Update image ghcr.io/siderolabs/kubelet to v1.31.1

.archive/ai/stable-diffusion/comfyui/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

.archive/default/nicehash/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

.archive/vault/ks.yaml

@@ -3,12 +3,9 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app vault
+  name: vault
   namespace: flux-system
 spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
   interval: 1m
   path: "./kubernetes/apps/security/vault/app"
   prune: true

.renovate/autoMerge.json5

@@ -7,7 +7,7 @@
       "automerge": true,
       "automergeType": "branch",
       "matchUpdateTypes": ["digest"],
-      "matchPackagePrefixes": ["ghcr.io/onedr0p", "ghcr.io/bjw-s", "ghcr.io/bjw-s-labs"],
+      "matchPackagePrefixes": ["ghcr.io/onedr0p", "ghcr.io/bjw-s"],
       "ignoreTests": true
     },
     {

.taskfiles/volsync/Taskfile.yaml

@@ -1,6 +1,6 @@
 ---
 # yaml-language-server: $schema=https://taskfile.dev/schema.json
-version: '3'
+version: "3"
 
 # This taskfile is used to manage certain VolSync tasks for a given application, limitations are described below.
 #   1. Fluxtomization, HelmRelease, PVC, ReplicationSource all have the same name (e.g. plex)
@@ -8,129 +8,215 @@ version: '3'
 #   3. Applications are deployed as either a Kubernetes Deployment or StatefulSet
 #   4. Each application only has one PVC that is being replicated
 
+x-env-vars: &env-vars
+  app: "{{.app}}"
+  claim: "{{.claim}}"
+  controller: "{{.controller}}"
+  job: "{{.job}}"
+  ns: "{{.ns}}"
+  pgid: "{{.pgid}}"
+  previous: "{{.previous}}"
+  puid: "{{.puid}}"
+
 vars:
-  VOLSYNC_RESOURCES_DIR: '{{.ROOT_DIR}}/.taskfiles/volsync/resources'
+  VOLSYNC_RESOURCES_DIR: "{{.ROOT_DIR}}/.taskfiles/volsync/resources"
 
 tasks:
-
   state-*:
     desc: Suspend or Resume Volsync
-    summary: |-
-      CLUSTER: Cluster to run command against (default: main)
-      STATE: resume or suspend (required)
+    summary: |
+      state: resume or suspend (required)
+    dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env']
     cmds:
-      # - until kubectl wait jobs --all --all-namespaces --for=condition=complete --timeout=5m &>/dev/null; do sleep 5; done
-      - flux {{.STATE}} kustomization volsync
-      - flux --namespace {{.NS}} {{.STATE}} helmrelease volsync
-      - kubectl --namespace {{.NS}} scale deployment --all --replicas {{if eq .STATE "suspend"}}0{{else}}1{{end}}
+      - flux --context $CLUSTER {{.state}} kustomization volsync
+      - flux --context $CLUSTER -n {{.ns}} {{.state}} helmrelease volsync
+      - kubectl --context $CLUSTER -n {{.ns}} scale deployment volsync --replicas {{if eq "suspend" .state}}0{{else}}1{{end}}
+    env: *env-vars
     vars:
-      NS: '{{.NS | default "volsync-system"}}'
-      STATE: '{{index .MATCH 0}}'
+      ns: '{{.ns | default "volsync-system"}}'
+      state: '{{index .MATCH 0}}'
+
+  list:
+    desc: List snapshots for an application
+    summary: |
+      ns: Namespace the PVC is in (default: default)
+      app: Application to list snapshots for (required)
+    dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env']
+    cmds:
+      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/list.tmpl.yaml) | kubectl --context $CLUSTER apply -f -
+      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} $CLUSTER
+      - kubectl --context $CLUSTER -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m
+      - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container main
+      - kubectl --context $CLUSTER -n {{.ns}} delete job {{.job}}
+    env: *env-vars
     requires:
-      vars: [CLUSTER]
+      vars: ["app"]
+    vars:
+      ns: '{{.ns | default "default"}}'
+      job: volsync-list-{{.app}}
+    preconditions:
+      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/list.tmpl.yaml
+    silent: true
 
   unlock:
-    desc: Unlock all Restic repositories
-    summary: |-
-      CLUSTER: Cluster to run command against (default: main)
-    cmd: >
-      kubectl get replicationsources --all-namespaces --no-headers -A | awk '{print $1, $2}'
-      | xargs --max-procs=2 -l bash -c 'kubectl --namespace "$0" patch --field-manager=flux-client-side-apply replicationsources "$1" --type merge --patch "{\"spec\":{\"restic\":{\"unlock\":\"{{now | unixEpoch}}\"}}}"'
+    desc: Unlock a Restic repository for an application
+    summary: |
+      ns: Namespace the PVC is in (default: default)
+      app: Application to unlock (required)
+    dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env']
+    cmds:
+      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/unlock.tmpl.yaml) | kubectl --context $CLUSTER apply -f -
+      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} $CLUSTER
+      - kubectl --context $CLUSTER -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m
+      - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container minio
+      - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container r2
+      - kubectl --context $CLUSTER -n {{.ns}} delete job {{.job}}
+    env: *env-vars
     requires:
-      vars: [CLUSTER]
+      vars: ["app"]
+    vars:
+      ns: '{{.ns | default "default"}}'
+      job: volsync-unlock-{{.app}}
+    preconditions:
+      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/unlock.tmpl.yaml
+    silent: true
 
   # To run backup jobs in parallel for all replicationsources:
-  #   - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:snapshot APP=$0 NS=$1'
+  #   - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:snapshot app=$0 ns=$1'
   snapshot:
-    desc: Snapshot an application
-    summary: |-
-      CLUSTER: Cluster to run command against (default: main)
-      NS: Namespace the application is in (default: default)
-      APP: Application to snapshot (required)
+    desc: Snapshot a PVC for an application
+    summary: |
+      cluster: Cluster to run command against (required)
+      ns: Namespace the PVC is in (default: default)
+      app: Application to snapshot (required)
     cmds:
-      - kubectl --namespace {{.NS}} patch replicationsources {{.APP}} --type merge -p '{"spec":{"trigger":{"manual":"{{now | unixEpoch}}"}}}'
-      - until kubectl --namespace {{.NS}} get job/{{.JOB}} &>/dev/null; do sleep 5; done
-      - kubectl --namespace {{.NS}} wait job/{{.JOB}} --for=condition=complete --timeout=120m
-    vars:
-      NS: '{{.NS | default "default"}}'
-      JOB: volsync-src-{{.APP}}
+      - kubectl --context {{.cluster}} -n {{.ns}} patch replicationsources {{.app}} --type merge -p '{"spec":{"trigger":{"manual":"{{.now}}"}}}'
+      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}}
+      - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=120m
+    env: *env-vars
     requires:
-      vars: [CLUSTER, APP]
+      vars: ["cluster", "app"]
+    vars:
+      now: '{{now | date "150405"}}'
+      ns: '{{.ns | default "default"}}'
+      job: volsync-src-{{.app}}
+      controller:
+        sh: true && {{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh {{.app}} {{.ns}} {{.cluster}}
     preconditions:
-      - kubectl --namespace {{.NS}} get replicationsources {{.APP}}
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
+      - kubectl --context {{.cluster}} -n {{.ns}} get replicationsources {{.app}}
 
