Added more reconcile webhooks

.pre-commit-config.yaml

@@ -21,9 +21,7 @@ repos:
     hooks:
       - id: kubeconform
 
-  # Linting does not work with external values.yaml
+  - repo: https://github.com/tarioch/flux-check-hook
-  # TODO: Include url to schema in values.yaml and validate based on that?
+    rev: v0.8.0
-  # - repo: https://github.com/tarioch/flux-check-hook
+    hooks:
-  #   rev: v0.8.0
+      - id: check-flux-helm-values
-  #   hooks:
-  #     - id: check-flux-helm-values

apps/grafana/release.yaml

@@ -65,12 +65,6 @@ spec:
       enabled: true
       existingSecret: grafana-ldap-toml
 
-    sidecar:
-      datasources:
-        enabled: true
-        searchNamespace: ALL
-        labelValue: "1"
-
     extraSecretMounts:
       - name: postgres-app-mount
         secretName: postgres-app

clusters/titan.lan.huizinga.dev/apps/siranga.yaml

@@ -46,7 +46,7 @@ spec:
   secretRef:
     name: receiver
   resources:
-    - apiVersion: source.toolkit.fluxcd.io/v1beta2
+    - apiVersion: source.toolkit.fluxcd.io/v1
       kind: OCIRepository
       name: siranga
 ---

clusters/titan.lan.huizinga.dev/infra/akri.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/akri/akri
+  path: ./infra/akri
   prune: true
   timeout: 2m
   sourceRef:

clusters/titan.lan.huizinga.dev/infra/authelia-controller.yaml

@@ -33,7 +33,7 @@ spec:
   secretRef:
     name: receiver
   resources:
-    - apiVersion: source.toolkit.fluxcd.io/v1beta2
+    - apiVersion: source.toolkit.fluxcd.io/v1
       kind: OCIRepository
       name: authelia-controller
 ---

clusters/titan.lan.huizinga.dev/infra/authelia.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/authelia/authelia
+  path: ./infra/authelia
   dependsOn:
     - name: traefik
     - name: cnpg

clusters/titan.lan.huizinga.dev/infra/cert-manager.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/cert-manager/cert-manager
+  path: ./infra/cert-manager
   prune: true
   timeout: 2m
   sourceRef:

clusters/titan.lan.huizinga.dev/infra/cnpg.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/cnpg/cnpg
+  path: ./infra/cnpg
   dependsOn:
     - name: topolvm
   prune: true

clusters/titan.lan.huizinga.dev/infra/kube-vip.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/kube-vip/kube-vip
+  path: ./infra/kube-vip
   dependsOn:
     - name: kyverno-policies
   prune: true

clusters/titan.lan.huizinga.dev/infra/kustomization.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ./../../../infra/akri
-  - ./../../../infra/authelia
-  - ./../../../infra/cert-manager
-  - ./../../../infra/cnpg
-  - ./../../../infra/descheduler.yaml
-  - ./../../../infra/dragonflydb.yaml
-  - ./../../../infra/external-snapshotter.yaml
-  - ./../../../infra/intel-device-plugins.yaml
-  - ./../../../infra/kube-vip
-  - ./../../../infra/kyverno
-  - ./../../../infra/lldap
-  - ./../../../infra/loki
-  - ./../../../infra/node-feature-discovery
-  - ./../../../infra/rook-ceph
-  - ./../../../infra/topolvm
-  - ./../../../infra/traefik
-  - ./../../../infra/velero

clusters/titan.lan.huizinga.dev/infra/kyverno-policies.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/kyverno/kyverno-policies
+  path: ./infra/kyverno-policies
   dependsOn:
     - name: kyverno
   prune: true

clusters/titan.lan.huizinga.dev/infra/kyverno.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/kyverno/kyverno
+  path: ./infra/kyverno
   prune: true
   timeout: 2m
   sourceRef:

clusters/titan.lan.huizinga.dev/infra/letsencrypt.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/cert-manager/letsencrypt
+  path: ./infra/letsencrypt
   dependsOn:
     - name: cert-manager
   prune: true

clusters/titan.lan.huizinga.dev/infra/lldap-controller.yaml

@@ -33,7 +33,7 @@ spec:
   secretRef:
     name: receiver
   resources:
-    - apiVersion: source.toolkit.fluxcd.io/v1beta2
+    - apiVersion: source.toolkit.fluxcd.io/v1
       kind: OCIRepository
       name: lldap-controller
 ---

