feat: Added cnpg

chore: Set minor version for all controllers
feat: Use single kustomization for all alerts
2025-12-15 03:13:39 +01:00 · 2025-12-15 03:08:10 +01:00 · 2025-12-15 03:08:10 +01:00 · 2025-12-15 03:08:10 +01:00 · 2025-12-15 03:08:10 +01:00 · 2025-12-15 03:08:10 +01:00
70 changed files with 908 additions and 81 deletions
--- a/.git-crypt/.gitattributes
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
--- a/.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg
+++ b/.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1 @@
+deploy.key filter=git-crypt diff=git-crypt
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,28 @@
+default_install_hook_types: [pre-commit, commit-msg]
+exclude: gotk-.*.yaml
+repos:
+  - repo: builtin
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args:
+          - --allow-multiple-documents
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-executables-have-shebangs
+
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.40.0
+    hooks:
+      - id: typos
+
+  - repo: https://github.com/sirwart/ripsecrets
+    rev: v0.1.11
+    hooks:
+      - id: ripsecrets-system
+
+  - repo: https://github.com/crate-ci/committed
+    rev: v1.1.8
+    hooks:
+      - id: committed
--- a/.secretsignore
+++ b/.secretsignore
@@ -0,0 +1 @@
+deploy.key
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -2,7 +2,7 @@ creation_rules:
  - path_regex: .*.yaml
    encrypted_regex: ^(data|stringData)$
    pgp: >-
-      1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+      CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
    age: >-
      age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul,
      age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
--- a/.typos.toml
+++ b/.typos.toml
@@ -0,0 +1,7 @@
+[default]
+extend-ignore-re = [
+  "(?Rm)^.*(#|//)\\s*spellchecker:disable-line$",
+  "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on",
+  "(#|//)\\s*spellchecker:ignore-next-line\\n.*",
+  "-{5}BEGIN AGE ENCRYPTED FILE-{5}(?:$|[^-]{63,}-{5}END)",
+]
--- a/README.md
+++ b/README.md
@@ -0,0 +1,7 @@
+# SSH Key issues
+
+Here are some things to check when running into ssh key issues:
+
+- Make sure that known hosts only contains a key of type ecdsa-sha2-nistp256 otherwise flux will fail to connect to the repository over ssh.
+
+- Make sure the deploy key is read/write.
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -4,6 +4,7 @@ root=$(git rev-parse --show-toplevel)

 tools=(talosctl cilium-cli yq helm)
 cilium_version=1.18.4
+flux_version=2.7.5

 for tool in "${tools[@]}"; do
 	command -v ${tool} > /dev/null || (echo "Missing: ${tool}" && exit -1)
@@ -58,6 +59,7 @@ if [ "${vip}" = "null" ]; then
 fi

 echo -n "Checking connection to ${bootstrap_ip}... "
+# spellchecker:ignore-next-line
 if nmap -Pn ${bootstrap_ip} -p 50000 | grep -q 'open'; then
 	echo "[Success]"
 else
@@ -67,6 +69,7 @@ fi

 count=0
 max_retries=20
+# spellchecker:ignore-next-line
 while ! nmap -Pn ${vip} -p 50000 | grep -q 'open' && [ ${count} -lt ${max_retries} ]; do
 	if [ $count -eq 0 ]; then
 		echo -n "Bootstrapping Kubernetes"
@@ -122,5 +125,10 @@ cilium-cli status --wait
 # cilium-cli connectivity test --namespace-labels pod-security.kubernetes.io/enforce=privileged

 echo "Bootstrapping flux..."
-flux bootstrap git --url ssh://git@huizinga.dev/infra/foundation --branch=main --path=clusters/${cluster_name} \
-	--components-extra=source-watcher
+flux bootstrap git \
+	--url ssh://git@huizinga.dev/infra/foundation \
+	--branch=main \
+	--private-key-file=clusters/${cluster_name}/deploy.key -s \
+	--path=clusters/${cluster_name} \
+	--components-extra=source-watcher \
+	--version v${flux_version}
--- a/clusters/testing/deploy.key
+++ b/clusters/testing/deploy.key
--- a/clusters/testing/deploy.key.pub
+++ b/clusters/testing/deploy.key.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK59NC6hLyDf+9zeOQ0stZeay51UyUpoBgONh0xxJFIlgra5ojyhrrQVlfjcUqdLe5yijWU1nCxKpaFGDPMdNE4= flux@testing
--- a/clusters/testing/flux-system/gotk-components.yaml
+++ b/clusters/testing/flux-system/gotk-components.yaml
@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.7.3
+# Flux Version: v2.7.5
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller,source-watcher
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: flux-system
@@ -19,7 +19,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: allow-egress
  namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: allow-scraping
  namespace: flux-system
 spec:
@@ -59,7 +59,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: allow-webhooks
  namespace: flux-system
 spec:
@@ -78,7 +78,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: critical-pods-flux-system
  namespace: flux-system
 spec:
@@ -98,7 +98,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +204,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: flux-edit-flux-system
@@ -212,6 +212,7 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
+  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -230,7 +231,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -239,6 +240,7 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
