infra/foundation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: infra:0cfcab2f974231a5f9eafcc352096e81f7d8e16c
Branches Tags
infra:main
...
compare: infra:main
Branches Tags
infra:main

21 Commits
0cfcab2f97 ... main

Author SHA1 Message Date
Dreaded_X
d51e723179 feat: Added lldap
All checks were successful
kustomization/cert-manager/fffa8587 reconciliation succeeded
kustomization/flux-system/fffa8587 reconciliation succeeded
kustomization/cnpg/fffa8587 reconciliation succeeded
kustomization/cilium/fffa8587 reconciliation succeeded
kustomization/spegel/fffa8587 reconciliation succeeded
kustomization/alerts/fffa8587 reconciliation succeeded
kustomization/longhorn/fffa8587 reconciliation succeeded
kustomization/cilium-config/fffa8587 reconciliation succeeded
kustomization/reflector/fffa8587 reconciliation succeeded
kustomization/lldap/fffa8587 reconciliation succeeded
kustomization/local-path-provisioner/fffa8587 reconciliation succeeded
kustomization/certificates/fffa8587 reconciliation succeeded
kustomization/longhorn-jobs/fffa8587 reconciliation succeeded
 2025-12-18 03:50:58 +01:00
Dreaded_X
fad4d94dc0 feat: Allow cnpg garage credentials reflection 2025-12-18 03:50:57 +01:00
Dreaded_X
bf226ea855 feat: Add reflector 2025-12-18 03:50:33 +01:00
Dreaded_X
dd873c296d feat: Redirect http to https 2025-12-18 03:50:33 +01:00
Dreaded_X
e0babc5b5f feat: Added default gateway 2025-12-18 03:50:32 +01:00
Dreaded_X
995eddb4e8 feat: Move certificates to default namespace 2025-12-18 03:50:32 +01:00
Dreaded_X
e2bd3ae33f feat: Setup cilium L2 announcements and IP pool 2025-12-18 03:50:32 +01:00
Dreaded_X
35472754c0 feat: Move spegel to apps 2025-12-18 03:50:31 +01:00
Dreaded_X
9154fafaef feat: Put ClusterIssuer under certificates 2025-12-18 03:50:31 +01:00
Dreaded_X
c0b51106f2 feat: Added barman cloud plugin 2025-12-18 03:50:19 +01:00
Dreaded_X
d5c6429205 feat: Added cnpg 2025-12-15 04:55:50 +01:00
Dreaded_X
be1c67d665 chore: Set minor version for all controllers 2025-12-15 04:55:50 +01:00
Dreaded_X
8046ec13aa feat: Use single kustomization for all alerts 2025-12-15 04:55:50 +01:00
Dreaded_X
e11250594f feat: Added flux status to gitea commits 2025-12-15 04:55:50 +01:00
Dreaded_X
4f76807824 chore: Moved telegram alerts config 2025-12-15 04:55:50 +01:00
Dreaded_X
d24347a93c feat: Add longhorn backup job 2025-12-15 04:55:49 +01:00
Dreaded_X
913b98333a feat: Pin flux version in bootstrap script 2025-12-15 04:55:49 +01:00
Dreaded_X
02ca71f13a chore: Added README with common issues 2025-12-15 04:55:49 +01:00
Flux
0e3931ece3 Add Flux v2.7.5 component manifests 2025-12-15 04:55:49 +01:00
Dreaded_X
83111317fb chore: Add 1 git-crypt collaborator 
New collaborators:

    CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
        Tim Huizinga <tim@huizinga.dev>
 2025-12-15 04:55:49 +01:00
Dreaded_X
5c16ed8137 feat: Added garage as default backup target 2025-12-15 04:55:49 +01:00
89 changed files with 980 additions and 86 deletions
Expand all files Collapse all files

4
.git-crypt/.gitattributes vendored Normal file
View File

@@ -0,0 +1,4 @@
# Do not edit this file. To specify the files to encrypt, create your own
# .gitattributes file in the directory where your files are.
* !filter !diff
*.gpg binary

BIN
.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg Normal file
View File

Binary file not shown.

7
README.md Normal file
View File

@@ -0,0 +1,7 @@
# SSH Key issues
Here are some things to check when running into ssh key issues:
- Make sure that known hosts only contains a key of type ecdsa-sha2-nistp256 otherwise flux will fail to connect to the repository over ssh.
- Make sure the deploy key is read/write.