clusters/titan.lan.huizinga.dev/infra/lldap.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/lldap/lldap
+  path: ./infra/lldap
   dependsOn:
     - name: traefik
     - name: cnpg

clusters/titan.lan.huizinga.dev/infra/node-feature-discovery-rules.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/node-feature-discovery/node-feature-discovery-rules
+  path: ./infra/node-feature-discovery-rules
   prune: true
   timeout: 2m
   sourceRef:

clusters/titan.lan.huizinga.dev/infra/node-feature-discovery.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/node-feature-discovery/node-feature-discovery
+  path: ./infra/node-feature-discovery
   prune: true
   timeout: 2m
   sourceRef:

clusters/titan.lan.huizinga.dev/infra/rook-ceph-cluster.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/rook-ceph/rook-ceph-cluster
+  path: ./infra/rook-ceph-cluster
   dependsOn:
     - name: rook-ceph
   prune: true

clusters/titan.lan.huizinga.dev/infra/rook-ceph.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/rook-ceph/rook-ceph
+  path: ./infra/rook-ceph
   prune: true
   timeout: 2m
   sourceRef:

clusters/titan.lan.huizinga.dev/infra/topolvm.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/topolvm/topolvm
+  path: ./infra/topolvm
   dependsOn:
     - name: cert-manager
   prune: true

clusters/titan.lan.huizinga.dev/infra/traefik-middleware.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/traefik/traefik-middleware
+  path: ./infra/traefik-middleware
   dependsOn:
     - name: traefik
   prune: true

clusters/titan.lan.huizinga.dev/infra/traefik.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/traefik/traefik
+  path: ./infra/traefik
   dependsOn:
     - name: letsencrypt
   prune: true

clusters/titan.lan.huizinga.dev/infra/velero.yaml

@@ -7,7 +7,7 @@ metadata:
     alert: flux-infra
 spec:
   interval: 15m
-  path: ./infra/velero/velero
+  path: ./infra/velero
   dependsOn:
     - name: external-snapshotter
   prune: true

infra/akri/akri/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: akri
-resources:
-  - ./namespace.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: akri-values
-    files:
-      - ./values.yaml

infra/akri/kustomization.yaml

@@ -1,4 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: akri
 resources:
-  - ./akri.yaml
+  - ./namespace.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml
+
+configurations:
+  - ../../common/name-reference/helm-release.yaml
+
+configMapGenerator:
+  - name: akri-values
+    files:
+      - ./values.yaml

infra/authelia/authelia/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: authelia
-resources:
-  - ./namespace.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-  - ./service-user.yaml
-  - ../../../common/postgres
-  - ../../../common/dragonflydb
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: authelia-values
-    files:
-      - ./values.yaml

infra/authelia/kustomization.yaml

@@ -1,5 +1,18 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: authelia
 resources:
-  - ./authelia-controller.yaml
+  - ./namespace.yaml
-  - ./authelia.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml
+  - ./service-user.yaml
+  - ../../common/postgres
+  - ../../common/dragonflydb
+
+configurations:
+  - ../../common/name-reference/helm-release.yaml
+
+configMapGenerator:
+  - name: authelia-values
+    files:
+      - ./values.yaml

infra/cert-manager/cert-manager/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - ./namespace.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: cert-manager-values
-    files:
-      - ./values.yaml

infra/cert-manager/kustomization.yaml

@@ -1,5 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: cert-manager
 resources:
-  - ./cert-manager.yaml
+  - ./namespace.yaml
-  - ./letsencrypt.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml
+
+configurations:
+  - ../../common/name-reference/helm-release.yaml
+
+configMapGenerator:
+  - name: cert-manager-values
+    files:
+      - ./values.yaml

infra/cnpg/cnpg/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cnpg-system
-resources:
-  - ./namespace.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: cnpg-values
-    files:
-      - ./values.yaml

infra/cnpg/kustomization.yaml

@@ -1,4 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: cnpg-system
 resources:
-  - ./cnpg.yaml
+  - ./namespace.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml
+configurations:
+  - ../../common/name-reference/helm-release.yaml
+
+configMapGenerator:
+  - name: cnpg-values
+    files:
+      - ./values.yaml