   # To run restore jobs in parallel for all replicationdestinations:
-  #    - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:restore APP=$0 NS=$1'
+  #    - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:restore app=$0 ns=$1'
   restore:
-    desc: Restore an application
-    summary: |-
-      CLUSTER: Cluster to run command against (default: main)
-      NS: Namespace the application is in (default: default)
-      APP: Application to restore (required)
-      PREVIOUS: Previous number of snapshots to restore (default: 2)
+    desc: Restore a PVC for an application
+    summary: |
+      cluster: Cluster to run command against (required)
+      ns: Namespace the PVC is in (default: default)
+      app: Application to restore (required)
+      previous: Previous number of snapshots to restore (default: 2)
     cmds:
-      - task: .suspend
-      - task: .restore
-      - task: .resume
+      - { task: .suspend, vars: *env-vars }
+      - { task: .wipe, vars: *env-vars }
+      - { task: .restore, vars: *env-vars }
+      - { task: .resume, vars: *env-vars }
+    env: *env-vars
     requires:
-      vars: [CLUSTER, APP]
+      vars: ["cluster", "app"]
+    vars:
+      ns: '{{.ns | default "default"}}'
+      previous: '{{.previous | default 2}}'
+      controller:
+        sh: "{{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh {{.app}} {{.ns}}"
+      claim:
+        sh: kubectl --context {{.cluster}} -n {{.ns}} get replicationsources/{{.app}} -o jsonpath="{.spec.sourcePVC}"
+      puid:
+        sh: kubectl --context {{.cluster}} -n {{.ns}} get replicationsources/{{.app}} -o jsonpath="{.spec.restic.moverSecurityContext.runAsUser}"
+      pgid:
+        sh: kubectl --context {{.cluster}} -n {{.ns}} get replicationsources/{{.app}} -o jsonpath="{.spec.restic.moverSecurityContext.runAsGroup}"
+    preconditions:
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh
 
+  cleanup:
+    desc: Delete volume populator PVCs in all namespaces
+    summary: |
+      cluster: Cluster to run command against (required)
+    cmds:
+      - for: { var: dest }
+        cmd: |
+          {{- $items := (split "/" .ITEM) }}
+          kubectl --context {{.cluster}} delete pvc -n {{ $items._0 }} {{ $items._1 }}
+      - for: { var: cache }
+        cmd: |
+          {{- $items := (split "/" .ITEM) }}
+          kubectl --context {{.cluster}} delete pvc -n {{ $items._0 }} {{ $items._1 }}
+      - for: { var: snaps }
+        cmd: |
+          {{- $items := (split "/" .ITEM) }}
+          kubectl --context {{.cluster}} delete volumesnapshot -n {{ $items._0 }} {{ $items._1 }}
+    env: *env-vars
+    requires:
+      vars: ["cluster"]
+    vars:
+      dest:
+        sh: kubectl --context {{.cluster}} get pvc --all-namespaces --no-headers | grep "dst-dest" | awk '{print $1 "/" $2}'
+      cache:
+        sh: kubectl --context {{.cluster}} get pvc --all-namespaces --no-headers | grep "dst-cache" | awk '{print $1 "/" $2}'
+      snaps:
+        sh: kubectl --context {{.cluster}} get volumesnapshot --all-namespaces --no-headers | grep "dst-dest" | awk '{print $1 "/" $2}'
+
+  # Suspend the Flux ks and hr
   .suspend:
     internal: true
     cmds:
-      - flux --namespace flux-system suspend kustomization {{.APP}}
-      - flux --namespace {{.NS}} suspend helmrelease {{.APP}}
-      - kubectl --namespace {{.NS}} scale {{.CONTROLLER}}/{{.APP}} --replicas 0
-      - kubectl --namespace {{.NS}} wait pod --for=delete --selector="app.kubernetes.io/name={{.APP}}" --timeout=5m
-    vars:
-      NS: '{{.NS | default "default"}}'
-      APP: '{{.APP}}'
-      CONTROLLER:
-        sh: kubectl --namespace {{.NS}} get deployment {{.APP}} &>/dev/null && echo deployment || echo statefulset
+      - flux --context {{.cluster}} -n flux-system suspend kustomization {{.app}}
+      - flux --context {{.cluster}} -n {{.ns}} suspend helmrelease {{.app}}
+      - kubectl --context {{.cluster}} -n {{.ns}} scale {{.controller}} --replicas 0
+      - kubectl --context {{.cluster}} -n {{.ns}} wait pod --for delete --selector="app.kubernetes.io/name={{.app}}" --timeout=2m
+    env: *env-vars
 
+  # Wipe the PVC of all data
+  .wipe:
+    internal: true
+    cmds:
+      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/wipe.tmpl.yaml) | kubectl --context {{.cluster}} apply -f -
+      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}}
+      - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=120m
+      - kubectl --context {{.cluster}} -n {{.ns}} logs job/{{.job}} --container main
+      - kubectl --context {{.cluster}} -n {{.ns}} delete job {{.job}}
+    env: *env-vars
+    vars:
+      job: volsync-wipe-{{.app}}
+    preconditions:
+      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wipe.tmpl.yaml
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
+
+  # Create VolSync replicationdestination CR to restore data
   .restore:
     internal: true
     cmds:
-      - minijinja-cli --env --trim-blocks --lstrip-blocks --autoescape=none {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.yaml.j2 | kubectl apply --server-side --filename -
-      - until kubectl --namespace {{.NS}} get job/{{.JOB}} &>/dev/null; do sleep 5; done
-      - kubectl --namespace {{.NS}} wait job/{{.JOB}} --for=condition=complete --timeout=120m
-      - kubectl --namespace {{.NS}} delete replicationdestination {{.JOB}}
+      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.tmpl.yaml) | kubectl --context {{.cluster}} apply -f -
+      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}}
+      - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=120m
+      - kubectl --context {{.cluster}} -n {{.ns}} delete replicationdestination {{.job}}
+    env: *env-vars
     vars:
-      NS: '{{.NS | default "default"}}'
-      JOB: volsync-dst-{{.APP}}
-      PREVIOUS: '{{.PREVIOUS | default 2}}'
-      CLAIM:
-        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.sourcePVC}"
-      ACCESS_MODES:
-        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.accessModes}"
-      STORAGE_CLASS_NAME:
-        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.storageClassName}"
-      PUID:
-        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.moverSecurityContext.runAsUser}"
-      PGID:
-        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.moverSecurityContext.runAsGroup}"
-    env:
-      NS: '{{.NS}}'
-      JOB: '{{.JOB}}'
-      APP: '{{.APP}}'
-      PREVIOUS: '{{.PREVIOUS}}'
-      CLAIM: '{{.CLAIM}}'
-      ACCESS_MODES: '{{.ACCESS_MODES}}'
-      STORAGE_CLASS_NAME: '{{.STORAGE_CLASS_NAME}}'
-      PUID: '{{.PUID}}'
-      PGID: '{{.PGID}}'
+      job: volsync-dst-{{.app}}
     preconditions:
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.yaml.j2
+      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.tmpl.yaml
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
 