+  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -255,7 +257,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: cluster-reconciler-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -275,7 +277,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: crd-controller-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -313,7 +315,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: buckets.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1084,7 +1086,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: externalartifacts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1280,7 +1282,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: gitrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2234,7 +2236,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helmcharts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2960,7 +2962,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helmrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -3591,7 +3593,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: ocirepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -4417,7 +4419,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: source-controller
  namespace: flux-system
 ---
@@ -4428,7 +4430,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4449,7 +4451,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4470,7 +4472,7 @@ spec:
        app.kubernetes.io/component: source-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -4493,7 +4495,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.7.3
+        image: ghcr.io/fluxcd/source-controller:v1.7.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -4557,7 +4559,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
  group: kustomize.toolkit.fluxcd.io
@@ -5927,7 +5929,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: kustomize-controller
  namespace: flux-system
 ---
@@ -5938,7 +5940,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: kustomize-controller
  namespace: flux-system
@@ -5957,7 +5959,7 @@ spec:
        app.kubernetes.io/component: kustomize-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -5977,7 +5979,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.7.2
+        image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -6034,7 +6036,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helmreleases.helm.toolkit.fluxcd.io
 spec:
  group: helm.toolkit.fluxcd.io
@@ -8665,7 +8667,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helm-controller
  namespace: flux-system
 ---
@@ -8676,7 +8678,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: helm-controller
  namespace: flux-system
@@ -8695,7 +8697,7 @@ spec:
        app.kubernetes.io/component: helm-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -8715,7 +8717,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.4.3
+        image: ghcr.io/fluxcd/helm-controller:v1.4.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -8772,7 +8774,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: alerts.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9162,7 +9164,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: providers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9574,7 +9576,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: receivers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -10051,7 +10053,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: notification-controller
  namespace: flux-system
 ---
@@ -10062,7 +10064,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10083,7 +10085,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: webhook-receiver
  namespace: flux-system
@@ -10104,7 +10106,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10123,7 +10125,7 @@ spec:
        app.kubernetes.io/component: notification-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -10141,7 +10143,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.7.4
+        image: ghcr.io/fluxcd/notification-controller:v1.7.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -10203,7 +10205,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: artifactgenerators.source.extensions.fluxcd.io
 spec:
  group: source.extensions.fluxcd.io
@@ -10496,7 +10498,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: source-watcher
  namespace: flux-system
 ---
@@ -10507,7 +10509,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: source-watcher
  name: source-watcher
  namespace: flux-system
@@ -10528,7 +10530,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: source-watcher
  namespace: flux-system
@@ -10549,7 +10551,7 @@ spec:
        app.kubernetes.io/component: source-watcher
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -10570,7 +10572,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-watcher:v2.0.2
+        image: ghcr.io/fluxcd/source-watcher:v2.0.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
--- a/clusters/testing/kustomization.yaml
+++ b/clusters/testing/kustomization.yaml
