Update Helm release thanos to v12.18.0

Update externaldns revision
Merge pull request 'Update Helm release cert-manager to v1.13.3' (#162 ) from renovate/cert-manager-1.x into main
2023-12-13 13:01:14 +00:00 · 2023-12-12 16:10:06 -06:00 · 2023-12-12 22:07:25 +00:00 · 2023-12-12 22:07:15 +00:00 · 2023-12-12 22:07:03 +00:00 · 2023-12-12 15:33:08 -06:00
15 changed files with 174 additions and 49 deletions
--- a/.renovate/customManagers.json5
+++ b/.renovate/customManagers.json5
@ -1,5 +1,14 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "customDatasources": {
+      "grafana-dashboards": {
+        "defaultRegistryUrlTemplate": "https://grafana.com/api/dashboards/{{packageName}}",
+        "format": "json",
+        "transformTemplates": [
+          "{\"releases\":[{\"version\": $string(revision)}]}"
+        ]
+      }
+    },
    "customManagers": [
      {
        "customType": "regex",
@ -8,10 +17,21 @@
          "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?$"
        ],
        "matchStrings": [
-          "depName=\"(?<depName>.*)\"\\n\\s+gnetId:\\s+(?<packageName>.*?)\\n\\s+revision:\\s+(?<currentValue>.*)"
+          "depName=\"(?<depName>\\S+)\"\\n.*?gnetId: (?<packageName>\\d+)\\n.*?revision: (?<currentValue>\\d+)"
        ],
        "datasourceTemplate": "custom.grafana-dashboards",
        "versioningTemplate": "regex:^(?<major>\\d+)$"
      }
+    ],
+    "packageRules": [
+      {
+        "addLabels": ["renovate/grafana-dashboard"],
+        "commitMessageExtra": "to revision {{newVersion}}",
+        "commitMessageTopic": "dashboard {{depName}}",
+        "matchDatasources": ["grafana-dashboards", "custom.grafana-dashboards"],
+        "matchUpdateTypes": ["major"],
+        "semanticCommitScope": "grafana-dashboards",
+        "semanticCommitType": "chore"
+      }
    ]
  }
--- a/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
+++ b/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
@ -10,7 +10,7 @@ spec:
  chart:
    spec:
      chart: cert-manager
-      version: v1.13.2
+      version: v1.13.3
      sourceRef:
        kind: HelmRepository
        name: jetstack
--- a/kubernetes/apps/flux-system/add-ons/webhooks/git/ingress.yaml
+++ b/kubernetes/apps/flux-system/add-ons/webhooks/git/ingress.yaml
@ -5,7 +5,7 @@ metadata:
  name: webhook-receiver
  namespace: flux-system
  annotations:
-    external-dns.alpha.kubernetes.io/target: valinor.hsn.dev
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
 spec:
  ingressClassName: "hsn-nginx"
  rules:
--- a/kubernetes/apps/monitoring/alertmanager/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/alertmanager/app/helmrelease.yaml
@ -27,7 +27,7 @@ spec:
          main:
            image:
              repository: quay.io/prometheus/alertmanager
-              tag: main@sha256:0834f92a9be3e81baf573a5a286a1d7496b813430fd392aaaa4043b36605bb01
+              tag: main@sha256:cf3b474d32e1f66fd2d80750bf35529aa4b49dad724857f4c481ab9a53befd94