+  # Resume Flux ks and hr
   .resume:
     internal: true
     cmds:
-      - flux --namespace {{.NS}} resume helmrelease {{.APP}}
-      - flux --namespace flux-system resume kustomization {{.APP}}
-      - kubectl --namespace {{.NS}} scale {{.CONTROLLER}}/{{.APP}} --replicas 1
-      - kubectl --namespace {{.NS}} wait pod --for=condition=ready --selector="app.kubernetes.io/name={{.APP}}" --timeout=5m
-    vars:
-      NS: '{{.NS | default "default"}}'
-      APP: '{{.APP}}'
-      CONTROLLER:
-        sh: kubectl --namespace {{.NS}} get deployment {{.APP}} &>/dev/null && echo deployment || echo statefulset
+      - flux --context {{.cluster}} -n {{.ns}} resume helmrelease {{.app}}
+      - flux --context {{.cluster}} -n flux-system resume kustomization {{.app}}
+    env: *env-vars

.taskfiles/volsync/resources/.env

@@ -0,0 +1 @@
+CLUSTER=theshire

.taskfiles/volsync/resources/list.tmpl.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ${job}
+  namespace: ${ns}
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: OnFailure
+      containers:
+        - name: main
+          image: docker.io/restic/restic:latest
+          args: ["snapshots"]
+          envFrom:
+            - secretRef:
+                name: ${app}-volsync-r2-secret
+          resources: {}

.taskfiles/volsync/resources/replicationdestination.tmpl.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: ${job}
+  namespace: ${ns}
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: ${app}-volsync-r2-secret
+    destinationPVC: ${claim}
+    copyMethod: Direct
+    storageClassName: ceph-block
+    # storageClassName: ceph-filesystem
+    # accessModes: ["ReadWriteMany"]
+    # IMPORTANT NOTE:
+    #   Set to the last X number of snapshots to restore from
+    previous: ${previous}
+    # OR;
+    # IMPORTANT NOTE:
+    #   On bootstrap set `restoreAsOf` to the time the old cluster was destroyed.
+    #   This will essentially prevent volsync from trying to restore a backup
+    #   from a application that started with default data in the PVC.
+    #   Do not restore snapshots made after the following RFC3339 Timestamp.
+    #   date --rfc-3339=seconds (--utc)
+    # restoreAsOf: "2022-12-10T16:00:00-05:00"
+    moverSecurityContext:
+      runAsUser: ${puid}
+      runAsGroup: ${pgid}
+      fsGroup: ${pgid}

.taskfiles/volsync/resources/replicationdestination.yaml.j2

@@ -1,23 +0,0 @@
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationDestination
-metadata:
-  name: {{ ENV.JOB }}
-  namespace: {{ ENV.NS }}
-spec:
-  trigger:
-    manual: restore-once
-  restic:
-    repository: {{ ENV.APP }}-volsync-secret
-    destinationPVC: {{ ENV.CLAIM }}
-    copyMethod: Direct
-    storageClassName: {{ ENV.STORAGE_CLASS_NAME }}
-    accessModes: {{ ENV.ACCESS_MODES }}
-    previous: {{ ENV.PREVIOUS }}
-    enableFileDeletion: true
-    cleanupCachePVC: true
-    cleanupTempPVC: true
-    moverSecurityContext:
-      runAsUser: {{ ENV.PUID }}
-      runAsGroup: {{ ENV.PGID }}
-      fsGroup: {{ ENV.PGID }}

.taskfiles/volsync/resources/unlock.tmpl.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ${job}
+  namespace: ${ns}
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: OnFailure
+      containers:
+        - name: minio
+          image: docker.io/restic/restic:latest
+          args: ["unlock", "--remove-all"]
+          envFrom:
+            - secretRef:
+                name: ${app}-volsync-secret
+          resources: {}
+        - name: r2
+          image: docker.io/restic/restic:latest
+          args: ["unlock", "--remove-all"]
+          envFrom:
+            - secretRef:
+                name: ${app}-volsync-r2-secret
+          resources: {}

.taskfiles/volsync/resources/wait-for-job.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+JOB=$1
+NAMESPACE="${2:-default}"
+CLUSTER="${3:-main}"
+
+[[ -z "${JOB}" ]] && echo "Job name not specified" && exit 1
+while true; do
+    STATUS="$(kubectl --context "${CLUSTER}" -n "${NAMESPACE}" get pod -l job-name="${JOB}" -o jsonpath='{.items[*].status.phase}')"
+    if [ "${STATUS}" == "Pending" ]; then
+        break
+    fi
+    sleep 1
+done

.taskfiles/volsync/resources/which-controller.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+APP=$1
+NAMESPACE="${2:-default}"
+CLUSTER="${3:-theshire}"
+
+is_deployment() {
+    kubectl --context "${CLUSTER}" -n "${NAMESPACE}" get deployment "${APP}" >/dev/null 2>&1
+}
+
+is_statefulset() {
+    kubectl --context "${CLUSTER}" -n "${NAMESPACE}" get statefulset "${APP}" >/dev/null 2>&1
+}
+
+if is_deployment; then
+    echo "deployment.apps/${APP}"
+elif is_statefulset; then
+    echo "statefulset.apps/${APP}"
+else
+    echo "No deployment or statefulset found for ${APP}"
+    exit 1
+fi

.taskfiles/volsync/resources/wipe.tmpl.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ${job}
+  namespace: ${ns}
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: OnFailure
+      containers:
+        - name: main
+          image: docker.io/library/alpine:latest
+          command: ["/bin/sh", "-c", "cd /config; find . -delete"]
+          volumeMounts:
+            - name: config
+              mountPath: /config
+          securityContext:
+            privileged: true
+          resources: {}
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: ${claim}

kubernetes/apps/ai/ollama/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: docker.io/ollama/ollama
-              tag: 0.3.14
+              tag: 0.3.12
             env:
               - name: OLLAMA_HOST
                 value: 0.0.0.0

kubernetes/apps/ai/ollama/ks.yaml

@@ -22,6 +22,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/ai/open-webui/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/ai/open-webui/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/anime/kustomization.yaml

