Update image ghcr.io/siderolabs/kubelet to v1.31.2

Reviewed-on: #767

.archive/ai/stable-diffusion/comfyui/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

.archive/default/nicehash/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

.archive/vault/ks.yaml

@@ -3,9 +3,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: vault
+  name: &app vault
   namespace: flux-system
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   interval: 1m
   path: "./kubernetes/apps/security/vault/app"
   prune: true

.renovate/autoMerge.json5

@@ -7,7 +7,7 @@
       "automerge": true,
       "automergeType": "branch",
       "matchUpdateTypes": ["digest"],
-      "matchPackagePrefixes": ["ghcr.io/onedr0p", "ghcr.io/bjw-s"],
+      "matchPackagePrefixes": ["ghcr.io/onedr0p", "ghcr.io/bjw-s", "ghcr.io/bjw-s-labs"],
       "ignoreTests": true
     },
     {

.taskfiles/volsync/Taskfile.yaml

@@ -1,6 +1,6 @@
 ---
 # yaml-language-server: $schema=https://taskfile.dev/schema.json
-version: "3"
+version: '3'
 
 # This taskfile is used to manage certain VolSync tasks for a given application, limitations are described below.
 #   1. Fluxtomization, HelmRelease, PVC, ReplicationSource all have the same name (e.g. plex)
@@ -8,215 +8,129 @@ version: "3"
 #   3. Applications are deployed as either a Kubernetes Deployment or StatefulSet
 #   4. Each application only has one PVC that is being replicated
 
-x-env-vars: &env-vars
-  app: "{{.app}}"
-  claim: "{{.claim}}"
-  controller: "{{.controller}}"
-  job: "{{.job}}"
-  ns: "{{.ns}}"
-  pgid: "{{.pgid}}"
-  previous: "{{.previous}}"
-  puid: "{{.puid}}"
-
 vars:
-  VOLSYNC_RESOURCES_DIR: "{{.ROOT_DIR}}/.taskfiles/volsync/resources"
+  VOLSYNC_RESOURCES_DIR: '{{.ROOT_DIR}}/.taskfiles/volsync/resources'
 
 tasks:
+
   state-*:
     desc: Suspend or Resume Volsync
-    summary: |
+    summary: |-
-      state: resume or suspend (required)
+      CLUSTER: Cluster to run command against (default: main)
-    dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env']
+      STATE: resume or suspend (required)
     cmds:
-      - flux --context $CLUSTER {{.state}} kustomization volsync
+      # - until kubectl wait jobs --all --all-namespaces --for=condition=complete --timeout=5m &>/dev/null; do sleep 5; done
-      - flux --context $CLUSTER -n {{.ns}} {{.state}} helmrelease volsync
+      - flux {{.STATE}} kustomization volsync
-      - kubectl --context $CLUSTER -n {{.ns}} scale deployment volsync --replicas {{if eq "suspend" .state}}0{{else}}1{{end}}
+      - flux --namespace {{.NS}} {{.STATE}} helmrelease volsync
-    env: *env-vars
+      - kubectl --namespace {{.NS}} scale deployment --all --replicas {{if eq .STATE "suspend"}}0{{else}}1{{end}}
     vars:
-      ns: '{{.ns | default "volsync-system"}}'
+      NS: '{{.NS | default "volsync-system"}}'
-      state: '{{index .MATCH 0}}'
+      STATE: '{{index .MATCH 0}}'
-
-  list:
-    desc: List snapshots for an application
-    summary: |
-      ns: Namespace the PVC is in (default: default)
-      app: Application to list snapshots for (required)
-    dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env']
-    cmds:
-      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/list.tmpl.yaml) | kubectl --context $CLUSTER apply -f -
-      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} $CLUSTER
-      - kubectl --context $CLUSTER -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m
-      - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container main
-      - kubectl --context $CLUSTER -n {{.ns}} delete job {{.job}}
-    env: *env-vars
     requires:
-      vars: ["app"]
+      vars: [CLUSTER]
-    vars:
-      ns: '{{.ns | default "default"}}'
-      job: volsync-list-{{.app}}
-    preconditions:
-      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/list.tmpl.yaml
-    silent: true
 
   unlock:
-    desc: Unlock a Restic repository for an application
+    desc: Unlock all Restic repositories
-    summary: |
+    summary: |-
-      ns: Namespace the PVC is in (default: default)
+      CLUSTER: Cluster to run command against (default: main)
-      app: Application to unlock (required)
+    cmd: >
-    dotenv: ['{{.VOLSYNC_RESOURCES_DIR}}/.env']
+      kubectl get replicationsources --all-namespaces --no-headers -A | awk '{print $1, $2}'
-    cmds:
+      | xargs --max-procs=2 -l bash -c 'kubectl --namespace "$0" patch --field-manager=flux-client-side-apply replicationsources "$1" --type merge --patch "{\"spec\":{\"restic\":{\"unlock\":\"{{now | unixEpoch}}\"}}}"'
-      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/unlock.tmpl.yaml) | kubectl --context $CLUSTER apply -f -
-      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} $CLUSTER
-      - kubectl --context $CLUSTER -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=1m
-      - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container minio
-      - kubectl --context $CLUSTER -n {{.ns}} logs job/{{.job}} --container r2
-      - kubectl --context $CLUSTER -n {{.ns}} delete job {{.job}}
-    env: *env-vars
     requires:
-      vars: ["app"]
+      vars: [CLUSTER]
-    vars:
-      ns: '{{.ns | default "default"}}'
-      job: volsync-unlock-{{.app}}
-    preconditions:
-      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/unlock.tmpl.yaml
-    silent: true
 
   # To run backup jobs in parallel for all replicationsources:
-  #   - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:snapshot app=$0 ns=$1'
+  #   - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:snapshot APP=$0 NS=$1'
   snapshot:
-    desc: Snapshot a PVC for an application
+    desc: Snapshot an application
-    summary: |
+    summary: |-
-      cluster: Cluster to run command against (required)
+      CLUSTER: Cluster to run command against (default: main)
-      ns: Namespace the PVC is in (default: default)
+      NS: Namespace the application is in (default: default)
-      app: Application to snapshot (required)
+      APP: Application to snapshot (required)
     cmds:
-      - kubectl --context {{.cluster}} -n {{.ns}} patch replicationsources {{.app}} --type merge -p '{"spec":{"trigger":{"manual":"{{.now}}"}}}'
+      - kubectl --namespace {{.NS}} patch replicationsources {{.APP}} --type merge -p '{"spec":{"trigger":{"manual":"{{now | unixEpoch}}"}}}'
-      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}}
+      - until kubectl --namespace {{.NS}} get job/{{.JOB}} &>/dev/null; do sleep 5; done
-      - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=120m
+      - kubectl --namespace {{.NS}} wait job/{{.JOB}} --for=condition=complete --timeout=120m
-    env: *env-vars
-    requires:
-      vars: ["cluster", "app"]
     vars:
-      now: '{{now | date "150405"}}'
+      NS: '{{.NS | default "default"}}'
-      ns: '{{.ns | default "default"}}'
+      JOB: volsync-src-{{.APP}}
-      job: volsync-src-{{.app}}
+    requires:
-      controller:
+      vars: [CLUSTER, APP]
-        sh: true && {{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh {{.app}} {{.ns}} {{.cluster}}
     preconditions:
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh
+      - kubectl --namespace {{.NS}} get replicationsources {{.APP}}
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
-      - kubectl --context {{.cluster}} -n {{.ns}} get replicationsources {{.app}}
 