              pullPolicy: IfNotPresent
    podAnnotations:
      reloader.stakater.com/auto: "true"
--- a/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
@ -14,7 +14,7 @@ spec:
        kind: HelmRepository
        name: grafana
        namespace: flux-system
-      version: 7.0.11
+      version: 7.0.17
  interval: 30m
  timeout: 20m
  maxHistory: 2
@ -159,7 +159,7 @@ spec:
        external-dns:
          # renovate: depName="External-dns"
          gnetId: 15038
-          revision: 1
+          revision: 3
          datasource: Prometheus
      #   minio:
      #     # renovate: depName="MinIO Dashboard"
--- a/kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml
@ -11,7 +11,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: 55.0.0
+      version: 55.3.1
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
--- a/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
+++ b/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
@ -11,7 +11,7 @@ spec:
  chart:
    spec:
      chart: thanos
-      version: 12.17.0
+      version: 12.18.0
      sourceRef:
        kind: HelmRepository
        name: bitnami
--- a/kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml
+++ b/kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml
@ -57,18 +57,20 @@ spec:
        nodes:
          - name: "nienna"
            devices:
-              - name: /dev/disk/by-id/scsi-0HC_Volume_37460833
+              - name: /dev/disk/by-id/nvme-SAMSUNG_MZVLB1T0HALR-00000_S3W6NA0M610693
+              - name: /dev/disk/by-id/ata-ST16000NM001J-2TW113_ZR5E7NQR
          - name: "orome"
            devices:
-              - name: /dev/disk/by-id/scsi-0HC_Volume_37645333
+              - name: /dev/disk/by-id/nvme-SAMSUNG_MZVLB1T0HBLR-00000_S4GJNX0R613503
+              - name: /dev/disk/by-id/ata-ST16000NM001J-2TW113_ZR6021Z3
      resources:
        mgr:
          limits:
            cpu: "1000m"
-            memory: "1Gi"
+            memory: "4Gi"
          requests:
            cpu: "1000m"
-            memory: "1Gi"
+            memory: "4Gi"

    cephBlockPoolsVolumeSnapshotClass:
      enabled: false
@ -77,8 +79,9 @@ spec:
      - name: ceph-blockpool
        spec:
          failureDomain: host
-          replicated:
-            size: 3
+          erasureCoded:
+            dataChunks: 2
+            codingChunks: 1
        storageClass:
          enabled: true
          name: ceph-block
--- a/kubernetes/apps/system/kubelet-csr-approver/app/helmrelease.yaml
+++ b/kubernetes/apps/system/kubelet-csr-approver/app/helmrelease.yaml
@ -16,6 +16,17 @@ spec:
        name: postfinance
        namespace: flux-system
      interval: 30m
+
+  values:
+    tolerations:
+      # https://github.com/hetznercloud/hcloud-cloud-controller-manager
+      # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
+      - key: "node.cloudprovider.kubernetes.io/uninitialized"
+        value: "true"
+        effect: "NoSchedule"
+      - key: "CriticalAddonsOnly"
+        operator: "Exists"