21
apps/artifacts.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: source.extensions.fluxcd.io/v1beta1
kind: ArtifactGenerator
metadata:
name: apps
namespace: flux-system
spec:
sources:
- alias: foundation
kind: GitRepository
name: flux-system
artifacts:
- name: spegel
originRevision: "@foundation"
copy:
- from: "@foundation/apps/spegel/**"
to: "@artifact/"
- name: lldap
originRevision: "@foundation"
copy:
- from: "@foundation/apps/lldap/**"
to: "@artifact/"

15
apps/lldap/base/cluster.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: lldap-db
namespace: lldap
# TODO: Add labels?
spec:
storage:
size: 8Gi
storageClass: local-path
plugins:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
barmanObjectName: garage-store

80
apps/lldap/base/deployment.yaml Normal file
View File

@@ -0,0 +1,80 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: lldap
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
spec:
selector:
matchLabels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
template:
metadata:
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
spec:
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: lldap
image: lldap/lldap:2025-12-12-alpine-rootless
env:
- name: LLDAP_LDAP_BASE_DN
value: dc=huizinga,dc=dev
- name: LLDAP_LDAP_USER_PASS
valueFrom:
secretKeyRef:
name: credentials
key: admin-pass
- name: LLDAP_KEY_SEED
valueFrom:
secretKeyRef:
name: credentials
key: key-seed
- name: LLDAP_JWT_SECRET
valueFrom:
secretKeyRef:
name: credentials
key: jwt-secret
- name: LLDAP_DATABASE_URL
valueFrom:
secretKeyRef:
name: lldap-db-app
key: uri
- name: TZ
value: CET
livenessProbe:
exec:
command:
- /app/lldap
- healthcheck
initialDelaySeconds: 5
periodSeconds: 30
ports:
- name: ldap
containerPort: 3890
- name: web
containerPort: 17170
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL

13
apps/lldap/base/http-route.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: lldap
namespace: lldap
spec:
parentRefs:
- name: gateway
namespace: default
rules:
- backendRefs:
- name: lldap
port: 17170

11
apps/lldap/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- cluster.yaml
- schedule-backup.yaml
- deployment.yaml
- service.yaml
- http-route.yaml
- secret-s3-garage.yaml
- object-store.yaml

2
configs/certificates/base/namespace.yaml → apps/lldap/base/namespace.yaml
View File

@@ -1,4 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: certificates
name: lldap

21
apps/lldap/base/object-store.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: garage-store
namespace: lldap
spec:
configuration:
destinationPath: s3://cnpg-backup/
endpointURL: http://192.168.1.1:3900
s3Credentials:
accessKeyId:
name: s3-garage
key: ACCESS_KEY_ID
secretAccessKey:
name: s3-garage
key: ACCESS_SECRET_KEY
region:
name: s3-garage
key: REGION
wal:
compression: gzip

13
apps/lldap/base/schedule-backup.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
name: daily-backup
namespace: lldap
spec:
schedule: "0 0 0 * * *"
backupOwnerReference: self
method: plugin
pluginConfiguration:
name: barman-cloud.cloudnative-pg.io
cluster:
name: db

9
apps/lldap/base/secret-s3-garage.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
kind: Secret
metadata:
name: s3-garage
namespace: lldap
annotations:
reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
type: Opaque
data: {}

19
apps/lldap/base/service.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: v1
kind: Service
metadata:
name: lldap
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
spec:
selector:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
ports:
- name: ldap
port: 3890
targetPort: ldap
- name: web
port: 17170
targetPort: web

21
apps/lldap/lldap.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: lldap
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 5m
dependsOn:
- name: cnpg
sourceRef:
kind: ExternalArtifact
name: lldap
decryption:
provider: sops
secretRef:
name: sops-gpg
path: ./${cluster_env}
prune: true
wait: true

6
apps/lldap/production/cluster.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: lldap-db
spec:
instances: 2

7
apps/lldap/production/deployment.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: lldap
namespace: lldap
spec:
replicas: 2

8
apps/lldap/production/http-route.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: lldap
namespace: lldap
spec:
hostnames:
- "users.huizinga.dev"

15
apps/lldap/production/kustomization.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secret-credentials.enc.yaml
patches:
- path: deployment.yaml
target:
kind: Deployment
- path: cluster.yaml
target:
kind: Cluster
- path: http-route.yaml
target:
kind: HTTPRoute

59
apps/lldap/production/secret-credentials.enc.yaml Normal file
View File

@@ -0,0 +1,59 @@
apiVersion: v1
kind: Secret
metadata:
name: credentials
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
type: Opaque
data:
jwt-secret: ENC[AES256_GCM,data:yUAsoCIEXH491Ko4wEAAevSETdMFuhypNzuU2th5zlLd9hbVKqsjclvCTLDD8aW0Y9Lv70pzzAADPwFCKNH/rXx0DzaGOP139kLRYDHafz3RYeuoJjgBGw==,iv:x3EmPbbL/aj9CbwF8lleDL+nhlidPU8R3hwXygtj7D8=,tag:XD4C/pwFLFmDryBW7NqsWg==,type:str]
key-seed: ENC[AES256_GCM,data:3jWLtfny+ahtSkkmUdbg+wFbSGIcCxOv9BxVr0oNLTetXrAx+OcZ6dKp1ktj0J9aYEppqVuANUlfqyVzhIQXOT5GomQ+9jPC4uLmIz9tu1LAcfv9zuGl/w==,iv:e3aAI6JWq16YaUZqvKulkHyhLb8eWy9t2ni/jGeNFow=,tag:sZEEvxlq145klFkEMsUOuA==,type:str]
#ENC[AES256_GCM,data:AnCuvbVM6M62wuWmpUx3u/5WdaCo1T7eCvbY30okKbmWnvM0HQT2gGDTuhIaOlc=,iv:Ho+/CAvs69VJ+uwAIH8LVL344qlDaK5z3AvzWh/Jgm0=,tag:uNfN1P7lmWKBuCY7eiywDw==,type:comment]
admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
sops:
age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-----END AGE ENCRYPTED FILE-----
- recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-17T02:58:02Z"
mac: ENC[AES256_GCM,data:yxmBIqS+KMr2Dp4eKslT1oNCcq2VEnGh4g3e7mkZzWjT6xPTdBEH8bT+c2XIFMWHJSUFoI7YyhvS1p5VgRBudaDyQCOk7tzyj0nkGiepZc1uYjSVO7VQ9CnfcdiD9AZ2srUjkcUoBaRfi2u6Qh2pPUUwMd4z8ms8v0CSk1qw0FE=,iv:V2rw624TN+pSGuq+JjVqM2bKozn7hGAykHV+638wo14=,tag:cdDascdYzzG33GztMd0Fdg==,type:str]
pgp:
- created_at: "2025-12-17T00:53:29Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
/V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
/riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
=j+fd
-----END PGP MESSAGE-----
fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
encrypted_regex: ^(data|stringData)$
version: 3.11.0