@@ -1,13 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  # Pre Flux-Kustomizations
-  - ./namespace.yaml
-  # Flux-Kustomizations
-  # - ./jellyfin/ks.yaml    # sqlite
-  # - ./jellyseerr/ks.yaml  # sqlite
-  - ./radarr/ks.yaml      # postgres
-  # - ./shoko/ks.yaml       # sqlite
-  - ./sonarr/ks.yaml      # postgres

kubernetes/apps/anime/namespace.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: anime
-  labels:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-    volsync.backube/privileged-movers: "true"
-    pgo-enabled-hsn.dev: "true"

kubernetes/apps/anime/radarr/app/externalsecret.yaml

@@ -1,46 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: radarr
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: radarr-secret
-    template:
-      engineVersion: v2
-      data:
-        PUSHOVER_TOKEN: "{{ .radarr_token }}"
-        PUSHOVER_USER_KEY: "{{ .userkey_jahanson }}"
-        RADARR__AUTH__APIKEY: "{{ .api_key_anime }}"
-  dataFrom:
-    - extract:
-        key: pushover
-    - extract:
-        key: radarr
----
-# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: radarr-db
-spec:
-  secretStoreRef:
-    name: crunchy-pgo-secrets
-    kind: ClusterSecretStore
-  target:
-    name: radarr-db-secret
-    template:
-      engineVersion: v2
-      data:
-        RADARR__POSTGRES__HOST: "{{ index . \"pgbouncer-host\" }}"
-        RADARR__POSTGRES__USER: "{{ .user }}"
-        RADARR__POSTGRES__PASSWORD: "{{ .password }}"
-        RADARR__POSTGRES__PORT: "{{ .port }}"
-        RADARR__POSTGRES__MAINDB: "{{ .dbname }}"
-  dataFrom:
-    - extract:
-        key: postgres-pguser-radarr-anime

kubernetes/apps/anime/radarr/app/helmrelease.yaml

@@ -1,119 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: &app radarr-anime
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.1
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    controllers:
-      radarr:
-        annotations:
-          reloader.stakater.com/auto: "true"
-        containers:
-          app:
-            image:
-              repository: ghcr.io/onedr0p/radarr-develop
-              tag: 5.13.0.9361
-            env:
-              RADARR__APP__INSTANCENAME: Radarr-Anime
-              RADARR__APP__THEME: dark
-              RADARR__AUTH__METHOD: External
-              RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
-              RADARR__LOG__DBENABLED: "False"
-              RADARR__LOG__LEVEL: info
-              RADARR__SERVER__PORT: &port 80
-              RADARR__UPDATE__BRANCH: develop
-              TZ: America/Chicago
-            envFrom:
-              - secretRef:
-                  name: radarr-secret
-              - secretRef:
-                  name: radarr-db-secret
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /ping
-                    port: *port
-                  initialDelaySeconds: 0
-                  periodSeconds: 10
-                  timeoutSeconds: 1
-                  failureThreshold: 3
-              readiness: *probes
-              startup:
-                enabled: false
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-            resources:
-              requests:
-                cpu: 10m
-              limits:
-                memory: 6Gi
-        pod:
-          securityContext:
-            runAsUser: 568
-            runAsGroup: 568
-            runAsNonRoot: true
-            fsGroup: 568
-            fsGroupChangePolicy: OnRootMismatch
-            supplementalGroups: [10000]
-    service:
-      app:
-        controller: radarr
-        ports:
-          http:
-            port: *port
-    ingress:
-      app:
-        enabled: true
-        className: internal-nginx
-        hosts:
-          - host: &host "{{ .Release.Name }}.jahanson.tech"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - hosts:
-              - *host
-    persistence:
-      config:
-        enabled: true
-        existingClaim: *app
-      tmp:
-        type: emptyDir
-      media:
-        type: nfs
-        server: 10.1.1.13
-        path: /eru/media
-        globalMounts:
-          - path: /data/nas-media
-      moria-media:
-        type: nfs
-        server: 10.1.1.61
-        path: /moria/media/
-        globalMounts:
-          - path: /data/moria-media

kubernetes/apps/anime/radarr/app/kustomization.yaml

@@ -1,8 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./externalsecret.yaml
-  - ./helmrelease.yaml
-  - ../../../../templates/volsync

kubernetes/apps/anime/radarr/ks.yaml

@@ -1,29 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app radarr-anime
-  namespace: flux-system
-spec:
-  targetNamespace: anime
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: crunchy-postgres-operator
-    - name: external-secrets-stores
-    - name: rook-ceph-cluster
-    - name: volsync
-  path: ./kubernetes/apps/anime/radarr/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: theshire
-  wait: false
-  interval: 30m
-  timeout: 5m
-  postBuild:
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/anime/sonarr/app/externalsecret.yaml

@@ -1,47 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: sonarr-secret
-    template:
-      engineVersion: v2
-      data:
-        PUSHOVER_TOKEN: "{{ .sonarr_token }}"
-        PUSHOVER_USER_KEY: "{{ .userkey_jahanson }}"
-        SONARR__AUTH__APIKEY: "{{ .api_key_anime }}"
-  dataFrom:
-    - extract:
-        key: pushover
-    - extract:
-        key: sonarr
----
-# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr-db
-spec:
-  secretStoreRef:
-    name: crunchy-pgo-secrets
-    kind: ClusterSecretStore
-  target:
-    name: sonarr-db-secret
-    template:
-      engineVersion: v2
-      data:
-        SONARR__POSTGRES__HOST: "{{ index . \"pgbouncer-host\" }}"
-        SONARR__POSTGRES__USER: "{{ .user }}"
-        SONARR__POSTGRES__PASSWORD: "{{ .password }}"
-        SONARR__POSTGRES__PORT: "{{ .port }}"
-        SONARR__POSTGRES__MAINDB: "{{ .dbname }}"
-  dataFrom:
-    - extract:
-        key: postgres-pguser-sonarr-anime

kubernetes/apps/anime/sonarr/app/helmrelease.yaml

@@ -1,119 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: &app sonarr-anime
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.1
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    controllers:
-      sonarr:
-        annotations:
-          reloader.stakater.com/auto: "true"
-        containers:
-          app:
-            image:
-              repository: ghcr.io/onedr0p/sonarr-develop
-              tag: 4.0.9.2513
-            env:
-              SONARR__APP__INSTANCENAME: Sonarr-Anime
-              SONARR__APP__THEME: dark
-              SONARR__AUTH__METHOD: External
-              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
-              SONARR__LOG__DBENABLED: "False"
-              SONARR__LOG__LEVEL: info
-              SONARR__SERVER__PORT: &port 80
-              SONARR__UPDATE__BRANCH: develop
-              TZ: America/Chicago
-            envFrom:
-              - secretRef:
-                  name: sonarr-secret
-              - secretRef:
-                  name: sonarr-db-secret
-            probes:
-              liveness: &probes
-                enabled: true
-                custom: true
-                spec:
-                  httpGet:
-                    path: /ping
-                    port: *port
-                  initialDelaySeconds: 0
-                  periodSeconds: 30
-                  timeoutSeconds: 5
-                  failureThreshold: 3
-              readiness: *probes
-              startup:
-                enabled: false
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-            resources:
-              requests:
-                cpu: 10m
-              limits:
-                memory: 6Gi
-        pod:
-          securityContext:
-            runAsUser: 568
-            runAsGroup: 568
-            runAsNonRoot: true
-            fsGroup: 568
-            fsGroupChangePolicy: OnRootMismatch
-            supplementalGroups: [10000]
-    service:
-      app:
-        controller: sonarr
-        ports:
-          http:
-            port: *port
-    ingress:
-      main:
-        enabled: true
-        className: internal-nginx
-        hosts:
-          - host: &host "{{ .Release.Name }}.jahanson.tech"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - hosts:
-              - *host
-    persistence:
-      config:
-        enabled: true
-        existingClaim: *app
-      tmp:
-        type: emptyDir
-      media:
-        type: nfs
-        server: 10.1.1.13
-        path: /eru/media
-        globalMounts:
-          - path: /data/nas-media
-      moria-media:
-        type: nfs
-        server: 10.1.1.61
-        path: /moria/media/
-        globalMounts:
-          - path: /data/moria-media