+
  valuesFrom:
    - kind: ConfigMap
      name: kubelet-csr-approver-values
--- a/kubernetes/bootstrap/hcloud.sops.yaml
+++ b/kubernetes/bootstrap/hcloud.sops.yaml
@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: hcloud
+    namespace: kube-system
+stringData:
+    ROBOT_ENABLED: ENC[AES256_GCM,data:tTSnWw==,iv:rSrqYIiQSOv6G0QxSYVU6DtW7b3PT7XNF/1pWx68M1g=,tag:2m6YXewARCcyXTjZGimodQ==,type:str]
+    token: ENC[AES256_GCM,data:DzLwUiv5JH/S6OBrzgNp0NO5U/7w0Pq2YtQ7uOAfg7Iw90qzGlzc8CqzlQOw0jHv91LzCUgjpeZn9QP93Dgprw==,iv:T6rqz1HmdKATl+8ov5qclhAo/NzHQTIN6eRSiCEyiZU=,tag:39VZ8N96NEXgvXTPQ/vvBA==,type:str]
+    robot-password: ENC[AES256_GCM,data:OeITzLUpgj03MyQ2n+SYgwykcw==,iv:9ZdbQW4ZAtqmGEiR4KBsziRXMAoHGHcBYXiwjep5H2A=,tag:4eGKJTfn0+NARz1k7j8jXA==,type:str]
+    robot-user: ENC[AES256_GCM,data:Cy2ilSDCVNaxES0N,iv:fs/fu9OOhNPDwgnw1xV8SPtbzlbDkbynvL4Z5L6aO2o=,tag:n2+BeAx8HLtD4rFbKMdUqw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1g786w8t40g9y29l33rfd4jqlwhrgsxsc7ped6uju60k54j0q3enql3kfve
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaVJMaEQvSGw1Y3h1WXVi
+            TGFnM1dTaHRaUEtOaVl5anpKazZjbVRpckIwCi9Bc1BueHYvMUljdWRrZFVpQldJ
+            bkRVMWJIdmdubGJXL2NOeUloV3RXQ0EKLS0tIEZadWZJcytYZW5ZdmtFbGcrUjZN
+            SGkvdTBIM1hxMTREL1JDT0NCcXo0ckUKW3fJ509OnrgKxLvWHALLvA4Ha91pN+GM
+            JRdKi8tSlyVEpFgumeOsan3fIrsi9urgqYjMuW5e6ApMZ8/2522MWA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-12-12T18:16:51Z"
+    mac: ENC[AES256_GCM,data:m3jplww3Pv4UnCIdyJ2DEkA95U5+Ovddk2DhEG7KhVQ/PTtG31UFCHdoBIgHf0ZcYmAYRLeyvUfRmi19I+h0h1eDrlbTwpFSYByunLvJZqk2Dp9WWCyGnoJ2Wh/dzW/pcLRSJCZWPxUGPR48cyZTlzg+iZHm760kbXQmzAE+ZHc=,iv:xxyyd9IaTtd+Te+2T156/c+842GVeOoPEs+IBZibWrk=,tag:EruEq5+6kU+nme9NydF/bg==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1
--- a/kubernetes/bootstrap/readme.md
+++ b/kubernetes/bootstrap/readme.md
@ -15,8 +15,10 @@ _These cannot be applied with `kubectl` in the regular fashion due to be encrypt
 ```sh
 sops --decrypt kubernetes/bootstrap/flux/age-key.sops.yaml | kubectl apply -f -
 sops --decrypt kubernetes/bootstrap/flux/git-deploy-key.sops.yaml | kubectl apply -f -
+sops --decrypt kubernetes/bootstrap/hcloud.sops.yaml | kubectl apply -f -
 sops --decrypt kubernetes/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f -
 kubectl apply -f kubernetes/flux/vars/cluster-settings.yaml
+kubectl apply -k kubernetes/apps/monitoring/kube-prometheus-stack/crds/
 ```

 ### Kick off Flux applying this repository
--- a/kubernetes/flux/vars/cluster-secrets.sops.yaml
+++ b/kubernetes/flux/vars/cluster-secrets.sops.yaml
@ -8,7 +8,7 @@ stringData:
    SECRET_PUSHOVER_ALERT_MANAGER_APIKEY: ENC[AES256_GCM,data:4+9e/tWQBszoPakAo+1vNhWsdKz8qfoioeUz+dTb,iv:sY4dkzMEmvi8kCLesBiknmoYHWq3uqXpWs5Y4FeFSuk=,tag:rPxH+5m6rPiSnhm2JrrT4w==,type:str]
    SECRET_HEALTHCHECKS_WEBHOOK: ENC[AES256_GCM,data:a6hjTy2HRy7s2+KHxfop8077CgAzzILCF/g5I9TIXdhRiziUrLpJVzC0mqNmfdooJsZyErrJ9ihamFKLFoK8S/PmD5IgWuZu,iv:l5JTxmiWct5nr7eJM/Rtl7AclhCoIQ4KW6nJK6Slhg0=,tag:K5yGxYBTNSSoxYJt8Kmhyw==,type:str]