   # To run restore jobs in parallel for all replicationdestinations:
-  #    - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:restore app=$0 ns=$1'
+  #    - kubectl get replicationsources --all-namespaces --no-headers | awk '{print $2, $1}' | xargs --max-procs=4 -l bash -c 'task volsync:restore APP=$0 NS=$1'
   restore:
-    desc: Restore a PVC for an application
+    desc: Restore an application
-    summary: |
+    summary: |-
-      cluster: Cluster to run command against (required)
+      CLUSTER: Cluster to run command against (default: main)
-      ns: Namespace the PVC is in (default: default)
+      NS: Namespace the application is in (default: default)
-      app: Application to restore (required)
+      APP: Application to restore (required)
-      previous: Previous number of snapshots to restore (default: 2)
+      PREVIOUS: Previous number of snapshots to restore (default: 2)
     cmds:
-      - { task: .suspend, vars: *env-vars }
+      - task: .suspend
-      - { task: .wipe, vars: *env-vars }
+      - task: .restore
-      - { task: .restore, vars: *env-vars }
+      - task: .resume
-      - { task: .resume, vars: *env-vars }
-    env: *env-vars
     requires:
-      vars: ["cluster", "app"]
+      vars: [CLUSTER, APP]
-    vars:
-      ns: '{{.ns | default "default"}}'
-      previous: '{{.previous | default 2}}'
-      controller:
-        sh: "{{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh {{.app}} {{.ns}}"
-      claim:
-        sh: kubectl --context {{.cluster}} -n {{.ns}} get replicationsources/{{.app}} -o jsonpath="{.spec.sourcePVC}"
-      puid:
-        sh: kubectl --context {{.cluster}} -n {{.ns}} get replicationsources/{{.app}} -o jsonpath="{.spec.restic.moverSecurityContext.runAsUser}"
-      pgid:
-        sh: kubectl --context {{.cluster}} -n {{.ns}} get replicationsources/{{.app}} -o jsonpath="{.spec.restic.moverSecurityContext.runAsGroup}"
-    preconditions:
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/which-controller.sh
 
-  cleanup:
-    desc: Delete volume populator PVCs in all namespaces
-    summary: |
-      cluster: Cluster to run command against (required)
-    cmds:
-      - for: { var: dest }
-        cmd: |
-          {{- $items := (split "/" .ITEM) }}
-          kubectl --context {{.cluster}} delete pvc -n {{ $items._0 }} {{ $items._1 }}
-      - for: { var: cache }
-        cmd: |
-          {{- $items := (split "/" .ITEM) }}
-          kubectl --context {{.cluster}} delete pvc -n {{ $items._0 }} {{ $items._1 }}
-      - for: { var: snaps }
-        cmd: |
-          {{- $items := (split "/" .ITEM) }}
-          kubectl --context {{.cluster}} delete volumesnapshot -n {{ $items._0 }} {{ $items._1 }}
-    env: *env-vars
-    requires:
-      vars: ["cluster"]
-    vars:
-      dest:
-        sh: kubectl --context {{.cluster}} get pvc --all-namespaces --no-headers | grep "dst-dest" | awk '{print $1 "/" $2}'
-      cache:
-        sh: kubectl --context {{.cluster}} get pvc --all-namespaces --no-headers | grep "dst-cache" | awk '{print $1 "/" $2}'
-      snaps:
-        sh: kubectl --context {{.cluster}} get volumesnapshot --all-namespaces --no-headers | grep "dst-dest" | awk '{print $1 "/" $2}'
-
-  # Suspend the Flux ks and hr
   .suspend:
     internal: true
     cmds:
-      - flux --context {{.cluster}} -n flux-system suspend kustomization {{.app}}
+      - flux --namespace flux-system suspend kustomization {{.APP}}
-      - flux --context {{.cluster}} -n {{.ns}} suspend helmrelease {{.app}}
+      - flux --namespace {{.NS}} suspend helmrelease {{.APP}}
-      - kubectl --context {{.cluster}} -n {{.ns}} scale {{.controller}} --replicas 0
+      - kubectl --namespace {{.NS}} scale {{.CONTROLLER}}/{{.APP}} --replicas 0
-      - kubectl --context {{.cluster}} -n {{.ns}} wait pod --for delete --selector="app.kubernetes.io/name={{.app}}" --timeout=2m
+      - kubectl --namespace {{.NS}} wait pod --for=delete --selector="app.kubernetes.io/name={{.APP}}" --timeout=5m
-    env: *env-vars
-
-  # Wipe the PVC of all data
-  .wipe:
-    internal: true
-    cmds:
-      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/wipe.tmpl.yaml) | kubectl --context {{.cluster}} apply -f -
-      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}}
-      - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=120m
-      - kubectl --context {{.cluster}} -n {{.ns}} logs job/{{.job}} --container main
-      - kubectl --context {{.cluster}} -n {{.ns}} delete job {{.job}}
-    env: *env-vars
     vars:
-      job: volsync-wipe-{{.app}}
+      NS: '{{.NS | default "default"}}'
-    preconditions:
+      APP: '{{.APP}}'
-      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
+      CONTROLLER:
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wipe.tmpl.yaml
+        sh: kubectl --namespace {{.NS}} get deployment {{.APP}} &>/dev/null && echo deployment || echo statefulset
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
 