kubernetes/apps/anime/sonarr/app/kustomization.yaml

@@ -1,8 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./externalsecret.yaml
-  - ./helmrelease.yaml
-  - ../../../../templates/volsync

kubernetes/apps/anime/sonarr/ks.yaml

@@ -1,29 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app sonarr-anime
-  namespace: flux-system
-spec:
-  targetNamespace: anime
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: crunchy-postgres-operator
-    - name: external-secrets-stores
-    - name: volsync
-    - name: rook-ceph-cluster
-  path: ./kubernetes/apps/anime/sonarr/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: theshire
-  wait: false
-  interval: 30m
-  timeout: 5m
-  postBuild:
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -3,12 +3,9 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app cert-manager
+  name: cert-manager
   namespace: flux-system
 spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
   interval: 10m
   path: "./kubernetes/apps/cert-manager/cert-manager/app"
   prune: true
@@ -21,12 +18,9 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app cert-manager-issuers
+  name: cert-manager-issuers
   namespace: flux-system
 spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
   interval: 10m
   path: "./kubernetes/apps/cert-manager/cert-manager/issuers"
   prune: true

kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml

@@ -3,12 +3,9 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app cert-manager-webhook-dnsimple
+  name: cert-manager-webhook-dnsimple
   namespace: flux-system
 spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
   targetNamespace: cert-manager
   interval: 10m
   path: "./kubernetes/apps/cert-manager/webhook-dnsimple/app"

kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/coder/coder/ks.yaml

@@ -20,4 +20,5 @@ spec:
     name: theshire
   wait: true
   interval: 30m
+  retryInterval: 1m
   timeout: 5m

kubernetes/apps/database/crunchy-postgres-operator/cluster/kustomization.yaml

@@ -5,7 +5,6 @@ kind: Kustomization
 resources:
   - ./externalsecret.yaml
   - ./gatus.yaml
-  - ./podmonitor.yaml
   - ./postgrescluster.yaml
   - ./pushsecret.yaml
   - ./service.yaml

kubernetes/apps/database/crunchy-postgres-operator/cluster/podmonitor.yaml

@@ -1,38 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/podmonitor_v1.json
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
-  name: cpgo-postgres
-spec:
-  jobLabel: cpgo-postgres
-  namespaceSelector:
-    matchNames:
-      - database
-  podMetricsEndpoints:
-    - honorLabels: true
-      path: /metrics
-      port: exporter
-      relabelings:
-        - sourceLabels:
-            [
-              "__meta_kubernetes_namespace",
-              "__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_cluster",
-            ]
-          targetLabel: pg_cluster
-          separator: "/"
-          replacement: "$1$2"
-        - sourceLabels:
-            [
-              __meta_kubernetes_pod_label_postgres_operator_crunchydata_com_instance,
-            ]
-          targetLabel: deployment
-        - sourceLabels:
-            [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_role]
-          targetLabel: role
-        - sourceLabels: [__meta_kubernetes_pod_name]
-          targetLabel: instance
-  selector:
-    matchLabels:
-      postgres-operator.crunchydata.com/cluster: postgres
-      postgres-operator.crunchydata.com/crunchy-postgres-exporter: "true"

kubernetes/apps/database/crunchy-postgres-operator/cluster/postgrescluster.yaml

@@ -23,13 +23,7 @@ spec:
     pgmonitor:
       exporter:
         # https://github.com/CrunchyData/postgres-operator-examples/blob/main/helm/install/values.yaml
-        # image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.15.0-12
-        resources:
-          requests:
-            cpu: 10m
-            memory: 64M
-          limits:
-            memory: 512M
+        image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.15.0-3
 
   patroni: # turn on sync writes to at least 1 other replica
     dynamicConfiguration:
@@ -45,7 +39,7 @@ spec:
       metadata:
         labels:
           app.kubernetes.io/name: crunchy-postgres
-      replicas: &replica 2
+      replicas: &replica 1
       dataVolumeClaimSpec:
         storageClassName: openebs-hostpath
         accessModes:
@@ -123,22 +117,12 @@ spec:
         - radarr_main
       password:
         type: AlphaNumeric
-    - name: radarr-anime
-      databases:
-        - radarr_anime
-      password:
-        type: AlphaNumeric
     - name: sonarr
       databases:
         - sonarr_logs
         - sonarr_main
       password:
         type: AlphaNumeric
-    - name: sonarr-anime
-      databases:
-        - sonarr_anime
-      password:
-        type: AlphaNumeric
     - name: jellyseerr
       databases:
         - jellyseerr
@@ -193,12 +177,6 @@ spec:
     pgBouncer:
       port: 5432
       replicas: *replica
-      service:
-        type: LoadBalancer
-        metadata:
-          annotations:
-            external-dns.alpha.kubernetes.io/hostname: pgbouncer.jahanson.tech
-            io.cilium/lb-ipam-ips: 10.1.1.36
       metadata:
         labels:
           app.kubernetes.io/name: crunchy-postgres-pgbouncer

kubernetes/apps/database/crunchy-postgres-operator/operator/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: pgo
-      version: 5.7.0
+      version: 5.6.1
       sourceRef:
         kind: HelmRepository
         name: crunchydata

kubernetes/apps/database/crunchy-postgres-operator/userinit-controller/helmrepository.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrepository-source-v1.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrepository-source-v1beta2.json
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:

kubernetes/apps/database/dragonfly/cluster/dragonfly.yaml

@@ -5,7 +5,7 @@ kind: Dragonfly
 metadata:
   name: dragonfly
 spec:
-  image: ghcr.io/dragonflydb/dragonfly:v1.24.0
+  image: ghcr.io/dragonflydb/dragonfly:v1.23.2
   replicas: 3
   env:
     - name: MAX_MEMORY

kubernetes/apps/database/dragonfly/ks.yaml

@@ -19,6 +19,7 @@ spec:
     name: theshire
   wait: true
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@@ -41,4 +42,5 @@ spec:
     name: theshire
   wait: true
   interval: 30m
+  retryInterval: 1m
   timeout: 5m

kubernetes/apps/database/emqx/app/externalsecret.yaml

@@ -44,17 +44,17 @@ spec:
             {
               "user_id": "tasmota",
               "password": "{{ .x_emqx_tasmota_password }}",
-              "is_superuser": true
+              "is_superuser": true # Until I can figure out authorization in emqx
             },
             {
               "user_id": "zwave",
               "password": "{{ .x_emqx_homeassistant_password }}",
-              "is_superuser": true
+              "is_superuser": true # Until I can figure out authorization in emqx
             },
             {
               "user_id": "zwave",
               "password": "{{ .x_emqx_zwave_password }}",
-              "is_superuser": true
+              "is_superuser": true # Until I can figure out authorization in emqx
             }
           ]
 