6
apps/lldap/staging/cluster.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: lldap-db
spec:
instances: 1

7
apps/lldap/staging/deployment.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: lldap
namespace: lldap
spec:
replicas: 1

8
apps/lldap/staging/http-route.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: lldap
namespace: lldap
spec:
hostnames:
- "users.staging.huizinga.dev"

15
apps/lldap/staging/kustomization.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secret-credentials.enc.yaml
patches:
- path: deployment.yaml
target:
kind: Deployment
- path: cluster.yaml
target:
kind: Cluster
- path: http-route.yaml
target:
kind: HTTPRoute

58
apps/lldap/staging/secret-credentials.enc.yaml Normal file
View File

@@ -0,0 +1,58 @@
apiVersion: v1
kind: Secret
metadata:
name: credentials
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
type: Opaque
data:
jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
sops:
age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-----END AGE ENCRYPTED FILE-----
- recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-17T00:53:29Z"
mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
pgp:
- created_at: "2025-12-17T00:53:29Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
/V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
/riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
=j+fd
-----END PGP MESSAGE-----
fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
encrypted_regex: ^(data|stringData)$
version: 3.11.0

1
controllers/spegel/helm-release.yaml → apps/spegel/helm-release.yaml
View File

@@ -16,6 +16,7 @@ spec:
chart:
spec:
chart: spegel
version: "0.5.x"
sourceRef:
kind: HelmRepository
name: spegel

0
controllers/spegel/helm-repository.yaml → apps/spegel/helm-repository.yaml
View File

0
controllers/spegel/kustomization.yaml → apps/spegel/kustomization.yaml
View File

0
controllers/spegel/namespace.yaml → apps/spegel/namespace.yaml
View File

0
controllers/spegel/spegel.yaml → apps/spegel/spegel.yaml
View File

4
bootstrap.sh
View File

@@ -4,6 +4,7 @@ root=$(git rev-parse --show-toplevel)
tools=(talosctl cilium-cli yq helm)
cilium_version=1.18.4
flux_version=2.7.5
for tool in "${tools[@]}"; do
command -v ${tool} > /dev/null || (echo "Missing: ${tool}" && exit -1)
@@ -129,4 +130,5 @@ flux bootstrap git \
--branch=main \
--private-key-file=clusters/${cluster_name}/deploy.key -s \
--path=clusters/${cluster_name} \
--components-extra=source-watcher
--components-extra=source-watcher \
--version v${flux_version}