-  # Create VolSync replicationdestination CR to restore data
   .restore:
     internal: true
     cmds:
-      - /etc/profiles/per-user/jahanson/bin/envsubst < <(cat {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.tmpl.yaml) | kubectl --context {{.cluster}} apply -f -
+      - minijinja-cli --env --trim-blocks --lstrip-blocks --autoescape=none {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.yaml.j2 | kubectl apply --server-side --filename -
-      - bash {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh {{.job}} {{.ns}} {{.cluster}}
+      - until kubectl --namespace {{.NS}} get job/{{.JOB}} &>/dev/null; do sleep 5; done
-      - kubectl --context {{.cluster}} -n {{.ns}} wait job/{{.job}} --for condition=complete --timeout=120m
+      - kubectl --namespace {{.NS}} wait job/{{.JOB}} --for=condition=complete --timeout=120m
-      - kubectl --context {{.cluster}} -n {{.ns}} delete replicationdestination {{.job}}
+      - kubectl --namespace {{.NS}} delete replicationdestination {{.JOB}}
-    env: *env-vars
     vars:
-      job: volsync-dst-{{.app}}
+      NS: '{{.NS | default "default"}}'
+      JOB: volsync-dst-{{.APP}}
+      PREVIOUS: '{{.PREVIOUS | default 2}}'
+      CLAIM:
+        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.sourcePVC}"
+      ACCESS_MODES:
+        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.accessModes}"
+      STORAGE_CLASS_NAME:
+        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.storageClassName}"
+      PUID:
+        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.moverSecurityContext.runAsUser}"
+      PGID:
+        sh: kubectl --namespace {{.NS}} get replicationsources/{{.APP}} --output=jsonpath="{.spec.restic.moverSecurityContext.runAsGroup}"
+    env:
+      NS: '{{.NS}}'
+      JOB: '{{.JOB}}'
+      APP: '{{.APP}}'
+      PREVIOUS: '{{.PREVIOUS}}'
+      CLAIM: '{{.CLAIM}}'
+      ACCESS_MODES: '{{.ACCESS_MODES}}'
+      STORAGE_CLASS_NAME: '{{.STORAGE_CLASS_NAME}}'
+      PUID: '{{.PUID}}'
+      PGID: '{{.PGID}}'
     preconditions:
-      - test -f /etc/profiles/per-user/jahanson/bin/envsubst
+      - test -f {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.yaml.j2
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/replicationdestination.tmpl.yaml
-      - test -f {{.VOLSYNC_RESOURCES_DIR}}/wait-for-job.sh
 
-  # Resume Flux ks and hr
   .resume:
     internal: true
     cmds:
-      - flux --context {{.cluster}} -n {{.ns}} resume helmrelease {{.app}}
+      - flux --namespace {{.NS}} resume helmrelease {{.APP}}
-      - flux --context {{.cluster}} -n flux-system resume kustomization {{.app}}
+      - flux --namespace flux-system resume kustomization {{.APP}}
-    env: *env-vars
+      - kubectl --namespace {{.NS}} scale {{.CONTROLLER}}/{{.APP}} --replicas 1
+      - kubectl --namespace {{.NS}} wait pod --for=condition=ready --selector="app.kubernetes.io/name={{.APP}}" --timeout=5m
+    vars:
+      NS: '{{.NS | default "default"}}'
+      APP: '{{.APP}}'
+      CONTROLLER:
+        sh: kubectl --namespace {{.NS}} get deployment {{.APP}} &>/dev/null && echo deployment || echo statefulset

.taskfiles/volsync/resources/.env

@@ -1 +0,0 @@
-CLUSTER=theshire

.taskfiles/volsync/resources/list.tmpl.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ${job}
-  namespace: ${ns}
-spec:
-  ttlSecondsAfterFinished: 3600
-  template:
-    spec:
-      automountServiceAccountToken: false
-      restartPolicy: OnFailure
-      containers:
-        - name: main
-          image: docker.io/restic/restic:latest
-          args: ["snapshots"]
-          envFrom:
-            - secretRef:
-                name: ${app}-volsync-r2-secret
-          resources: {}

.taskfiles/volsync/resources/replicationdestination.tmpl.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationDestination
-metadata:
-  name: ${job}
-  namespace: ${ns}
-spec:
-  trigger:
-    manual: restore-once
-  restic:
-    repository: ${app}-volsync-r2-secret
-    destinationPVC: ${claim}
-    copyMethod: Direct
-    storageClassName: ceph-block
-    # storageClassName: ceph-filesystem
-    # accessModes: ["ReadWriteMany"]
-    # IMPORTANT NOTE:
-    #   Set to the last X number of snapshots to restore from
-    previous: ${previous}
-    # OR;
-    # IMPORTANT NOTE:
-    #   On bootstrap set `restoreAsOf` to the time the old cluster was destroyed.
-    #   This will essentially prevent volsync from trying to restore a backup
-    #   from a application that started with default data in the PVC.
-    #   Do not restore snapshots made after the following RFC3339 Timestamp.
-    #   date --rfc-3339=seconds (--utc)
-    # restoreAsOf: "2022-12-10T16:00:00-05:00"
-    moverSecurityContext:
-      runAsUser: ${puid}
-      runAsGroup: ${pgid}
-      fsGroup: ${pgid}

.taskfiles/volsync/resources/replicationdestination.yaml.j2

@@ -0,0 +1,23 @@
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: {{ ENV.JOB }}
+  namespace: {{ ENV.NS }}
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: {{ ENV.APP }}-volsync-secret
+    destinationPVC: {{ ENV.CLAIM }}
+    copyMethod: Direct
+    storageClassName: {{ ENV.STORAGE_CLASS_NAME }}
+    accessModes: {{ ENV.ACCESS_MODES }}
+    previous: {{ ENV.PREVIOUS }}
+    enableFileDeletion: true
+    cleanupCachePVC: true
+    cleanupTempPVC: true
+    moverSecurityContext:
+      runAsUser: {{ ENV.PUID }}
+      runAsGroup: {{ ENV.PGID }}
+      fsGroup: {{ ENV.PGID }}

.taskfiles/volsync/resources/unlock.tmpl.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ${job}
-  namespace: ${ns}
-spec:
-  ttlSecondsAfterFinished: 3600
-  template:
-    spec:
-      automountServiceAccountToken: false
-      restartPolicy: OnFailure
-      containers:
-        - name: minio
-          image: docker.io/restic/restic:latest
-          args: ["unlock", "--remove-all"]
-          envFrom:
-            - secretRef:
-                name: ${app}-volsync-secret
-          resources: {}
-        - name: r2
-          image: docker.io/restic/restic:latest
-          args: ["unlock", "--remove-all"]
-          envFrom:
-            - secretRef:
-                name: ${app}-volsync-r2-secret
-          resources: {}

.taskfiles/volsync/resources/wait-for-job.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-JOB=$1
-NAMESPACE="${2:-default}"
-CLUSTER="${3:-main}"
-
-[[ -z "${JOB}" ]] && echo "Job name not specified" && exit 1
-while true; do
-    STATUS="$(kubectl --context "${CLUSTER}" -n "${NAMESPACE}" get pod -l job-name="${JOB}" -o jsonpath='{.items[*].status.phase}')"
-    if [ "${STATUS}" == "Pending" ]; then
-        break
-    fi
-    sleep 1
-done

.taskfiles/volsync/resources/which-controller.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-APP=$1
-NAMESPACE="${2:-default}"
-CLUSTER="${3:-theshire}"
-
-is_deployment() {
-    kubectl --context "${CLUSTER}" -n "${NAMESPACE}" get deployment "${APP}" >/dev/null 2>&1
-}
-
-is_statefulset() {
-    kubectl --context "${CLUSTER}" -n "${NAMESPACE}" get statefulset "${APP}" >/dev/null 2>&1
-}
-
-if is_deployment; then
-    echo "deployment.apps/${APP}"
-elif is_statefulset; then
-    echo "statefulset.apps/${APP}"
-else
-    echo "No deployment or statefulset found for ${APP}"
-    exit 1
-fi