kubernetes/apps/database/emqx/app/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: emqx-operator
-      version: 2.2.25
+      version: 2.2.24
       sourceRef:
         kind: HelmRepository
         name: emqx
@@ -26,8 +26,6 @@ spec:
     - name: cert-manager
       namespace: cert-manager
   values:
-    podannotations:
-      reloader.stakater.com/auto: "true"
     fullnameOverride: emqx-operator
     image:
       repository: ghcr.io/emqx/emqx-operator

kubernetes/apps/database/emqx/cluster/cluster.yaml

@@ -5,7 +5,7 @@ kind: EMQX
 metadata:
   name: emqx
 spec:
-  image: public.ecr.aws/emqx/emqx:5.8.1
+  image: public.ecr.aws/emqx/emqx:5.8.0
   config:
     mode: Merge
   coreTemplate:

kubernetes/apps/database/emqx/cluster/resources/emqx.conf

@@ -2,7 +2,7 @@ authentication {
   backend = "built_in_database"
   mechanism = "password_based"
   password_hash_algorithm {
-      name = "bcrypt"
+      name = "bcrypt",
   }
   user_id_type = "username"
   bootstrap_file = "/opt/init-user.json"
@@ -11,6 +11,11 @@ authentication {
 
 authorization {
   sources = [
+    {
+      type = file
+      enable = true
+      path = "/opt/acl.conf"
+    },
     {
       type = built_in_database
       enable = true

kubernetes/apps/database/emqx/ks.yaml

@@ -19,6 +19,7 @@ spec:
     name: theshire
   wait: true
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@@ -41,4 +42,5 @@ spec:
     name: theshire
   wait: true
   interval: 30m
+  retryInterval: 1m
   timeout: 5m

kubernetes/apps/default/atuin/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/autobrr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/autobrr/autobrr
-              tag: v1.48.0@sha256:0ae19e3beedf491396e450b024c23e9e24df4d692286c0442a81fa699493def0
+              tag: v1.47.1@sha256:5364237a98b12bb269384dd4f4feaf7583027591c26bc2e6aaac0baa4e142b34
             env:
               AUTOBRR__CHECK_FOR_UPDATES: "false"
               AUTOBRR__HOST: 0.0.0.0

kubernetes/apps/default/autobrr/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/excalidraw/app/helmrelease.yaml

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: docker.io/excalidraw/excalidraw
-              tag: latest@sha256:687708a6c879b9120c82b61faf9ff242367395be1d5f90c385989405e51b5433
+              tag: latest@sha256:df3ddf00d7977d7007ea33b5397239ff20955eeeeafd38735cb1604be799564a
               pullPolicy: IfNotPresent
             probes:
               liveness:

kubernetes/apps/default/excalidraw/ks.yaml

@@ -17,6 +17,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/home-assistant/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/home-assistant
-              tag: 2024.10.3@sha256:59cb3b01ea4695c5df8f4cc1e4d01fa7e22090caa3fd3f000a96b6a5de909f91
+              tag: 2024.10.1@sha256:04614835418d2bdacd64685b516e58e7c5446f72485d446e7635282ba1a06c43
             env:
               TZ: America/Chicago
             envFrom:

kubernetes/apps/default/home-assistant/ks.yaml

@@ -19,6 +19,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/it-tools/ks.yaml

@@ -17,6 +17,7 @@ spec:
     name: theshire
   wait: false # no flux ks dependents
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/kustomization.yaml

@@ -22,7 +22,6 @@ resources:
   - ./recyclarr/ks.yaml
   - ./redlib/ks.yaml
   - ./sabnzbd/ks.yaml
-  - ./scrypted/ks.yaml
   - ./searxng/ks.yaml
   - ./sonarr/ks.yaml
   - ./tautulli/ks.yaml

kubernetes/apps/default/linkwarden/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/linkwarden/app/kustomization.yaml

@@ -3,7 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./externalsecret.yaml
-  - ./helmrelease.yaml
   - ../../../../templates/gatus/internal
   - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml

kubernetes/apps/default/linkwarden/ks.yaml

@@ -22,6 +22,7 @@ spec:
     name: theshire
   wait: false # no flux ks dependents
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/maintainerr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/maintainerr/app/kustomization.yaml

@@ -5,4 +5,4 @@ kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ../../../../templates/volsync
-  - ../../../../templates/gatus/internal
+  # - ../../../../templates/gatus/internal

kubernetes/apps/default/omegabrr/ks.yaml

@@ -19,6 +19,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/overseerr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/overseerr/ks.yaml

@@ -20,6 +20,7 @@ spec:
     - name: volsync
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/piped/app/helmrelease.yaml

@@ -18,11 +18,6 @@ spec:
   values:
     defaultPodOptions:
       automountServiceAccountToken: false
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        fsGroupChangePolicy: "OnRootMismatch"
 
     controllers:
       backend:
@@ -30,6 +25,13 @@ spec:
         annotations:
           secret.reloader.stakater.com/reload: piped-secret
 
+        pod:
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            fsGroupChangePolicy: "OnRootMismatch"
+
         containers:
           app:
             image:
@@ -56,13 +58,21 @@ spec:
 
       frontend:
         strategy: RollingUpdate
+        pod:
+          securityContext:
+            runAsUser: 101
+            runAsGroup: 101
+            fsGroup: 101
+            fsGroupChangePolicy: "OnRootMismatch"
 
         containers:
           app:
             image:
               repository: ghcr.io/bjw-s-labs/piped-frontend
-              tag: 2024.10.19@sha256:73dc140014c715b503b0b8b806fd2e6ed070eeef6b2556b28a4381c690ebfdc8
+              tag: latest@sha256:c4cb0cfbdf149cdb738fb9e41a5cc748a7ea53053f4c5e036b9f7578d9273328
             env:
+              HTTP_PORT: 8080
+              HTTP_WORKERS: 4
               BACKEND_HOSTNAME: piped-api.hsn.dev
             probes:
               liveness:
@@ -77,19 +87,21 @@ spec:
                 memory: 256Mi
             securityContext:
               allowPrivilegeEscalation: false
-              capabilities:
-                drop:
-                  - ALL
-              readOnlyRootFilesystem: true
 
       ytproxy:
         strategy: RollingUpdate
+        pod:
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            fsGroupChangePolicy: "OnRootMismatch"
 
         containers:
           app:
             image:
               repository: 1337kavin/piped-proxy
-              tag: latest@sha256:47cf993679d1bf6b1dbfd3282e143818f2f11106832605789d1e26df52ac7b41
+              tag: latest@sha256:9872edd2c47c9c33dfa44c334e4cef4e2c6ec91638eb2dcf6ca36b7b3037fd59
             command:
               - /app/piped-proxy
             probes:

kubernetes/apps/default/plex/ks.yaml

@@ -19,6 +19,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/prowlarr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/prowlarr-develop
-              tag: 1.25.4.4818@sha256:5a936e5c73ebedfc45f1fa2541e84862a6c0df75b8f5148a082119fb65d55e2b
+              tag: 1.25.1.4770@sha256:8b59eb7f9e5321b702bdacae3468b63d71720091ba3b0e9dfaca686a7705d2b8
             env:
               # Ref: https://github.com/Radarr/Radarr/issues/7030#issuecomment-1039689518
               # Ref: https://github.com/dotnet/runtime/issues/9336

kubernetes/apps/default/prowlarr/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/radarr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/radarr-develop
-              tag: 5.13.0.9361
+              tag: 5.12.0.9255
             env:
               RADARR__APP__INSTANCENAME: Radarr
               RADARR__APP__THEME: dark

kubernetes/apps/default/radarr/ks.yaml

@@ -22,6 +22,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/recyclarr/app/resources/recyclarr.yml

