Update image quay.io/redlib/redlib to f07a153

add rebroadcast ports and swap to nvidia container.
update mount names
2024-10-12 16:03:04 +00:00 · 2024-10-12 07:16:22 -05:00 · 2024-10-12 06:42:46 -05:00 · 2024-10-11 20:06:09 -05:00 · 2024-10-11 19:58:29 -05:00 · 2024-10-11 19:57:15 -05:00
69 changed files with 769 additions and 81 deletions
--- a/.archive/default/nicehash/ks.yaml
+++ b/.archive/default/nicehash/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/ai/ollama/ks.yaml
+++ b/kubernetes/apps/ai/ollama/ks.yaml
@ -22,7 +22,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/ai/open-webui/ks.yaml
+++ b/kubernetes/apps/ai/open-webui/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/coder/coder/ks.yaml
+++ b/kubernetes/apps/coder/coder/ks.yaml
@ -20,5 +20,4 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/database/dragonfly/ks.yaml
+++ b/kubernetes/apps/database/dragonfly/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@ -42,5 +41,4 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/database/emqx/ks.yaml
+++ b/kubernetes/apps/database/emqx/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@ -42,5 +41,4 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/default/atuin/ks.yaml
+++ b/kubernetes/apps/default/atuin/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/autobrr/ks.yaml
+++ b/kubernetes/apps/default/autobrr/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/excalidraw/ks.yaml
+++ b/kubernetes/apps/default/excalidraw/ks.yaml
@ -17,7 +17,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/home-assistant/ks.yaml
+++ b/kubernetes/apps/default/home-assistant/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/it-tools/app/helmrelease.yaml
+++ b/kubernetes/apps/default/it-tools/app/helmrelease.yaml
@ -3,53 +3,55 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: &app it-tools
+  name: it-tools
 spec:
  interval: 30m
  chart:
    spec:
      chart: app-template
      version: 3.5.1
+      interval: 30m
      sourceRef:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-      strategy: rollback
+
  values:
    controllers:
      it-tools:
+        replicas: 1
+        strategy: RollingUpdate
        annotations:
          reloader.stakater.com/auto: "true"
+        pod:
+          securityContext:
+            runAsUser: 101
+            runAsGroup: 101
+            fsGroup: 101
+            fsGroupChangePolicy: "OnRootMismatch"
        containers:
          app:
            image:
-              repository: ghcr.io/corentinth/it-tools
-              tag: 2024.5.13-a0bc346
-            env:
-              TZ: America/Chicago
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
+              repository: ghcr.io/bjw-s-labs/it-tools
+              tag: 2024.5.13
            resources:
              requests:
-                cpu: 100m
+                cpu: 5m
+                memory: 32Mi
              limits:
-                memory: 500Mi
+                memory: 256Mi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
    service:
      app:
-        controller: *app
+        controller: it-tools
        ports:
          http:
-            port: 80
+            port: 8080
    ingress:
      app:
        enabled: true
@ -68,3 +70,7 @@ spec:
        tls:
          - hosts:
              - *host
+
+    persistence:
+      tmp:
+        type: emptyDir
--- a/kubernetes/apps/default/it-tools/ks.yaml
+++ b/kubernetes/apps/default/it-tools/ks.yaml
@ -17,7 +17,6 @@ spec:
    name: theshire
  wait: false # no flux ks dependents
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/kustomization.yaml
+++ b/kubernetes/apps/default/kustomization.yaml
@ -22,6 +22,7 @@ resources:
  - ./recyclarr/ks.yaml
  - ./redlib/ks.yaml
  - ./sabnzbd/ks.yaml
+  - ./scrypted/ks.yaml
  - ./searxng/ks.yaml
  - ./sonarr/ks.yaml
  - ./tautulli/ks.yaml
--- a/kubernetes/apps/default/linkwarden/ks.yaml
+++ b/kubernetes/apps/default/linkwarden/ks.yaml
@ -22,7 +22,6 @@ spec:
    name: theshire
  wait: false # no flux ks dependents
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/omegabrr/ks.yaml
+++ b/kubernetes/apps/default/omegabrr/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/overseerr/ks.yaml