.taskfiles/volsync/resources/wipe.tmpl.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ${job}
-  namespace: ${ns}
-spec:
-  ttlSecondsAfterFinished: 3600
-  template:
-    spec:
-      automountServiceAccountToken: false
-      restartPolicy: OnFailure
-      containers:
-        - name: main
-          image: docker.io/library/alpine:latest
-          command: ["/bin/sh", "-c", "cd /config; find . -delete"]
-          volumeMounts:
-            - name: config
-              mountPath: /config
-          securityContext:
-            privileged: true
-          resources: {}
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: ${claim}

kubernetes/apps/ai/ollama/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: docker.io/ollama/ollama
-              tag: 0.3.12
+              tag: 0.3.14
             env:
               - name: OLLAMA_HOST
                 value: 0.0.0.0

kubernetes/apps/ai/ollama/ks.yaml

@@ -22,7 +22,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/ai/open-webui/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/ai/open-webui/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/anime/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Pre Flux-Kustomizations
+  - ./namespace.yaml
+  # Flux-Kustomizations
+  # - ./jellyfin/ks.yaml    # sqlite
+  # - ./jellyseerr/ks.yaml  # sqlite
+  - ./radarr/ks.yaml      # postgres
+  # - ./shoko/ks.yaml       # sqlite
+  - ./sonarr/ks.yaml      # postgres

kubernetes/apps/anime/namespace.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: anime
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    volsync.backube/privileged-movers: "true"
+    pgo-enabled-hsn.dev: "true"

kubernetes/apps/anime/radarr/app/externalsecret.yaml

@@ -0,0 +1,46 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: radarr
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: radarr-secret
+    template:
+      engineVersion: v2
+      data:
+        PUSHOVER_TOKEN: "{{ .radarr_token }}"
+        PUSHOVER_USER_KEY: "{{ .userkey_jahanson }}"
+        RADARR__AUTH__APIKEY: "{{ .api_key_anime }}"
+  dataFrom:
+    - extract:
+        key: pushover
+    - extract:
+        key: radarr
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: radarr-db
+spec:
+  secretStoreRef:
+    name: crunchy-pgo-secrets
+    kind: ClusterSecretStore
+  target:
+    name: radarr-db-secret
+    template:
+      engineVersion: v2
+      data:
+        RADARR__POSTGRES__HOST: "{{ index . \"pgbouncer-host\" }}"
+        RADARR__POSTGRES__USER: "{{ .user }}"
+        RADARR__POSTGRES__PASSWORD: "{{ .password }}"
+        RADARR__POSTGRES__PORT: "{{ .port }}"
+        RADARR__POSTGRES__MAINDB: "{{ .dbname }}"
+  dataFrom:
+    - extract:
+        key: postgres-pguser-radarr-anime

kubernetes/apps/anime/radarr/app/helmrelease.yaml

@@ -0,0 +1,119 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app radarr-anime
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controllers:
+      radarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/radarr-develop
+              tag: 5.13.0.9361
+            env:
+              RADARR__APP__INSTANCENAME: Radarr-Anime
+              RADARR__APP__THEME: dark
+              RADARR__AUTH__METHOD: External
+              RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              RADARR__LOG__DBENABLED: "False"
+              RADARR__LOG__LEVEL: info
+              RADARR__SERVER__PORT: &port 80
+              RADARR__UPDATE__BRANCH: develop
+              TZ: America/Chicago
+            envFrom:
+              - secretRef:
+                  name: radarr-secret
+              - secretRef:
+                  name: radarr-db-secret
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+              limits:
+                memory: 6Gi
+        pod:
+          securityContext:
+            runAsUser: 568
+            runAsGroup: 568
+            runAsNonRoot: true
+            fsGroup: 568
+            fsGroupChangePolicy: OnRootMismatch
+            supplementalGroups: [10000]
+    service:
+      app:
+        controller: radarr
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal-nginx
+        hosts:
+          - host: &host "{{ .Release.Name }}.jahanson.tech"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        enabled: true
+        existingClaim: *app
+      tmp:
+        type: emptyDir
+      media:
+        type: nfs
+        server: 10.1.1.13
+        path: /eru/media
+        globalMounts:
+          - path: /data/nas-media
+      moria-media:
+        type: nfs
+        server: 10.1.1.61
+        path: /moria/media/
+        globalMounts:
+          - path: /data/moria-media

kubernetes/apps/anime/radarr/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  - ../../../../templates/volsync

kubernetes/apps/anime/radarr/ks.yaml

@@ -0,0 +1,29 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app radarr-anime
+  namespace: flux-system
+spec:
+  targetNamespace: anime
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: crunchy-postgres-operator
+    - name: external-secrets-stores
+    - name: rook-ceph-cluster
+    - name: volsync
+  path: ./kubernetes/apps/anime/radarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  interval: 30m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
+      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/anime/sonarr/app/externalsecret.yaml

@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: sonarr
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: sonarr-secret
+    template:
+      engineVersion: v2
+      data:
+        PUSHOVER_TOKEN: "{{ .sonarr_token }}"
+        PUSHOVER_USER_KEY: "{{ .userkey_jahanson }}"
+        SONARR__AUTH__APIKEY: "{{ .api_key_anime }}"
+  dataFrom:
+    - extract:
+        key: pushover
+    - extract:
+        key: sonarr
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: sonarr-db
+spec:
+  secretStoreRef:
+    name: crunchy-pgo-secrets
+    kind: ClusterSecretStore
+  target:
+    name: sonarr-db-secret
+    template:
+      engineVersion: v2
+      data:
+        SONARR__POSTGRES__HOST: "{{ index . \"pgbouncer-host\" }}"
+        SONARR__POSTGRES__USER: "{{ .user }}"
+        SONARR__POSTGRES__PASSWORD: "{{ .password }}"
+        SONARR__POSTGRES__PORT: "{{ .port }}"
+        SONARR__POSTGRES__MAINDB: "{{ .dbname }}"
+  dataFrom:
+    - extract:
+        key: postgres-pguser-sonarr-anime