96
clusters/testing/flux-system/gotk-components.yaml
View File

@@ -1,6 +1,6 @@
---
# This manifest was generated by flux. DO NOT EDIT.
# Flux Version: v2.7.3
# Flux Version: v2.7.5
# Components: source-controller,kustomize-controller,helm-controller,notification-controller,source-watcher
apiVersion: v1
kind: Namespace
@@ -8,7 +8,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/warn-version: latest
name: flux-system
@@ -19,7 +19,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: allow-egress
namespace: flux-system
spec:
@@ -39,7 +39,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: allow-scraping
namespace: flux-system
spec:
@@ -59,7 +59,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: allow-webhooks
namespace: flux-system
spec:
@@ -78,7 +78,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: critical-pods-flux-system
namespace: flux-system
spec:
@@ -98,7 +98,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: crd-controller-flux-system
rules:
- apiGroups:
@@ -204,7 +204,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
name: flux-edit-flux-system
@@ -212,6 +212,7 @@ rules:
- apiGroups:
- notification.toolkit.fluxcd.io
- source.toolkit.fluxcd.io
- source.extensions.fluxcd.io
- helm.toolkit.fluxcd.io
- image.toolkit.fluxcd.io
- kustomize.toolkit.fluxcd.io
@@ -230,7 +231,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -239,6 +240,7 @@ rules:
- apiGroups:
- notification.toolkit.fluxcd.io
- source.toolkit.fluxcd.io
- source.extensions.fluxcd.io
- helm.toolkit.fluxcd.io
- image.toolkit.fluxcd.io
- kustomize.toolkit.fluxcd.io
@@ -255,7 +257,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: cluster-reconciler-flux-system
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -275,7 +277,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: crd-controller-flux-system
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -313,7 +315,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: buckets.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -1084,7 +1086,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: externalartifacts.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -1280,7 +1282,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: gitrepositories.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -2234,7 +2236,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: helmcharts.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -2960,7 +2962,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: helmrepositories.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -3591,7 +3593,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: ocirepositories.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -4417,7 +4419,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: source-controller
namespace: flux-system
---
@@ -4428,7 +4430,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: source-controller
namespace: flux-system
@@ -4449,7 +4451,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: source-controller
namespace: flux-system
@@ -4470,7 +4472,7 @@ spec:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
spec:
containers:
- args:
@@ -4493,7 +4495,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
image: ghcr.io/fluxcd/source-controller:v1.7.3
image: ghcr.io/fluxcd/source-controller:v1.7.4
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -4557,7 +4559,7 @@ metadata:
app.kubernetes.io/component: kustomize-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: kustomizations.kustomize.toolkit.fluxcd.io
spec:
group: kustomize.toolkit.fluxcd.io
@@ -5927,7 +5929,7 @@ metadata:
app.kubernetes.io/component: kustomize-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: kustomize-controller
namespace: flux-system
---
@@ -5938,7 +5940,7 @@ metadata:
app.kubernetes.io/component: kustomize-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: kustomize-controller
namespace: flux-system
@@ -5957,7 +5959,7 @@ spec:
app.kubernetes.io/component: kustomize-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
spec:
containers:
- args:
@@ -5977,7 +5979,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
image: ghcr.io/fluxcd/kustomize-controller:v1.7.2
image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -6034,7 +6036,7 @@ metadata:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: helmreleases.helm.toolkit.fluxcd.io
spec:
group: helm.toolkit.fluxcd.io
@@ -8665,7 +8667,7 @@ metadata:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: helm-controller
namespace: flux-system
---
@@ -8676,7 +8678,7 @@ metadata:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: helm-controller
namespace: flux-system
@@ -8695,7 +8697,7 @@ spec:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
spec:
containers:
- args:
@@ -8715,7 +8717,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
image: ghcr.io/fluxcd/helm-controller:v1.4.3
image: ghcr.io/fluxcd/helm-controller:v1.4.5
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -8772,7 +8774,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: alerts.notification.toolkit.fluxcd.io
spec:
group: notification.toolkit.fluxcd.io
@@ -9162,7 +9164,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: providers.notification.toolkit.fluxcd.io
spec:
group: notification.toolkit.fluxcd.io
@@ -9574,7 +9576,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: receivers.notification.toolkit.fluxcd.io
spec:
group: notification.toolkit.fluxcd.io
@@ -10051,7 +10053,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: notification-controller
namespace: flux-system
---
@@ -10062,7 +10064,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: notification-controller
namespace: flux-system
@@ -10083,7 +10085,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: webhook-receiver
namespace: flux-system
@@ -10104,7 +10106,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: notification-controller
namespace: flux-system
@@ -10123,7 +10125,7 @@ spec:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
spec:
containers:
- args:
@@ -10141,7 +10143,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
image: ghcr.io/fluxcd/notification-controller:v1.7.4
image: ghcr.io/fluxcd/notification-controller:v1.7.5
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -10203,7 +10205,7 @@ metadata:
app.kubernetes.io/component: source-watcher
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: artifactgenerators.source.extensions.fluxcd.io
spec:
group: source.extensions.fluxcd.io
@@ -10496,7 +10498,7 @@ metadata:
app.kubernetes.io/component: source-watcher
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
name: source-watcher
namespace: flux-system
---
@@ -10507,7 +10509,7 @@ metadata:
app.kubernetes.io/component: source-watcher
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: source-watcher
name: source-watcher
namespace: flux-system
@@ -10528,7 +10530,7 @@ metadata:
app.kubernetes.io/component: source-watcher
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
control-plane: controller
name: source-watcher
namespace: flux-system
@@ -10549,7 +10551,7 @@ spec:
app.kubernetes.io/component: source-watcher
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
app.kubernetes.io/version: v2.7.3
app.kubernetes.io/version: v2.7.5
spec:
containers:
- args:
@@ -10570,7 +10572,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
image: ghcr.io/fluxcd/source-watcher:v2.0.2
image: ghcr.io/fluxcd/source-watcher:v2.0.3
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:

12
clusters/testing/kustomization.yaml
View File

@@ -6,11 +6,17 @@ resources:
- ../../controllers/artifacts.yaml
- ../../controllers/cilium/cilium.yaml
- ../../controllers/cert-manager/cert-manager.yaml
- ../../controllers/spegel/spegel.yaml
- ../../controllers/longhorn/longhorn.yaml
- ../../controllers/local-path-provisioner/local-path-provisioner.yaml
- ../../controllers/cnpg/cnpg.yaml
- ../../controllers/reflector/reflector.yaml
- ../../configs/artifacts.yaml
- ../../configs/letsencrypt/letsencrypt.yaml
- ../../configs/cilium-config/cilium-config.yaml
- ../../configs/certificates/certificates.yaml
- ../../configs/telegram-alerts/telegram-alerts.yaml
- ../../configs/alerts/alerts.yaml
- ../../configs/longhorn-jobs/longhorn-jobs.yaml
- ../../apps/artifacts.yaml
- ../../apps/spegel/spegel.yaml
- ../../apps/lldap/lldap.yaml