infra/kube-vip/kube-vip/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: kube-system
-resources:
-  - ./service-account.yaml
-  - ./cluster-role.yaml
-  - ./cluster-role-binding.yaml
-  - ./daemon-set.yaml
-
-  - https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/refs/tags/v0.0.11/manifest/kube-vip-cloud-controller.yaml
-  - ./config-map-kubevip.yaml

infra/kube-vip/kustomization.yaml

@@ -1,4 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: kube-system
 resources:
-  - ./kube-vip.yaml
+  - ./service-account.yaml
+  - ./cluster-role.yaml
+  - ./cluster-role-binding.yaml
+  - ./daemon-set.yaml
+
+  - https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/refs/tags/v0.0.11/manifest/kube-vip-cloud-controller.yaml
+  - ./config-map-kubevip.yaml

infra/kyverno/kustomization.yaml

@@ -1,5 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: kyverno
 resources:
-  - ./kyverno-policies.yaml
+  - ./namespace.yaml
-  - ./kyverno.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml
+
+configurations:
+  - ../../common/name-reference/helm-release.yaml
+
+configMapGenerator:
+  - name: kyverno-values
+    files:
+      - ./values.yaml

infra/kyverno/kyverno/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: kyverno
-resources:
-  - ./namespace.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: kyverno-values
-    files:
-      - ./values.yaml

infra/lldap/kustomization.yaml

@@ -1,5 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: lldap
 resources:
-  - ./lldap-controller.yaml
+  - ./namespace.yaml
-  - ./lldap.yaml
+  - ./secret-lldap-credentials.yaml
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./ingress-route.yaml
+  - ../../common/postgres

infra/lldap/lldap/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: lldap
-resources:
-  - ./namespace.yaml
-  - ./secret-lldap-credentials.yaml
-  - ./deployment.yaml
-  - ./service.yaml
-  - ./ingress-route.yaml
-  - ../../../common/postgres

infra/loki/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./loki.yaml
-  - ./promtail.yaml

infra/loki/loki.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: loki
-  namespace: flux-system
-  labels:
-    alert: flux-infra
-spec:
-  interval: 15m
-  path: ./infra/loki/loki
-  dependsOn:
-    - name: rook-ceph
-  prune: true
-  timeout: 2m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  wait: true

infra/loki/loki/helm-release.yaml

@@ -1,18 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: loki
-spec:
-  chart:
-    spec:
-      chart: loki
-      reconcileStrategy: ChartVersion
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-      version: 6.29.0
-  interval: 15m
-  timeout: 5m
-  valuesFrom:
-    - kind: ConfigMap
-      name: loki-values

infra/loki/loki/helm-repository.yaml

@@ -1,7 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: grafana
-spec:
-  interval: 15m
-  url: https://grafana.github.io/helm-charts

infra/loki/loki/kustomization.yaml

@@ -1,22 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: loki
-resources:
-  - ./namespace.yaml
-  - ./object-bucket-claim.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: loki-values
-    files:
-      - ./values.yaml
-  - name: grafana-datasource
-    options:
-      labels:
-        grafana_datasource: "1"
-    files:
-      - ./loki-datasource.yaml

infra/loki/loki/loki-datasource.yaml

@@ -1,8 +0,0 @@
-apiVersion: 1
-datasources:
-  - name: Loki
-    type: loki
-    access: proxy
-    url: http://loki-gateway.loki.svc.cluster.local
-    uid: "loki"
-    jsonData: {}

infra/loki/loki/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: loki

infra/loki/loki/object-bucket-claim.yaml

@@ -1,7 +0,0 @@
-apiVersion: objectbucket.io/v1alpha1
-kind: ObjectBucketClaim
-metadata:
-  name: loki-bucket
-spec:
-  generateBucketName: loki
-  storageClassName: ceph-bucket