kubernetes/apps/anime/sonarr/app/helmrelease.yaml

@@ -0,0 +1,119 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sonarr-anime
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controllers:
+      sonarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: 4.0.9.2513
+            env:
+              SONARR__APP__INSTANCENAME: Sonarr-Anime
+              SONARR__APP__THEME: dark
+              SONARR__AUTH__METHOD: External
+              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              SONARR__LOG__DBENABLED: "False"
+              SONARR__LOG__LEVEL: info
+              SONARR__SERVER__PORT: &port 80
+              SONARR__UPDATE__BRANCH: develop
+              TZ: America/Chicago
+            envFrom:
+              - secretRef:
+                  name: sonarr-secret
+              - secretRef:
+                  name: sonarr-db-secret
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 30
+                  timeoutSeconds: 5
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+              limits:
+                memory: 6Gi
+        pod:
+          securityContext:
+            runAsUser: 568
+            runAsGroup: 568
+            runAsNonRoot: true
+            fsGroup: 568
+            fsGroupChangePolicy: OnRootMismatch
+            supplementalGroups: [10000]
+    service:
+      app:
+        controller: sonarr
+        ports:
+          http:
+            port: *port
+    ingress:
+      main:
+        enabled: true
+        className: internal-nginx
+        hosts:
+          - host: &host "{{ .Release.Name }}.jahanson.tech"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        enabled: true
+        existingClaim: *app
+      tmp:
+        type: emptyDir
+      media:
+        type: nfs
+        server: 10.1.1.13
+        path: /eru/media
+        globalMounts:
+          - path: /data/nas-media
+      moria-media:
+        type: nfs
+        server: 10.1.1.61
+        path: /moria/media/
+        globalMounts:
+          - path: /data/moria-media

kubernetes/apps/anime/sonarr/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  - ../../../../templates/volsync

kubernetes/apps/anime/sonarr/ks.yaml

@@ -0,0 +1,29 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sonarr-anime
+  namespace: flux-system
+spec:
+  targetNamespace: anime
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: crunchy-postgres-operator
+    - name: external-secrets-stores
+    - name: volsync
+    - name: rook-ceph-cluster
+  path: ./kubernetes/apps/anime/sonarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  interval: 30m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
+      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -3,9 +3,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cert-manager
+  name: &app cert-manager
   namespace: flux-system
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   interval: 10m
   path: "./kubernetes/apps/cert-manager/cert-manager/app"
   prune: true
@@ -18,9 +21,12 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cert-manager-issuers
+  name: &app cert-manager-issuers
   namespace: flux-system
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   interval: 10m
   path: "./kubernetes/apps/cert-manager/cert-manager/issuers"
   prune: true

kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml

@@ -3,9 +3,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cert-manager-webhook-dnsimple
+  name: &app cert-manager-webhook-dnsimple
   namespace: flux-system
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   targetNamespace: cert-manager
   interval: 10m
   path: "./kubernetes/apps/cert-manager/webhook-dnsimple/app"

kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/coder/coder/ks.yaml

@@ -20,5 +20,4 @@ spec:
     name: theshire
   wait: true
   interval: 30m
-  retryInterval: 1m
   timeout: 5m

kubernetes/apps/database/crunchy-postgres-operator/cluster/kustomization.yaml

@@ -5,6 +5,7 @@ kind: Kustomization
 resources:
   - ./externalsecret.yaml
   - ./gatus.yaml
+  - ./podmonitor.yaml
   - ./postgrescluster.yaml
   - ./pushsecret.yaml
   - ./service.yaml

kubernetes/apps/database/crunchy-postgres-operator/cluster/podmonitor.yaml

@@ -0,0 +1,38 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/monitoring.coreos.com/podmonitor_v1.json
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: cpgo-postgres
+spec:
+  jobLabel: cpgo-postgres
+  namespaceSelector:
+    matchNames:
+      - database
+  podMetricsEndpoints:
+    - honorLabels: true
+      path: /metrics
+      port: exporter
+      relabelings:
+        - sourceLabels:
+            [
+              "__meta_kubernetes_namespace",
+              "__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_cluster",
+            ]
+          targetLabel: pg_cluster
+          separator: "/"
+          replacement: "$1$2"
+        - sourceLabels:
+            [
+              __meta_kubernetes_pod_label_postgres_operator_crunchydata_com_instance,
+            ]
+          targetLabel: deployment
+        - sourceLabels:
+            [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_role]
+          targetLabel: role
+        - sourceLabels: [__meta_kubernetes_pod_name]
+          targetLabel: instance
+  selector:
+    matchLabels:
+      postgres-operator.crunchydata.com/cluster: postgres
+      postgres-operator.crunchydata.com/crunchy-postgres-exporter: "true"

kubernetes/apps/database/crunchy-postgres-operator/cluster/postgrescluster.yaml

@@ -23,7 +23,13 @@ spec:
     pgmonitor:
       exporter:
         # https://github.com/CrunchyData/postgres-operator-examples/blob/main/helm/install/values.yaml
-        image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.15.0-3
+        # image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.15.0-12
+        resources:
+          requests:
+            cpu: 10m
+            memory: 64M
+          limits:
+            memory: 512M
 
   patroni: # turn on sync writes to at least 1 other replica
     dynamicConfiguration:
@@ -39,7 +45,7 @@ spec:
       metadata:
         labels:
           app.kubernetes.io/name: crunchy-postgres
-      replicas: &replica 1
+      replicas: &replica 2
       dataVolumeClaimSpec:
         storageClassName: openebs-hostpath
         accessModes:
@@ -117,12 +123,22 @@ spec:
         - radarr_main
       password:
         type: AlphaNumeric
+    - name: radarr-anime
+      databases:
+        - radarr_anime
+      password:
+        type: AlphaNumeric
     - name: sonarr
       databases:
         - sonarr_logs
         - sonarr_main
       password:
         type: AlphaNumeric
+    - name: sonarr-anime
+      databases:
+        - sonarr_anime
+      password:
+        type: AlphaNumeric
     - name: jellyseerr
       databases:
         - jellyseerr
@@ -177,6 +193,12 @@ spec:
     pgBouncer:
       port: 5432
       replicas: *replica
+      service:
+        type: LoadBalancer
+        metadata:
+          annotations:
+            external-dns.alpha.kubernetes.io/hostname: pgbouncer.jahanson.tech
+            io.cilium/lb-ipam-ips: 10.1.1.36
       metadata:
         labels:
           app.kubernetes.io/name: crunchy-postgres-pgbouncer

kubernetes/apps/database/crunchy-postgres-operator/operator/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: pgo
-      version: 5.6.1
+      version: 5.7.0
       sourceRef:
         kind: HelmRepository
         name: crunchydata

kubernetes/apps/database/crunchy-postgres-operator/userinit-controller/helmrepository.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrepository-source-v1beta2.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrepository-source-v1.json
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:

kubernetes/apps/database/dragonfly/cluster/dragonfly.yaml

@@ -5,7 +5,7 @@ kind: Dragonfly
 metadata:
   name: dragonfly
 spec:
-  image: ghcr.io/dragonflydb/dragonfly:v1.23.2
+  image: ghcr.io/dragonflydb/dragonfly:v1.24.0
   replicas: 3
   env:
     - name: MAX_MEMORY