@@ -2,9 +2,17 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - flux-system/
+
  - ../../controllers/artifacts.yaml
  - ../../controllers/cilium/cilium.yaml
  - ../../controllers/cert-manager/cert-manager.yaml
+  - ../../controllers/spegel/spegel.yaml
+  - ../../controllers/longhorn/longhorn.yaml
+  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
+  - ../../controllers/cnpg/cnpg.yaml
+
  - ../../configs/artifacts.yaml
  - ../../configs/letsencrypt/letsencrypt.yaml
  - ../../configs/certificates/certificates.yaml
+  - ../../configs/alerts/alerts.yaml
+  - ../../configs/longhorn-jobs/longhorn-jobs.yaml
--- a/committed.toml
+++ b/committed.toml
@@ -0,0 +1,2 @@
+style = "conventional"
+ignore_author_re = "Flux"
--- a/configs/alerts/alerts.yaml
+++ b/configs/alerts/alerts.yaml
@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: alerts
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: alerts
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  path: ./
+  prune: true
+  wait: true
--- a/configs/alerts/kustomization.yaml
+++ b/configs/alerts/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - telegram
+  - repo
--- a/configs/alerts/repo/alert.yaml
+++ b/configs/alerts/repo/alert.yaml
@@ -0,0 +1,12 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: repo
+  namespace: flux-system
+spec:
+  providerRef:
+    name: repo
+  eventSeverity: info
+  eventSources:
+    - kind: Kustomization
+      name: "*"
--- a/configs/alerts/repo/kustomization.yaml
+++ b/configs/alerts/repo/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret-repo.enc.yaml
+  - provider.yaml
+  - alert.yaml
--- a/configs/alerts/repo/provider.yaml
+++ b/configs/alerts/repo/provider.yaml
@@ -0,0 +1,10 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: repo
+  namespace: flux-system
+spec:
+  type: gitea
+  address: https://git.huizinga.dev/infra/foundation
+  secretRef:
+    name: repo
--- a/configs/alerts/repo/secret-repo.enc.yaml
+++ b/configs/alerts/repo/secret-repo.enc.yaml
@@ -0,0 +1,52 @@
+apiVersion: v1
+stringData:
+    token: ENC[AES256_GCM,data:RZLFgmuin4hjJ1gSOFZLFeLpF/KjIr6vBGgovhyfLD9PQKSQq6eg5g==,iv:VUTnjgcoqfVcZrDM1S2VqBdSCYXC6hj4lHx/mI8bw8s=,tag:QSj3c5OX6JqJxt6WnglAIw==,type:str]
+kind: Secret
+metadata:
+    name: repo
+    namespace: flux-system
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNmJhYUtTYnNRcTlvaXFE
+            WHNsWFVrUDMrZzUyTHJ4WGJTOU4rL29pRmtZCkNqRGVYa0hOWWljSThsUHlDSnVD
+            UGpBcS9UZDU2Q2NMOEtCaC9qcnREY0EKLS0tIERpQ01LVnh5dm5wRjFnUVlXWmxr
+            OUYvK29RUXNjeE02Q1l6TDZaNzhSNG8K5JPUi2txe31/cgLF0+WnEDmSpgDhMGdv
+            CDP4b7O0VpN32sE3t19cFeuZ38oS/kn0d4Lsw4eu7L+uuZheq2PN0Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MkJOdlF2YVVES3ZnTm1t
+            QXJLSUF6OWJrWmhOamVOK2JOY2lWdXFxT1h3CnRkOHpCY2dRU2xLRzdCKzVHY2R3
+            ZUdBTldwWVRYNkN0SUpiQjJTL2h5UzQKLS0tIEpXTWRNbTh2YW13V0psVzU0Zkxo
+            RE5SSzI4MmdOWGhBTGNzR2NPeHArSHcK8sOiSL6tfAT6KFLkFy0NpRuiVbFayJPR
+            vtki2eku7b0MKsQKCv/JPwSdOa7q/8Mxngiajxqwae0nObETSR+2TA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-15T00:11:25Z"
+    mac: ENC[AES256_GCM,data:xXPnZ5DP90FtT7yDUOPAMHl7vXgFM8JEnm/mpozB5/I4f3xxGP9b3RVfK3zESgqHREVUoD/hIQaTCwYHeqqWKwB7yQxc4ZuMKlTJ11iw0R8vsbj0Lk/a8v0kzCx5CDoTcvZE78go8LtIfYVxBKvcwP9ZN0Q9RuR235RVMW5Rz5M=,iv:oS9OUiyhliHzl1NEgfFr+eEfmgXlMX7VeeOcE382p1k=,tag:w6t9lNHqUYAFcEI3E4UBcQ==,type:str]
+    pgp:
+        - created_at: "2025-12-09T02:34:13Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAAxzvoy2eJdqO5p12H8PzOqp6viq2c6G8VGULDOOWUk7VG
+            DTfzEjOTjnGooz1dMHb0MdYGm5DVyuxp+6AW/i5XZmPSiV1fWuROUFaf9qb+EcVS
+            mq7Csor0MKbQAns2C7xWe1AZq73AL1cXsWAWOvNuAKnP510nLds08FHAUhirylkl
+            X2Jv/xys+gaY/XpyvkIPyRKfCfO1IzwjHy1OiIkvx+QZWaEjm5psP262ckZlMl+R
+            nf3rF/ZNzyo2Nli1wnUPKtcCXanfZXuDadgUlc+9ISMB2UEFlUC8lvQngXPwTdmN
+            etXYvy/OI2Hyx5ynVvewAGLSHhwOlCjH7/6xGvTOhFzVsi/Tk4TsJTKZu25/j0Jy
+            pgZ/WNPQegq0o/vxxiyU+OJdDv8SDew6f5mjgfD1wikvMDBBgW3TLrNnlQMqSPpr
+            KSLLlgkLkie21F0YVlDh3MK5MDWySZC6VZfuD/kZIpsqeatka3IRDsRRvFV6teGM
+            cJ1eNFRDAXnI9GB8KpuRH9sYLVzgQdmLBfP8ksadci/ykjtQp/92mwf7nMThT+09
+            cYG36Y8G5HCly0ZdY+Zl1Evw43W8vp5Va5Zc8EWvz51kk03gQd7jlOjGFgCarSOv
+            w3jKC1CUVKQi+JIfeufYb6vPWvYWJKTvP2yikw46nwoHkPixeRhelR27qWLWu3jS
+            XAF+wgVNKSJPC94eVbRBjpj51IN/gyj051ria/uw++Z8SuHVGiqT1B+gTd6pyVSU
+            cHGRCPkIC0g75q9Fgmxfob9hAkybGxJ+fWOzBTpmnzG+1VScNAYTbyXiOFVo
+            =fVSN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/configs/alerts/telegram/alert.yaml
+++ b/configs/alerts/telegram/alert.yaml
@@ -0,0 +1,18 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: telegram
+  namespace: flux-system
+spec:
+  providerRef:
+    name: telegram
+  eventSeverity: error
+  eventSources:
+    - kind: GitRepository
+      name: "*"
+    - kind: Kustomization
+      name: "*"
+    - kind: HelmRepository
+      name: "*"
+    - kind: HelmRelease
+      name: "*"
--- a/configs/alerts/telegram/kustomization.yaml