+++ b/kubernetes/apps/default/overseerr/ks.yaml
@ -20,7 +20,6 @@ spec:
    - name: volsync
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/plex/ks.yaml
+++ b/kubernetes/apps/default/plex/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/prowlarr/ks.yaml
+++ b/kubernetes/apps/default/prowlarr/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/radarr/ks.yaml
+++ b/kubernetes/apps/default/radarr/ks.yaml
@ -22,7 +22,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/recyclarr/ks.yaml
+++ b/kubernetes/apps/default/recyclarr/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/redlib/app/helmrelease.yaml
+++ b/kubernetes/apps/default/redlib/app/helmrelease.yaml
@ -38,7 +38,7 @@ spec:
          app:
            image:
              repository: quay.io/redlib/redlib
-              tag: latest@sha256:e61e2535518e0b574f92642612f33f6fbee1aa22b2ff36ee740e26a025bb0039
+              tag: latest@sha256:f07a1531d520121e1260bfd9d4b3dbadb26a8ad20a8a7b8639723907160839e4
            env:
              REDLIB_DEFAULT_SHOW_NSFW: on
              REDLIB_DEFAULT_WIDE: on
--- a/kubernetes/apps/default/redlib/ks.yaml
+++ b/kubernetes/apps/default/redlib/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/sabnzbd/ks.yaml
+++ b/kubernetes/apps/default/sabnzbd/ks.yaml
@ -21,7 +21,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/scrypted/app/helmrelease.yaml
+++ b/kubernetes/apps/default/scrypted/app/helmrelease.yaml
@ -0,0 +1,111 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: scrypted
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+
+  values:
+    controllers:
+      scrypted:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        pod:
+          nodeSelector:
+            google.feature.node.kubernetes.io/coral: "true"
+            nvidia.com/gpu.present: "true"
+          securityContext:
+            supplementalGroups:
+              - 568
+        containers:
+          app:
+            image:
+              repository: ghcr.io/koush/scrypted
+              tag: v0.119.1-jammy-nvidia
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  failureThreshold: 30
+                  periodSeconds: 5
+            resources:
+              requests:
+                cpu: 136m
+                memory: 1024Mi
+              limits:
+                nvidia.com/gpu: 1
+                memory: 8192Mi
+            securityContext:
+              privileged: true
+    service:
+      app:
+        controller: scrypted
+        ports:
+          http:
+            port: 11080
+            primary: true
+          rebroadcast1: # driveway
+            port: 39655
+          rebroadcast2: # sideyard
+            port: 46561
+          rebroadcast3: # doorbell
+            port: 44759
+
+    ingress:
+      app:
+        className: "internal-nginx"
+        annotations:
+        hosts:
+          - host: &host scrypted.jahanson.tech
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        existingClaim: scrypted
+        advancedMounts:
+          scrypted:
+            app:
+              - path: /server/volume
+      cache:
+        type: emptyDir
+        globalMounts:
+          - path: /.cache
+      cache-npm:
+        type: emptyDir
+        globalMounts:
+          - path: /.npm
+      dev-bus-usb:
+        type: hostPath
+        hostPath: /dev/bus/usb
+        hostPathType: Directory
+      sys-bus-usb:
+        type: hostPath
+        hostPath: /sys/bus/usb
+        hostPathType: Directory
+      recordings:
+        type: nfs
+        server: shadowfax.jahanson.tech
+        path: /nahar/scrypted
+        globalMounts:
+          - path: /recordings
--- a/kubernetes/apps/default/scrypted/app/kustomization.yaml
+++ b/kubernetes/apps/default/scrypted/app/kustomization.yaml
@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ../../../../templates/volsync
--- a/kubernetes/apps/default/scrypted/ks.yaml
+++ b/kubernetes/apps/default/scrypted/ks.yaml
@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &appname scrypted
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
+  interval: 30m
+  timeout: 5m
+  path: "./kubernetes/apps/default/scrypted/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  dependsOn:
+    - name: rook-ceph-cluster
+    - name: volsync
+    - name: external-secrets-stores
+  postBuild:
+    substitute:
+      APP: *appname
+      APP_UID: "0"
+      APP_GID: "0"
+      VOLSYNC_CAPACITY: 5Gi
--- a/kubernetes/apps/default/searxng/ks.yaml
+++ b/kubernetes/apps/default/searxng/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/sonarr/ks.yaml
+++ b/kubernetes/apps/default/sonarr/ks.yaml
@ -22,7 +22,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/tautulli/ks.yaml
+++ b/kubernetes/apps/default/tautulli/ks.yaml
@ -20,7 +20,6 @@ spec:
    - name: volsync
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/default/unpackerr/ks.yaml
+++ b/kubernetes/apps/default/unpackerr/ks.yaml
@ -19,5 +19,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/default/zwave/ks.yaml
+++ b/kubernetes/apps/default/zwave/ks.yaml
@ -17,7 +17,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/kube-system/cilium/ks.yaml
+++ b/kubernetes/apps/kube-system/cilium/ks.yaml
@ -17,7 +17,6 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@ -40,5 +39,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/kube-system/coredns/ks.yaml
+++ b/kubernetes/apps/kube-system/coredns/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/kube-system/fstrim/ks.yaml
+++ b/kubernetes/apps/kube-system/fstrim/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml
+++ b/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/kube-system/node-feature-discovery/rules/googlecoral.yaml
+++ b/kubernetes/apps/kube-system/node-feature-discovery/rules/googlecoral.yaml
@ -0,0 +1,16 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/nfd.k8s-sigs.io/nodefeaturerule_v1alpha1.json
+apiVersion: nfd.k8s-sigs.io/v1alpha1
+kind: NodeFeatureRule
+metadata:
+  name: google-coral-device
+spec:
+  rules:
+    - # Google Coral USB Accelerator
+      name: google.coral
+      labels:
+        google.feature.node.kubernetes.io/coral: "true"
+      matchFeatures:
+        - feature: usb.device
+          matchExpressions:
+            vendor: {op: In, value: ["1a6e", "18d1"]}
--- a/kubernetes/apps/kube-system/node-feature-discovery/rules/nvidia.yaml
+++ b/kubernetes/apps/kube-system/node-feature-discovery/rules/nvidia.yaml
@ -1,5 +1,5 @@
-# yaml-language-server: $schema=https://ks.hsn.dev/nfd.k8s-sigs.io/nodefeaturerule_v1alpha1.json
 ---
+# yaml-language-server: $schema=https://ks.hsn.dev/nfd.k8s-sigs.io/nodefeaturerule_v1alpha1.json
 apiVersion: nfd.k8s-sigs.io/v1alpha1
 kind: NodeFeatureRule
 metadata:
--- a/kubernetes/apps/kube-system/rocky-nenya.yaml
+++ b/kubernetes/apps/kube-system/rocky-nenya.yaml
@ -4,13 +4,13 @@ metadata:
  name: rocky-nenya
  namespace: kube-system
 spec:
-  #  nodeName: nenya
+  nodeName: shadowfax-01
  containers:
    - name: rocky
      image: rockylinux:9
      securityContext:
        privileged: true
-      command: ["/bin/bash", "-c", "while true; do sleep 10; done"]
+      command: ["/bin/bash", "-c", "dnf install -y iputils dnsutils && while true; do sleep 10; done"]
      resources:
        requests:
          cpu: 100m
--- a/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml
+++ b/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: spegel
-      version: v0.0.25
+      version: v0.0.26
      sourceRef:
        kind: HelmRepository
        name: spegel-org
--- a/kubernetes/apps/kube-system/spegel/ks.yaml
+++ b/kubernetes/apps/kube-system/spegel/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/kyverno/kyverno/app/helmrelease.yaml
+++ b/kubernetes/apps/kyverno/kyverno/app/helmrelease.yaml
@ -66,6 +66,7 @@ spec:
                - ""
              resources:
                - pods
+                - nodes
              verbs:
                - create
                - update
@ -78,3 +79,114 @@ spec:
            matchLabels:
              app.kubernetes.io/instance: kyverno
              app.kubernetes.io/component: kyverno
+    config:
+      # -- Resource types to be skipped by the Kyverno policy engine.
+      # Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list.
+      # These are joined together without spaces, run through `tpl`, and the result is set in the config map.