kubernetes/apps/database/dragonfly/ks.yaml

@@ -19,7 +19,6 @@ spec:
     name: theshire
   wait: true
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@@ -42,5 +41,4 @@ spec:
     name: theshire
   wait: true
   interval: 30m
-  retryInterval: 1m
   timeout: 5m

kubernetes/apps/database/emqx/app/externalsecret.yaml

@@ -44,17 +44,17 @@ spec:
             {
               "user_id": "tasmota",
               "password": "{{ .x_emqx_tasmota_password }}",
-              "is_superuser": true # Until I can figure out authorization in emqx
+              "is_superuser": true
             },
             {
               "user_id": "zwave",
               "password": "{{ .x_emqx_homeassistant_password }}",
-              "is_superuser": true # Until I can figure out authorization in emqx
+              "is_superuser": true
             },
             {
               "user_id": "zwave",
               "password": "{{ .x_emqx_zwave_password }}",
-              "is_superuser": true # Until I can figure out authorization in emqx
+              "is_superuser": true
             }
           ]
 

kubernetes/apps/database/emqx/app/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: emqx-operator
-      version: 2.2.24
+      version: 2.2.25
       sourceRef:
         kind: HelmRepository
         name: emqx
@@ -26,6 +26,8 @@ spec:
     - name: cert-manager
       namespace: cert-manager
   values:
+    podannotations:
+      reloader.stakater.com/auto: "true"
     fullnameOverride: emqx-operator
     image:
       repository: ghcr.io/emqx/emqx-operator

kubernetes/apps/database/emqx/cluster/cluster.yaml

@@ -5,7 +5,7 @@ kind: EMQX
 metadata:
   name: emqx
 spec:
-  image: public.ecr.aws/emqx/emqx:5.8.0
+  image: public.ecr.aws/emqx/emqx:5.8.1
   config:
     mode: Merge
   coreTemplate:

kubernetes/apps/database/emqx/cluster/resources/emqx.conf

@@ -2,7 +2,7 @@ authentication {
   backend = "built_in_database"
   mechanism = "password_based"
   password_hash_algorithm {
-      name = "bcrypt",
+      name = "bcrypt"
   }
   user_id_type = "username"
   bootstrap_file = "/opt/init-user.json"
@@ -11,11 +11,6 @@ authentication {
 
 authorization {
   sources = [
-    {
-      type = file
-      enable = true
-      path = "/opt/acl.conf"
-    },
     {
       type = built_in_database
       enable = true

kubernetes/apps/database/emqx/ks.yaml

@@ -19,7 +19,6 @@ spec:
     name: theshire
   wait: true
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@@ -42,5 +41,4 @@ spec:
     name: theshire
   wait: true
   interval: 30m
-  retryInterval: 1m
   timeout: 5m

kubernetes/apps/default/atuin/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/autobrr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/autobrr/autobrr
-              tag: v1.47.1@sha256:5364237a98b12bb269384dd4f4feaf7583027591c26bc2e6aaac0baa4e142b34
+              tag: v1.48.0@sha256:0ae19e3beedf491396e450b024c23e9e24df4d692286c0442a81fa699493def0
             env:
               AUTOBRR__CHECK_FOR_UPDATES: "false"
               AUTOBRR__HOST: 0.0.0.0

kubernetes/apps/default/autobrr/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/excalidraw/app/helmrelease.yaml

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: docker.io/excalidraw/excalidraw
-              tag: latest@sha256:df3ddf00d7977d7007ea33b5397239ff20955eeeeafd38735cb1604be799564a
+              tag: latest@sha256:687708a6c879b9120c82b61faf9ff242367395be1d5f90c385989405e51b5433
               pullPolicy: IfNotPresent
             probes:
               liveness:

kubernetes/apps/default/excalidraw/ks.yaml

@@ -17,7 +17,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/home-assistant/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/home-assistant
-              tag: 2024.10.1@sha256:04614835418d2bdacd64685b516e58e7c5446f72485d446e7635282ba1a06c43
+              tag: 2024.10.3@sha256:59cb3b01ea4695c5df8f4cc1e4d01fa7e22090caa3fd3f000a96b6a5de909f91
             env:
               TZ: America/Chicago
             envFrom:

kubernetes/apps/default/home-assistant/ks.yaml

@@ -19,7 +19,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/it-tools/ks.yaml

@@ -17,7 +17,6 @@ spec:
     name: theshire
   wait: false # no flux ks dependents
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/kustomization.yaml

@@ -22,6 +22,7 @@ resources:
   - ./recyclarr/ks.yaml
   - ./redlib/ks.yaml
   - ./sabnzbd/ks.yaml
+  - ./scrypted/ks.yaml
   - ./searxng/ks.yaml
   - ./sonarr/ks.yaml
   - ./tautulli/ks.yaml

kubernetes/apps/default/linkwarden/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/linkwarden/app/kustomization.yaml

@@ -3,7 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../../../templates/gatus/internal
-  - ../../../../templates/volsync
   - ./externalsecret.yaml
   - ./helmrelease.yaml
+  - ../../../../templates/gatus/internal
+  - ../../../../templates/volsync

kubernetes/apps/default/linkwarden/ks.yaml

@@ -22,7 +22,6 @@ spec:
     name: theshire
   wait: false # no flux ks dependents
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/maintainerr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/maintainerr/app/kustomization.yaml

@@ -5,4 +5,4 @@ kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ../../../../templates/volsync
-  # - ../../../../templates/gatus/internal
+  - ../../../../templates/gatus/internal

kubernetes/apps/default/omegabrr/ks.yaml

@@ -19,7 +19,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/overseerr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/overseerr/ks.yaml

@@ -20,7 +20,6 @@ spec:
     - name: volsync
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/piped/app/helmrelease.yaml

@@ -18,6 +18,11 @@ spec:
   values:
     defaultPodOptions:
       automountServiceAccountToken: false
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: "OnRootMismatch"
 
     controllers:
       backend:
@@ -25,13 +30,6 @@ spec:
         annotations:
           secret.reloader.stakater.com/reload: piped-secret
 