+++ b/configs/alerts/telegram/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret-telegram.enc.yaml
+  - provider.yaml
+  - alert.yaml
--- a/configs/alerts/telegram/provider.yaml
+++ b/configs/alerts/telegram/provider.yaml
@@ -0,0 +1,11 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: telegram
+  namespace: flux-system
+spec:
+  type: telegram
+  # TODO: Would be nice if this was not hard coded
+  channel: "-4748034121"
+  secretRef:
+    name: telegram
--- a/configs/alerts/telegram/secret-telegram.enc.yaml
+++ b/configs/alerts/telegram/secret-telegram.enc.yaml
@@ -0,0 +1,52 @@
+apiVersion: v1
+stringData:
+    token: ENC[AES256_GCM,data:azBE1dVSbYNZzpagsQrmEoYGIGFn/URQ3VrksQRhUKuJyCrc6o6360u/k38NKg==,iv:iYpqz6Ndh5QESa8yGPU1nKD8/sb3dgloNLa3HFDihnU=,tag:2w0eslkZQOIb+qPYgNmHIQ==,type:str]
+kind: Secret
+metadata:
+    name: telegram
+    namespace: flux-system
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsN2VGQjBoZUp3TjU4YW1W
+            cnJ5QW9aY1FtdUFvcENZRnV5cXVjMkhEOFFjCkFMTm4yUjFZOG56YUVXRkE3SndI
+            eFQ2clF1ZDZicUtCNk9JYW15US9XSDQKLS0tIExHVDdsaVdyVktobWRaUmZPK2V1
+            NSsyVFRaeFJ6NUhOaDdPZy9yOVhVUXMK32YSPm1nDMvCFLbTTVcy3HdSVueUP2lS
+            dNr/myyFX3s8dkXHXJDj14XBu5O3Fk0ktHa2bFfvx+wosHPixG4TqQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0cDlERWorN1hXNlMxUnVp
+            TjZGcis4eVRBWWZVUG5nRzEwMy9Jd21DSFFvCk1ld2tEZWJvV3pHMmVsb2lDRk53
+            aitnbmJpaFE5NGxGd0N3VSt1N2N2WHcKLS0tIDRKMTN0bk9hcUNTNWpsaEMrY01R
+            ckU4YlF3Z0JXTGRaVnJnd1ZITHU3RzQKk/kNn84JwoWl/77wEyeljrTkYSTBSpAW
+            fDn4ddsrmays2kEb8ux0ZbqsNNrt3IhDYd0urks20INvS9BkXJMI0A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-09T01:52:28Z"
+    mac: ENC[AES256_GCM,data:EObi2Da0n+RpKOfpay2NQM140lniPUY12MNFQIw4wNlCS8EFzJHNrPk/SpFDOY5HqvT27wRfz//oTGVzt6+TNkfAU3GcGYuJZezwFvbAkkoRuVmGauZ/ZyfG8PmdPN1imYa2ajqaQW/gym06TbtaLaI54txeK0PE1z+oWXZIW14=,iv:fVU6mkfyuck/pu7ff5n2Gd6pGclLU7jt5Dy2vOOnctA=,tag:4JUDNvgVskKlAHlJ5MwsFA==,type:str]
+    pgp:
+        - created_at: "2025-12-09T01:52:28Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7pKPTYH5bqOARAAlVFcHIEsMcSUuPWKxOtpGBLdnWo/9d8GsQwUDsh9Kk8C
+            tLVJn8cXNGdvt28pmS22L3KDOX0o3WGNNWvZfe9D6cG4WPH1yug4axQoVTnMUpYE
+            a8nsqMRgfNdTkbDfOtU+EV4Aq9iMl2MVqy3D/Vc2MnPk/WvcQUGXd1viJJrOhBcP
+            S0mTDRQOUjdgrX4RIcinx2yQQgMTAiduxj0sSaK6BWEDaum50WjthV+/GlCz2hks
+            nf+BzY+MbCDFKMjfSbpdZhyQ0VvkV8Yu7UtoxaI6w9KUqH8zHjqaNjhELmLy2FKv
+            6kAiW/XUuR6BZTbo1MgLG4gJwQU6+pHELXAh/h+Qj+wX6agYOZNmQqAmQahnfQZ/
+            cy7mzGf4vQlMxeayOUdJVDbqhWlMpCVmGkWqtfBwAJKr7r7fjRP+VuZ06KyilGr0
+            NyibyKVp6+ostTXNlMmvTGBiQpNv+/9822PhFKN/ARde32igUmtnRiwoYyrZ644y
+            Y6BAmnEuu+mfpIDPODQ4gWP+t9vwuzBPTUP2DVqXgqHoOgK2HnGIeNtKh8PqPkG4
+            qPI/3b1LqN+yMOI9HU1fv2IUbRPksauNNq1rrK/9scasT1MqoKEBWjntdDJ7MuR6
+            RQ6S3xU8dyBW0jNe3JFa1dIvM+QlVysIpy8kCv81DeNDT/Yp8psTJXeBa25tcovS
+            XAHlK1OXm7zOchfPa46EWjbMMSwcIle9VVrJCAsjS2eFriOK8wMn3Awyl9V2zcEX
+            6F6+jzvVYUbxXZupCdJoZo7faaC8TyA10o2LxrcdFwLtjByVgVz3mYmpHVwQ
+            =BwkI
+            -----END PGP MESSAGE-----
+          fp: 1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/configs/artifacts.yaml
+++ b/configs/artifacts.yaml
@@ -19,3 +19,13 @@ spec:
      copy:
        - from: "@foundation/configs/certificates/**"
          to: "@artifact/"
+    - name: alerts
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/configs/alerts/**"
+          to: "@artifact/"
+    - name: longhorn-jobs
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/configs/longhorn-jobs/**"
+          to: "@artifact/"
--- a/configs/certificates/certificates.yaml
+++ b/configs/certificates/certificates.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
  interval: 1h
  retryInterval: 2m
-  timeout: 5m
+  timeout: 15m
  dependsOn:
    - name: letsencrypt
  sourceRef:
--- a/configs/letsencrypt/secret-cloudflare-token.enc.yaml
+++ b/configs/letsencrypt/secret-cloudflare-token.enc.yaml
@@ -11,43 +11,43 @@ sops:
        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZGVBS1dpRlVQemlRR2gv
-            WFQraFRxV1hGTVZ1UlNPeXV5Z1VTQ0o2QVFjCjZmYzh0dmhDczllU1pUdGs3Ti82
-            blBOZTAwSUVMTVlJcHNRNVA1NytTMk0KLS0tIGtwR0dYOUxOaUVWb041SXQ5cktU
-            b0QwUVJNVDBTUkcwcWxmV3R4Rm4wNjQKC/hMgUvkTlROHPiBZcJ1ALu2zqknkFhw
-            qDBjJmwpCApaLKrFMxgMEMySNbN2l04fnCQQtZ97ZH87C1lj5WFT8A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT1F1MWlqTHdOVUFPZURS
+            TjZzRm04KzJobHp2Vy8xNHVBUW5WMko1bFU0ClpHSUphVWdFTGFsaytMRE1PSkR0
+            UnVGVU84c2tmZ2tCTG5QTEJxOFdWMHcKLS0tIGNybUdXZS9QUlk5dk1PRFhtdXNQ
+            Y3ZjOG5wMjlXYWpqeUYyUVFQYmQwSEUKd09GwvJx55mznG0JT8baa9LkkWcNT/ux
+            p4qgxg9F9hHGRXNnrMNaYnEj8NV01cd4yXCha+C7IVL0MssBrmJW8Q==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOSDA1NkJGdUsyR3hUeG85
-            TUpldmk1V054SDNyNHdlVEhtM3NSMlBjc3hJCk9yQXd5ajl5VnFsZytMWHA5dlNN
-            Q2pxNHVMd01mMEwwT0pKVnBBYjByWXMKLS0tIE9uQ3pzMW90MEhZUGtxVUkrZFJH
-            VXJSejR2bzRLamdoemhSRkwwRGxnVDAKOVvuGT6ZO+JB33RrCF0oqyA0GXAznGOE