infra/loki/loki/values.yaml

@@ -1,75 +0,0 @@
-loki:
-  auth_enabled: false
-
-  schemaConfig:
-    configs:
-      - from: "2024-04-01"
-        store: tsdb
-        object_store: s3
-        schema: v13
-        index:
-          prefix: index_
-          period: 24h
-
-  limits_config:
-    split_queries_by_interval: "1h"
-    retention_period: 672h # 28 days retention
-  query_scheduler:
-    max_outstanding_requests_per_tenant: 2048
-
-  storage:
-    type: s3
-    bucketNames:
-      chunks: "${BUCKET_NAME}"
-      ruler: "${BUCKET_NAME}"
-      admin: "${BUCKET_NAME}"
-    s3:
-      # s3 URL can be used to specify the endpoint, access key, secret key, and bucket name this works well for S3 compatible storages or if you are hosting Loki on-premises and want to use S3 as the storage backend. Either use the s3 URL or the individual fields below (AWS endpoint, region, secret).
-      # s3: s3://access_key:secret_access_key@custom_endpoint/bucket_name
-      # AWS endpoint URL
-      endpoint: "${BUCKET_HOST}"
-      # AWS region where the S3 bucket is located
-      region: "${BUCKET_REGION}"
-      # AWS secret access key
-      secretAccessKey: "${AWS_SECRET_ACCESS_KEY}"
-      # AWS access key ID
-      accessKeyId: "${AWS_ACCESS_KEY_ID}"
-      # AWS signature version (e.g., v2 or v4)
-      # signatureVersion: <your-signature-version>
-      # Forces the path style for S3 (true/false)
-      s3ForcePathStyle: true
-      # Allows insecure (HTTP) connections (true/false)
-      insecure: true
-      # HTTP configuration settings
-      # http_config: {}
-
-backend:
-  replicas: 2
-
-  extraArgs:
-    - -config.expand-env=true
-  extraEnvFrom:
-    - secretRef:
-        name: loki-bucket
-    - configMapRef:
-        name: loki-bucket
-read:
-  replicas: 2
-
-  extraArgs:
-    - -config.expand-env=true
-  extraEnvFrom:
-    - secretRef:
-        name: loki-bucket
-    - configMapRef:
-        name: loki-bucket
-write:
-  replicas: 2
-
-  extraArgs:
-    - -config.expand-env=true
-  extraEnvFrom:
-    - secretRef:
-        name: loki-bucket
-    - configMapRef:
-        name: loki-bucket

infra/loki/promtail.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: promtail
-  namespace: flux-system
-  labels:
-    alert: flux-infra
-spec:
-  interval: 15m
-  path: ./infra/loki/promtail
-  dependsOn:
-    - name: loki
-  prune: true
-  timeout: 2m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  wait: true

infra/loki/promtail/helm-release.yaml

@@ -1,18 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: promtail
-spec:
-  chart:
-    spec:
-      chart: promtail
-      reconcileStrategy: ChartVersion
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-      version: 6.16.6
-  interval: 15m
-  timeout: 5m
-  valuesFrom:
-    - kind: ConfigMap
-      name: promtail-values

infra/loki/promtail/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: loki
-resources:
-  - ./helm-release.yaml
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: promtail-values
-    files:
-      - ./values.yaml

infra/loki/promtail/values.yaml

@@ -1,14 +0,0 @@
-initContainer:
-  # -- Specifies whether the init container for setting inotify max user instances is to be enabled
-  - name: init
-    # -- Docker registry, image and tag for the init container image
-    image: docker.io/busybox:1.33
-    # -- Docker image pull policy for the init container image
-    imagePullPolicy: IfNotPresent
-    # -- The inotify max user instances to configure
-    command:
-      - sh
-      - -c
-      - sysctl -w fs.inotify.max_user_instances=512
-    securityContext:
-      privileged: true

infra/node-feature-discovery/kustomization.yaml

@@ -1,5 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: node-feature-discovery
 resources:
-  - ./node-feature-discovery-rules.yaml
+  - ./namespace.yaml
-  - ./node-feature-discovery.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml
+
+configurations:
+  - ../../common/name-reference/helm-release.yaml
+
+configMapGenerator:
+  - name: nfd-values
+    files:
+      - ./values.yaml

infra/node-feature-discovery/node-feature-discovery/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: node-feature-discovery
-resources:
-  - ./namespace.yaml
-  - ./helm-repository.yaml
-  - ./helm-release.yaml
-
-configurations:
-  - ../../../common/name-reference/helm-release.yaml
-
-configMapGenerator:
-  - name: nfd-values
-    files:
-      - ./values.yaml