@@ -11,12 +11,6 @@ sonarr:
     quality_definition:
       type: series
 
-    include:
-      # Comment out any of the following includes to disable them
-      - template: sonarr-quality-definition-anime
-      - template: sonarr-v4-quality-profile-anime
-      - template: sonarr-v4-custom-formats-anime
-
     quality_profiles:
       - name: Web 1080p
         reset_unmatched_scores:
@@ -106,22 +100,6 @@ sonarr:
         assign_scores_to:
           - name: Web 1080p
           - name: Web 720p
-      # Anime Score Overrides
-      - trash_ids:
-          - 026d5aadd1a6b4e550b134cb6c72b3ca # Uncensored
-        assign_scores_to:
-          - name: Remux-1080p - Anime
-            score: 0 # Adjust scoring as desired
-      - trash_ids:
-          - b2550eb333d27b75833e25b8c2557b38 # 10bit
-        assign_scores_to:
-          - name: Remux-1080p - Anime
-            score: 0 # Adjust scoring as desired
-      - trash_ids:
-          - 418f50b10f1907201b6cfdf881f467b7 # Anime Dual Audio
-        assign_scores_to:
-          - name: Remux-1080p - Anime
-            score: 0 # Adjust scoring as desired
 
 radarr:
   radarr:

kubernetes/apps/default/recyclarr/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/redlib/app/helmrelease.yaml

@@ -38,7 +38,7 @@ spec:
           app:
             image:
               repository: quay.io/redlib/redlib
-              tag: latest@sha256:a3f1eca3ebfc043eea4bc8274b1e9fe86ec15d0efa13536bd519f36eb18f763d
+              tag: latest@sha256:e61e2535518e0b574f92642612f33f6fbee1aa22b2ff36ee740e26a025bb0039
             env:
               REDLIB_DEFAULT_SHOW_NSFW: on
               REDLIB_DEFAULT_WIDE: on

kubernetes/apps/default/redlib/ks.yaml

@@ -19,6 +19,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/sabnzbd/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/sabnzbd
-              tag: 4.3.3@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
+              tag: 4.3.3@sha256:6614d759bbaa6884926c6aa75018339bd35cd1add0ff92c907087327dd470477
             env:
               TZ: America/Chicago
               SABNZBD__PORT: &port 80

kubernetes/apps/default/sabnzbd/ks.yaml

@@ -21,6 +21,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/scrypted/app/helmrelease.yaml

@@ -1,120 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: &app scrypted
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.1
-      interval: 30m
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-
-  values:
-    controllers:
-      scrypted:
-        annotations:
-          reloader.stakater.com/auto: "true"
-        pod:
-          nodeSelector:
-            google.feature.node.kubernetes.io/coral: "true"
-            nvidia.com/gpu.present: "true"
-          securityContext:
-            supplementalGroups:
-              - 568
-        containers:
-          app:
-            image:
-              repository: ghcr.io/koush/scrypted
-              tag: v0.121.0-jammy-nvidia
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-              startup:
-                enabled: true
-                spec:
-                  failureThreshold: 30
-                  periodSeconds: 5
-            resources:
-              requests:
-                cpu: 136m
-                memory: 1024Mi
-              limits:
-                nvidia.com/gpu: 1
-                memory: 8192Mi
-            securityContext:
-              privileged: true
-    service:
-      app:
-        controller: *app
-        type: LoadBalancer
-        annotations:
-          io.cilium/lb-ipam-ips: 10.1.1.33
-        nameOverride: *app
-        ports:
-          http:
-            port: 11080
-            primary: true
-          rebroadcast1: # driveway
-            port: 39655
-          rebroadcast2: # sideyard
-            port: 46561
-          rebroadcast3: # doorbell
-            port: 44759
-          homekit: # homekit
-            port: 42010
-          homekit-bridge: # bridge
-            port: 33961
-
-
-    ingress:
-      app:
-        className: "internal-nginx"
-        annotations:
-        hosts:
-          - host: &host scrypted.jahanson.tech
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - hosts:
-              - *host
-    persistence:
-      config:
-        existingClaim: scrypted
-        advancedMounts:
-          scrypted:
-            app:
-              - path: /server/volume
-      cache:
-        type: emptyDir
-        globalMounts:
-          - path: /.cache
-      cache-npm:
-        type: emptyDir
-        globalMounts:
-          - path: /.npm
-      dev-bus-usb:
-        type: hostPath
-        hostPath: /dev/bus/usb
-        hostPathType: Directory
-      sys-bus-usb:
-        type: hostPath
-        hostPath: /sys/bus/usb
-        hostPathType: Directory
-      recordings:
-        type: nfs
-        server: shadowfax.jahanson.tech
-        path: /nahar/scrypted
-        globalMounts:
-          - path: /recordings

kubernetes/apps/default/scrypted/app/kustomization.yaml

@@ -1,7 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ../../../../templates/volsync

kubernetes/apps/default/scrypted/ks.yaml

@@ -1,30 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &appname scrypted
-  namespace: flux-system
-spec:
-  targetNamespace: default
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *appname
-  interval: 30m
-  timeout: 5m
-  path: "./kubernetes/apps/default/scrypted/app"
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: theshire
-  wait: false
-  dependsOn:
-    - name: rook-ceph-cluster
-    - name: volsync
-    - name: external-secrets-stores
-  postBuild:
-    substitute:
-      APP: *appname
-      APP_UID: "0"
-      APP_GID: "0"
-      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/default/searxng/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/searxng/ks.yaml

@@ -20,6 +20,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/sonarr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/sonarr/ks.yaml

@@ -22,6 +22,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/tautulli/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/tautulli/tautulli
-              tag: v2.14.6@sha256:f54d2d3a78780c765cd7a10b882474909f50247b5d2d118badaa9c035421effd
+              tag: v2.14.5@sha256:6017b491d8e9100a97391b639fff5824ad36a315c69aae3c9ed78407994a626e
             env:
               TZ: America/Chicago
             command: ["/usr/local/bin/python", "Tautulli.py"]

kubernetes/apps/default/tautulli/ks.yaml

@@ -20,6 +20,7 @@ spec:
     - name: volsync
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/unpackerr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/unpackerr/ks.yaml