+      # @default -- See [values.yaml](https://github.com/kyverno/kyverno/blob/ed1906a0dc281c2aeb9b7046b843708825310330/charts/kyverno/values.yaml#L207C3-L316C1)
+      resourceFilters:
+        - '[Event,*,*]'
+        - '[*/*,kube-system,*]'
+        - '[*/*,kube-public,*]'
+        - '[*/*,kube-node-lease,*]'
+        - '[Node,*,*]'
+        - '[Node/*,*,*]'
+        - '[APIService,*,*]'
+        - '[APIService/*,*,*]'
+        - '[TokenReview,*,*]'
+        - '[SubjectAccessReview,*,*]'
+        - '[SelfSubjectAccessReview,*,*]'
+        # remove the following to allow for schematic-to-pod.yaml to work
+        # - '[Binding,*,*]'
+        # - '[Pod/binding,*,*]'
+        - '[ReplicaSet,*,*]'
+        - '[ReplicaSet/*,*,*]'
+        - '[EphemeralReport,*,*]'
+        - '[ClusterEphemeralReport,*,*]'
+        # exclude resources from the chart
+        - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
+        - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
+        - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
+        - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
+        - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
+        - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
+        - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
+        - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
--- a/kubernetes/apps/kyverno/kyverno/ks.yaml
+++ b/kubernetes/apps/kyverno/kyverno/ks.yaml
@ -13,7 +13,6 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
 ---
 # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
@ -32,5 +31,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/kyverno/kyverno/policies/kustomization.yaml
+++ b/kubernetes/apps/kyverno/kyverno/policies/kustomization.yaml
@ -4,3 +4,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./remove-cpu-limits.yaml
+  - ./schematic-to-pod.yaml
--- a/kubernetes/apps/kyverno/kyverno/policies/schematic-to-pod.yaml
+++ b/kubernetes/apps/kyverno/kyverno/policies/schematic-to-pod.yaml
@ -0,0 +1,39 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kyverno.io/clusterpolicy_v1.json
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: mutate-pod-binding
+  annotations:
+    pod-policies.kyverno.io/autogen-controllers: none
+    policies.kyverno.io/title: Mutate Pod Add Schematic
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.10.0
+    policies.kyverno.io/minversion: 1.10.0
+    kyverno.io/kubernetes-version: "1.30"
+spec:
+  background: false
+  rules:
+    - name: project-foo
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod/binding
+              names:
+                - apply-talos*
+      context:
+        - name: node
+          variable:
+            jmesPath: request.object.target.name
+            default: ""
+        - name: schematic
+          apiCall:
+            urlPath: "/api/v1/nodes/{{node}}"
+            jmesPath: 'metadata.annotations."extensions.talos.dev/schematic" || ''empty'''
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              extensions.talos.dev/schematic: "{{ schematic }}"
--- a/kubernetes/apps/network/cloudflared/ks.yaml
+++ b/kubernetes/apps/network/cloudflared/ks.yaml
@ -22,5 +22,4 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/observability/alertmanager/ks.yaml
+++ b/kubernetes/apps/observability/alertmanager/ks.yaml
@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
@ -21,3 +21,24 @@ spec:
  dependsOn:
    - name: external-secrets-stores
    - name: rook-ceph-cluster
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app alertmanager-silencer
+  namespace: flux-system
+spec:
+  targetNamespace: observability
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: "./kubernetes/apps/observability/alertmanager/silencer"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
--- a/kubernetes/apps/observability/alertmanager/silencer/helmrelease.yaml
+++ b/kubernetes/apps/observability/alertmanager/silencer/helmrelease.yaml
@ -0,0 +1,56 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: alertmanager-silencer
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.0.4
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  dependsOn:
+    - name: alertmanager
+      namespace: observability
+  values:
+    controllers:
+      alertmanager-silencer:
+        type: cronjob
+        cronjob:
+          schedule: "@daily"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/kubanetics
+              tag: 2024.10.6
+            env:
+              SCRIPT_NAME: alertmanager-silencer.sh
+              ALERTMANAGER_URL: http://alertmanager.observability.svc.cluster.local:9093
+              MATCHERS_0: alertname=CephPGImbalance job=rook-ceph-exporter
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 25m