-            gT/7i9aMKuJfJr5RhfK1GY6JJf18mHt+jwM2epjtcFYzZpMjh2zjcg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaDQ0Mnp5NVV3Yi9uRkcw
+            MFJOTFEzVldBYUFXejg0d2pPYVAwYndWMVU0CkFpMVJxUkFwa1BDeTFLZnJwdEp5
+            a3R3VlNqZnkyODEyZ3U1ZEZIK3dJL2MKLS0tIFZoaml2cndVYmJCQ2JsRFlrWURy
+            SEFVKytlWDJnMmp1QTM2eGZuV3E1eUkKjfsfazFaec1x6EOkEht+GbBHSV/L4GUz
+            YpDx9vIMB2T0wUd5U6ecNdyea2HwYg4gzUtwzDf1AGYtoOv9doig3g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-01T01:33:08Z"
-    mac: ENC[AES256_GCM,data:9pXCN0JoIFc7OXJvJFBtd/BGP9aByPFq+8KKUqv0MKXVWJWXxzTzN8yoinxsPrw0KSLOJ98ieDIHj2ukVMpuOILOzDELArDsiP0/TAq387V9S7vx+Z2OnCSVuHoW97fvvqSxqhyAuZ8a4alNQ83TtOdZ2gK6VMxWMKizZWdpGeI=,iv:KaEJ6avIlBSTBSIdi/xDF249WEbzubLviBTaDHSwp5A=,tag:TbwJvDuYJY8EdL6yxekWzQ==,type:str]
+    lastmodified: "2025-12-09T02:35:32Z"
+    mac: ENC[AES256_GCM,data:4cprvZzT//nt0PHbJ+p46jnLjfiXF4VlaKA0p2bGKlXWoThvJd9lpUD8xVzXo860U5aGWzqIsdONRjuJcRY4zPz/mkgcRz+gZKkcOCtS2wDOUkk98n2EuwbbJ4+fBH+RbqtcZmocsiGPt6JOLPOPZHpe+t2iiFoBewFfLuND8PM=,iv:eFZ3mEPlEHOLvmWAaDepJjwaaHgcnGBw8v3FEFvOcVI=,tag:GL+bqXS1Qe+7BZEgLEYtNw==,type:str]
    pgp:
-        - created_at: "2025-12-01T01:33:08Z"
+        - created_at: "2025-12-09T02:35:37Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7pKPTYH5bqOAQ//XvRMEPLhIX1a7oAq5bBY/rl8o5NiBl2z78Bi2ddZ5Fnt
-            J1f9syNMfYCrtkrZ5dgGcbELYcdP0QFajyDYWDViz4elmdqsvdzIPY7DAdzj7NQU
-            gZhoJyBSK5EP4x/89fFdd9zR54nVH8K9036bp4KEGzu611YxdwHT9EtheTSM12S/
-            ZVvVrN0wq6ld9NH0PxEimGL1GhGn+dpVczN1CL1Qh81dz1FpvADd7AJQ7JprkbN8
-            SBSG+omRBhuZaoXTurihgL702q/zzX0/ZyQ24ONsaQGWXJmdXx+lRBgfmWPL9w8b
-            6tcAwfCyOw6QTaTPipOvtHG3M6rhl3AxPWFm2eIv1oXtFGMAbmxOCDfGzy+Tkuva
-            JdlObrgU1v9CAxeKSeqetEZWHY/kPiUSlRUD+C4sHxJBO0MEzxQzNBlh7NgGBOPh
-            Ldum/jZbcCJCOyPXS1Q4bW89gwaTVTeOVpadSwwsJap8+13E2sar3BES2tIGiGTZ
-            e44S5pS/ycSMLQHxmPgyVnMTtMcRU5qtmEo6hjhrB05bppGQFAiCDilM6PHFJ+oN
-            1IDOXCoqiDwS2Yxm7IQrw/7WvHqngTwwJyxjy6q4bgocgrnSqKzqoE0pBZvX1oGN
-            1Num+9u+XwWAb2m9QUJAiWy9R16AgDD9Gp3ekArwztlMSWrXnIGz/zUL+ehh3avS
-            XgH1P2d8+QPjhrXq9Hyu9wANeL1Z1qQFKTTe9ReqRUc+B4Ts8ACf26FYSneksgJd
-            2lyesmgmrGlFzGCVdPCBOuCPCicP/w28WzYUI7amzraPa5kHEhl3wzkQiTE710c=
-            =XaqU
+            hQIMA51kG++kLewoARAAjNHNqLtH4I+qJoW+/DtUhSCy66V9gznDeqWwwhERaGCN
+            LNNN43m7zD5rGei4G3dK12xyacMVExbjGxMQironUG/DdNw4dmYpZlktOxb8ec8Y
+            NK669WI8TC1vltLaET/NLEXih0zKEEf5DO1xKEdTFpU4hG8yGg6X82vVHhnUTiaP
+            ChtnjaOqPFz3HTk8oa2HvhQvYgZB1FCEI+jrCsxZVHp8j+6iN9NtxEFrpIcDsYVN
+            XpYupukU3kymBHOYx3tptiufR4riOr7RnmNu+dEvJSsaOjax4E8l3k48jEBbNcHQ
+            CVQf2qf0iRcOQPNHrcy40QKlxUUacO2OJa2aq6G1rceaZosqE09PJmQZUfKi4zYq
+            qho590mtdfdcub7h3xGVL9i84fdGpkL+BEJCLvf0PSj0VaVJDND2Mibqo+S9lGPb
+            6dJIIaMeh1Dm5dK7uMBut7+dv4GPO+IljuwXjAWh0tDIUx7P7gWsLiUjJ/rhFw+f
+            7lSY2sRAzXcEGIbBZc+K0CdNx1fbHaagL4ENjEIoTr6Uxn5Qepxv+iXhYsZzJaOR
+            AG7v8KvlXAW5DcmndWYg8eyTc6+76iiFNDPCVlXaugcmzlqq87fObre2ZwBIq6re
+            KZaHRz8gwEeXxZAOZEMhoRTNJkyQr2DiwDSa0CzW96N/VcbukjSPFzTRrO+eZEvS
+            XgGfoHUY+OWLWnxI3/Cu81DIAt0TRBtTN5jL1h9C450heaHfJ+wGC5hf/t1I6GTO
+            N6NqKiYRCNCepFQASuOqyzTi8jyNvwgbOeFL/UYGpzNX7Y8CIawVSfjncuRtTmQ=
+            =ta8P
            -----END PGP MESSAGE-----
-          fp: 1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
--- a/configs/longhorn-jobs/kustomization.yaml
+++ b/configs/longhorn-jobs/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - recurring-job-backup.yaml
+  - recurring-job-snapshot.yaml
+  - recurring-job-trim.yaml
--- a/configs/longhorn-jobs/longhorn-jobs.yaml
+++ b/configs/longhorn-jobs/longhorn-jobs.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn-jobs
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: longhorn
+  sourceRef:
+    kind: ExternalArtifact
+    name: longhorn-jobs
+  prune: true
+  wait: true
--- a/configs/longhorn-jobs/recurring-job-backup.yaml
+++ b/configs/longhorn-jobs/recurring-job-backup.yaml
@@ -0,0 +1,14 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: backup
+  namespace: longhorn-system
+spec:
+  cron: "0 5 * * *"
+  task: "backup"
+  retain: 14
+  concurrency: 1
+  groups:
+    - default
+  parameters:
+    full-backup-interval: "7"
--- a/configs/longhorn-jobs/recurring-job-snapshot.yaml
+++ b/configs/longhorn-jobs/recurring-job-snapshot.yaml
@@ -0,0 +1,12 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: snapshot
+  namespace: longhorn-system
+spec:
+  cron: "0 */12 * * *"
+  task: "snapshot"
+  retain: 14
+  concurrency: 1
+  groups:
+    - default
--- a/configs/longhorn-jobs/recurring-job-trim.yaml
+++ b/configs/longhorn-jobs/recurring-job-trim.yaml
@@ -0,0 +1,11 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: trim
+  namespace: longhorn-system
+spec:
+  cron: "0 0 7 * *"
+  task: "filesystem-trim"
+  concurrency: 1
+  groups:
+    - default
--- a/controllers/artifacts.yaml
+++ b/controllers/artifacts.yaml
@@ -19,3 +19,28 @@ spec:
      copy:
        - from: "@foundation/controllers/cert-manager/**"
          to: "@artifact/"
+    - name: spegel
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/spegel/**"
+          to: "@artifact/"
+    - name: openebs
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/openebs/**"
+          to: "@artifact/"
+    - name: longhorn
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/longhorn/**"
+          to: "@artifact/"
+    - name: local-path-provisioner
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/local-path-provisioner**"
+          to: "@artifact/"
+    - name: cnpg
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/cnpg/**"
+          to: "@artifact/"
--- a/controllers/cert-manager/oci-repository.yaml
+++ b/controllers/cert-manager/oci-repository.yaml
@@ -10,4 +10,4 @@ spec:
    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
    operation: copy
  ref:
-    semver: "1.x"
+    semver: "1.19.x"
--- a/controllers/cilium/base/helm-release.yaml
+++ b/controllers/cilium/base/helm-release.yaml
@@ -17,7 +17,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      version: "1.x"
+      version: "1.18.x"
      sourceRef:
        kind: HelmRepository
        name: cilium
--- a/controllers/cnpg/base/helm-release.yaml
+++ b/controllers/cnpg/base/helm-release.yaml
@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cnpg
+  namespace: cnpg-system
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: cloudnative-pg
+      version: "0.27.x"
+      sourceRef:
+        kind: HelmRepository
+        name: cnpg
+      interval: 24h
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base
+    - kind: ConfigMap
+      name: values-overlay
+      optional: true
--- a/controllers/cnpg/base/helm-repository.yaml
+++ b/controllers/cnpg/base/helm-repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cnpg
+  namespace: cnpg-system
+spec:
+  interval: 24h
+  url: https://cloudnative-pg.github.io/charts
--- a/controllers/cnpg/base/kustomization.yaml
+++ b/controllers/cnpg/base/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: cnpg
+    files:
+      - values.yaml
--- a/controllers/cnpg/base/name-reference.yaml
+++ b/controllers/cnpg/base/name-reference.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
--- a/controllers/cnpg/base/namespace.yaml
+++ b/controllers/cnpg/base/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cnpg-system
--- a/controllers/cnpg/base/values.yaml
+++ b/controllers/cnpg/base/values.yaml
--- a/controllers/cnpg/cnpg.yaml
+++ b/controllers/cnpg/cnpg.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cnpg
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: cpng
+  path: ./${cluster_env}
+  prune: true
+  wait: true
--- a/controllers/cnpg/production/kustomization.yaml
+++ b/controllers/cnpg/production/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: cnpg
+    files:
+      - values.yaml
--- a/controllers/cnpg/production/values.yaml
+++ b/controllers/cnpg/production/values.yaml
@@ -0,0 +1 @@
+replicaCount: 2
--- a/controllers/cnpg/staging/kustomization.yaml
+++ b/controllers/cnpg/staging/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: cnpg
+    files:
+      - values.yaml
--- a/controllers/cnpg/staging/values.yaml
+++ b/controllers/cnpg/staging/values.yaml
@@ -0,0 +1 @@
+replicaCount: 1
--- a/controllers/local-path-provisioner/kustomization.yaml
+++ b/controllers/local-path-provisioner/kustomization.yaml
@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - github.com/rancher/local-path-provisioner/deploy?ref=v0.0.32
+patches:
+  - patch: |-
+      kind: ConfigMap
+      apiVersion: v1
+      metadata:
+        name: local-path-config
+        namespace: local-path-storage
+      data:
+        config.json: |-
+          {
+                  "nodePathMap":[
+                  {
+                          "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
+                          "paths":["/var/mnt/local-path-provisioner"]
+                  }
+                  ]
+          }
+  - patch: |-
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: local-path-storage
+        labels:
+          pod-security.kubernetes.io/enforce: privileged
--- a/controllers/local-path-provisioner/local-path-provisioner.yaml
+++ b/controllers/local-path-provisioner/local-path-provisioner.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: local-path-provisioner
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: local-path-provisioner
+  path: ./
+  prune: true
+  wait: true
--- a/controllers/longhorn/base/helm-release.yaml
+++ b/controllers/longhorn/base/helm-release.yaml
@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: longhorn
+      version: "1.10.x"
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+      interval: 24h
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base
+    - kind: ConfigMap
+      name: values-overlay
+      optional: true
--- a/controllers/longhorn/base/helm-repository.yaml
+++ b/controllers/longhorn/base/helm-repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 24h
+  url: https://charts.longhorn.io
