Z9PCIP4qGjfd1V2yjCO+btrMmoFXPhfRwQE8=,tag:1reTIU0ZcKSQWgNPuaxgcQ==,type:str] - key: ENC[AES256_GCM,data:KPaWyLWQ3rh4Yi6VafZ21RPoJIILbSR34sKKNWzZEhnG2qXkRrwOErT1tEc+8cBTp3AjWLeR5XeogEn/DpITRp5d/qwp+SmaSN52D5WZfIm1hlCMQJWNG1ajFE5OEffCHABBhUlcE4ektyiJp47sSYJ6UlNtaid6Xdj32kCUco2xa+isG7QNHO22bM2TuFAznMWk+7eBgKQ7wOtx3CpUyH/nR9k+zZBANreIo0BBH6E6yTUCKGqeoFwWFubMO3a3/UcS/9AmC79V809isMoFMn4uIRWfnNCTUaihadPdVUGt1R5N8O4DKqrFB3vNAbZVIhSEHIRuFSjLixssyu7tf28iyH7WG/vMRSvkC3qMS7+afDwMb+Z4e6tWvyE5+Rz5rlXlPVJ9l8NI2TjUzYeNcQ==,iv:a5FKNc3uG8HJ4Zk2cJUQO4q+ccOaV9nXq/23cCc97oM=,tag:WNpVMiC1rVJcZ7RQY+T+Dg==,type:str] + crt: ENC[AES256_GCM,data:6ATQh+AF1e1t0mUggn97+fcv594tQk2v7BqfDHLaY/rM+cBzDH2dxt6Z2BSyN8jOqAh9mmrVtAhi2n/fjs2hjEUVddLdGFY1FbuXkABTZqfXpHOZjxb+P+XVAUbVl0lZuaw4KU91ZrSuVkmljosHzedAFKdc8fYQZnfwgu8jTPx4a9qzx4IARRnwa4dWwkOXrBuBoDRorapnX35JFkVfHCDZ/vfcIfJxEWNWRu5XlaGBW9fBCU6NhORUU3RBU5uFU1I06bZaSy7oitCCqV1T6N3VIa1vPPBejeMbJ1IpYnYYgqBcpEk70OnBbCPHyGJSqLd5USrydebhTcNTYs367x5di5Cuc9pNrErgumwjIuyiatQQd84ZeLyf8Co4t0tDHYVpkpju0R0VFf95nkkKNRvXPn/VpIKAyqjwApYBcDOsPfQtAufL2i1dY0FgR7UEVWsuc+rS4M1PpM2xNEe1gPpKZhCyckjkZarzO9I7eG2gDl6ZfVQox0XIiMY2Q1Wq3oHfaf9dDsvfceSGPfh5f0DBSNd4FF+OSUTkg6p5WNKUvPJGnzTqg5HnajzEWZOS0LsXhg2pF8AVQHKMH9JU37h6RQMCsuPF3PwZF9vAm2CHatYlq0bEdBGMbv2uDeLD4smWg02tDJhPnUY4mzXcSd21TRNFmG57wdahGEGomlK2Wv+G/rFNRHIk3rdPzjpAeI57RRBs00rPAewrS8pU/HHFj/u59X7roKaCduZGgIyyNOhMEnd9xRm+3Cusy/80/5ThYK1WZA6NhQknrcIgroTUT6IQ6T5UJCKrKeOzebIHpWrDwhaJYgy9Wb/911cEnENDd1WNpPgGv9y9q79KFzzb9lyUBEuTPwa/4/UbOWbF2sKYUEGf/yaoQACBFTFCfjwXaCbGJ6RMeXJxBCqPWlTSDtO04wycqNS2kzT9828bfZGMzPQXofeC1qYH0FYXH7jWq9RilmhheBdBBqtQkc253JuzlUcXRN+77x6dP45/dmB5z/2lT3dpTxUwbWoVuKr/QvxLENcBPWFqnf2nmsxAiaR7442Px9LRJg==,iv:UQJB27AG9MZjstMtnZ+LOQ4gh7Ys+VWrzeKCdks487s=,tag:Ipa4LZsRzGK4gMaMstaQdw==,type:str] + key: ENC[AES256_GCM,data:hsOXE5F5/wHOmWoeAiy8pjB8A18D7Dkj+UiffZznMIqpEjje0zKsBJkxgTWECD+vX5Ad93pWj24JCukdmvmV0tfnWwjrwZeB3DUDau4xT6O4OgunQl+L6muzGI4b7Rin8z2PhKVGAh3lf2phtk866l5j6wf8fvbJqSi7OT7pNbabkbOgK208bR+c3VCG+0JyIF7ZeUG4tbeY3/zAMHW32tjJlwSqOSTjZ+hNnLZIpBcgTMKvS0eMX7DadAFAFxAhQLYTN/8VEgLKnIMYR5qJ6dSIrkonvmaPpZn1cGlvLMnRE5N+6X5kUVbySZiL+hgLt5QANlGepomxwuuwtZww6rSDMsWQVn2SVmdt1EuOwkQGv1LnlU2t3aElbpr4+jE2W7yWy5MpqckUkssOam1d9g==,iv:cgfKu/sKlDSjej7M2JnUBbESsxknsfw+Azt7BwOx2uE=,tag:kxRckRzggMCZuvhdaeEI8A==,type:str] k8saggregator: - crt: ENC[AES256_GCM,data:3YxmqpybTb97mTNzLp8nuO23cewjuWvXmeDpCIdzrvt48qVT9HrVIuosaFtqKVkMduJBbVfqgfPFjgGd0lltWfb3dh6QJBfp/C5TML0u5cyQe+RThacVdmZeer5ETpw2vYK+bvhjnVhjgaSYmrbZ6i9267m3hSlf1LERgE5kJlVpzRMcuWxfhhK7l76KiCyf4Z9WReAqWvAn9obofBMOdhuI1IG+y1iWjES1N2G9Wof95tOL9JAcG9Wru8oFJKY/cvjU0n2atX1GoWlE1k9FE8ZmayLjc2pjnumMdQOICwmIYmYsu5uaR6DvkZ0lIz+U3Bp5TUdjTYGrRQIoQH9NqyqVHrRuIhQuzQ0oOtGSa9fB3LR0hCMhGOTwRH0UVntVSIngeZa55nWQH5OAWYL3zi6+H3qmlbtj2clRs1WG+HolRVU+fH47aHa7i6wixOYaBkBZyLyGPPP0loKHPXKsRh07WmwHZscsCfHRcGjDcvEPn9Brnrh1t5+cz1CBCm5ksQJXh9JjTaG+5e4NdOsQKV7+MntLceSppRIT5At7cOMlhh+un6PLFM1Z2gfMK/2Nnb00xLhAjkjAC/hT+cukl7PFc+6Ttz7MjBzSCD+DUMQ2Oe2wTGY60IUyMaXGUP9udNdMnEgOwRB9DIAYyvA7oibNd/xTn+lEfSUBKHgCBecv7HbXdaHuCkaALi8KfmQwiwVTi10PiBMOTiE2MVRx4UB9YKav/axEt3K48Y3KkXPwfurtofZJwQNk8UZpBTxPduSwsOLAJwrqzIvlYdcsSyjsFyfGZiwChP5Ezyn1YwXhsSkFkpC49Wj76cuKm0a48I+e3VexgHDMT8jXTX5G+zlBOyAepVMyNOqHjBZ19XNY4E5M1bRjDA+NiIK51IelVM74jq9fat1MpkwAjlh2i+1ECzYp5EF/a/T4GHQnqP4KjwKwOIEk11E7JNtIJNl0,iv:3YbtSgYsUgSAIyLv+7wVmyaSlRU7ETRxEXGO48L5mxI=,tag:5gqlu3kPg3NLUi5N8CFohg==,type:str] - key: ENC[AES256_GCM,data:0jEpBv6TfRA9JL0wuKNK+kaZmnfWA4dDC8M7JHWUI2+CzHI8/CnSs4LmuaHEg69IyhxMz8QmUK0JR55GxGZaXoaaPNg75RH6vWZzbYanAYCQ/jmNutme01q4l5gPC3ncnuUgSkgZqy6U8lSIbQzd6Z+g9pEp2sqcv1wE/pZEBmP/oZxvlAPI/TmrTnihdoloSq9ovEmuhlkb2lQDUu5vadAhOwILyB8sY/3srJ326GQXKJCIFLQSVtZL22FoF5EEN4zj6Eo4JB6+qyeHbVYCzrTGKBEIuIh2jnJiuHXr7pU9ks39eJ+RjAtztoSGzrrMNEKhsApDWKVoHPmaQHexJNnoYUc8+OitNpfWFZt6myRrXHBOLmE8yglWjZ5LYiA5mgVLteVTm2apaXGQLV57xg==,iv:H397yF63NsSKbflL7UzP/M2j9xI8BO11T9vZ9LkVsZA=,tag:55qD004ldZiOheDLtUEPpg==,type:str] + crt: ENC[AES256_GCM,data:I0ElOehHI7OoFh8K4vGUP9INWUOJdqu8dP2u7PP48TtkBA3jc20xJKYA9B9cdVg1VoKzJCo4v7ixTSShJzSrVbf4DQFDVv8I70UsWOhjfBKqdx86A68oa9XKo6E7wPY4P4hFxeXilQM9mwDDRexuAKpPyHo0qLthjbn8P2jI7p9sBtYqpmo5+7i0BAnKVYT1H8oIg34Ltv8t8XSIXgexjMZXlZDPFLAZl7RY/53dLX1gjNorT0BzSNNttlfHHyUXnewGzpjYS+UgJtpfxeIlwuCMHE1iq/k4IY+jO9VrfXgyjxTSVR58btT6QgxDDtnGyvyDMkZF1UhQqiZHd5CAg5UK+TgBdtgAgEJJNuJMxFN7TB2S4mAEewvssobt5tj+HY3eOsnMtx34crdoJ7Q3/LwBvpnPy4q+P2NMBqYvJiCirMX9ShnXIKqpbCj6xgEqbXB+1dWdiAFq/jkiyax4OOAvEM+KndMvv57GNZLtKEwY+DtHGTooJ2G8ekkqBkQPyLRfMcd4UshqeOSytfaVBJeEZ0fuc1K2A9agPjdp3BCRUdsgFPWpYliSDk0npjKeHb7heRNMkCKnL8L2RopcCi1WmDMirXG+MFT2hXtAe4e72ZSWr6vYgU1iqZtBObWw2ckhcnQN+6Ewm0oeXp2HMu03elDi4SeIabwx5tHoRSFuvDe3SL5d87O0exHdbk/f7OI2CG5LSSmSjC/9fPOrxtr2aDyUr8LuSjCHEIZYnBce7Q/xPMomdyxr+r+TEdgzjeh5acPWjytwjGcNItiaL5e1ZiSnToLvFMD6fZD8kb5oldinhSjqhKenDVzouPFhr4NGgsApdaBLxZGzVQHAaoweWOkxBdrN+1r8rGxp4R+P8E6s1KrObFboQzXuZn45yzR/Tj4ciEtodbOn+e8H+Hfxkoor5ICm1BoArQVCC8HqEV4A513V0g==,iv:Wdo8SnHcLE5qiQOahTLK2umueiawMUzjrqz22VzLX50=,tag:ky8NpuHcbQpnahe5m/CapA==,type:str] + key: ENC[AES256_GCM,data:JdMk0NseBEpd4B19ZBOQASn/D09WX04872LkR0hpjlTxRyQmKghHOO3iuY4O5vo179Of3w04dCLypHJRSh9Najoc2G4QlRkVtuDz8Y2ibAyvROcVP9tZIpiiffm076eUGgW4/tMEy5ik3qoHlZmqE29zjxuVqAeXTZykE5li3loE2F0HZezjEha8A4QEzj/w3qWztAoFJq1VlAWMD3z8/NED1ZO8V0dM1GnkQZgcx7LSC4+WP7H4INSZjQktD19Ra6b5XuOSKj3A4cBfmWYW18XvOXiktKtDruz/oBZdLXccLFD4HOrYvac932RKRqL2nHtgdxmDjiN97ZpPrd4dTpSESepqErUrj087N1uspm8g/tNFxr0DUY22h5ovdUNClxv+3Hwmla2Kj0sOXwzCdw==,iv:+sCWWDrfxHaHPwyk486BnG4b252LKtqq4HoxMiI7RhI=,tag:gJKJ5FbaL41XhG2FeaK3uQ==,type:str] k8sserviceaccount: - key: ENC[AES256_GCM,data:bWaK19quoA59fl/aRgDy6uxkcaTMwcfpSlu0GPgeGDcX9nF4hT6EyZyII5XDXOPcKuu359R9Ytd8ctt0FN8araEoHUmKcEV8i6aGL2zgGu3KX6P2Gd49PYTuLhS4tBxZIDeiNhI8btaMxlTywkRk3EKbs6PE04yVBCUmFlE+PbQn+RZT45b/D5CJCEWpAM3qR2SqcXFZg1fQdLSgD+ZnnDgGNOAfvBxoxNWOukZKFp0n9rvnSX0bdY6xACngDCxQKhUPcbhGRWbHyYhcLjtR7f7H8smC5lNl3Rh8VtJy/vKKBVfSaHkmWRiWapdBk+fE5Q7Wp9+WGGOxx5RsXMLHydaAHlcYBiRi/iDWiM8juuh0lU6vJpY6i10b2MWZmKxuqd9Yp6foDcKK9SWtuasnpzcoi27vlCo3LPW2JdRoWYW1y1xymm+R43yimXdDi9wY9siDFg1DcEGPeOg7EiPU6BXGzeQTl+z0+bAqTF0Gi0MOLhuPD5ZZXS/tsehJCQ/uOS8b8py5eWPi5SU0oUrWzsSeh+DpU+LlwuLbEAvoPCa9id49tapYc6Ec8E69lxrLVHSihsEtstqTY/eBABV/OlXSXfIHNQEwbdyeYG/7IsoZ+LcDxuxrMD5/mKAfoDeodkQsjs8f19wTA4Q0ujsVciaNQPMo4gScqb7u0jbw2wwOeYken7k24OHnSwhVuT+cdkhVF0ESSUGKRDhWcX8XluD8fBRfYWpiXjLZ+SSzjNU+4ud+hh/zOzQh31+zFdnseup0TJ0bWwwtjVSTjyo4hsrvGQl0OfUB6wZNA0M8g+MUhsyD0JDcJlq/Bycrhvum2SDFV2jyzJDdVdhPhhpeUAMrVxGcrubpXJgfb51A0gurFCW5Rnop2E5387Fs9I/PQ20fkr4Gpc/ibfNQ9azuAPZkaqwjThfPoeX5JdSudO2gTNkAfRI29kM4lKQqt0zLDBHSoPGzLsg4C80EhxcyUEBBVkT6u+O9maBarhUDhCrPBWZtn8bHDJIcMwcRBvtJkuRnHJkIZzaC2lJZV9sXnM1EAvnujWTOOeUdnmOIAZPXbHBXUXwzmVACPItQV0Uxu3aw4UrXTLeDcLnMuO2roF68TQixq/3dX0Nu9G5Kkfh0VnxxEPH7jlNp+9KXbR2s/CrcozZt5AB2/m8GkqJ3JPgdSla6kg9bmD/OtYA+a+HUkYW02jlCUWkyv8O4HBfl3OtWGSztdBM7bj9kvegEWj2Aj6A45D9N1u2rJpwxtz5tbLfky2/w0OkNsdIr8f6ZEyNrUNtuRmOhajfsPlVFAGly/ZxNN6dH+pYy7KQ1crT1lXFjxQig6gMzehSkw1sn3pD3y+1bd0pgEdxcp3FvqEgS/aZy62VLOGaXOFkNldM1EuCT5x43QP5G698Eh58xvkQw/tSqgl2oPpBC6BoskRAX/aF/bPrYQ4wJijAnxSv8un1puaZToRo+PGvdpMBfK3/FaG6/fYIF5ey+BPWk+fpaVPjZ8Ib70IEwR18g0rOdo26yL8fjxDKERIK3gLW7gTtSWxtbUWAk02pNI+cT3WKbdke2mMcEiv/bi94fetnR5R5PuK/GzZsO93yyDTflLxzmrFiBDaDov0uR6SKM/QG4bVIBMPbW5z/mZQDmZnbFXkp56BZVOuEfbdibAIPdnejb1whBfoSeEbqP/3U3LcDXpeoz2bSgEoE71NbA9LfRdaX00Wt2AW+/bhr8fJD6hTAdBQNfwtT5VVg7OOAUSOfKpVTflpfI5MOsC8zw/P233/ESKpT/mWTC+OIIQiEOyLc+FOP17TYO8vhA3i7xfYw1PMvu6Ze3mcwotlgDz1zbc24bMDlgP/VncAdgpvXk7IjWYOn2bT9XnL39uPhppoduJwL/HIAUmz7fsWXPLvoxRp4mZSjg3VPFkakvqkJEdfi/ru26tQvYtTZl3VEDepWa0pZptvNnizwULyDkD8rBSRLvTVHiOKuIKK64D5Qn5U3aaxtNv3oBIyLJyOSsZ3Ro739pOPuJf8RJO+BZYzqOW9FEUZtugeSdvF+kbFEV1hXlTl6whWuGBHptF7GUc0GIEs3LFN1Zy0XKm4Slkp+P+lEYaZ/dBfu2j3cpN7Q2VsVmJqdHU66OcRZZ+/zyX8EJr/PKLgdDFniAsa+OCaZBGS1Henpkw+jADkUlfyQETFcOGkkNywW2W51in13U3AqPvCbRnzWtpq8MuOYP9QTcNGgg4Eflc7xoT/2tsOwiTjIocemMjmaQURZPIHCdJFgW2BmrLQKyDkoop+j69sZ6vWW9MZKlfLzkdxGNCXUoKMj2b2vis22m+PdxBoMNCgViWgXjBzznoV4rLvs16GGC4Q0knGoD2m0mQs8/Pj4/FF0kNYEemAwgCVfDm2n9Xf2GmdH/8KjrOBWQLZhXuCgbD/FNMt8o+63LIoeydW+yYbuuF1FFF7nOomFdlE+4iFxFLPASiKAsPW9bQGhp3XVUnoBNB9451XoEtKhrXSZeo+Ae9F9UVidKPiOVWbj2ZfaPlYCHLRKJIHkdB0iJAGX7fwv/z8XHkxr0/L0CHUtSgTMnTYxFYRiCT7rtNJcf55T+DexrfqZNcMpaFELrpGZbuxVTNeBNXIe9FB0vC6HqyphkLCK8joiXKIG55k5x4e4Hs7W7+lfOqrl40efVo/lyZuk5iStZ2t4KDVmtpXRkFdf2Ir1Pd3T1CSz2xP5qRMQX8VhdIBbFVe+WxqXQBnGomOC7Rc8mCxs2vakfLUmU7yt4cilCZt/Ndt4um0WRoBLVVzClg9sR/U2KoJc8dtEC9mC/v2Lgss/Vpecx5kMizLoys7eqGeGAeo8ldryLoAUiq+P7O9MeR07bMEeD0QEHOyzW4934zhDniw2uuCLerb+MVdU6TW/9pDVhXIKVbRdKG6GzaKkeqJBx5SCfShAqRbtGm/ZF2ExxUbqeAYA19BydPdGLr5bJ2BAXc4yYX2xA1ZFZtaCGz8qrWsYTAa00yEsvLO12/TB7hSTy95SbR5KkX0DHVNC2WrU7p6Mn5lnjrSyQt6L6Gxn1zplFpDMq0cK4NdJgCvMaq4PI1oFq+BI2Jgyl5Y/AdenxDpHSrIjxMOSe+iVflBBoGs1xAp7PNnVIA1LVVnl8JG5HEgG6rEJpt7xvQZkB07YxyjHHqlvYHCku96AKVXqv5U/BulyptlIsvIZVaElLF30H90xLFnG/zelbOQoU50Ds9hN8usVgcGRX1PFAs9nEuVQPnqcRhmG2hpvK+UcEom7bvYVmi9wyDE0Ymodnqfa1jG9gBmYP/L5E1NEnmJ/jWX1E2mpR6uLq0ofCTn8LJOl7kOpBpAUUTI8tXaUD81tiKpviRi65JikaCBQM9XRDxrhfqsZoktZV3c0ojlEZWt/g8Z9aYjXuMtfpD3Pmag9RkF7mMVUOI1Ae3jBTZtx+mfnGoDo7Zz39RWNuWQNW1Z72Jg+1SKzUrMtFUDDwzRa7coFzNnBlBVtTwHvPDvHANKuJxUT7AiKx87qkLMfwDYCEd3PHivJMwJPylzwept/rcl2/nMXhl2u+OHeVdsDG6ZoR0x4wTiv10lrfXjvDS6HLNToFHYQAwcGH63G0tLe1DoHkClgSds94QTrEbmlfvhzNzi1pndOHCOgENQtcXxGqEZzuvy7a3aPiwFmfZWNj2PdJE91PwRzSbGDfue+SpU6uLuVJOtKGyQA4U1ZUzq3B2RZqg+g+cbeJPnUdL0bxEocCOPIgipI+kegUzrMjuuUM+MtNuXEqe9LoESB8MoYPG0g6sHyglYodS9ZtysDBEYZpuGA9HBcmuTsDeHIm7tYlfNKnpXHuBkALYb9DPfwqgca4P6TxHIJZMDbh7YcwNsYErBidjrkxgsCHwHlzxmTwChT734PzXeWTG60izIoSsp3XjBhSgXEV0wVg6Nq9J7nV2cjmTvJaypbkzkYYYtDPdbo+AqQHLotv3km7uxYAoEXCJhXj4VBzx1b+RGjlI1Zugut2TyYV7nh7cgaHCuIi3IpN7XjPbf4EFZ8RWwNlBVfPT/8Jbr2yuHPidTBbc1fZPTlwGDCZqh9/SVMoZ7V/EC3N9zyHzWoLABZ26M+27gOb9zTMPf/aacOUn9Ym2/Se5uJ0viy3B5y7/PV0YvtQFFjpdZicG0fCFqN+Kjv/xUuv5btoU7CWoFwMMQ79eGTd1KTCU8I0FkFPGXt4mWc1y8gPs5c/76w+khG6KmNnhkNgKsEknUHcSNh103Pa8M+23CFCEUYxfZSA8fWwR277iDMhs1JcMhz7loApKMGhjsH9IAPoBLVQ0oAC7786XsgXrPLbzEF3YW26QdjjjHqJs+2FsN/tTGiai5N3lsc/502ii2bMUMGkcccLt7/Bu4zKusHnnZqFezN2+1/7ay15y/muidi+pqpkv1ZD+lW6wLXTzO16Mo/cmzU0ONY/0CvG20ZUT9azY1uorMzReke7eH31QfLGlajaOqioREyODTKf1ZsNbhKf4MKbNncQE3W4ED9g4xQff0uYKw5uWC+NUOpJCdvHdw09xiZ/ZahV3dItr3/MVY6w/Z0WRjZnE9oN0CkVeW1k8VuEac0144A0O4Mbd6z2kvNgaC9bJ/QytqcTIrt9ej2Ml6tpyyil9JbnGX+iH0YlDE3VmbqHOU97//32E2w2EJXoT6LQez6c0P3eHtd13zGWXEyL04WK1ls0LKDZTDucmGudOT01BstSeXNw1E+HZGrcJv3n3yLKtswB7ioVEncas59IZq1Cg91UeKgp1a9EStgsSmXpz8ad4vMm4a+mj8fswJJkurE6eLdYsiEpMqkQmP6ua5MwPArv4wDr+bchw0zEZyTYgylRRtJmFMQ/wM1b31KSqdkn86XjpbFn5IAcOh4+LvHdZ3ImdBXIVjhePK3yhn9n1ZuuugwmVdxKWoxckn3DCASm1M3HdMndoWM5JzULwysZkDIRCHeh4tR1o2HHN/0SE2YwAnzq0wP2OUuiuf5lnLOsvnPGmM//nhMy1H+LuL7hyn/ITniLf73dg21BRM0wIt27W+vLkk15EQnjwJBVp2TCn68Cue42bGDXFQqNW2EKs9tFGnSHAhLV34ARRTxThXVe/eKCA6UjYt7pjA8ifPsfaTfhYQzlpKY6hBg7T+D+3s/1sE9EPnaba87gwsO5XSMh1vtZhC/Klr0v8X55bCcPf1R+vhLXOu0kx0ye6UOxWyiE4jn/ZLb8utttgcZnqe78D0g7oMwjSLhUcZdGqhxmrvNL9pbq2rs0Ymo880oyFpu5NUc2heYjbH6HCy8cz6VoRudBG5p5H4RvmoJtuZnL4kzIA4PjP0IpM+TehPe5xO34MNc5vth/D8oId0bAhe7RfZjCPW0LEF/xAhnWis0QUbn0MszOOAq0wZqTZDtyRjf5YxNclGvQc2XrSMr83TrHe5Nj0t6wc3Un9QVZER5zaXKTNwLky7EJ907TZy6wuFlsg4z/3700BKQeqoNHfef7ZeY/fuwjehYfKlnUXlNR9Zp39FGPePORB2SGv1iWtauB09J7XpbsaR4U6ugVv/BbWm4IxZ0Eu2Hh/zp6Itlib2WUg5VW0iv0MOZFCWr8IUhzZCA3o83puTacq6InBapu1s8VXIcz0pdCIMkPxcUh215yy1hrkU/zRCyIcNehk9nzkiuit4xYn9wlNelJellhFw5i4JK6NBInPh0IObi98mgEvw5FGJIEAZ8cxyPQ5FpxMFea0RpEuMYoffWpH+OkduyoWzsrVy2UdCnOOATgCj4cJJQtZQ==,iv:j1JW4EqVsIyWC4b7mIDpaWBPh2h1RtJVCi+7Q+ft+AU=,tag:9fE+XH5MihSAR9K44noKeg==,type:str] + key: ENC[AES256_GCM,data:sp3uall9BWQYZfomsZjIdBxBQ5RcA0b7eo0r/mA1Mp8/Xihg2kOqqfF3pSryrmI0MJXvNUNfM9t6sixdqXUhSK9qZ+CvdVnGzx2vlQwML8uAx5K3aMEvQ9HERoUS+EIixtP66Mbj4KNmU8UqNEDoNaD4NPmS0g0E2gFsCjaghyqF/TMWlxTlkhe6yflMHB98ggUdVk7+p5LeKJRrjWjSIrd/3X/iD5HyFQm0zKwwbE1Q3YJu9HJ6xpWTtuIeYPdwO6IANPEyEPxVjPVp2PdqHPe+OAq1et1JNU2p3kGwaRRphajxzdVNvqTE8ZeayYY4+HT9QP9Aam7uVtLv81U50G+ZiSlgdldwhtTVhIlrqaS8Ubfg1blAlOi2qSzb+H13Hh+mDhYcGXRRnyBoYVPyMh7gqflMtImLf/AsHjeIdcGLvRH2VQWenMfNIV5hj8WefQxQ4FpqVkSVVV243cp3rl2enaiLhsulbAuD1fAPi6mcISgYibB7bEC0OPgdmm4EqqoCpt4Q1rA8mxBMRsXQURj+27u3c3rwqahB/egInO0pDJjRWb7C+oE8DX4HPCLILfIw9Bk8ZXd+jhoGNQS/lZCQ/d9/JPbr/dE5vDxQDrUJcsA0ghVxtmw3uW5ejVROW5gK97ajjHj2lo0oscfK+xCPE9/ULx7FkkmDBzFrCqcPtNRgvfiFM6z4V3qnpVwzsKaOpvvaC8viRbgJ9T2I3cfUh5K5UMOptIvqARSufZTI3gB1NvTcbW2WUUV0ApZKgM5FrrdiCSRRTgEWyPAuuR5BOanEYKfQsXwDntuAFRfmWUpAnb63jtyv90rt+zgUvxgKjrY71flI0Tqusu8IzK7v5P/c6HWNWf/ltqwWvN9iXzNWzOLbECGgYvAByzBqCE6qBGFsRocISUebYFAiEPefWFIU48n6BthfxS+fI6v+ArBpqMhqwYuZbZjbjgJlTA9BqqW9cECHRim++iWsrowyZEnm08hnzSdfuFRcnlceeD+NQcYKlhqVkJqH4PgI0gymb8qtTlfIEVyeC/N1bmicMS81agOjaAvnuzAeKY6Cp94TSUuEyfsgdK0+I3HJdh9RUOAKpvqBQ2uasogfPwyVnMZfjXNO1lrSrNrk5oCgaxiSvwo+sCrFlq8TJxy8HlsktWe7Y8/G1+8yK+ikGaYTQuK1YNS172FHv3Ag34jPVpFCA4A2lu9ozDhGid9te7b6v3Zfgm0G0Clr5RVJuTNWMwsyTRGLaDmnnopLixwY+ptpeOINE+TwT8E9f7HXyThZ2B+NRroY2UlG1EQBTgzZvhwpGejSdVu9rx98apao7WlVUvdqQ0+J36dSxcOYAxv7RZZp2kGlrOy9FthjjAmon9fcl+WK0C/ITMhQMTB4X7j/YD0Q9UDLJaunvE5EicgN1WqK/88lrsEWCTtNKMUk0wbaaUXTtoe+OXXdb8lzdJgDAakHLAmI/IYubFeI3gawnVNN5hDAM7vH8r9mS18qKe+lUzO7BIo4AXai1shs2aCGeMOxt7pBBe8J9UKD0GvjtOR+YpiXX7oBOEkPvOk/YI6ZN5FbOqpOkf+aleudNUnIovVzrRmZHFvt84AbOYkdafgMdrri7Jx+LSwK/q3hD5xQeEk7Uf5Cfe5xdJOdwnQYUwojxorjMtkap+OwSs6K3G1sbiWff5krBPsWr2EVdg5XHCglyNAUNNQbxwk28VTEo7RyzyTG6REkQU6rJOekLPyZDGoqvc1+kOpHDYSFYvCx9L8y8D5UQwjT71109xBYS8X/epU30i9CAF2KefuRlfEUlN4p//mvztZRS/crPC+pYly1MQYOBOHXeJun3Mo0Qr8XyHUe+OSv96Jk7IVKjljFYjHxg+GgsHI1/4plUXhF2pkSqEle+lPMD0BUJyKvvADNrBaLXd8dMe3Wp+wwxrGZ2ccVCpmnkIjy5hH32NHN1sEdM7QN01wpMvHDRoulRoajyCqf+/Yzg0LLBZ39Qt4zo0OS7NO1Lb2kQ8aE7iFPhQeQjoZM+Ei7UYDeT+GklesNA8ii6cuTRYU1SFDXGWUnWDZjhCy3XZybOVV1ZpWvBOGy4lqhYpE4OLnHXKOr/VgICx3SYSpgIh4ow4j2txYFnCImCCPNf0//b+Q4qiQe5VFC4K07i/hBhMnYnNkgXXW3War0lRuXLemyzgfhuCAHKDAKgDG1HV+aI6nEuWGNu129F9dDR6zugeQADZfK+p6deGjW/BHKuQ2fv3O9RsMGxSnGDYgHzoMQ5p1Q4dy2uNO07J39bdFN/LlD5YZq7lsGF+UmIjyLWb/fkk5zUakUw/josNTdWkOo0X6PWx2uWE9l2Ity4uMLk+1hv9eFL5DoxA4W6Ak0kn2ELXukTOPIma1AeOgh+5xEx6xx2ZYVq0HuIOJvTL0DSZY66lW0HQwr892qieYaILi5g2LvKmigeYvhsAC+nwigVJ233CHX8A7zyxlxtN9NH2R6MI5RgqEQEBmRe9NQ6rbtQPNMU0Dz9xqTaRhF+ZB5kSkouuM6DMgN6djx55ovJR8M+f+2Nlli4sGCDAwJHMy6XWfN8iWXQdhEPlnP1b23OTm3Rxm+GlcfsDBgjj+rSWODLHhx7aj830FIOiRSCs4We9YXax50IXzC0yT6Bt+I44GCQj5r1SHFXTvt61kBEcVSCyW2kU/q0uqz/Vyg7fCGeOFCE8C+N8RX6j9tIFzlrhDpFh8/sfzCtAoA9KLYrq1f/rughbw6hWyWvk9Fl3ncaL/1GRTCzr9cbgWLTRen3Ky/kNusHhMEEEmatCg+Ll8U/8yjCFC+brr200655x8NnnkRLSSWYKLrXyq6v9SLmZQUZGrTr9AqvVPoz8lJTFlGw+A192bbvZK5/lb1Ndi21g8ydMb+49gFN30c1JjOc/Bcol3YGndO7vva5Xurwx9CXV3p6a5xLrpUPQM0VJ6COQ1rM0mwzfpaOZfCPfrxGIxLAdGAat2QO3oGRnf7ESPzV8cBZtHb00tGnfmzFiQLiP8DwkkOV6WL+01MTnC5FS6irQy8ar3MKZCOn8A/RG61k+poM4iJzL7A4zuu6brcgVgY6c/6OJYNyPLWFuocKx4dA5TsNa0PcuOmNnFzxJKaH7tg1rIMNStrQCKj9Atkrdd9PJ3jPZPQcxlWi1jzF9lw5sGD3jtk+eG5n0RgUOP5fTWu5cX33