+              limits:
+                memory: 128Mi
+        pod:
+          securityContext:
+            runAsUser: 568
+            runAsGroup: 568
+            runAsNonRoot: true
--- a/kubernetes/apps/observability/alertmanager/silencer/kustomization.yaml
+++ b/kubernetes/apps/observability/alertmanager/silencer/kustomization.yaml
@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
--- a/kubernetes/apps/observability/gatus/ks.yaml
+++ b/kubernetes/apps/observability/gatus/ks.yaml
@ -20,7 +20,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml
+++ b/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/observability/victoria-metrics/ks.yaml
+++ b/kubernetes/apps/observability/victoria-metrics/ks.yaml
@ -17,7 +17,6 @@ spec:
    name: theshire
  wait: true
  interval: 30m
-  retryInterval: 1m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
@ -40,4 +39,3 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
--- a/kubernetes/apps/openebs-system/openebs/ks.yaml
+++ b/kubernetes/apps/openebs-system/openebs/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/qbittorrent/cross-seed/ks.yaml
+++ b/kubernetes/apps/qbittorrent/cross-seed/ks.yaml
@ -19,7 +19,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/qbittorrent/flood/ks.yaml
+++ b/kubernetes/apps/qbittorrent/flood/ks.yaml
@ -22,7 +22,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
  postBuild:
    substitute:
--- a/kubernetes/apps/qbittorrent/qbittorrent/ks.yaml
+++ b/kubernetes/apps/qbittorrent/qbittorrent/ks.yaml
@ -47,5 +47,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml
+++ b/kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml
@ -75,7 +75,7 @@ spec:
              "--exclude-category", "music",
              "--exclude-tag", "added:24h",
              "--include-tag", "unregistered",
-              "--dry-run",
+              # "--dry-run",
              "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local",
              "--port", "80"
            ]
@ -87,7 +87,7 @@ spec:
              "--exclude-category", "music",
              "--include-tag", "expired", # defined in config.yaml
              "--include-tag", "added:7d",
-              "--dry-run",
+              # "--dry-run",
              "--server", "qbittorrent.$(POD_NAMESPACE).svc.cluster.local",
              "--port", "80"
            ]
--- a/kubernetes/apps/rook-ceph/rook-ceph/ks.yaml
+++ b/kubernetes/apps/rook-ceph/rook-ceph/ks.yaml
@ -17,7 +17,6 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@ -38,5 +37,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 15m
--- a/kubernetes/apps/system-upgrade/kustomization.yaml
+++ b/kubernetes/apps/system-upgrade/kustomization.yaml
@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Pre Flux-Kustomizations
+  - ./namespace.yaml
+  # Flux-Kustomizations
+  - ./system-upgrade-controller/ks.yaml
--- a/kubernetes/apps/system-upgrade/namespace.yaml
+++ b/kubernetes/apps/system-upgrade/namespace.yaml
@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: system-upgrade
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    volsync.backube/privileged-movers: "true"
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: alert-manager
+  namespace: system-upgrade
+spec:
+  type: alertmanager
+  address: http://alertmanager.observability.svc.cluster.local:9093/api/v2/alerts/
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/alert_v1beta3.json
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: alert-manager
+  namespace: system-upgrade
+spec:
+  providerRef:
+    name: alert-manager
+  eventSeverity: error
+  eventSources:
+    - kind: HelmRelease
+      name: "*"
+  exclusionList:
+    - "error.*lookup github\\.com"
+    - "error.*lookup raw\\.githubusercontent\\.com"
+    - "dial.*tcp.*timeout"
+    - "waiting.*socket"
+  suspend: false
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml
@ -0,0 +1,101 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app system-upgrade-controller
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      system-upgrade-controller:
+        strategy: RollingUpdate
+        containers:
+          app:
+            image:
+              repository: docker.io/rancher/system-upgrade-controller
+              tag: v0.14.1@sha256:7e13a9b2b984f0c0fd6328439b575348723cc6954b91db3453057fcb784e2d29
+            env:
+              SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
+              SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
+              SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
+              SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
+              SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