--- a/controllers/longhorn/base/kustomization.yaml
+++ b/controllers/longhorn/base/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: longhorn-system
+    files:
+      - values.yaml
--- a/controllers/longhorn/base/name-reference.yaml
+++ b/controllers/longhorn/base/name-reference.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
--- a/controllers/longhorn/base/namespace.yaml
+++ b/controllers/longhorn/base/namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
+    pod-security.kubernetes.io/audit: privileged
--- a/controllers/longhorn/base/values.yaml
+++ b/controllers/longhorn/base/values.yaml
@@ -0,0 +1,13 @@
+defaultSettings:
+  defaultDataPath: /var/mnt/longhorn
+  replicaAutoBalance: best-effort
+  defaultDataLocality: best-effort
+  freezeFilesystemForSnapshot: true
+  storageReservedPercentageForDefaultDisk: 0
+  storageMinimalAvailablePercentage: 10
+  storageOverProvisioningPercentage: 25
+persistence:
+  defaultDataLocality: best-effort
+defaultBackupStore:
+  backupTarget: s3://longhorn-backup@garage/
+  backupTargetCredentialSecret: s3-garage
--- a/controllers/longhorn/longhorn.yaml
+++ b/controllers/longhorn/longhorn.yaml
@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: longhorn
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  path: ./${cluster_env}
+  prune: true
+  wait: true
--- a/controllers/longhorn/production/kustomization.yaml
+++ b/controllers/longhorn/production/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: longhorn-system
+    files:
+      - values.yaml
--- a/controllers/longhorn/production/values.yaml
+++ b/controllers/longhorn/production/values.yaml
@@ -0,0 +1,4 @@
+defaultSettings:
+  defaultReplicaCount: 2
+persistence:
+  defaultClassReplicaCount: 2
--- a/controllers/longhorn/staging/kustomization.yaml
+++ b/controllers/longhorn/staging/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secret-s3-garage.yaml
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: longhorn-system
+    files:
+      - values.yaml
--- a/controllers/longhorn/staging/secret-s3-garage.yaml
+++ b/controllers/longhorn/staging/secret-s3-garage.yaml
@@ -0,0 +1,56 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-garage
+    namespace: longhorn-system
+type: Opaque
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Z61V0zZ0sApVz8gP+Yc6LTKQcW0jdRaWXa4=,iv:SpLgdgI4Yc48NYNb9wE3C28ixBg8vu5tTf7bUENMfrE=,tag:DDbqGvSbcpDxzPUpHbhLKA==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:FK/BS+rXAD2sXND6zHJ2G/GIcFIe01kL/1WP1RJNX86Jc9aCra26+FQQ4zU0Uanh8tQqSzf2qMwK1uMkr/SI4A==,iv:36UsdtiRN3fPr+HtRHSad7oEetiJh56sq+Ypyq/W5FA=,tag:rYHPuCOCHA+YoEKdfN8P0g==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:2iB2cf1E4ucxJEDGRpe2wiX9yMCZA1A=,iv:c+izWJ+i7lHybZlU9yKS5Q+Zj9lOGysCbewz9iRud3M=,tag:UX4zr9dguSAUBqm1xJnNJQ==,type:str]
+    AWS_DEFAULT_REGION: ENC[AES256_GCM,data:x8oa5+m6,iv:w7Ko7PithIEtO6UoW063hxpqcctD4kBw3dCGKYlmQxU=,tag:HskDJefMh4EGKVp8gf9eCw==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
+            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
+            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
+            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
+            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
+            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
+            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
+            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
+            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-13T00:39:37Z"
+    mac: ENC[AES256_GCM,data:H63bqddFd/4v4mGtam/wLa2PX6gn6xeHJMiETdbbrtUjPvspo8soHtFrtMjp1OoU4wYQbYs/0Dr4MRvSeEwVCrkYsOZeHkn8GecnrmqYqmn8eeL6fNSjoshO+eil6lBr0oWW9OPuzjN+avg/+Ucsl9HtnM+VbSIeDeO+7kGc6EI=,iv:DA7fugq5zibsHhbdKuepwHggmsqSmi9w4MIAOZnILvA=,tag:jsJxtFhSFzpZq9KZXCYN4A==,type:str]
+    pgp:
+        - created_at: "2025-12-11T23:56:15Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
+            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
+            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
+            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
+            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
+            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
+            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
+            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
+            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
+            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
+            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
+            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
+            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
+            =/yAN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/controllers/longhorn/staging/values.yaml
+++ b/controllers/longhorn/staging/values.yaml
@@ -0,0 +1,4 @@
+defaultSettings:
+  defaultReplicaCount: 1
+persistence:
+  defaultClassReplicaCount: 1
--- a/controllers/openebs/helm-release.yaml