-        pod:
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            fsGroup: 1000
-            fsGroupChangePolicy: "OnRootMismatch"
-
         containers:
           app:
             image:
@@ -58,21 +56,13 @@ spec:
 
       frontend:
         strategy: RollingUpdate
-        pod:
-          securityContext:
-            runAsUser: 101
-            runAsGroup: 101
-            fsGroup: 101
-            fsGroupChangePolicy: "OnRootMismatch"
 
         containers:
           app:
             image:
               repository: ghcr.io/bjw-s-labs/piped-frontend
-              tag: latest@sha256:c4cb0cfbdf149cdb738fb9e41a5cc748a7ea53053f4c5e036b9f7578d9273328
+              tag: 2024.10.19@sha256:73dc140014c715b503b0b8b806fd2e6ed070eeef6b2556b28a4381c690ebfdc8
             env:
-              HTTP_PORT: 8080
-              HTTP_WORKERS: 4
               BACKEND_HOSTNAME: piped-api.hsn.dev
             probes:
               liveness:
@@ -87,21 +77,19 @@ spec:
                 memory: 256Mi
             securityContext:
               allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              readOnlyRootFilesystem: true
 
       ytproxy:
         strategy: RollingUpdate
-        pod:
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            fsGroup: 1000
-            fsGroupChangePolicy: "OnRootMismatch"
 
         containers:
           app:
             image:
               repository: 1337kavin/piped-proxy
-              tag: latest@sha256:9872edd2c47c9c33dfa44c334e4cef4e2c6ec91638eb2dcf6ca36b7b3037fd59
+              tag: latest@sha256:47cf993679d1bf6b1dbfd3282e143818f2f11106832605789d1e26df52ac7b41
             command:
               - /app/piped-proxy
             probes:

kubernetes/apps/default/plex/ks.yaml

@@ -19,7 +19,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/prowlarr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/prowlarr-develop
-              tag: 1.25.1.4770@sha256:8b59eb7f9e5321b702bdacae3468b63d71720091ba3b0e9dfaca686a7705d2b8
+              tag: 1.25.4.4818@sha256:5a936e5c73ebedfc45f1fa2541e84862a6c0df75b8f5148a082119fb65d55e2b
             env:
               # Ref: https://github.com/Radarr/Radarr/issues/7030#issuecomment-1039689518
               # Ref: https://github.com/dotnet/runtime/issues/9336

kubernetes/apps/default/prowlarr/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/radarr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/radarr-develop
-              tag: 5.12.0.9255
+              tag: 5.13.0.9361
             env:
               RADARR__APP__INSTANCENAME: Radarr
               RADARR__APP__THEME: dark

kubernetes/apps/default/radarr/ks.yaml

@@ -22,7 +22,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/recyclarr/app/resources/recyclarr.yml

@@ -11,6 +11,12 @@ sonarr:
     quality_definition:
       type: series
 
+    include:
+      # Comment out any of the following includes to disable them
+      - template: sonarr-quality-definition-anime
+      - template: sonarr-v4-quality-profile-anime
+      - template: sonarr-v4-custom-formats-anime
+
     quality_profiles:
       - name: Web 1080p
         reset_unmatched_scores:
@@ -100,6 +106,22 @@ sonarr:
         assign_scores_to:
           - name: Web 1080p
           - name: Web 720p
+      # Anime Score Overrides
+      - trash_ids:
+          - 026d5aadd1a6b4e550b134cb6c72b3ca # Uncensored
+        assign_scores_to:
+          - name: Remux-1080p - Anime
+            score: 0 # Adjust scoring as desired
+      - trash_ids:
+          - b2550eb333d27b75833e25b8c2557b38 # 10bit
+        assign_scores_to:
+          - name: Remux-1080p - Anime
+            score: 0 # Adjust scoring as desired
+      - trash_ids:
+          - 418f50b10f1907201b6cfdf881f467b7 # Anime Dual Audio
+        assign_scores_to:
+          - name: Remux-1080p - Anime
+            score: 0 # Adjust scoring as desired
 
 radarr:
   radarr:

kubernetes/apps/default/recyclarr/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/redlib/app/helmrelease.yaml

@@ -38,7 +38,7 @@ spec:
           app:
             image:
               repository: quay.io/redlib/redlib
-              tag: latest@sha256:e61e2535518e0b574f92642612f33f6fbee1aa22b2ff36ee740e26a025bb0039
+              tag: latest@sha256:a3f1eca3ebfc043eea4bc8274b1e9fe86ec15d0efa13536bd519f36eb18f763d
             env:
               REDLIB_DEFAULT_SHOW_NSFW: on
               REDLIB_DEFAULT_WIDE: on

kubernetes/apps/default/redlib/ks.yaml

@@ -19,7 +19,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/sabnzbd/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/sabnzbd
-              tag: 4.3.3@sha256:6614d759bbaa6884926c6aa75018339bd35cd1add0ff92c907087327dd470477
+              tag: 4.3.3@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
             env:
               TZ: America/Chicago
               SABNZBD__PORT: &port 80

kubernetes/apps/default/sabnzbd/ks.yaml

@@ -21,7 +21,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/scrypted/app/helmrelease.yaml

@@ -0,0 +1,120 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app scrypted
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+
+  values:
+    controllers:
+      scrypted:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        pod:
+          nodeSelector:
+            google.feature.node.kubernetes.io/coral: "true"
+            nvidia.com/gpu.present: "true"
+          securityContext:
+            supplementalGroups:
+              - 568
+        containers:
+          app:
+            image:
+              repository: ghcr.io/koush/scrypted
+              tag: v0.121.0-jammy-nvidia
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  failureThreshold: 30
+                  periodSeconds: 5
+            resources:
+              requests:
+                cpu: 136m
+                memory: 1024Mi
+              limits:
+                nvidia.com/gpu: 1
+                memory: 8192Mi
+            securityContext:
+              privileged: true
+    service:
+      app:
+        controller: *app
+        type: LoadBalancer
+        annotations:
+          io.cilium/lb-ipam-ips: 10.1.1.33
+        nameOverride: *app
+        ports:
+          http:
+            port: 11080
+            primary: true
+          rebroadcast1: # driveway
+            port: 39655
+          rebroadcast2: # sideyard
+            port: 46561
+          rebroadcast3: # doorbell
+            port: 44759
+          homekit: # homekit
+            port: 42010
+          homekit-bridge: # bridge
+            port: 33961
+
+
+    ingress:
+      app:
+        className: "internal-nginx"
+        annotations:
+        hosts:
+          - host: &host scrypted.jahanson.tech
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        existingClaim: scrypted
+        advancedMounts:
+          scrypted:
+            app:
+              - path: /server/volume
+      cache:
+        type: emptyDir
+        globalMounts:
+          - path: /.cache
+      cache-npm:
+        type: emptyDir
+        globalMounts:
+          - path: /.npm
+      dev-bus-usb:
+        type: hostPath
+        hostPath: /dev/bus/usb
+        hostPathType: Directory
+      sys-bus-usb:
+        type: hostPath
+        hostPath: /sys/bus/usb
+        hostPathType: Directory
+      recordings:
+        type: nfs
+        server: shadowfax.jahanson.tech
+        path: /nahar/scrypted
+        globalMounts:
+          - path: /recordings

kubernetes/apps/default/scrypted/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ../../../../templates/volsync

kubernetes/apps/default/scrypted/ks.yaml

@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &appname scrypted
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
+  interval: 30m
+  timeout: 5m
+  path: "./kubernetes/apps/default/scrypted/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  dependsOn:
+    - name: rook-ceph-cluster
+    - name: volsync
+    - name: external-secrets-stores
+  postBuild:
+    substitute:
+      APP: *appname
+      APP_UID: "0"
+      APP_GID: "0"
+      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/default/searxng/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/searxng/ks.yaml