+              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.1
+              SYSTEM_UPGRADE_JOB_POD_REPLACEMENT_POLICY: Failed
+              SYSTEM_UPGRADE_JOB_PRIVILEGED: true
+              SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
+              SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
+              SYSTEM_UPGRADE_CONTROLLER_NAME: *app
+              SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
+                valueFrom:
+                  fieldRef:
+                    fieldPath: metadata.namespace
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+              seccompProfile:
+                type: RuntimeDefault
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile: { type: RuntimeDefault }
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+          effect: NoSchedule
+    serviceAccount:
+      create: true
+      name: system-upgrade
+    persistence:
+      tmp:
+        type: emptyDir
+      etc-ssl:
+        type: hostPath
+        hostPath: /etc/ssl
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - readOnly: true
+      etc-pki:
+        type: hostPath
+        hostPath: /etc/pki
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - readOnly: true
+      etc-ca-certificates:
+        type: hostPath
+        hostPath: /etc/ca-certificates
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - readOnly: true
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml
@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrelease.yaml
+  - rbac.yaml
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml
@ -0,0 +1,21 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system-upgrade
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: system-upgrade
+    namespace: system-upgrade
+---
+apiVersion: talos.dev/v1alpha1
+kind: ServiceAccount
+metadata:
+  name: talos
+spec:
+  roles:
+    - os:admin
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml
@ -0,0 +1,50 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app system-upgrade-controller
+  namespace: flux-system
+spec:
+  targetNamespace: system-upgrade
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: node-feature-discovery-rules
+  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: true
+  interval: 30m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app system-upgrade-controller-plans
+  namespace: flux-system
+spec:
+  targetNamespace: system-upgrade
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: system-upgrade-controller
+  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  interval: 30m
+  timeout: 5m
+  postBuild:
+    substitute:
+      # renovate: datasource=docker depName=ghcr.io/siderolabs/installer
+      TALOS_VERSION: v1.8.1
+      # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+      KUBERNETES_VERSION: v1.30.2
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kubernetes.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kubernetes.yaml
@ -0,0 +1,45 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: kubernetes
+spec:
+  version: ${KUBERNETES_VERSION}
+  serviceAccountName: system-upgrade
+  secrets:
+    - name: talos
+      path: /var/run/secrets/talos.dev
+      ignoreUpdates: true
+  concurrency: 1
+  exclusive: true
+  nodeSelector:
+    matchExpressions:
+      - key: feature.node.kubernetes.io/system-os_release.ID
+        operator: In
+        values: ["talos"]
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+  tolerations:
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  prepare: &prepare
+    image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
+    envs:
+      - name: NODE_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.hostIP
+    args:
+      - --nodes=$(NODE_IP)
+      - health
+      - --server=false
+  upgrade:
+    <<: *prepare
+    args:
+      - --nodes=$(NODE_IP)
+      - upgrade-k8s
+      - --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml
@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./kubernetes.yaml
+  - ./talos.yaml
--- a/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/talos.yaml
+++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/talos.yaml
@ -0,0 +1,51 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: talos
+spec:
+  version: ${TALOS_VERSION}
+  serviceAccountName: system-upgrade
+  secrets:
+    - name: talos
+      path: /var/run/secrets/talos.dev
+      ignoreUpdates: true
+  concurrency: 1
+  exclusive: true
+  nodeSelector:
+    matchExpressions:
+      - key: feature.node.kubernetes.io/system-os_release.ID
+        operator: In
+        values: ["talos"]
+      - key: feature.node.kubernetes.io/system-os_release.VERSION_ID
+        operator: NotIn
+        values: ["${TALOS_VERSION}"]