4
configs/telegram-alerts/telegram-alerts.yaml → configs/alerts/alerts.yaml
View File

@@ -1,7 +1,7 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: telegram-alerts
name: alerts
namespace: flux-system
spec:
interval: 1h
@@ -9,7 +9,7 @@ spec:
timeout: 5m
sourceRef:
kind: ExternalArtifact
name: telegram-alerts
name: alerts
decryption:
provider: sops
secretRef:

4
configs/letsencrypt/kustomization.yaml → configs/alerts/kustomization.yaml
View File

@@ -1,5 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- secret-cloudflare-token.enc.yaml
- cluster-issuer.yaml
- telegram
- repo

12
configs/alerts/repo/alert.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Alert
metadata:
name: repo
namespace: flux-system
spec:
providerRef:
name: repo
eventSeverity: info
eventSources:
- kind: Kustomization
name: "*"

2
configs/telegram-alerts/kustomization.yaml → configs/alerts/repo/kustomization.yaml
View File

@@ -1,6 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- secret-telegram.yaml
- secret-repo.enc.yaml
- provider.yaml
- alert.yaml

10
configs/alerts/repo/provider.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Provider
metadata:
name: repo
namespace: flux-system
spec:
type: gitea
address: https://git.huizinga.dev/infra/foundation
secretRef:
name: repo

8
configs/telegram-alerts/secret-telegram.enc.yaml → configs/alerts/repo/secret-repo.enc.yaml
View File

@@ -1,9 +1,9 @@
apiVersion: v1
stringData:
token: ENC[AES256_GCM,data:azBE1dVSbYNZzpagsQrmEoYGIGFn/URQ3VrksQRhUKuJyCrc6o6360u/k38NKg==,iv:iYpqz6Ndh5QESa8yGPU1nKD8/sb3dgloNLa3HFDihnU=,tag:2w0eslkZQOIb+qPYgNmHIQ==,type:str]
token: ENC[AES256_GCM,data:RZLFgmuin4hjJ1gSOFZLFeLpF/KjIr6vBGgovhyfLD9PQKSQq6eg5g==,iv:VUTnjgcoqfVcZrDM1S2VqBdSCYXC6hj4lHx/mI8bw8s=,tag:QSj3c5OX6JqJxt6WnglAIw==,type:str]
kind: Secret
metadata:
name: telegram
name: repo
namespace: flux-system
sops:
age:
@@ -25,8 +25,8 @@ sops:
RE5SSzI4MmdOWGhBTGNzR2NPeHArSHcK8sOiSL6tfAT6KFLkFy0NpRuiVbFayJPR
vtki2eku7b0MKsQKCv/JPwSdOa7q/8Mxngiajxqwae0nObETSR+2TA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-09T02:34:49Z"
mac: ENC[AES256_GCM,data:dwt7iU5FQjd3Hn/ynE+hAv6L6/EwGgJ9KR/98RsGL+ZoDOXrcnPu8I1Zp4HIuwxzLQetYPeeZy0qGl452eWnbI8kJ2MySGGpqdYeJVWplyfx3pSMT5ms7gbHYTAS7Kp8VLPtzynyKA14fJZNiECd/onVJehxE5bEtKEuiE7ZRvE=,iv:nc59zZeHLtwjsrCOI/WgQc7ZXKXI+5/Q2QcIdBVI+RQ=,tag:xdrCwPDVA1im+cNwPgU6Lg==,type:str]
lastmodified: "2025-12-15T00:11:25Z"
mac: ENC[AES256_GCM,data:xXPnZ5DP90FtT7yDUOPAMHl7vXgFM8JEnm/mpozB5/I4f3xxGP9b3RVfK3zESgqHREVUoD/hIQaTCwYHeqqWKwB7yQxc4ZuMKlTJ11iw0R8vsbj0Lk/a8v0kzCx5CDoTcvZE78go8LtIfYVxBKvcwP9ZN0Q9RuR235RVMW5Rz5M=,iv:oS9OUiyhliHzl1NEgfFr+eEfmgXlMX7VeeOcE382p1k=,tag:w6t9lNHqUYAFcEI3E4UBcQ==,type:str]
pgp:
- created_at: "2025-12-09T02:34:13Z"
enc: |-

0
configs/telegram-alerts/alert.yaml → configs/alerts/telegram/alert.yaml
View File

6
configs/alerts/telegram/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- secret-telegram.enc.yaml
- provider.yaml
- alert.yaml

0
configs/telegram-alerts/provider.yaml → configs/alerts/telegram/provider.yaml
View File

