Update Helm release thanos to v15

Reviewed-on: jahanson/homelab#178

kubernetes/apps/cert-manager/cert-manager/issuers/cloudflare/issuer-letsencrypt-prod-jahanson-tech.yaml

@@ -1,22 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/clusterissuer_v1.json
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: le-cf-prod-jahanson-tech
-spec:
-  acme:
-    email: "joe@veri.dev"
-    preferredChain: ""
-    privateKeySecretRef:
-      name: letsencrypt-cloudflare-production
-    server: https://acme-v02.api.letsencrypt.org/directory
-    solvers:
-      - dns01:
-          cloudflare:
-            apiTokenSecretRef:
-              name: cloudflare-api-token
-              key: jahanson-tech-api-token
-        selector:
-          dnsZones:
-            - jahanson.tech

kubernetes/apps/cert-manager/cert-manager/issuers/cloudflare/issuer-letsencrypt-prod.yaml

@@ -7,10 +7,10 @@ metadata:
 spec:
   acme:
     email: "joe@veri.dev"
-    preferredChain: ""
     privateKeySecretRef:
       name: letsencrypt-cloudflare-production
     server: https://acme-v02.api.letsencrypt.org/directory
+    preferredChain: "ISRG Root X1"
     solvers:
       - dns01:
           cloudflare:

kubernetes/apps/cert-manager/cert-manager/issuers/dnsimple/externalsecret.yaml

@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: zerossl-secret
+  namespace: cert-manager
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: zerossl-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        api-token: "{{ .dnsimple_cert_manager_api_token }}"
+        eab-hmac-key: "{{ .zerossl_eab_hmac_key }}"
+  dataFrom:
+    - extract:
+        key: DNSimple
+      rewrite:
+        - regexp:
+            source: "(.*)"
+            target: "dnsimple_$1"
+    - extract:
+        key: ZeroSSL
+      rewrite:
+        - regexp:
+            source: "(.*)"
+            target: "zerossl_$1"

kubernetes/apps/cert-manager/cert-manager/issuers/dnsimple/issuer-zerossl-prod.yaml

@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: issuer-zerossl-prod
+spec:
+  acme:
+    server: https://acme.zerossl.com/v2/DV90
+    email: "joe@veri.dev"
+    privateKeySecretRef:
+      name: zerossl-production
+    externalAccountBinding:
+      keyID: feJODDijN9gypthMXaHtVA
+      keySecretRef:
+        name: zerossl-secret
+        key: eab-hmac-key
+      keyAlgorithm: HS256
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.hsn.dev
+            solverName: dnsimple
+            config:
+              apiKeySecretRef:
+                name: zerossl-secret
+                key: api-token
+        selector:
+          dnsZones:
+            - jahanson.tech

kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml

@@ -6,5 +6,6 @@ namespace: cert-manager
 resources:
   - ./cloudflare/externalsecret.yaml
   - ./cloudflare/issuer-letsencrypt-prod.yaml
-  - ./cloudflare/issuer-letsencrypt-prod-jahanson-tech.yaml
   - ./cloudflare/issuer-letsencrypt-staging.yaml
+  - ./dnsimple/externalsecret.yaml
+  - ./dnsimple/issuer-zerossl-prod.yaml

kubernetes/apps/cert-manager/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./cert-manager/ks.yaml
+  - ./webhook-dnsimple/ks.yaml

kubernetes/apps/cert-manager/webhook-dnsimple/app/apiservice.yaml

@@ -0,0 +1,16 @@
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.acme.hsn.dev
+  labels:
+    app: cert-manager-webhook-dnsimple
+  annotations:
+    cert-manager.io/inject-ca-from: "cert-manager/webhook-dnsimple-webhook-tls"
+spec:
+  group: acme.hsn.dev
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: webhook-dnsimple
+    namespace: cert-manager
+  version: v1alpha1

kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml

@@ -0,0 +1,70 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: webhook-dnsimple
+spec:
+  chart:
+    spec:
+      chart: app-template
+      version: 3.0.4
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  interval: 30m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controllers:
+      webhook-dnsimple:
+        strategy: RollingUpdate
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: git.hsn.dev/jahanson/cert-manager-webhook-dnsimple
+              tag: v0.0.1
+            args:
+              - --secure-port=8443
+              - --tls-cert-file=/tls/tls.crt
+              - --tls-private-key-file=/tls/tls.key
+            env:
+              - name: GROUP_NAME
+                value: "acme.hsn.dev"
+            resources:
+              requests:
+                cpu: 23m
+                memory: 249M
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+    service:
+      app:
+        controller: webhook-dnsimple
+        ports:
+          https:
+            port: 443
+            targetPort: 8443
+            protocol: TCP
+    persistence:
+      certs:
+        type: secret
+        name: webhook-dnsimple-webhook-tls
+        globalMounts:
+          - path: /tls
+            readOnly: true
+    serviceAccount:
+      create: true
+      name: webhook-dnsimple

kubernetes/apps/cert-manager/webhook-dnsimple/app/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./apiservice.yaml
+  - ./helmrelease.yaml
+  - ./pki.yaml
+  - ./rbac.yaml

kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml

@@ -0,0 +1,62 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
+# Create a selfsigned Issuer, in order to create a root CA certificate for
+# signing webhook serving certificates
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: webhook-dnsimple-selfsign
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-dnsimple
+spec:
+  selfSigned: {}
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
+# Create an Issuer that uses the above generated CA certificate to issue certs
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: webhook-dnsimple-ca
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-dnsimple
+spec:
+  ca:
+    secretName: webhook-dnsimple-ca
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
+# Generate a CA Certificate used to sign certificates for the webhook
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: webhook-dnsimple-ca
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-dnsimple
+spec:
+  secretName: webhook-dnsimple-ca
+  duration: 43800h # 5y
+  issuerRef:
+    name: webhook-dnsimple-selfsign
+  commonName: "ca.dnsimple-webhook.cert-manager"
+  isCA: true
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
+# Finally, generate a serving certificate for the webhook to use
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: webhook-dnsimple-webhook-tls
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-dnsimple
+spec:
+  secretName: webhook-dnsimple-webhook-tls
+  duration: 8760h # 1y
+  issuerRef:
+    name: webhook-dnsimple-ca
+  dnsNames:
+  - webhook-dnsimple
+  - webhook-dnsimple.cert-manager
+  - webhook-dnsimple.cert-manager.svc

kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml

@@ -0,0 +1,119 @@
+---
+# Grant cert-manager permission to validate using our apiserver
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: webhook-dnsimple:domain-solver
+  labels:
+    app: cert-manager-webhook-dnsimple
+rules:
+  - apiGroups:
+      - acme.hsn.dev
+    resources:
+      - '*'
+    verbs:
+      - 'create'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: flow-schema-reader
+  labels:
+    app: cert-manager-webhook-dnsimple
+rules:
+  - apiGroups: ["flowcontrol.apiserver.k8s.io"]
+    resources: ["flowschemas", "prioritylevelconfigurations"]
+    verbs: ["list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: grant-flow-schema-permission
+  labels:
+    app: cert-manager-webhook-dnsimple
+subjects:
+  - kind: ServiceAccount
+    name: webhook-dnsimple
+    namespace: cert-manager
+roleRef:
+  kind: ClusterRole
+  name: flow-schema-reader
+  apiGroup: rbac.authorization.k8s.io
+---
+# apiserver gets the auth-delegator role to delegate auth decisions to the core apiserver
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: webhook-dnsimple:auth-delegator
+  labels:
+    app: cert-manager-webhook-dnsimple
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: webhook-dnsimple
+    namespace: cert-manager
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: webhook-dnsimple:domain-solver
+  labels:
+    app: cert-manager-webhook-dnsimple
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: webhook-dnsimple:domain-solver
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: cert-manager
+    namespace: cert-manager
+---
+# Grant the webhook permission to read the api-token Secret in the specified namespace.
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ namespace: "cert-manager"
+ name: webhook-dnsimple:access-secret
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ name: webhook-dnsimple:access-secret
+ namespace: "cert-manager"
+subjects:
+- kind: ServiceAccount
+  name: webhook-dnsimple
+  namespace: "cert-manager"
+roleRef:
+ kind: Role
+ name: webhook-dnsimple:access-secret
+ apiGroup: rbac.authorization.k8s.io
+---
+# Grant the webhook permission to read the ConfigMap containing the Kubernetes
+# apiserver's requestheader-ca-certificate.
+# This ConfigMap is automatically created by the Kubernetes apiserver.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: webhook-dnsimple:webhook-authentication-reader
+  namespace: kube-system
+  labels:
+    app: cert-manager-webhook-dnsimple
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: webhook-dnsimple
+    namespace: cert-manager

kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml

@@ -0,0 +1,16 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-webhook-dnsimple
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  interval: 10m
+  path: "./kubernetes/apps/cert-manager/webhook-dnsimple/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab
+  wait: true

kubernetes/apps/dragonfly-operator-system/dragonfly-operator/app/helmrelease.yaml

@@ -52,7 +52,7 @@ spec:
           app:
             image:
               repository: docker.dragonflydb.io/dragonflydb/operator
-              tag: v1.1.1
+              tag: v1.1.2
             args:
               - "--health-probe-bind-address=:8081"
               - "--metrics-bind-address=127.0.0.1:8080"

kubernetes/apps/kube-system/reloader/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: reloader
-      version: 1.0.72
+      version: 1.0.74
       sourceRef:
         kind: HelmRepository
         name: stakater

kubernetes/apps/network/ingress-nginx/internal/certificate.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   secretName: "jahanson-tech-tls"
   issuerRef:
-    name: le-cf-prod-jahanson-tech
+    name: issuer-zerossl-prod
     kind: ClusterIssuer
   commonName: "jahanson.tech"
   dnsNames:

kubernetes/apps/observability/thanos/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: thanos
-      version: 15.0.2
+      version: 15.0.0
       sourceRef:
         kind: HelmRepository
         name: bitnami

kubernetes/apps/rook-ceph/rook-ceph/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: rook-ceph
-      version: v1.13.7
+      version: v1.13.8
       sourceRef:
         kind: HelmRepository
         name: rook-ceph

kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: rook-ceph-cluster
-      version: v1.13.7
+      version: v1.13.8
       sourceRef:
         kind: HelmRepository
         name: rook-ceph

kubernetes/flux/repositories/helm/kustomization.yaml

@@ -33,4 +33,5 @@ resources:
  - prometheus-community.yaml
  - rook-ceph.yaml
  - stakater.yaml
+ - stevehipwell.yaml
  - xenitab.yaml

kubernetes/flux/repositories/helm/stevehipwell.yaml

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: stevehipwell
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 5m
+  url: oci://ghcr.io/stevehipwell/helm-charts