+  tolerations:
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  prepare: &prepare
+    image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
+    envs:
+      - name: NODE_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.hostIP
+      - name: TALOS_SCHEMATIC_ID
+        valueFrom:
+          fieldRef:
+            fieldPath: metadata.annotations['extensions.talos.dev/schematic']
+    args:
+      - --nodes=$(NODE_IP)
+      - health
+      - --server=false
+  upgrade:
+    <<: *prepare
+    args:
+      - --nodes=$(NODE_IP)
+      - upgrade
+      - --image=factory.talos.dev/installer/$(TALOS_SCHEMATIC_ID):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
+      - --wait=false
--- a/kubernetes/apps/volsync-system/snapshot-controller/ks.yaml
+++ b/kubernetes/apps/volsync-system/snapshot-controller/ks.yaml
@ -17,5 +17,4 @@ spec:
    name: theshire
  wait: false
  interval: 30m
-  retryInterval: 1m
  timeout: 5m
--- a/kubernetes/bootstrap/helmfile.yaml
+++ b/kubernetes/bootstrap/helmfile.yaml
@ -50,7 +50,7 @@ releases:
  - name: spegel
    namespace: kube-system
    chart: oci://ghcr.io/spegel-org/helm-charts/spegel
-    version: v0.0.25
+    version: v0.0.26
    values:
      - ../apps/kube-system/spegel/app/helm-values.yml
    needs:
--- a/kubernetes/bootstrap/talos/talconfig.yaml
+++ b/kubernetes/bootstrap/talos/talconfig.yaml
@ -2,7 +2,7 @@
 # yaml-language-server: $schema=https://ks.hsn.dev/talconfig.json
 clusterName: theshire

-talosVersion: v1.7.6
+talosVersion: v1.8.1
 kubernetesVersion: 1.30.2
 endpoint: "https://10.1.1.57:6444"

@ -107,8 +107,8 @@ nodes:
        systemExtensions:
          officialExtensions:
            - siderolabs/amd-ucode
-            - siderolabs/nonfree-kmod-nvidia
-            - siderolabs/nvidia-container-toolkit
+            - siderolabs/nonfree-kmod-nvidia-production
+            - siderolabs/nvidia-container-toolkit-production

 worker:
  schematic:
Author	SHA1	Message	Date
Renovate Bot	134cc34515	Update image quay.io/redlib/redlib to f07a153	2024-10-12 16:03:04 +00:00
Joseph Hanson	52a4fc077b	add rebroadcast ports and swap to nvidia container.	2024-10-12 07:16:22 -05:00
Joseph Hanson	5051f5b6f4	update mount names	2024-10-12 06:42:46 -05:00
Joseph Hanson	587565c0ed	correct pvc name	2024-10-11 20:06:09 -05:00
Joseph Hanson	ba526c130b	correct namespace	2024-10-11 19:58:29 -05:00
Joseph Hanson	c7037694fa	add scrypted	2024-10-11 19:57:15 -05:00
Joseph Hanson	45d91c392d	update toolpod	2024-10-11 19:54:48 -05:00
Joseph Hanson	acba2f290f	swap deps	2024-10-11 18:47:50 -05:00
Joseph Hanson	aa7119a6e4	add alert manager silencer back	2024-10-11 18:44:08 -05:00
Joseph Hanson	b56314020a	remove retryInterval on all flux	2024-10-11 18:25:37 -05:00
Joseph Hanson	d67ed006ca	update to talos v1.8.1	2024-10-11 18:12:51 -05:00
Joseph Hanson	d0d86351c1	add google coral detection	2024-10-11 18:12:26 -05:00
Joseph Hanson	efb553e50b	remove old code -- different hardware now supported.	2024-10-11 12:17:21 -05:00
Joseph Hanson	487976e388	{}!!!!!!!!!	2024-10-11 10:53:39 -05:00
Joseph Hanson	7c8802e3bf	remove pod binding policy filters for schematic-to-pod policy to work	2024-10-11 10:31:13 -05:00
Joseph Hanson	7a67c2ddbf	Merge pull request 'Update image ghcr.io/siderolabs/installer to v1.8.1' (#722 ) from renovate/talos into main Reviewed-on: #722	2024-10-11 09:57:44 -05:00
Joseph Hanson	af2c995b76	re-enable talos plan	2024-10-11 09:57:19 -05:00
Renovate Bot	1d32d2de95	Update image ghcr.io/siderolabs/installer to v1.8.1	2024-10-11 14:54:57 +00:00
Joseph Hanson	17c3e2f311	upgrade to v1.8.0	2024-10-11 07:30:38 -05:00
Joseph Hanson	be091afd25	remove talos plan for SUC for now	2024-10-11 07:30:27 -05:00
Joseph Hanson	1cb15bfbfe	time to prune old jobs	2024-10-11 07:03:24 -05:00
jahanson	0eaa4c65d0	revert talos version for SUC revert Merge pull request 'Update image ghcr.io/siderolabs/installer to v1.7.7' (#719) from renovate/patch-talos into main Reviewed-on: #719	2024-10-11 07:00:12 -05:00
Joseph Hanson	623737f4e2	apiversion	2024-10-11 06:46:10 -05:00
Joseph Hanson	0da719e372	Merge pull request 'Update image ghcr.io/siderolabs/installer to v1.7.7' (#719 ) from renovate/patch-talos into main Reviewed-on: #719	2024-10-11 06:35:15 -05:00
Joseph Hanson	a54a7a3807	Merge pull request 'Update image spegel to v0.0.26' (#720 ) from renovate/spegel-0.x into main Reviewed-on: #720	2024-10-11 06:06:04 -05:00
Renovate Bot	b6636664d1	Update image spegel to v0.0.26	2024-10-11 11:03:20 +00:00
Renovate Bot	88179415ae	Update image ghcr.io/siderolabs/installer to v1.7.7	2024-10-11 11:03:08 +00:00
Joseph Hanson	4f2756bcd4	add system-upgrade-controller 🤞	2024-10-11 05:51:48 -05:00
Joseph Hanson	2ca0b5805f	nonroot!	2024-10-11 05:43:23 -05:00