+++ b/controllers/openebs/helm-release.yaml
@@ -0,0 +1,49 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openebs
+  namespace: openebs
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: openebs
+      version: "4.x"
+      sourceRef:
+        kind: HelmRepository
+        name: openebs
+      interval: 24h
+  values:
+    loki:
+      enabled: false
+    alloy:
+      enabled: false
+    mayastor:
+      etcd:
+        replicaCount: 1
+      nats:
+        cluster:
+          replicas: 1
+      eventing:
+        enabled: false
+      obs:
+        callhome:
+          enabled: false
+      csi:
+        node:
+          initContainers:
+            enabled: false
+    engines:
+      local:
+        lvm:
+          enabled: false
+        zfs:
+          enabled: false
--- a/controllers/openebs/helm-repository.yaml
+++ b/controllers/openebs/helm-repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: openebs
+  namespace: openebs
+spec:
+  interval: 24h
+  url: https://openebs.github.io/openebs
--- a/controllers/openebs/kustomization.yaml
+++ b/controllers/openebs/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
--- a/controllers/openebs/namespace.yaml
+++ b/controllers/openebs/namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openebs
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
+    pod-security.kubernetes.io/audit: privileged
--- a/controllers/openebs/openebs.yaml
+++ b/controllers/openebs/openebs.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openebs
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: openebs
+  path: ./
+  prune: true
+  wait: true
--- a/controllers/spegel/helm-release.yaml
+++ b/controllers/spegel/helm-release.yaml
@@ -0,0 +1,26 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: spegel
+      version: "0.5.x"
+      sourceRef:
+        kind: HelmRepository
+        name: spegel
+      interval: 24h
+  values:
+    spegel:
+      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
--- a/controllers/spegel/helm-repository.yaml
+++ b/controllers/spegel/helm-repository.yaml
@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  type: "oci"
+  interval: 24h
+  url: oci://ghcr.io/spegel-org/helm-charts
--- a/controllers/spegel/kustomization.yaml
+++ b/controllers/spegel/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
--- a/controllers/spegel/namespace.yaml
+++ b/controllers/spegel/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spegel
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
--- a/controllers/spegel/spegel.yaml
+++ b/controllers/spegel/spegel.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: spegel
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: spegel
+  path: ./
+  prune: true
+  wait: true
Author	SHA1	Message	Date
Dreaded_X	4bfa715948	feat: Added cnpg All checks were successful kustomization/flux-system/1b69816f reconciliation succeeded kustomization/spegel/1b69816f reconciliation succeeded	2025-12-15 03:13:39 +01:00
Dreaded_X	e2d685dcfe	chore: Set minor version for all controllers	2025-12-15 03:08:10 +01:00
Dreaded_X	8c7b939bfb	feat: Use single kustomization for all alerts	2025-12-15 03:08:10 +01:00
Dreaded_X	6090de51c4	feat: Added flux status to gitea commits	2025-12-15 03:08:10 +01:00
Dreaded_X	f005fab6f8	chore: Moved telegram alerts config	2025-12-15 03:08:10 +01:00
Dreaded_X	f10a7f430c	feat: Add longhorn backup job	2025-12-15 03:08:10 +01:00
Dreaded_X	c1d80adf8a	feat: Pin flux version in bootstrap script	2025-12-15 03:08:10 +01:00
Dreaded_X	8fc89fa643	chore: Added README with common issues	2025-12-15 03:08:09 +01:00
Flux	7cfc406e08	Add Flux v2.7.5 component manifests	2025-12-15 03:08:09 +01:00
Dreaded_X	d1ba82afc2	chore: Add 1 git-crypt collaborator New collaborators: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9 Tim Huizinga <tim@huizinga.dev>	2025-12-15 03:08:09 +01:00
Dreaded_X	a6680b2a01	feat: Added garage as default backup target	2025-12-15 03:08:09 +01:00
Dreaded_X	466f4244d7	chore: Adjusted certificate kustomization timeout	2025-12-15 03:08:09 +01:00
Dreaded_X	128ba4627c	chore: Update sops keys	2025-12-15 03:08:09 +01:00
Dreaded_X	f78fc3d8c1	chore: Typos ignore age encrypted blocks	2025-12-15 03:08:09 +01:00
Dreaded_X	7236d72e53	feat: Added telegram alerts	2025-12-15 03:08:09 +01:00
Dreaded_X	f2e9cede37	feat: Added local-path-provisioner	2025-12-15 03:08:09 +01:00
Dreaded_X	bdc35b8d45	feat: Separate config for production/testing	2025-12-15 03:00:02 +01:00
Dreaded_X	4c86c13942	feat: Switch to longhorn	2025-12-15 03:00:02 +01:00
Dreaded_X	02419996c4	feat: Testing on single node	2025-12-15 03:00:02 +01:00
Dreaded_X	92e7e9ebc5	feat: Added OpenEBS	2025-12-15 03:00:02 +01:00
Dreaded_X	39929c9a74	feat: Use pre-generated deploy key	2025-12-15 03:00:02 +01:00
Dreaded_X	1085275c76	chore: Added pre-commit hooks	2025-12-15 03:00:02 +01:00
Dreaded_X	9353408ed6	feat: Added spegel	2025-12-15 03:00:02 +01:00
				`@@ -0,0 +1 @@`
				`ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK59NC6hLyDf+9zeOQ0stZeay51UyUpoBgONh0xxJFIlgra5ojyhrrQVlfjcUqdLe5yijWU1nCxKpaFGDPMdNE4= flux@testing`