@@ -20,7 +20,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/sonarr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/sonarr/ks.yaml

@@ -22,7 +22,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/tautulli/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/tautulli/tautulli
-              tag: v2.14.5@sha256:6017b491d8e9100a97391b639fff5824ad36a315c69aae3c9ed78407994a626e
+              tag: v2.14.6@sha256:f54d2d3a78780c765cd7a10b882474909f50247b5d2d118badaa9c035421effd
             env:
               TZ: America/Chicago
             command: ["/usr/local/bin/python", "Tautulli.py"]

kubernetes/apps/default/tautulli/ks.yaml

@@ -20,7 +20,6 @@ spec:
     - name: volsync
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/default/unpackerr/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/default/unpackerr/ks.yaml

@@ -19,5 +19,4 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m

kubernetes/apps/default/zwave/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/zwave-js/zwave-js-ui
-              tag: 9.21.1@sha256:a28eaf01060dbe2fa30045d6b2ac6a31bc34efbebb7aa7d19787929929aea16a
+              tag: 9.24.0@sha256:ed648be6b058c6aa74abca1868c3ac48cb82b06b22ef0ef4f7ba66dd9d331bfc
             env:
               TZ: America/Chicago
               PORT: &port 80

kubernetes/apps/default/zwave/ks.yaml

@@ -17,7 +17,6 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
   postBuild:
     substitute:

kubernetes/apps/flux-system/add-ons/ks.yaml

@@ -3,11 +3,14 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: flux-webhooks
+  name: &app flux-webhooks
   namespace: flux-system
   labels:
     substitution.flux.home.arpa/enabled: "true"
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   interval: 10m
   path: ./kubernetes/apps/flux-system/add-ons/webhooks
   prune: true
@@ -20,11 +23,14 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: flux-monitoring
+  name: &app flux-monitoring
   namespace: flux-system
   labels:
     substitution.flux.home.arpa/enabled: "true"
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   interval: 10m
   path: ./kubernetes/apps/flux-system/add-ons/monitoring
   prune: true

kubernetes/apps/kube-system/chronyd/app/helmrelease.yaml

@@ -0,0 +1,56 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app chronyd
+spec:
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  interval: 30m
+  values:
+    controllers:
+      chronyd:
+        type: daemonset
+        strategy: RollingUpdate
+        annotations:
+          reloader.stakater.com/auto: "true"
+        pod:
+          tolerations:
+            - key: node-role.kubernetes.io/master
+              effect: NoSchedule
+        containers:
+          app:
+            image:
+              repository: docker.io/library/rockylinux
+              tag: 9
+            args:
+              - "/bin/bash"
+              - "-c"
+              - "dnf install -y chrony iputils dnsutils && chronyd -n -d"
+            resources:
+              requests:
+                cpu: 23m
+                memory: 50M
+            securityContext:
+              privileged: true
+
+    persistence:
+      config:
+        type: configMap
+        name: chronyd-configmap
+        globalMounts:
+          - path: /etc/chrony.conf
+            subPath: chrony.conf
+            readOnly: true
+      data:
+        type: emptyDir
+        globalMounts:
+          - path: /var/lib/chrony

kubernetes/apps/kube-system/chronyd/app/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: chronyd-configmap
+    files:
+      - chrony.conf=./resources/chrony.conf
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/kube-system/chronyd/app/resources/chrony.conf

@@ -0,0 +1,27 @@
+# Cloudflare time servers
+server time.cloudflare.com iburst
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+#leapsecmode slew
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz right/UTC
+
+# Specify directory for log files.
+logdir /var/log/chrony

kubernetes/apps/kube-system/chronyd/ks.yaml

@@ -0,0 +1,20 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app chronyd
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/kube-system/chronyd/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  interval: 30m
+  timeout: 5m

kubernetes/apps/kube-system/cilium/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: 1.16.2
+      version: 1.16.3
       sourceRef:
         kind: HelmRepository
         name: cilium

kubernetes/apps/kube-system/cilium/config/l2.yaml

@@ -7,7 +7,8 @@ metadata:
 spec:
   loadBalancerIPs: true
   # interfaces: ["^enp.*|^eth.*|^ens.*|^eno.*"]
-  interfaces: ["^eno+|^enp+"]
+  interfaces: ["^eno+|^enp+|^bond+"]
+  # interfaces: ["^bond+"]
   nodeSelector:
     matchLabels:
       kubernetes.io/os: linux

kubernetes/apps/kube-system/cilium/ks.yaml

@@ -17,7 +17,6 @@ spec:
     name: theshire
   wait: true
   interval: 30m
-  retryInterval: 1m
   timeout: 5m
 ---
 # yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
@@ -40,5 +39,4 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m

kubernetes/apps/kube-system/coredns/ks.yaml

@@ -17,5 +17,4 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m

kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml

@@ -0,0 +1,64 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: descheduler
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: descheduler
+      version: 0.31.0
+      sourceRef:
+        kind: HelmRepository
+        name: descheduler
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    replicas: 2
+    kind: Deployment
+    deschedulerPolicyAPIVersion: descheduler/v1alpha2
+    deschedulerPolicy:
+      profiles:
+        - name: Default
+          pluginConfig:
+            - name: DefaultEvictor
+              args:
+                evictFailedBarePods: true
+                evictLocalStoragePods: true
+                evictSystemCriticalPods: true
+                nodeFit: true
+            - name: RemovePodsViolatingInterPodAntiAffinity
+            - name: RemovePodsViolatingNodeAffinity
+              args:
+                nodeAffinityType:
+                  - requiredDuringSchedulingIgnoredDuringExecution
+            - name: RemovePodsViolatingNodeTaints
+            - name: RemovePodsViolatingTopologySpreadConstraint
+              args:
+                constraints:
+                  - DoNotSchedule
+                  - ScheduleAnyway
+          plugins:
+            balance:
+              enabled:
+                - RemovePodsViolatingTopologySpreadConstraint
+            deschedule:
+              enabled:
+                - RemovePodsViolatingInterPodAntiAffinity
+                - RemovePodsViolatingNodeAffinity
+                - RemovePodsViolatingNodeTaints
+    service:
+      enabled: true
+    serviceMonitor:
+      enabled: true
+    leaderElection:
+      enabled: true

kubernetes/apps/kube-system/descheduler/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/kube-system/descheduler/ks.yaml

@@ -0,0 +1,20 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app descheduler
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/kube-system/descheduler/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: theshire
+  wait: false
+  interval: 30m
+  timeout: 5m

kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

kubernetes/apps/kube-system/fstrim/ks.yaml

@@ -17,5 +17,4 @@ spec:
     name: theshire
   wait: false
   interval: 30m
-  retryInterval: 1m
   timeout: 5m