    SECRET_CLOUDFLARE_ACCOUNT_ID: ENC[AES256_GCM,data:X63a7aMBMyd9Be6bik0knOyMXnYx/Kg3SoOrG0bkAHU=,iv:POcU1kIRWekrzUdzqPopKDovviK+fMZRVuZVWp9Vuuc=,tag:n9UamxITJCiLbH37Ta2lTg==,type:str]
-    K8S_SERVICE_ENDPOINT: ENC[AES256_GCM,data:dRQiZcBNb95uNMzdlqM=,iv:KBK/YcOQsO/5UnM3glNiK8pA45XZ9NPcY+9H3Q1yFXk=,tag:YwQoSsmcvP3g79yHfrFJVw==,type:str]
+    K8S_SERVICE_ENDPOINT: ENC[AES256_GCM,data:3Ozpy3bMzEc=,iv:l0ND37q9ygRzYy/sjjzQC6vHk44PxPAxQPGVll5tXqQ=,tag:jK3FQiHRRoBBKhYugk2/NQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -24,8 +24,8 @@ sops:
            dDhWMDZYait3UzNRZy9oVk85cHBPdEUKa7e22jHlW1chaLDKBB1in8ZTFnfKMXug
            QJQ/9z6z/RjmnnFam2FWg++Xg2A8LQ7XTZcfR97csf59DQ/xwu7sVw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-11T04:04:11Z"
-    mac: ENC[AES256_GCM,data:P/TJeZ0oZVqZCAo5mxtxhFgzuEW8RFatDNQS/0GcXVs+FB7Y9t5WmFFpHWTddo8E8YtzXFkvQAmXpUS9VmjLDh4k0pPlw+6kO4XnDpci9yemugLf1oEuZcOGNYahxMPNFver7HVUUp1VvIJnwjBPfq1kppDnmUjo6wUAPd126RE=,iv:bax+X0a6w+NCpqk4F3Zwo32vKdsjECMXYx8yBN74FF8=,tag:zi69sJqzNhkLAEEyC6lPdQ==,type:str]
+    lastmodified: "2023-12-12T17:41:48Z"
+    mac: ENC[AES256_GCM,data:ViV0wIxtAak3BTEALubdJfZZpGO5fvdfzaqQ3LRcZZfEG2tuV/1cUT4UNfENA/Pu/3v6htfepAekwUJPrBLCGQzIdwnrjgeLV3njtwNVeGh9+y/6PGwK3+7Biymg7fWYFEyL348aHyPfZ744Z6Y5bFEoiRfTIW6FgQyZ9DOJ32s=,iv:1DBDc/zekjjbj8TBAX3FbPTyXrwkVt3OJL2OhvcVRqo=,tag:naNziCLKmuXffWHnATB88w==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.8.1
--- a/renovate.json5
+++ b/renovate.json5
@ -22,15 +22,6 @@
      "kubernetes/.+\\.ya?ml$"
    ]
  },
-  "customDatasources": {
-    "grafana-dashboards": {
-      "defaultRegistryUrlTemplate": "https://grafana.com/api/dashboards/{{packageName}}",
-      "format": "json",
-      "transformTemplates": [
-        "{\"releases\":[{\"version\": $string(revision)}]}"
-      ]
-    }
-  },
  "regexManagers": [
    {
      "description": [
--- a/talos/talconfig.yaml
+++ b/talos/talconfig.yaml
@ -16,16 +16,6 @@ additionalMachineCertSans:

 nodes:
  # cloud CAX21 Arm64
-  - hostname: aule
-    disableSearchDomain: true
-    ipAddress: ${auleIP}
-    controlPlane: true
-    installDiskSelector:
-      busPath: /dev/sda
-    networkInterfaces:
-      - interface: eth0
-        dhcp: true
-  # cloud CAX21 Arm64
  - hostname: arlen
    disableSearchDomain: true
    ipAddress: ${arlenIP}
@ -35,6 +25,12 @@ nodes:
    networkInterfaces:
      - interface: eth0
        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
  # cloud CAX21 Arm64
  - hostname: eonwe
    disableSearchDomain: true
@ -45,6 +41,28 @@ nodes:
    networkInterfaces:
      - interface: eth0
        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
+  # cloud CAX21 Arm64
+  - hostname: aule
+    disableSearchDomain: true
+    ipAddress: ${auleIP}
+    controlPlane: true
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
  # Bare-metal AX41-Nvme - AMD Ryzen 5 3600 6-Core Processor (Zen2) - 64GB ECC RAM
  - hostname: nienna