@@ -19,4 +19,5 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m

kubernetes/apps/default/zwave/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/zwave-js/zwave-js-ui
-              tag: 9.24.0@sha256:ed648be6b058c6aa74abca1868c3ac48cb82b06b22ef0ef4f7ba66dd9d331bfc
+              tag: 9.21.1@sha256:a28eaf01060dbe2fa30045d6b2ac6a31bc34efbebb7aa7d19787929929aea16a
             env:
               TZ: America/Chicago
               PORT: &port 80

kubernetes/apps/default/zwave/ks.yaml

@@ -17,6 +17,7 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/flux-system/add-ons/ks.yaml

@@ -3,14 +3,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app flux-webhooks
+  name: flux-webhooks
   namespace: flux-system
   labels:
     substitution.flux.home.arpa/enabled: "true"
 spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
   interval: 10m
   path: ./kubernetes/apps/flux-system/add-ons/webhooks
   prune: true
@@ -23,14 +20,11 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app flux-monitoring
+  name: flux-monitoring
   namespace: flux-system
   labels:
     substitution.flux.home.arpa/enabled: "true"
 spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
   interval: 10m
   path: ./kubernetes/apps/flux-system/add-ons/monitoring
   prune: true

kubernetes/apps/kube-system/chronyd/app/helmrelease.yaml

@@ -1,56 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: &app chronyd
-spec:
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.1
-      interval: 30m
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-  interval: 30m
-  values:
-    controllers:
-      chronyd:
-        type: daemonset
-        strategy: RollingUpdate
-        annotations:
-          reloader.stakater.com/auto: "true"
-        pod:
-          tolerations:
-            - key: node-role.kubernetes.io/master
-              effect: NoSchedule
-        containers:
-          app:
-            image:
-              repository: docker.io/library/rockylinux
-              tag: 9
-            args:
-              - "/bin/bash"
-              - "-c"
-              - "dnf install -y chrony iputils dnsutils && chronyd -n -d"
-            resources:
-              requests:
-                cpu: 23m
-                memory: 50M
-            securityContext:
-              privileged: true
-
-    persistence:
-      config:
-        type: configMap
-        name: chronyd-configmap
-        globalMounts:
-          - path: /etc/chrony.conf
-            subPath: chrony.conf
-            readOnly: true
-      data:
-        type: emptyDir
-        globalMounts:
-          - path: /var/lib/chrony

kubernetes/apps/kube-system/chronyd/app/kustomization.yaml

@@ -1,12 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-configMapGenerator:
-  - name: chronyd-configmap
-    files:
-      - chrony.conf=./resources/chrony.conf
-generatorOptions:
-  disableNameSuffixHash: true

kubernetes/apps/kube-system/chronyd/app/resources/chrony.conf

@@ -1,27 +0,0 @@
-# Cloudflare time servers
-server time.cloudflare.com iburst
-
-# Record the rate at which the system clock gains/losses time.
-driftfile /var/lib/chrony/drift
-
-# Allow the system clock to be stepped in the first three updates
-# if its offset is larger than 1 second.
-makestep 1.0 3
-
-# Enable kernel synchronization of the real-time clock (RTC).
-rtcsync
-
-# Specify file containing keys for NTP authentication.
-keyfile /etc/chrony.keys
-
-# Save NTS keys and cookies.
-ntsdumpdir /var/lib/chrony
-
-# Insert/delete leap seconds by slewing instead of stepping.
-#leapsecmode slew
-
-# Get TAI-UTC offset and leap seconds from the system tz database.
-leapsectz right/UTC
-
-# Specify directory for log files.
-logdir /var/log/chrony

kubernetes/apps/kube-system/chronyd/ks.yaml

@@ -1,20 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app chronyd
-  namespace: flux-system
-spec:
-  targetNamespace: kube-system
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/kube-system/chronyd/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: theshire
-  wait: false
-  interval: 30m
-  timeout: 5m

kubernetes/apps/kube-system/cilium/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: 1.16.3
+      version: 1.16.2
       sourceRef:
         kind: HelmRepository
         name: cilium

kubernetes/apps/kube-system/cilium/config/l2.yaml

@@ -7,8 +7,7 @@ metadata:
 spec:
   loadBalancerIPs: true
   # interfaces: ["^enp.*|^eth.*|^ens.*|^eno.*"]
-  interfaces: ["^eno+|^enp+|^bond+"]
-  # interfaces: ["^bond+"]
+  interfaces: ["^eno+|^enp+"]
   nodeSelector:
     matchLabels:
       kubernetes.io/os: linux

kubernetes/apps/kube-system/cilium/ks.yaml

@@ -17,6 +17,7 @@ spec:
     name: theshire
   wait: true
   interval: 30m
+  retryInterval: 1m
   timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@@ -39,4 +40,5 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m

kubernetes/apps/kube-system/coredns/ks.yaml

@@ -17,4 +17,5 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m

kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml

@@ -1,64 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: descheduler
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: descheduler
-      version: 0.31.0
-      sourceRef:
-        kind: HelmRepository
-        name: descheduler
-        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      strategy: rollback
-      retries: 3
-  values:
-    replicas: 2
-    kind: Deployment
-    deschedulerPolicyAPIVersion: descheduler/v1alpha2
-    deschedulerPolicy:
-      profiles:
-        - name: Default
-          pluginConfig:
-            - name: DefaultEvictor
-              args:
-                evictFailedBarePods: true
-                evictLocalStoragePods: true
-                evictSystemCriticalPods: true
-                nodeFit: true
-            - name: RemovePodsViolatingInterPodAntiAffinity
-            - name: RemovePodsViolatingNodeAffinity
-              args:
-                nodeAffinityType:
-                  - requiredDuringSchedulingIgnoredDuringExecution
-            - name: RemovePodsViolatingNodeTaints
-            - name: RemovePodsViolatingTopologySpreadConstraint
-              args:
-                constraints:
-                  - DoNotSchedule
-                  - ScheduleAnyway
-          plugins:
-            balance:
-              enabled:
-                - RemovePodsViolatingTopologySpreadConstraint
-            deschedule:
-              enabled:
-                - RemovePodsViolatingInterPodAntiAffinity
-                - RemovePodsViolatingNodeAffinity
-                - RemovePodsViolatingNodeTaints
-    service:
-      enabled: true
-    serviceMonitor:
-      enabled: true
-    leaderElection:
-      enabled: true

kubernetes/apps/kube-system/descheduler/app/kustomization.yaml

@@ -1,6 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml

kubernetes/apps/kube-system/descheduler/ks.yaml

@@ -1,20 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app descheduler
-  namespace: flux-system
-spec:
-  targetNamespace: kube-system
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/kube-system/descheduler/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: theshire
-  wait: false
-  interval: 30m
-  timeout: 5m

kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/kube-system/fstrim/ks.yaml

@@ -17,4 +17,5 @@ spec:
     name: theshire
   wait: false
   interval: 30m
+  retryInterval: 1m
   timeout: 5m