Update Helm release thanos to v15

kubernetes/apps/cert-manager/cert-manager/issuers/cloudflare/issuer-letsencrypt-prod-jahanson-tech.yaml

@@ -0,0 +1,22 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: le-cf-prod-jahanson-tech
+spec:
+  acme:
+    email: "joe@veri.dev"
+    preferredChain: ""
+    privateKeySecretRef:
+      name: letsencrypt-cloudflare-production
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: jahanson-tech-api-token
+        selector:
+          dnsZones:
+            - jahanson.tech

kubernetes/apps/cert-manager/cert-manager/issuers/cloudflare/issuer-letsencrypt-prod.yaml

@@ -7,10 +7,10 @@ metadata:
 spec:
   acme:
     email: "joe@veri.dev"
+    preferredChain: ""
     privateKeySecretRef:
       name: letsencrypt-cloudflare-production
     server: https://acme-v02.api.letsencrypt.org/directory
-    preferredChain: "ISRG Root X1"
     solvers:
       - dns01:
           cloudflare:

kubernetes/apps/cert-manager/cert-manager/issuers/dnsimple/externalsecret.yaml

@@ -1,32 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: zerossl-secret
-  namespace: cert-manager
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: zerossl-secret
-    creationPolicy: Owner
-    template:
-      engineVersion: v2
-      data:
-        api-token: "{{ .dnsimple_cert_manager_api_token }}"
-        eab-hmac-key: "{{ .zerossl_eab_hmac_key }}"
-  dataFrom:
-    - extract:
-        key: DNSimple
-      rewrite:
-        - regexp:
-            source: "(.*)"
-            target: "dnsimple_$1"
-    - extract:
-        key: ZeroSSL
-      rewrite:
-        - regexp:
-            source: "(.*)"
-            target: "zerossl_$1"

kubernetes/apps/cert-manager/cert-manager/issuers/dnsimple/issuer-zerossl-prod.yaml

@@ -1,30 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/clusterissuer_v1.json
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: issuer-zerossl-prod
-spec:
-  acme:
-    server: https://acme.zerossl.com/v2/DV90
-    email: "joe@veri.dev"
-    privateKeySecretRef:
-      name: zerossl-production
-    externalAccountBinding:
-      keyID: feJODDijN9gypthMXaHtVA
-      keySecretRef:
-        name: zerossl-secret
-        key: eab-hmac-key
-      keyAlgorithm: HS256
-    solvers:
-      - dns01:
-          webhook:
-            groupName: acme.hsn.dev
-            solverName: dnsimple
-            config:
-              apiKeySecretRef:
-                name: zerossl-secret
-                key: api-token
-        selector:
-          dnsZones:
-            - jahanson.tech

kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml

@@ -6,6 +6,5 @@ namespace: cert-manager
 resources:
   - ./cloudflare/externalsecret.yaml
   - ./cloudflare/issuer-letsencrypt-prod.yaml
+  - ./cloudflare/issuer-letsencrypt-prod-jahanson-tech.yaml
   - ./cloudflare/issuer-letsencrypt-staging.yaml
-  - ./dnsimple/externalsecret.yaml
-  - ./dnsimple/issuer-zerossl-prod.yaml

kubernetes/apps/cert-manager/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./cert-manager/ks.yaml
-  - ./webhook-dnsimple/ks.yaml

kubernetes/apps/cert-manager/webhook-dnsimple/app/apiservice.yaml

@@ -1,16 +0,0 @@
-apiVersion: apiregistration.k8s.io/v1
-kind: APIService
-metadata:
-  name: v1alpha1.acme.hsn.dev
-  labels:
-    app: cert-manager-webhook-dnsimple
-  annotations:
-    cert-manager.io/inject-ca-from: "cert-manager/webhook-dnsimple-webhook-tls"
-spec:
-  group: acme.hsn.dev
-  groupPriorityMinimum: 1000
-  versionPriority: 15
-  service:
-    name: webhook-dnsimple
-    namespace: cert-manager
-  version: v1alpha1

kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml

@@ -1,70 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2beta2
-kind: HelmRelease
-metadata:
-  name: webhook-dnsimple
-spec:
-  chart:
-    spec:
-      chart: app-template
-      version: 3.0.4
-      interval: 30m
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-  interval: 30m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    controllers:
-      webhook-dnsimple:
-        strategy: RollingUpdate
-        annotations:
-          reloader.stakater.com/auto: "true"
-        containers:
-          app:
-            image:
-              repository: git.hsn.dev/jahanson/cert-manager-webhook-dnsimple
-              tag: v0.0.1
-            args:
-              - --secure-port=8443
-              - --tls-cert-file=/tls/tls.crt
-              - --tls-private-key-file=/tls/tls.key
-            env:
-              - name: GROUP_NAME
-                value: "acme.hsn.dev"
-            resources:
-              requests:
-                cpu: 23m
-                memory: 249M
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-    service:
-      app:
-        controller: webhook-dnsimple
-        ports:
-          https:
-            port: 443
-            targetPort: 8443
-            protocol: TCP
-    persistence:
-      certs:
-        type: secret
-        name: webhook-dnsimple-webhook-tls
-        globalMounts:
-          - path: /tls
-            readOnly: true
-    serviceAccount:
-      create: true
-      name: webhook-dnsimple

kubernetes/apps/cert-manager/webhook-dnsimple/app/kustomization.yaml

@@ -1,9 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./apiservice.yaml
-  - ./helmrelease.yaml
-  - ./pki.yaml
-  - ./rbac.yaml

kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml

@@ -1,62 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
-# Create a selfsigned Issuer, in order to create a root CA certificate for
-# signing webhook serving certificates
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: webhook-dnsimple-selfsign
-  namespace: "cert-manager"
-  labels:
-    app: cert-manager-webhook-dnsimple
-spec:
-  selfSigned: {}
----
-# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
-# Create an Issuer that uses the above generated CA certificate to issue certs
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: webhook-dnsimple-ca
-  namespace: "cert-manager"
-  labels:
-    app: cert-manager-webhook-dnsimple
-spec:
-  ca:
-    secretName: webhook-dnsimple-ca
----
-# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
-# Generate a CA Certificate used to sign certificates for the webhook
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: webhook-dnsimple-ca
-  namespace: "cert-manager"
-  labels:
-    app: cert-manager-webhook-dnsimple
-spec:
-  secretName: webhook-dnsimple-ca
-  duration: 43800h # 5y
-  issuerRef:
-    name: webhook-dnsimple-selfsign
-  commonName: "ca.dnsimple-webhook.cert-manager"
-  isCA: true
----
-# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
-# Finally, generate a serving certificate for the webhook to use
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: webhook-dnsimple-webhook-tls
-  namespace: "cert-manager"
-  labels:
-    app: cert-manager-webhook-dnsimple
-spec:
-  secretName: webhook-dnsimple-webhook-tls
-  duration: 8760h # 1y
-  issuerRef:
-    name: webhook-dnsimple-ca
-  dnsNames:
-  - webhook-dnsimple
-  - webhook-dnsimple.cert-manager
-  - webhook-dnsimple.cert-manager.svc

kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml

@@ -1,119 +0,0 @@
----
-# Grant cert-manager permission to validate using our apiserver
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: webhook-dnsimple:domain-solver
-  labels:
-    app: cert-manager-webhook-dnsimple
-rules:
-  - apiGroups:
-      - acme.hsn.dev
-    resources:
-      - '*'
-    verbs:
-      - 'create'
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: flow-schema-reader
-  labels:
-    app: cert-manager-webhook-dnsimple
-rules:
-  - apiGroups: ["flowcontrol.apiserver.k8s.io"]
-    resources: ["flowschemas", "prioritylevelconfigurations"]
-    verbs: ["list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: grant-flow-schema-permission
-  labels:
-    app: cert-manager-webhook-dnsimple
-subjects:
-  - kind: ServiceAccount
-    name: webhook-dnsimple
-    namespace: cert-manager
-roleRef:
-  kind: ClusterRole
-  name: flow-schema-reader
-  apiGroup: rbac.authorization.k8s.io
----
-# apiserver gets the auth-delegator role to delegate auth decisions to the core apiserver
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: webhook-dnsimple:auth-delegator
-  labels:
-    app: cert-manager-webhook-dnsimple
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-  - apiGroup: ""
-    kind: ServiceAccount
-    name: webhook-dnsimple
-    namespace: cert-manager
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: webhook-dnsimple:domain-solver
-  labels:
-    app: cert-manager-webhook-dnsimple
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: webhook-dnsimple:domain-solver
-subjects:
-  - apiGroup: ""
-    kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager
----
-# Grant the webhook permission to read the api-token Secret in the specified namespace.
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- namespace: "cert-manager"
- name: webhook-dnsimple:access-secret
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch"]
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: webhook-dnsimple:access-secret
- namespace: "cert-manager"
-subjects:
-- kind: ServiceAccount
-  name: webhook-dnsimple
-  namespace: "cert-manager"
-roleRef:
- kind: Role
- name: webhook-dnsimple:access-secret
- apiGroup: rbac.authorization.k8s.io
----
-# Grant the webhook permission to read the ConfigMap containing the Kubernetes
-# apiserver's requestheader-ca-certificate.
-# This ConfigMap is automatically created by the Kubernetes apiserver.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: webhook-dnsimple:webhook-authentication-reader
-  namespace: kube-system
-  labels:
-    app: cert-manager-webhook-dnsimple
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: extension-apiserver-authentication-reader
-subjects:
-  - apiGroup: ""
-    kind: ServiceAccount
-    name: webhook-dnsimple
-    namespace: cert-manager

kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml

@@ -1,16 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager-webhook-dnsimple
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  interval: 10m
-  path: "./kubernetes/apps/cert-manager/webhook-dnsimple/app"
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homelab
-  wait: true

kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/helmrelease.yaml

@@ -52,7 +52,7 @@ spec:
           app:
             image:
               repository: docker.dragonflydb.io/dragonflydb/operator
-              tag: v1.1.2
+              tag: v1.1.1
             args:
               - "--health-probe-bind-address=:8081"
               - "--metrics-bind-address=127.0.0.1:8080"

kubernetes/apps/kube-system/reloader/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: reloader
-      version: 1.0.74
+      version: 1.0.72
       sourceRef:
         kind: HelmRepository
         name: stakater

kubernetes/apps/network/ingress-nginx/internal/certificate.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   secretName: "jahanson-tech-tls"
   issuerRef:
-    name: issuer-zerossl-prod
+    name: le-cf-prod-jahanson-tech
     kind: ClusterIssuer
   commonName: "jahanson.tech"
   dnsNames:

kubernetes/apps/observability/thanos/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: thanos
-      version: 15.0.0
+      version: 15.0.2
       sourceRef:
         kind: HelmRepository
         name: bitnami

kubernetes/apps/rook-ceph/rook-ceph/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: rook-ceph
-      version: v1.13.8
+      version: v1.13.7
       sourceRef:
         kind: HelmRepository
         name: rook-ceph

kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: rook-ceph-cluster
-      version: v1.13.8
+      version: v1.13.7
       sourceRef:
         kind: HelmRepository
         name: rook-ceph

kubernetes/flux/repositories/helm/kustomization.yaml

@@ -33,5 +33,4 @@ resources:
  - prometheus-community.yaml
  - rook-ceph.yaml
  - stakater.yaml
- - stevehipwell.yaml
  - xenitab.yaml

kubernetes/flux/repositories/helm/stevehipwell.yaml

@@ -1,11 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1beta2.json
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: stevehipwell
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/stevehipwell/helm-charts