0
configs/telegram-alerts/secret-telegram.yaml → configs/alerts/telegram/secret-telegram.enc.yaml
View File

13
configs/artifacts.yaml
View File

@@ -9,18 +9,23 @@ spec:
kind: GitRepository
name: flux-system
artifacts:
- name: letsencrypt
- name: cilium-config
originRevision: "@foundation"
copy:
- from: "@foundation/configs/letsencrypt/**"
- from: "@foundation/configs/cilium-config/**"
to: "@artifact/"
- name: certificates
originRevision: "@foundation"
copy:
- from: "@foundation/configs/certificates/**"
to: "@artifact/"
- name: telegram-alerts
- name: alerts
originRevision: "@foundation"
copy:
- from: "@foundation/configs/telegram-alerts/**"
- from: "@foundation/configs/alerts/**"
to: "@artifact/"
- name: longhorn-jobs
originRevision: "@foundation"
copy:
- from: "@foundation/configs/longhorn-jobs/**"
to: "@artifact/"

2
configs/certificates/base/certificate-huizinga-dev.yaml
View File

@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: huizinga-dev
namespace: certificates
namespace: default
spec:
secretName: huizinga-dev-tls
issuerRef:

0
configs/letsencrypt/cluster-issuer.yaml → configs/certificates/base/cluster-issuer.yaml
View File

3
configs/certificates/base/kustomization.yaml
View File

@@ -1,5 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- certificate-huizinga-dev.yaml
- secret-cloudflare-token.enc.yaml
- cluster-issuer.yaml

0
configs/letsencrypt/secret-cloudflare-token.enc.yaml → configs/certificates/base/secret-cloudflare-token.enc.yaml
View File

6
configs/certificates/certificates.yaml
View File

@@ -8,10 +8,14 @@ spec:
retryInterval: 2m
timeout: 15m
dependsOn:
- name: letsencrypt
- name: cert-manager
sourceRef:
kind: ExternalArtifact
name: certificates
decryption:
provider: sops
secretRef:
name: sops-gpg
path: ./${cluster_env}
prune: true
wait: true

2
configs/certificates/production/certificate-huizinga-dev.yaml
View File

@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: huizinga-dev
namespace: certificates
namespace: default
spec:
commonName: "huizinga.dev"
dnsNames:

2
configs/certificates/staging/certificate-huizinga-dev.yaml
View File

@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: huizinga-dev
namespace: certificates
namespace: default
spec:
commonName: "staging.huizinga.dev"
dnsNames:

9
configs/cilium-config/base/cilium-l2-announcement-policy.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
name: default-policy
spec:
interfaces:
- ^eth[0-9]+
externalIPs: true
loadBalancerIPs: true

24
configs/cilium-config/base/gateway.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway
namespace: default
spec:
gatewayClassName: cilium
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: Same
- name: https
protocol: HTTPS
port: 443
tls:
certificateRefs:
- kind: Secret
name: huizinga-dev-tls
allowedRoutes:
namespaces:
from: All

15
configs/cilium-config/base/http-route-http-filter-redirect.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-filter-redirect
namespace: default
spec:
parentRefs:
- name: gateway
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

6
configs/cilium-config/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cilium-l2-announcement-policy.yaml
- gateway.yaml
- http-route-http-filter-redirect.yaml

17
configs/cilium-config/cilium-config.yaml Normal file
View File

@@ -0,0 +1,17 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium-config
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 15m
dependsOn:
- name: cilium
sourceRef:
kind: ExternalArtifact
name: cilium-config
path: ./${cluster_env}
prune: true
wait: true

7
configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: default-pool
spec:
blocks:
- cidr: 10.0.2.100/24

5
configs/cilium-config/production/kustomization.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- cilium-load-balancer-ip-pool.yaml

8
configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: default-pool
spec:
blocks:
- start: 192.168.1.100
stop: 192.168.1.200

5
configs/cilium-config/staging/kustomization.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- cilium-load-balancer-ip-pool.yaml

6
configs/longhorn-jobs/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- recurring-job-backup.yaml
- recurring-job-snapshot.yaml
- recurring-job-trim.yaml

16
configs/longhorn-jobs/longhorn-jobs.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: longhorn-jobs
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 5m
dependsOn:
- name: longhorn
sourceRef:
kind: ExternalArtifact
name: longhorn-jobs
prune: true
wait: true

14
configs/longhorn-jobs/recurring-job-backup.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: longhorn.io/v1beta2
kind: RecurringJob
metadata:
name: backup
namespace: longhorn-system
spec:
cron: "0 5 * * *"
task: "backup"
retain: 14
concurrency: 1
groups:
- default
parameters:
full-backup-interval: "7"

12
configs/longhorn-jobs/recurring-job-snapshot.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: longhorn.io/v1beta2
kind: RecurringJob
metadata:
name: snapshot
namespace: longhorn-system
spec:
cron: "0 */12 * * *"
task: "snapshot"
retain: 14
concurrency: 1
groups:
- default

11
configs/longhorn-jobs/recurring-job-trim.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: longhorn.io/v1beta2
kind: RecurringJob
metadata:
name: trim
namespace: longhorn-system
spec:
cron: "0 0 7 * *"
task: "filesystem-trim"
concurrency: 1
groups:
- default