CVuHAoMCZ2Uy/m5HlCtATDvb2lJ3fEuhUCfxXzgSAOC3i0zqwTEzD8V2DbfXaBuhLy4XtOZ7tNEyt+YsG1DIsMNKqiDx2PQ+tLJEqiPLO6E0ntXeNqNqLoih7FTAIrNBTXtdA9XyB/sbpnezLvpbBNu2OrkAZ5emxcuEm+4cEr11qRnd2xyNrbCGApdEHPnMJ0p+Hfw1OFFm7Ydj+j463M3RhgSR66mYgMzR8hHLDO9vYXZ/0JcUbEOI4ZyO9vuQi0AXI9TKP7e6l6/zeAs5iB1pt4LjCRXRXpdkmxlINRhEZ9ltjc+9QDcemLgJFA+N89jPjwhKrclu/ZNx4Pisu01G6PSrZfu36uGT6GKVyXgO+D5Vp9Hgx5xBBGPlqqUTMFgnq5kDZt7LXhHd94iZS2et2wSyX/eUBy6+CiMyX8TOrpM0lf4S2xIYbSLmYP10zKLlEmo0mla8LbB8iIGvi1GwZDYHiT/x4y2lqMlOtoVeh1mzgM0TG3r6IxsWfJzjkKnWlSnLKIX+tUkBHeTSAgszNFd2QZAv8YePgPqcFCwg2Z8W6bzz/070Nghkwxfa/rlxYuk64zYOzCecCk3N3FKNvQNcf4Y+lItKQ1BrFDBZ08f1c3KQki7QQOvUFCTNAiv8nzeSs6K3cbI30PSNjgd2knps8AzQuRl1aGmCHBm5iUGty8UnKfN2aBm6td/fGkdV9Svy2FuMXzaoQaEa8ypyuPw0TckMkvKl3oSGDxNhl7Muon2V0McS0LkC0ZAetBWbqvMVVTdnueuHZahGVu2ztpr/bln1WWJRR7L5hExE5vMnDqi2MBAiSSAfWmIVVomO4UDvOl1hYhKkq+6fWjE234EyCz2AcUmze1flm6VyChV042Q8UJvXVAeZi2GLMq5D5GZ0kwoAw5Le+PHwTq17yeAeinIBJnHmD/EOgx++3TM1F96VdTSJqt1IS62vNlqnIzc8E/8Z/8IhdhhOWNY+7Me3FYAqNJT4fH3b19GD3vUcjNzy/FL3VEmWEpj+OPTAMRgfzPqugK0LesDQxlLqpqNaV/dB/RNhx6ncNsYhhOXcY7xxt1VylSVERoo9/AYtGraGF3AQCdlNtGunSQpbSAqTokXydID6iDStJRU3ct1Cq9R0sjamhwStJDWbWKyTRwSD6kzowTIXQNtoM5/nXqfAd28jddRY7LvKN6bLgB5W3VTvaybQKhRNoo2C0vHCLFFlJzWuIEIbAL+iMO4NXk6HgIjWRU5OGgH7G5H06LZSZj+9TOxLKaezplcck/hvgOKRhIIO9gy5jEmyGl/eb8aLEFcG2VH7MFBYw1jZdq8QDWvFNBBcsuVZMoNtfoq8qU4Vw3f+T4hUjFFbzAWomg723ElDp1CR4d8dvT6+5TSIMYGc5O26DNoprm+eLi/u+q2zgggUvOnNtZ9NmHLpnzEEgKnABoK1as3xYGp2eF/AWVgBk20hfePeQCL76c+OxoJC9+Nu8jdI5FC0gzO6nVaNNFOD2MB0XQPNZtqX9n2dQMVnPOFqCAdtnwNA+mT19q8fD+RO6P6WLgGhFXnQfRgVk2CrLSTmQUrthAI914eeCfJpbqcVZ/4iJU4i5tbWFgMLI5EAGZwgGw5H531gKqzq7u0oTX/d16SiDMMhnhBWBIb5WNm0J2QIjlNpKOP9uONQrkT1EKetMrC1qKsq5uZFdrMPbpX2U5PBh+0sIxTjvxWpGD882zZFjiBY/a0UvxK03ts1G6nYny2Wwd/URfphcwjQ9X1qP/e2kxT35XlK0PsHj1QZCsgB9NKoG1LRthdEQWB9/EE6nz9YSbPJrF911Igmd35VZGpCHT3V+hmE1HNCXMEpBLTlbVFqcUaLGmZgHfGc2O3Q5QWhoP9D2gNoRDpzEk44eIkxBaa/iU85P/gzgcwZOcg8VaRkVgQummXI2bvtKyT2hqBemtYsWhp8tHuHZNDCT4SkpL1E/zsAE+0HmXBQ6NEduFhmsbPoDKYE5/JToakDE/ZGe/qkktGVt1PKxGr+EBDSioXwicLOY9YR7+FzWLAT+mlGXNeUkHdO6p7D5RJPfY+uLFeV8OH9ghvT2OD2TSdomylhDCzNXh9pJ6i5NkFBziF2EY2HWdXcdxwW/3DO1F/2n4jMsYblGLRB46j+8mcjh2Yr6n7RunNxyf2rYu8YBiTJ0BUSa5ZXlSLa5zh9H/lBERz3rspaa/QIj1Pz/mZoOT4mIyajXJoUwdCjIuETl8RioojK8AavaZhxJTkKPQdYr8x72knsxU80DbFa0xILn35aMDNirk9DHHZWWUxO8fkha+RZPE14AhsjJqxVLHbAK7RxIkUdLmJoMTQIvxBdSCttvhtGszHcyjxxeFMtMH9qHwfOzcW29EWnjZhD6ajKM/VKgYcpYIdVH23msvwG+RdbVrb8lTZCZHk7NVWB21hU5WB9o+sepm5/gDIShqTlhIn3ODgWPzJUqLbytZFnqAe/t0OEvQM1ZIWp0v6kH9bBCdy0A+F+pcJSI5rwUzJOr3NhYJOI/1nlTtaadK7GDLqQOtmwlbBOAMtGzl2AH4xol0S6989IVT2IKR0pA==,iv:9BsyZZeMelL8Y8wyewZtuaYCN8Iln0zaVkexG+5CzHA=,tag:qMveJy0juiErucQF2vXYkg==,type:str] os: - crt: ENC[AES256_GCM,data:gQ65HrYcDVeSLZPMRPCVtCFiSMzF2mw41I4c0zQawiSbwfa2is2895KiFsi7NDtWhCgAPbOoWvwfm7z2jcWhgII4vi6JX4LoWHzF6bctrPAIZa14TLjcM2gN0BETvGW7sqSXYVfQagNHYDXr1gN/Edj76Tm43iqywig9pi5ZMqwJqWHaZHVQCG89Cn/+5lJwd3Pm9+YJ/lNnUUhIRNLB9ElN97NM2wmPWp3Msq+ZAjjwxsEGhWiVxQcOI8qNeYH68xLmBugHe0Cbnp7esksqLvYwqy/q80Fd/Cvsla0Irv7NxuXt3zcxHEF45inBIyGRpu7UPvLv21Fclyy/WmEEjzpm2D/94DvVoOg/gYn/rtok/D18mJwFAoPkeUYFt3cm//wdJkexmsWcavDM0A/x7ouMgHHqgE3I1BDm440jGz6jsG0DEOLJ7tMuizBDhY+FqfFIvjSt/bcX3En5iiSGjyY59ugNUkkYorDP/mjh+js+bHMzWId5f9fyQ6oz5bidF1Dw/OEfHJt+BjZI73QPgo9ukxQ4zygm47VwJxhXRWX7FK5Hj5ZcMe3JiDxpbdaopDfd3Rjxp1Qrh+MVhIs6RoZdWuPWSumUno+WgeD/IcK1WdTH5mYSdYBfAzSioXyXioX0KDjGx8exzmkOkAy7b/iOk86aJ3aICFq67uxn2MY/pbqxEmNEOZtXI03Lr0JJ9y85giw9mpind5qXBZRdYA65ueSvV+7gIwQ0ez9/TFZCT4sa9xgsnpNbk8qeSwOKaqcRavodj4s7ZQJlCHGtsL6YnBmpuX6pgkqRs6zGYzovbZOrK4cxoAHn/rCM/h9aCHfG4NLm9v1lVRtbfGMwFiFZxna28gjqwcXXjoVXPibGTxzP,iv:/Z1siSkwGd1dywxVjvr74VQAGfUWLLasFNbeBGH7CSU=,tag:TfBrPURAY24OqoQ3c7ZgpQ==,type:str] - key: ENC[AES256_GCM,data:y1jJNx8l9w6B20SsnY2t0F0J3VhxTVMxZND/1awq6f6/vz7gQq0f5CGktIlaJpouuGM3yBd2yngJsnAd3sTuhpIDdkh/D8dghzeolpZmVuLcC6VmDav+WltR5YBm7YZTa2WiyxQzs6S00mndA+RNzjKCMUE+gbH54tCCj99Rd+dmsR5SME0rnilHpO5y+xhZxAzeN5rb9dEB3vXfllm5fMX2VIXO4tIEegYz7wahByLvodB3,iv:NkXwb993RFCjnSaFH/4IFwpkCaQa+pSCLYMaz7wX8Ko=,tag:Ii5Ss0+TgNFjqkTHqBUpOA==,type:str] + crt: ENC[AES256_GCM,data:2xIqMlc9t2blgIbNf2PZG4UKj+yCJyDo+ME8Lx5L4/Q+OCP0Gmd2vPAYgZHqyyn0F7zX6zY6znTm9m25lgYcEscxmjhcITS6xzMtLwPo1XErRvVcF8l1KKLclRHIPalQYe2TsaSXN6M8sLouubkgx/3CqNU3DqXq1rc/nTTSb5jTrjGOeWrgjx6r+lsI5XkJM8QCxVJ5oek0XbJVZWewVtvOWeW/8w5i8DhLA6lcCce0zFGylWcAjazGwJNugm9vDeMdLzpbmKKQ0of22HSdpdo8QrWThFPxGiZRuXVq70O428n/1S7NKFx9ax4o87qTPl/tdDv5vWmWwzLG0sU//AWvO0umI9sHoOwl+MluTlJEBK9a//exTkFcZCfOy1qjRWkfo4eIUv3Bs655ftepA9TGQU+8SLVaxmrjSB4oQC6kdterdjwYWvFYWa0GrdVjm0mW759/vOLrV0k4gaeeHgTWAaAEfJ1T654ehFjgRreIKVqPKU8vo59eghhlgIIPCzfOEBrdbHUWcF1d66uSeKJt0oyoXgRR9nNxQJARoH9nkXLJCoi3ttxCqbV0hD7b+7ooT/2WfkFS2YvBnwgR9dtyIvZh6gwjypbdcNAAoQqS1X21vt2yh+AUkL3rdQU36XdV+iTTxqtvHIsrPgBB1i3z+GEcTXdfbs9mqSvj2K100/6y7bc7Kr/fNGNUuT87rs58ODoYA3IMGMpgYb7a1OwNa5R1/0bovBvbNeZqYD+92kRWIhtu9WXxqxuqrfhe2GjdYiwlpAq+fvmLup61ekdtO3RSa4gjCXFk9xhUDoPg48muXJxpKHo/5XiQc11yhLnzV4c4bQsuor9aU+LAJnj3ZPKRmwEcbXOaTzeqWr3Nk9lI,iv:jh3Yxzmnd6hSO5K7kjEn0ikfDoXBld/SrgdOmKFi5Xo=,tag:aVusAZdhz0vmUY1hk95N1w==,type:str] + key: ENC[AES256_GCM,data:vE+0+lGFdDbXlxQf4NnVL5qAAWUU+lLPV0lTQi36ZiccFzqKnsN+oikzuwrKbxf4WLcrQGZ9HtPcXZoBFFfxoYB6T5V8Cp8kN/9/3TuDqzOSF1jSMh0b3/qAPfeX/0gtZ5qcdjpWVHcwKJmk0ikV6n8ik6nIfph6SU4UZRXym/42N3uB0nolfpA+dbtodWsSENwPmf42RJWnhWYNZtsqUAPmI2kZYkImo9+VZZG1Qevb2pFt,iv:gbSfL5GUn5njObBG/5SFHgs/ZpQ0QWoiO+NmLckEjDY=,tag:lLcdNuhiO0ROvKHCXeK4yg==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + - recipient: age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVUVrVzM2K3FxZW1vZWU2 - eGphc0hyVDVFK1YzQXJuWGpwM05pcm9hekc4Ci9Xc05GNHhUNHFpL2hNUmh1dFdu - bmt6Ti9SL1hMa1RrbVQxdUxKWVhMWXcKLS0tIHpIS1BoRzdQSWV0SG11KzBqbUxI - Z2IrdTdhdjlkbmpnZWFJTjRYS0daZ1UKYun8zBETwkX7bTGDq0lmT971fxk4rjBh - r7vEIHAXJXSN+l2j49epmQgDbJsLnxU0WYg2ujjvHGSPe7ZE+C5W/g== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvMnhIeWtZUERTOFdOeXMy + ZE9SKzM0aXQyc1UrTi90TXZlUzdZdU1pYW5nCmpQMkJVZllBazVwUnQ5VmJFSE1u + TXVDYnJOUEQ5SDVLSk0ydW8reDU4YVEKLS0tIGdyUXYyMFBCZDhmVGJrNVdvclAz + cnJBaXVXQ1FJL3Y3R3NuU09JTHkxTjAKKfHOeVtTgDWmIfZoZ7fd38s1Vll6YgIr + YbCPwy4iy08ZRee9T/vUaCEi+6Lw40SYU8x2qxWlDYPouh+STVljqg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-07-08T17:37:37Z" - mac: ENC[AES256_GCM,data:o0D4a6UdOY3WeG9CIMH00AW4kNMbhNWKteOCZu8p0c+GuVgan8PaUkxi6NhB2H1BqYd3WB3LgGfAsTjcK4qd/hOwz/WwT2hf3Tf3zuZHaNKOH9M03TRTImLuWYdjpr2uEDBaUG0hWIufr4SmppDmdos12EDWMlPTgT3zvFpJd3o=,iv:IbWzjHzDAkjeryjlnSVDj+Kjpx3iVPOAFvrKRKjm6s4=,tag:DW/pajHvNz2fYIOuXYyImg==,type:str] + lastmodified: "2024-07-15T13:07:52Z" + mac: ENC[AES256_GCM,data:wChyg1ZPV/0YD4TIqGEMHKCGDbQMelKNn/3TagM9P9DRMYGpVkIrXuc1G1nRAJ+Z4CG/grfm4FiRG8JrhuBvKuHDVEJWw1+cK2qrUidC147a3OsTGUtMNq4hntuBdHhiIR8xFa9Gbok45C0v7t33YzjT0MWRb+gwEPbrc130oBo=,iv:tJmQsOrUvSom7eMOkb3ApIncXA3+pgf3Q6DVkbeBL9g=,tag:ZZzFXUQOoiDaNpCqDsnoPw==,type:str] pgp: [] encrypted_regex: ^(token|crt|key|id|secret|secretboxencryptionsecret|ca|bootstraptoken)$ version: 3.8.1 diff --git a/kubernetes/flux/cluster-apps.yaml b/kubernetes/flux/cluster-apps.yaml index 2bfa9a1..7298435 100644 --- a/kubernetes/flux/cluster-apps.yaml +++ b/kubernetes/flux/cluster-apps.yaml @@ -11,7 +11,7 @@ spec: prune: true sourceRef: kind: GitRepository - name: homelab + name: theshire decryption: provider: sops secretRef: diff --git a/kubernetes/flux/config/cluster.yaml b/kubernetes/flux/config/cluster.yaml index 79ddd5c..c631b73 100644 --- a/kubernetes/flux/config/cluster.yaml +++ b/kubernetes/flux/config/cluster.yaml @@ -3,13 +3,13 @@ apiVersion: source.toolkit.fluxcd.io/v1 kind: GitRepository metadata: - name: homelab + name: theshire namespace: flux-system spec: interval: 30m ref: branch: main - url: https://git.hsn.dev/jahanson/homelab.git + url: https://git.hsn.dev/jahanson/theshire.git ignore: | # exclude all /* @@ -29,7 +29,7 @@ spec: wait: false sourceRef: kind: GitRepository - name: homelab + name: theshire decryption: provider: sops secretRef: diff --git a/kubernetes/flux/repositories/git/kubevirt-cdi.yaml b/kubernetes/flux/repositories/git/kubevirt-cdi.yaml deleted file mode 100644 index 18de624..0000000 --- a/kubernetes/flux/repositories/git/kubevirt-cdi.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/source.toolkit.fluxcd.io/gitrepository_v1.json -apiVersion: source.toolkit.fluxcd.io/v1 -kind: GitRepository -metadata: - name: kubevirt-cdi - namespace: flux-system -spec: - interval: 30m - url: https://git.hsn.dev/jahanson/kubevirt-flux.git - ref: - branch: cdi-v1.59.0 - ignore: | - # exclude all - /* - # include files - !/deploy diff --git a/kubernetes/flux/repositories/git/kubevirt.yaml b/kubernetes/flux/repositories/git/kubevirt.yaml deleted file mode 100644 index b5bde71..0000000 --- a/kubernetes/flux/repositories/git/kubevirt.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/source.toolkit.fluxcd.io/gitrepository_v1.json -apiVersion: source.toolkit.fluxcd.io/v1 -kind: GitRepository -metadata: - name: kubevirt - namespace: flux-system -spec: - interval: 30m - url: https://git.hsn.dev/jahanson/kubevirt-flux.git - ref: - branch: v1.2.2 - ignore: | - # exclude all - /* - # include files - !