    disableSearchDomain: true
@ -57,17 +75,27 @@ nodes:
    #     officialExtensions:
    #       - siderolabs/amd-ucode
    #       - siderolabs/qemu-guest-agent
-    talosImageURL: factory.talos.dev/installer/696bb48d9c48e567596f393a4ff9bfd26d4dda5d92c16beb580e96fa68d6324c
+    talosImageURL: harbor.hsn.dev/factory.talos.dev/installer/696bb48d9c48e567596f393a4ff9bfd26d4dda5d92c16beb580e96fa68d6324c
    # https://factory.talos.dev/image/696bb48d9c48e567596f393a4ff9bfd26d4dda5d92c16beb580e96fa68d6324c/v1.5.5/metal-amd64.iso
    # no guest agent in the raw.xz image
    # https://factory.talos.dev/image/6c789e7a3eec37617fd9d239a7f696ba48e75bc4780f5cb30bf8882686d79a22/v1.5.5/metal-amd64.raw.xz
    installDiskSelector:
      busPath: /pci0000:00/0000:00:0a.0/virtio2/
-      # Ceph Disk Fast: /pci0000:00/0000:00:11.0/nvme/nvme0/nvme0n1
-      # Ceph Disk Large: /pci0000:00/0000:00:10.0/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eth0
        dhcp: true
+      - interface: eth1
+        dhcp: false
+        vlans:
+          - vlanId: 4010
+            mtu: 1400
+            addresses:
+              - 10.2.1.2/24
+            dhcp: false
+            routes:
+              - network: 10.2.0.0/16
+                gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+                metric: 2048
  # VM on EX44 - Intel Gen 13 (Raptor Lake) - 64GB RAM
  - hostname: orome
    disableSearchDomain: true
@ -81,14 +109,25 @@ nodes:
    #             - siderolabs/i915-ucode
    #             - siderolabs/intel-ucode
    #             - siderolabs/qemu-guest-agent
-    talosImageURL: factory.talos.dev/installer/f2f665587318c2d79e7b315cc333fff276ed59c8de831f16e28b4db107496ac2
+    talosImageURL: harbor.hsn.dev/factory.talos.dev/installer/f2f665587318c2d79e7b315cc333fff276ed59c8de831f16e28b4db107496ac2
    # https://factory.talos.dev/image/f2f665587318c2d79e7b315cc333fff276ed59c8de831f16e28b4db107496ac2/metal-amd64.iso
    installDiskSelector:
      busPath: /pci0000:00/0000:00:0a.0/virtio2/
-      # Ceph Disk: /dev/disk/by-id/nvme-SAMSUNG_MZVL2512HCJQ-00B00_S675NU0TB36132
    networkInterfaces:
      - interface: eth0
        dhcp: true
+      - interface: eth1
+        dhcp: false
+        vlans:
+          - vlanId: 4010
+            mtu: 1400
+            addresses:
+              - 10.2.1.3/24
+            dhcp: false
+            routes:
+              - network: 10.2.0.0/16
+                gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+                metric: 2048
 worker:
  patches:
    - |-
@ -111,6 +150,19 @@ worker:
            rotate-server-certificates: "true"
          extraConfig:
            maxPods: 150
+          nodeIP:
+            validSubnets:
+                - 10.2.0.0/16
+        registries:
+          mirrors:
+            docker.io:
+              endpoints:
+                - http://harbor.hsn.dev/v2/docker.io
+              overridePath: true
+            ghcr.io:
+              endpoints:
+                - http://harbor.hsn.dev/v2/ghcr.io
+              overridePath: true
 controlPlane:
  patches:
    - |-
@ -125,6 +177,9 @@ controlPlane:
            name: none
        proxy:
          disabled: true
+        etcd:
+          advertisedSubnets:
+            - 10.2.0.0/24

    - |-
      - op: remove
@ -136,6 +191,16 @@ controlPlane:
          kubePrism:
            enabled: true
            port: 7445
+        registries:
+          mirrors:
+            docker.io:
+              endpoints:
+                - http://harbor.hsn.dev/v2/docker.io
+              overridePath: true
+            ghcr.io:
+              endpoints:
+                - http://harbor.hsn.dev/v2/ghcr.io
+              overridePath: true

        files:
          - op: create
@ -151,6 +216,9 @@ controlPlane:
            rotate-server-certificates: "true"
          extraConfig:
            maxPods: 150
+          nodeIP:
+            validSubnets:
+                - 10.2.0.0/16
        sysctls:
          fs.inotify.max_user_watches: "1048576"
          fs.inotify.max_user_instances: "8192"
--- a/talos/talenv.sops.yaml
+++ b/talos/talenv.sops.yaml
@ -1,10 +1,10 @@
 clusterName: ENC[AES256_GCM,data:iT5CwpMddw==,iv:st1ajjpRXQiHozpIJqUUwmRe542IiR2aWLEdqkk4W9k=,tag:KOCQ8x28kwNNDUXwOTpulg==,type:str]
-clusterEndpointIP: ENC[AES256_GCM,data:nQcNkmmaLuOxz5tTKlY=,iv:IAnSXk667TSWcE2QDmE/xk56R6dCsNK5hMIY96BPN08=,tag:G1ebt6kfJ2V1WMfJ9zNBhA==,type:str]
-auleIP: ENC[AES256_GCM,data:fowDru5uo1tx36Y3vQ==,iv:wSPdnE+eQ+er2pCOvS2DoynCxA+4oNbJacQhvQR6KJk=,tag:Fb+D9nA3U/QbgqmQhDMDDw==,type:str]
-arlenIP: ENC[AES256_GCM,data:O3z2uYFNjS9iMng=,iv:b6T1AbWdIoFrH3hV1zop1C2x652sweKhgKPzUVNoDUY=,tag:d6edGxWSXtq9cpbcjIbtQw==,type:str]
-eonweIP: ENC[AES256_GCM,data:WdN3OPeVD0ppPax856w=,iv:QVhxp1Q3JPbHZAyZbwoBfmIu+qazvAQPKJR10RdtfFI=,tag:raJ2APpfNTyXLSH9SjzoGA==,type:str]
-niennaIP: ENC[AES256_GCM,data:XQCs/IoSGQIzBKe2Kw==,iv:P72qBaIHY8oLpfR+t5ZZ31XJE1kytCvav0I25nQKSWI=,tag:ZVbQHHzct2Y/fvHxAXROXQ==,type:str]
-oromeIP: ENC[AES256_GCM,data:nCeVxdK8Q1+E9nMoeNM=,iv:lqM72ewe+nwJUiJGOsLmGBtUU9JcxxmbEUZJNdFroWI=,tag:cpXvK0HW22mpy4nxWCgRmw==,type:str]
+clusterEndpointIP: ENC[AES256_GCM,data:3oaQK/8A4H8=,iv:GUtz5qkZMy/mq+Qf2VkoxTJpoeC7F8ySJcmzcTcLEkY=,tag:8GsMnWRBptAhzSQ9IZxwbA==,type:str]
+auleIP: ENC[AES256_GCM,data:l+3uRMhfUDk=,iv:emxhDXyCKP9ijhxH4egI/3i+BCprcPf0AIVVi29GCGE=,tag:+0dl4A72vIgXdNlk5Etdug==,type:str]
+arlenIP: ENC[AES256_GCM,data:uXEM6zEuo40=,iv:eZMNksxYqpfYaY70yiJDOOnpOZ2cIfu4sE71irlUWOY=,tag:C0PjKj3FVDeLhUFInEQzLg==,type:str]
+eonweIP: ENC[AES256_GCM,data:zfIK5G67zEQ=,iv:xXPae345ybW9u6SX5eNHwEcBe+Y/7Gvzt6qWni3x+k4=,tag:hFO15lqDviJz+dnsa8IgMg==,type:str]
+niennaIP: ENC[AES256_GCM,data:3FRJBHRujl0=,iv:wd+Wp8DCXITYv4/Ys26+2GmeMXn0hvakxMUpDALqciE=,tag:P0Px35bWU0IzpH2H0i6dpA==,type:str]
+oromeIP: ENC[AES256_GCM,data:xSp35+pBlyk=,iv:Utk+kCiUKbSrx3kCsEtc90VRWEC9FSZJvJ1fvLZWc38=,tag:6uHW+BiOau9PUS2I2OnVGA==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -20,8 +20,8 @@ sops:
            MTFUZEplYVN5RGhhMGNEcDlGbTVQcjQKktwztZAHGUqoxbGHuAg0dX5Vap+wFVfx
            ku6Hzg1ZU8Lvd8ODe+4p+RvHSKVll1akgpPVuymCUxl+I6EvH7gEDA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-10T16:40:14Z"
-    mac: ENC[AES256_GCM,data:P0rbT2U+Ga29qR7hewngNrmfqA0ShNnCjaYGQLyHTsowqJ3ZY4HX7UQzwtXaZZTfz0SSIAK9yUHStmOoQ0p6c5t6uhww5565MAi23J5vQSkg3iIZ9MLuHkfAYwt4mOXVxvlhGMM0sEkE3nsurHVyEB3TOBgXKziz7Wi+pH1knXw=,iv:QBs7SV667gbiWbTNOcmzHc2eygJSLmK2aiLF4b4qvWU=,tag:/LjNKYD+XooTRLr/gcJQvg==,type:str]
+    lastmodified: "2023-12-12T17:44:15Z"
+    mac: ENC[AES256_GCM,data:bXullHomsdG80EKIVrghmPIkcQMzWX/gvM8w0iqWRbunC4SlNTzFIgrHvs1qYdyPqy+rC2NhhhWGBVSDEfAA5wRQ/xmLPmFP/z9hKsUiQqHUwZflu2taB2SLuhjMMHS2sKwcP3uPA1anPkvEjhx+IpGv9X92RHqr8YF1r2LhOVk=,iv:OQwhjxw/FI/S9pXS9/HHTFdFxIetKUPcESscfJNjkao=,tag:AhoPRZifwQVPRO38fA/LSQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
Author	SHA1	Message	Date
Smeagol	a7bf854ae1	Update Helm release thanos to v12.18.0	2023-12-13 13:01:14 +00:00
Joseph Hanson	77e513d817	Update externaldns revision	2023-12-12 16:10:06 -06:00
Joseph Hanson	ec4dbfc30c	Merge pull request 'Update Helm release cert-manager to v1.13.3' (#162 ) from renovate/cert-manager-1.x into main Reviewed-on: #162	2023-12-12 22:07:25 +00:00
Joseph Hanson	b3461cd357	Merge pull request 'Update quay.io/prometheus/alertmanager:main Docker digest to cf3b474' (#156 ) from renovate/quay.io-prometheus-alertmanager-main into main Reviewed-on: #156	2023-12-12 22:07:15 +00:00
Joseph Hanson	7924b2696d	Merge pull request 'Update Helm release grafana to v7.0.17' (#161 ) from renovate/grafana-7.x into main Reviewed-on: #161	2023-12-12 22:07:03 +00:00
Joseph Hanson	3560057df5	don't declare CNAME.	2023-12-12 15:33:08 -06:00
Joseph Hanson	5e05b6ecff	Proxy ingress.	2023-12-12 15:33:07 -06:00
Joseph Hanson	688415fc65	Merge pull request 'Update kube-prometheus-stack Docker tag to v55.3.1' (#159 ) from renovate/kube-prometheus-stack-55.x into main Reviewed-on: #159	2023-12-12 21:26:24 +00:00
Smeagol	f246416745	Update kube-prometheus-stack Docker tag to v55.3.1	2023-12-12 20:40:01 +00:00
Joseph Hanson	849d21dd19	Moving grafana resources to external file.	2023-12-12 14:36:20 -06:00
Joseph Hanson	ece569535b	Back to talosnet.	2023-12-12 13:11:52 -06:00
Joseph Hanson	844879f83e	Add tolerations to csr-approver for hccm.	2023-12-12 13:11:27 -06:00
Joseph Hanson	c0261d7053	Add hcloud to bootstrap.	2023-12-12 13:10:12 -06:00
Joseph Hanson	ca4b6786f1	Update service endpoint	2023-12-12 13:09:33 -06:00
Joseph Hanson	e7be552415	Added limit, it was crashing without one.	2023-12-12 09:19:50 -06:00
Smeagol	a086d5ce8a	Update Helm release grafana to v7.0.17	2023-12-12 15:01:17 +00:00
Joseph Hanson	58ec4cd87d	Added drives and switched blockpool to erasure coded.	2023-12-12 08:10:18 -06:00
Smeagol	0165d90573	Update Helm release cert-manager to v1.13.3	2023-12-12 06:07:06 +00:00
Smeagol	f2eb89105d	Update quay.io/prometheus/alertmanager:main Docker digest to cf3b474	2023-12-11 14:01:11 +00:00