17
controllers/artifacts.yaml
View File

@@ -19,11 +19,6 @@ spec:
copy:
- from: "@foundation/controllers/cert-manager/**"
to: "@artifact/"
- name: spegel
originRevision: "@foundation"
copy:
- from: "@foundation/controllers/spegel/**"
to: "@artifact/"
- name: openebs
originRevision: "@foundation"
copy:
@@ -37,5 +32,15 @@ spec:
- name: local-path-provisioner
originRevision: "@foundation"
copy:
- from: "@foundation/controllers/local-path-provisioner/**"
- from: "@foundation/controllers/local-path-provisioner**"
to: "@artifact/"
- name: cnpg
originRevision: "@foundation"
copy:
- from: "@foundation/controllers/cnpg/**"
to: "@artifact/"
- name: reflector
originRevision: "@foundation"
copy:
- from: "@foundation/controllers/reflector/**"
to: "@artifact/"

2
controllers/cert-manager/oci-repository.yaml
View File

@@ -10,4 +10,4 @@ spec:
mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
operation: copy
ref:
semver: "1.x"
semver: "1.19.x"

2
controllers/cilium/base/helm-release.yaml
View File

@@ -17,7 +17,7 @@ spec:
chart:
spec:
chart: cilium
version: "1.x"
version: "1.18.x"
sourceRef:
kind: HelmRepository
name: cilium

29
controllers/cnpg/base/helm-release.yaml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cnpg
namespace: cnpg-system
spec:
interval: 12h
install:
strategy:
name: RetryOnFailure
retryInterval: 2m
upgrade:
strategy:
name: RetryOnFailure
retryInterval: 3m
chart:
spec:
chart: cloudnative-pg
version: "0.27.x"
sourceRef:
kind: HelmRepository
name: cnpg
interval: 24h
valuesFrom:
- kind: ConfigMap
name: values-base
- kind: ConfigMap
name: values-overlay
optional: true

8
controllers/cnpg/base/helm-repository.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: cnpg
namespace: cnpg-system
spec:
interval: 24h
url: https://cloudnative-pg.github.io/charts

16
controllers/cnpg/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-repository.yaml
- helm-release.yaml
- https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.9.0/manifest.yaml
configurations:
- name-reference.yaml
configMapGenerator:
- name: values-base
namespace: cnpg-system
files:
- values.yaml

6
controllers/cnpg/base/name-reference.yaml Normal file
View File

@@ -0,0 +1,6 @@
nameReference:
- kind: ConfigMap
version: v1
fieldSpecs:
- path: spec/valuesFrom/name
kind: HelmRelease

4
controllers/cnpg/base/namespace.yaml Normal file
View File

@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: cnpg-system

0
controllers/cnpg/base/values.yaml Normal file
View File

14
configs/letsencrypt/letsencrypt.yaml → controllers/cnpg/cnpg.yaml
View File

@@ -1,21 +1,21 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: letsencrypt
name: cnpg
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 5m
dependsOn:
- name: cert-manager
sourceRef:
kind: ExternalArtifact
name: letsencrypt
decryption:
provider: sops
secretRef:
name: sops-gpg
path: ./
dependsOn:
- name: cert-manager
sourceRef:
kind: ExternalArtifact
name: cnpg
path: ./${cluster_env}
prune: true
wait: true

10
controllers/cnpg/production/kustomization.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
configMapGenerator:
- name: values-overlay
namespace: cnpg-system
files:
- values.yaml

1
controllers/cnpg/production/values.yaml Normal file
View File

@@ -0,0 +1 @@
replicaCount: 2

11
controllers/cnpg/staging/kustomization.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secret-s3-garage.enc.yaml
configMapGenerator:
- name: values-overlay
namespace: cnpg-system
files:
- values.yaml

57
controllers/cnpg/staging/secret-s3-garage.enc.yaml Normal file
View File

@@ -0,0 +1,57 @@
apiVersion: v1
kind: Secret
metadata:
name: s3-garage
namespace: cnpg-system
annotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
type: Opaque
stringData:
ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
ACCESS_SECRET_KEY: ENC[AES256_GCM,data:INipEOcpPSij6TDu+bCuMOdsGm58nEBC4UJfEGRqeMmXZ9A+EBrMiRL6z3s29uz4qdqwZ3C8E4PVz01/41bMEA==,iv:x+gku8q7efHaaMpD/dc19IrwmK2gDp04bjH8WN/xhkc=,tag:QiSF6B8IqMrCsOUCe8c0bw==,type:str]
REGION: ENC[AES256_GCM,data:WIGPWwii,iv:ZdP5uNYqa8CZxa/xyrYXxGvE9fzt95slzwpzSzRy9DY=,tag:yANYtLzJCL/1pcvBXY7X7g==,type:str]
sops:
age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
-----END AGE ENCRYPTED FILE-----
- recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-18T02:50:50Z"
mac: ENC[AES256_GCM,data:+kfs0EDnnZNnHMf91P6rAN52lugHFO4XcNJiKLpXt7bfTSMbiwgVbvRElXGTbLXLVSz70uZyzV/mt0ZcfEfPbwE/Pdh6SmFiWwQwLT1M50MdrxAWWYvSCS9r4h1Cow3N3K2/dXH7N/4AVHTg3ohXlP92fxVh1wL0cVnke/lcQgY=,iv:M5n9+lgq0fBx5Yg1e0N6v0obbnmarvVwIHAjCr5XmM4=,tag:NBA01MtG40T3nST7b00tiw==,type:str]
pgp:
- created_at: "2025-12-11T23:56:15Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
/9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
=/yAN
-----END PGP MESSAGE-----
fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
encrypted_regex: ^(data|stringData)$
version: 3.11.0