/deploy diff --git a/kubernetes/flux/repositories/git/kustomization.yaml b/kubernetes/flux/repositories/git/kustomization.yaml deleted file mode 100644 index 160bbf7..0000000 --- a/kubernetes/flux/repositories/git/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - kubevirt.yaml - - kubevirt-cdi.yaml diff --git a/kubernetes/flux/repositories/helm/angelnu.yaml b/kubernetes/flux/repositories/helm/angelnu.yaml index 694897a..e9a4ac4 100644 --- a/kubernetes/flux/repositories/helm/angelnu.yaml +++ b/kubernetes/flux/repositories/helm/angelnu.yaml @@ -8,4 +8,4 @@ metadata: spec: interval: 30m url: https://angelnu.github.io/helm-charts - timeout: 3m \ No newline at end of file + timeout: 3m diff --git a/kubernetes/flux/repositories/helm/emqx.yaml b/kubernetes/flux/repositories/helm/coredns.yaml similarity index 80% rename from kubernetes/flux/repositories/helm/emqx.yaml rename to kubernetes/flux/repositories/helm/coredns.yaml index 1ca9ebf..27537d7 100644 --- a/kubernetes/flux/repositories/helm/emqx.yaml +++ b/kubernetes/flux/repositories/helm/coredns.yaml @@ -3,8 +3,8 @@ apiVersion: source.toolkit.fluxcd.io/v1 kind: HelmRepository metadata: - name: emqx + name: coredns namespace: flux-system spec: interval: 2h - url: https://repos.emqx.io/charts + url: https://coredns.github.io/helm diff --git a/kubernetes/flux/repositories/helm/descheduler.yaml b/kubernetes/flux/repositories/helm/descheduler.yaml index 76de28c..9c83ebb 100644 --- a/kubernetes/flux/repositories/helm/descheduler.yaml +++ b/kubernetes/flux/repositories/helm/descheduler.yaml @@ -7,4 +7,4 @@ metadata: namespace: flux-system spec: interval: 2h - url: https://kubernetes-sigs.github.io/descheduler \ No newline at end of file + url: https://kubernetes-sigs.github.io/descheduler diff --git a/kubernetes/flux/repositories/helm/kustomization.yaml b/kubernetes/flux/repositories/helm/kustomization.yaml index f4795c0..0a9cf76 100644 --- a/kubernetes/flux/repositories/helm/kustomization.yaml +++ b/kubernetes/flux/repositories/helm/kustomization.yaml @@ -8,13 +8,13 @@ resources: - backube.yaml - bjw-s.yaml - cilium.yaml + - coredns.yaml - crowdsec.yaml - crunchydata.yaml - democratic-csi.yaml - descheduler.yaml - dragonflydb.yaml - elastic.yaml - - emqx.yaml - external-secrets.yaml - fairwinds.yaml - grafana.yaml @@ -35,4 +35,3 @@ resources: - spegel-org.yaml - stakater.yaml - stevehipwell.yaml - - victoria-metrics.yaml diff --git a/kubernetes/flux/repositories/helm/spegel-org.yaml b/kubernetes/flux/repositories/helm/spegel-org.yaml index 9cb852f..25db6d4 100644 --- a/kubernetes/flux/repositories/helm/spegel-org.yaml +++ b/kubernetes/flux/repositories/helm/spegel-org.yaml @@ -8,4 +8,4 @@ metadata: spec: type: oci interval: 5m - url: oci://ghcr.io/spegel-org/helm-charts \ No newline at end of file + url: oci://ghcr.io/spegel-org/helm-charts diff --git a/kubernetes/flux/repositories/helm/stevehipwell.yaml b/kubernetes/flux/repositories/helm/stevehipwell.yaml index c2dceb7..bd0d086 100644 --- a/kubernetes/flux/repositories/helm/stevehipwell.yaml +++ b/kubernetes/flux/repositories/helm/stevehipwell.yaml @@ -1,5 +1,5 @@ --- -# yaml-language-server: $schema=https://ks.hsn.dev/source.toolkit.fluxcd.io/helmrepository_v1beta2.json +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1beta2.json apiVersion: source.toolkit.fluxcd.io/v1 kind: HelmRepository metadata: diff --git a/kubernetes/flux/repositories/helm/victoria-metrics.yaml b/kubernetes/flux/repositories/helm/victoria-metrics.yaml deleted file mode 100644 index 37ee6b0..0000000 --- a/kubernetes/flux/repositories/helm/victoria-metrics.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# yaml-language-server: $schema=https://ks.hsn.dev/source.toolkit.fluxcd.io/helmrepository_v1beta2.json -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: victoria-metrics - namespace: flux-system -spec: - interval: 30m - url: https://victoriametrics.github.io/helm-charts/ - timeout: 3m diff --git a/kubernetes/flux/repositories/kustomization.yaml b/kubernetes/flux/repositories/kustomization.yaml index 196ac06..219c6e2 100644 --- a/kubernetes/flux/repositories/kustomization.yaml +++ b/kubernetes/flux/repositories/kustomization.yaml @@ -5,4 +5,3 @@ kind: Kustomization namespace: flux-system resources: - ./helm - - ./git diff --git a/kubernetes/flux/vars/cluster-secrets.sops.yaml b/kubernetes/flux/vars/cluster-secrets.sops.yaml index e806805..9fa006e 100644 --- a/kubernetes/flux/vars/cluster-secrets.sops.yaml +++ b/kubernetes/flux/vars/cluster-secrets.sops.yaml @@ -4,25 +4,25 @@ metadata: name: cluster-secrets namespace: flux-system stringData: - CLUSTER_SECRET_CLOUDFLARE_ACCOUNT_ID: ENC[AES256_GCM,data:bQvXy9wHJcVKCa9xb89Ji2VSBmsxPKuEXIG/+KiclmM=,iv:63JdSorOBh2uz98ajzdtydSbJH3wKEaX5fRP3LX8g9Q=,tag:NH7Y6EoWaEGVal7E0XHg0w==,type:str] - CLUSTER_SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:7UFpD5GCCwg+N5y1LKvhtLNRdTugwMQrR9tBSJ1ogt9qZNCJ,iv:ZjOh5Lr9vDxsbDeUx0/EuBLDSwlh71jn9wM6Cpl2FdE=,tag:GJTGF4LtPWWsv4lIDRg51g==,type:str] + CLUSTER_SECRET_CLOUDFLARE_ACCOUNT_ID: ENC[AES256_GCM,data:9YWkXR/bWSbo020UOD81Y9FT9TOmOcPUudD/JEj0Src=,iv:FqWULXadlng/odR93Sv8HXy+3NLfMh1jj5BoA3+er90=,tag:PETCCxtVvJU2/Kw/Uupujg==,type:str] + CLUSTER_SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:JBVLvSlU3nXRI/ZZfrd6ahGjQPHn3AQYqAMa4HcRKX4dQyu7,iv:EtzKsH1UWB4zyXimSngqOnV+gwf8BrfF9TKM1ADgBr4=,tag:V+Ip8AtReDyvnmbH1hSDYA==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: - - recipient: age1eqlaq205y5jre9hu5hvulywa7w3d4qyxwmafneamxcn7nejesedsf4q9g6 + - recipient: age1gr4js8ln65khjzjkf9gs5c32a2vrrv6jlv5asuz6hccqq8pddc4sjflprn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUdHVVdXUyMUlYc01Va25F - aXg2YWVDdnQwQnRGMWE4SEJtUnNka216YkVRCks5SUJBMzIxY25PWXQzSlBybkdL - Smwxc1hscTlNdzkzUWVPaXBYNkg5RWsKLS0tIGg0UHU3NGlpR1I5RjAvK1NvS3hl - K3J3NTZHQlhIOEt6YnZ6QU5QZ0JLT3MKYyy736Q4oXmaryf+JLlgEoK64iGDlUDg - JbdxbEfCPh3xbuTAff5oU0LxX9XVsoKBO/8+ew6+P/8bcjeb9sNCEg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOeUIrTloyWXFRYTlSeWp3 + eDZpVkNHbUhhQzJ4MEFUbEptUmFvQWlDdkZFCnJPY1FwaEx3RVpidnNPZUlZRjZz + Nnp0Wkx1WTc5MXJnVUV5bmpSSW5OM0kKLS0tIDE2NDEzKzZXZENicXdQaUNuUllB + MzA0aXAwbjUrV0ZMbmVHRUtRanUweE0K/I2EoGJKvfpC9sMNxYBbp41qQnRPYbGB + ApDo7SVBhXR+jnCmBrNdKbmpFdcGkHTYZ35LtuTuuBeq+bPyBazAQA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-02-27T18:35:50Z" - mac: ENC[AES256_GCM,data:23mZCtZNAoOBnZGF7nweq9PXhk27VOUgY3C6xa5DhQsJjFAGv6J9e8om4WsVaYKyo0PJ24Qi1JVQOsEHc3eCNq9W/W5Kh7cNM6FEjQPWwfL3Bz2pC97J+nGedbgsdl6bQzazfHQ+n5tMWbc9Po5qOP+7Wna5BIlZ5KVZk8WuFMY=,iv:C7QUH4kJo53kGokm4S8Hgr1nbP4Zc5efRS4ociQYyI8=,tag:+ceCQSXufLMOn07ENG5WCA==,type:str] + lastmodified: "2024-07-14T17:47:42Z" + mac: ENC[AES256_GCM,data:pdlFLlQTGZ9Wuom0N38C043+6D05WSlE7UIt7BfhYNajwCqucCFhzphTKfGyx73WEJ9ctAmkAv1vQRjyFUDULgwSILH5dVV99a85dAguwaQJn/kqmf/jiznF/wRXek8CE/gQlu23bjM82vTEg5GdrDrFeenWBe9xYCt/UdmVp4A=,iv:fp6e3UCEEeWf3MT34f7Ae+ap4ss3KXD7boTrrBy6kpM=,tag:jtw9PlalhoGcbDhrQzNPXA==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.8.1 diff --git a/kubernetes/flux/vars/cluster-settings.yaml b/kubernetes/flux/vars/cluster-settings.yaml index f9d9366..7215c73 100644 --- a/kubernetes/flux/vars/cluster-settings.yaml +++ b/kubernetes/flux/vars/cluster-settings.yaml @@ -5,4 +5,4 @@ metadata: name: cluster-settings namespace: flux-system data: - CLUSTER_NAME: homelab + CLUSTER_NAME: theshire diff --git a/kubernetes/templates/gatus/external/configmap.yaml b/kubernetes/templates/gatus/external/configmap.yaml index fe9bbda..04086b7 100644 --- a/kubernetes/templates/gatus/external/configmap.yaml +++ b/kubernetes/templates/gatus/external/configmap.yaml @@ -17,4 +17,4 @@ data: conditions: - "[STATUS] == ${GATUS_STATUS:-200}" alerts: - - type: pushover \ No newline at end of file + - type: pushover diff --git a/kubernetes/templates/gatus/external/kustomization.yaml b/kubernetes/templates/gatus/external/kustomization.yaml index d4e4af4..e09060b 100644 --- a/kubernetes/templates/gatus/external/kustomization.yaml +++ b/kubernetes/templates/gatus/external/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ./configmap.yaml \ No newline at end of file + - ./configmap.yaml diff --git a/kubernetes/templates/volsync/claim.yaml b/kubernetes/templates/volsync/claim.yaml index 34346fa..1f2d9e1 100644 --- a/kubernetes/templates/volsync/claim.yaml +++ b/kubernetes/templates/volsync/claim.yaml @@ -12,4 +12,4 @@ spec: resources: requests: storage: "${VOLSYNC_CAPACITY}" - storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs}" + storageClassName: "${VOLSYNC_STORAGECLASS:-ceph-block}" diff --git a/kubernetes/templates/volsync/minio.yaml b/kubernetes/templates/volsync/minio.yaml index c42ef35..eb2a998 100644 --- a/kubernetes/templates/volsync/minio.yaml +++ b/kubernetes/templates/volsync/minio.yaml @@ -36,11 +36,11 @@ spec: copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}" pruneIntervalDays: 7 repository: "${APP}-volsync-secret" - volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-openebs-zfs}" + volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-csi-ceph-blockpool}" cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}" - cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-openebs-hostpath}" + cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-ceph-block}" cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"] - storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs}" + storageClassName: "${VOLSYNC_STORAGECLASS:-ceph-block}" accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"] moverSecurityContext: runAsUser: ${APP_UID:-568} @@ -62,11 +62,11 @@ spec: restic: repository: "${APP}-volsync-secret" copyMethod: Snapshot # must be Snapshot - volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-openebs-zfs}" - cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-openebs-hostpath}" + volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-csi-ceph-blockpool}" + cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-ceph-block}" cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"] cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}" - storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs}" + storageClassName: "${VOLSYNC_STORAGECLASS:-ceph-block}" accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"] capacity: "${VOLSYNC_CAPACITY}" moverSecurityContext: diff --git a/kubernetes/templates/volsync/r2.yaml b/kubernetes/templates/volsync/r2.yaml index d7ae84c..e5ba28e 100644 --- a/kubernetes/templates/volsync/r2.yaml +++ b/kubernetes/templates/volsync/r2.yaml @@ -36,11 +36,11 @@ spec: copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}" pruneIntervalDays: 7 repository: "${APP}-volsync-r2-secret" - volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-openebs-zfs}" + volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-csi-ceph-blockpool}" cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}" - cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-openebs-hostpath}" + cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-ceph-block}" cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"] - storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs}" + storageClassName: "${VOLSYNC_STORAGECLASS:-ceph-block}" accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"] moverSecurityContext: runAsUser: ${APP_UID:-568} diff --git a/kubernetes/tools/kbench.yaml b/kubernetes/tools/kbench.yaml index b0e71e6..1894da4 100644 --- a/kubernetes/tools/kbench.yaml +++ b/kubernetes/tools/kbench.yaml @@ -5,8 +5,8 @@ metadata: name: kbench-pvc spec: # storageClassName: zfs-generic-nfs-csi - storageClassName: openebs-hostpath - # storageClassName: openebs-zfs + # storageClassName: openebs-hostpath + storageClassName: ceph-block accessModes: - ReadWriteOnce resources: diff --git a/kubernetes/tools/wipeone.yaml b/kubernetes/tools/wipeone.yaml index 6e11d0f..3c9b6e8 100644 --- a/kubernetes/tools/wipeone.yaml +++ b/kubernetes/tools/wipeone.yaml @@ -6,16 +6,16 @@ metadata: namespace: kube-system spec: restartPolicy: Never - nodeName: shadowfax + nodeName: gandalf-01 containers: - name: disk-wipe - image: docker.io/library/alpine:3.20.2 + image: docker.io/library/alpine:latest securityContext: privileged: true resources: {} env: - name: CEPH_DISK - value: "/dev/nvme2n1" + value: "/dev/nvme0n1" command: [ "/bin/sh", diff --git a/kubernetes/tools/wiperook.yaml b/kubernetes/tools/wiperook.yaml index fda079e..6c7367e 100644 --- a/kubernetes/tools/wiperook.yaml +++ b/kubernetes/tools/wiperook.yaml @@ -2,20 +2,20 @@ apiVersion: v1 kind: Pod metadata: - name: disk-wipe-s01 + name: disk-wipe-sam namespace: kube-system spec: restartPolicy: Never - nodeName: talos-fki-fmf + nodeName: sam containers: - name: disk-wipe - image: docker.io/library/alpine:3.20.2 + image: docker.io/library/alpine:latest securityContext: privileged: true resources: {} env: - name: CEPH_DISK - value: "/dev/xvdb" + value: "/dev/nvme0n1" command: [ "/bin/sh", @@ -39,20 +39,20 @@ spec: apiVersion: v1 kind: Pod metadata: - name: disk-wipe-anduril + name: disk-wipe-frodo namespace: kube-system spec: restartPolicy: Never - nodeName: talos-xuc-f2e + nodeName: frodo containers: - name: disk-wipe - image: docker.io/library/alpine:3.20.2 + image: docker.io/library/alpine:latest securityContext: privileged: true resources: {} env: - name: CEPH_DISK - value: "/dev/nvme1n1" + value: "/dev/nvme0n1" command: [ "/bin/sh", @@ -76,14 +76,14 @@ spec: apiVersion: v1 kind: Pod metadata: - name: disk-wipe-g01 + name: disk-wipe-bilbo namespace: kube-system spec: restartPolicy: Never - nodeName: talos-opy-6ij + nodeName: bilbo containers: - name: disk-wipe - image: docker.io/library/alpine:3.20.2 + image: docker.io/library/alpine:latest securityContext: privileged: true resources: {} diff --git a/renovate.json5 b/renovate.json5 index ac8695d..603ecc7 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -2,13 +2,11 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:recommended", - "local>jahanson/homelab//.renovate/customManagers.json5", - "local>jahanson/homelab//.renovate/autoMerge.json5", - "local>jahanson/homelab//.renovate/packageRules.json5" - ], - "ignorePaths": [ - ".archive/**" + "local>jahanson/theshire//.renovate/customManagers.json5", + "local>jahanson/theshire//.renovate/autoMerge.json5", + "local>jahanson/theshire//.renovate/packageRules.json5" ], + "ignorePaths": [".archive/**"], "flux": { "fileMatch": [ "kubernetes/.+\\.ya?ml$" @@ -67,11 +65,6 @@ } ], "packageRules": [ - { - "description": "Update Gluetun only daily", - "matchDepNames": ["ghcr.io/qdm12/gluetun"], - "extends": ["schedule:daily"] - }, { "description": "Use custom versioning for Vector", "matchDatasources": [ @@ -225,27 +218,8 @@ ], "group": { "commitMessageTopic": "{{{groupName}}} group" - } + }, }, - { - "description": "Ollama combine datasources.", - "groupName": "Ollama", - "matchPackagePatterns": [ - "docker.io/ollama/ollama", - "ollama" - ], - "matchDatasources": [ - "docker", - "github-releases" - ], - "matchUpdateTypes": [ - "minor", - "patch" - ], - "group": { - "commitMessageTopic": "{{{groupName}}} group" - } - } - // Version strategies - ] - } + // Version strategies + ] +} diff --git a/shell.nix b/shell.nix index 402b159..cd3e2bf 100644 --- a/shell.nix +++ b/shell.nix @@ -17,6 +17,6 @@ pkgs.mkShell { kubernetes-helm pre-commit sops - cachix + age ]; }