1
controllers/cnpg/staging/values.yaml Normal file
View File

@@ -0,0 +1 @@
replicaCount: 1

1
controllers/longhorn/base/helm-release.yaml
View File

@@ -16,7 +16,6 @@ spec:
chart:
spec:
chart: longhorn
# TODO: Is it safe to upgrade automatically to 1.x?
version: "1.10.x"
sourceRef:
kind: HelmRepository

3
controllers/longhorn/base/values.yaml
View File

@@ -8,3 +8,6 @@ defaultSettings:
storageOverProvisioningPercentage: 25
persistence:
defaultDataLocality: best-effort
defaultBackupStore:
backupTarget: s3://longhorn-backup@garage/
backupTargetCredentialSecret: s3-garage

4
controllers/longhorn/longhorn.yaml
View File

@@ -10,6 +10,10 @@ spec:
sourceRef:
kind: ExternalArtifact
name: longhorn
decryption:
provider: sops
secretRef:
name: sops-gpg
path: ./${cluster_env}
prune: true
wait: true

1
controllers/longhorn/staging/kustomization.yaml
View File

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secret-s3-garage.enc.yaml
configMapGenerator:
- name: values-overlay

55
controllers/longhorn/staging/secret-s3-garage.enc.yaml Normal file
View File

@@ -0,0 +1,55 @@
apiVersion: v1
kind: Secret
metadata:
name: s3-garage
namespace: longhorn-system
type: Opaque
stringData:
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Z61V0zZ0sApVz8gP+Yc6LTKQcW0jdRaWXa4=,iv:SpLgdgI4Yc48NYNb9wE3C28ixBg8vu5tTf7bUENMfrE=,tag:DDbqGvSbcpDxzPUpHbhLKA==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:FK/BS+rXAD2sXND6zHJ2G/GIcFIe01kL/1WP1RJNX86Jc9aCra26+FQQ4zU0Uanh8tQqSzf2qMwK1uMkr/SI4A==,iv:36UsdtiRN3fPr+HtRHSad7oEetiJh56sq+Ypyq/W5FA=,tag:rYHPuCOCHA+YoEKdfN8P0g==,type:str]
AWS_ENDPOINTS: ENC[AES256_GCM,data:2iB2cf1E4ucxJEDGRpe2wiX9yMCZA1A=,iv:c+izWJ+i7lHybZlU9yKS5Q+Zj9lOGysCbewz9iRud3M=,tag:UX4zr9dguSAUBqm1xJnNJQ==,type:str]
sops:
age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
-----END AGE ENCRYPTED FILE-----
- recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-15T03:54:35Z"
mac: ENC[AES256_GCM,data:mXl4RyNkiUa0siCcB74fcRb2WLkak64qCVwaPnx3dG+BE1pwfLJUocXs13ueaVFlAwqAFD5ZN0B+yiEqxk7DXvga5/S1zewJIFHAeOdG9sW3lNJaCHXjgkg4GBOpCii173bUIl5QTp9fgEFLsc6IFsXcalhXOIdiJtV9zj5xlHQ=,iv:4atqqw9claajWbXH2YBQ0cA89ZdaiqFHwKrhOxMBVLk=,tag:NtwG2L1XZCCuTp5Q8ygJ5g==,type:str]
pgp:
- created_at: "2025-12-11T23:56:15Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
/9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
=/yAN
-----END PGP MESSAGE-----
fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
encrypted_regex: ^(data|stringData)$
version: 3.11.0

23
controllers/reflector/helm-release.yaml Normal file
View File

@@ -0,0 +1,23 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: reflector
namespace: reflector
spec:
interval: 12h
install:
strategy:
name: RetryOnFailure
retryInterval: 2m
upgrade:
strategy:
name: RetryOnFailure
retryInterval: 3m
chart:
spec:
chart: reflector
version: "9.1.x"
sourceRef:
kind: HelmRepository
name: reflector
interval: 24h

9
controllers/reflector/helm-repository.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: reflector
namespace: reflector
spec:
type: "oci"
interval: 24h
url: oci://ghcr.io/emberstack/helm-charts

6
controllers/reflector/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-repository.yaml
- helm-release.yaml

4
controllers/reflector/namespace.yaml Normal file
View File

@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: reflector

15
controllers/reflector/reflector.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: reflector
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 5m
sourceRef:
kind: ExternalArtifact
name: reflector
path: ./
prune: true
wait: true