chore: Set minor version for all controllers

New collaborators:

    CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
        Tim Huizinga <tim@huizinga.dev>

.git-crypt/.gitattributes

@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary

.gitattributes

@@ -0,0 +1 @@
+deploy.key filter=git-crypt diff=git-crypt

.pre-commit-config.yaml

@@ -0,0 +1,28 @@
+default_install_hook_types: [pre-commit, commit-msg]
+exclude: gotk-.*.yaml
+repos:
+  - repo: builtin
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args:
+          - --allow-multiple-documents
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-executables-have-shebangs
+
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.40.0
+    hooks:
+      - id: typos
+
+  - repo: https://github.com/sirwart/ripsecrets
+    rev: v0.1.11
+    hooks:
+      - id: ripsecrets-system
+
+  - repo: https://github.com/crate-ci/committed
+    rev: v1.1.8
+    hooks:
+      - id: committed

.secretsignore

@@ -0,0 +1 @@
+deploy.key

.sops.yaml

@@ -2,7 +2,7 @@ creation_rules:
   - path_regex: .*.yaml
     encrypted_regex: ^(data|stringData)$
     pgp: >-
-      1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+      CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
     age: >-
       age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul,
       age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj

.typos.toml

@@ -0,0 +1,7 @@
+[default]
+extend-ignore-re = [
+  "(?Rm)^.*(#|//)\\s*spellchecker:disable-line$",
+  "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on",
+  "(#|//)\\s*spellchecker:ignore-next-line\\n.*",
+  "-{5}BEGIN AGE ENCRYPTED FILE-{5}(?:$|[^-]{63,}-{5}END)",
+]

README.md

@@ -0,0 +1,7 @@
+# SSH Key issues
+
+Here are some things to check when running into ssh key issues:
+
+- Make sure that known hosts only contains a key of type ecdsa-sha2-nistp256 otherwise flux will fail to connect to the repository over ssh.
+
+- Make sure the deploy key is read/write.

bootstrap.sh

@@ -4,6 +4,7 @@ root=$(git rev-parse --show-toplevel)
 
 tools=(talosctl cilium-cli yq helm)
 cilium_version=1.18.4
+flux_version=2.7.5
 
 for tool in "${tools[@]}"; do
 	command -v ${tool} > /dev/null || (echo "Missing: ${tool}" && exit -1)
@@ -58,6 +59,7 @@ if [ "${vip}" = "null" ]; then
 fi
 
 echo -n "Checking connection to ${bootstrap_ip}... "
+# spellchecker:ignore-next-line
 if nmap -Pn ${bootstrap_ip} -p 50000 | grep -q 'open'; then
 	echo "[Success]"
 else
@@ -67,6 +69,7 @@ fi
 
 count=0
 max_retries=20
+# spellchecker:ignore-next-line
 while ! nmap -Pn ${vip} -p 50000 | grep -q 'open' && [ ${count} -lt ${max_retries} ]; do
 	if [ $count -eq 0 ]; then
 		echo -n "Bootstrapping Kubernetes"
@@ -122,5 +125,10 @@ cilium-cli status --wait
 # cilium-cli connectivity test --namespace-labels pod-security.kubernetes.io/enforce=privileged
 
 echo "Bootstrapping flux..."
-flux bootstrap git --url ssh://git@huizinga.dev/infra/foundation --branch=main --path=clusters/${cluster_name} \
+flux bootstrap git \
-	--components-extra=source-watcher
+	--url ssh://git@huizinga.dev/infra/foundation \
+	--branch=main \
+	--private-key-file=clusters/${cluster_name}/deploy.key -s \
+	--path=clusters/${cluster_name} \
+	--components-extra=source-watcher \
+	--version v${flux_version}

clusters/testing/deploy.key.pub

@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK59NC6hLyDf+9zeOQ0stZeay51UyUpoBgONh0xxJFIlgra5ojyhrrQVlfjcUqdLe5yijWU1nCxKpaFGDPMdNE4= flux@testing

clusters/testing/flux-system/gotk-components.yaml

@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.7.3
+# Flux Version: v2.7.5
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller,source-watcher
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     pod-security.kubernetes.io/warn: restricted
     pod-security.kubernetes.io/warn-version: latest
   name: flux-system
@@ -19,7 +19,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: allow-egress
   namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: allow-scraping
   namespace: flux-system
 spec:
@@ -59,7 +59,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: allow-webhooks
   namespace: flux-system
 spec:
@@ -78,7 +78,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: critical-pods-flux-system
   namespace: flux-system
 spec:
@@ -98,7 +98,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +204,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
   name: flux-edit-flux-system
@@ -212,6 +212,7 @@ rules:
 - apiGroups:
   - notification.toolkit.fluxcd.io
   - source.toolkit.fluxcd.io
+  - source.extensions.fluxcd.io
   - helm.toolkit.fluxcd.io
   - image.toolkit.fluxcd.io
   - kustomize.toolkit.fluxcd.io
@@ -230,7 +231,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -239,6 +240,7 @@ rules:
 - apiGroups:
   - notification.toolkit.fluxcd.io
   - source.toolkit.fluxcd.io
+  - source.extensions.fluxcd.io
   - helm.toolkit.fluxcd.io
   - image.toolkit.fluxcd.io
   - kustomize.toolkit.fluxcd.io
@@ -255,7 +257,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: cluster-reconciler-flux-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -275,7 +277,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: crd-controller-flux-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -313,7 +315,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: buckets.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -1084,7 +1086,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: externalartifacts.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -1280,7 +1282,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: gitrepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -2234,7 +2236,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: helmcharts.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -2960,7 +2962,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: helmrepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -3591,7 +3593,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: ocirepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -4417,7 +4419,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: source-controller
   namespace: flux-system
 ---
@@ -4428,7 +4430,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: source-controller
   namespace: flux-system
@@ -4449,7 +4451,7 @@ metadata:
     app.kubernetes.io/component: source-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: source-controller
   namespace: flux-system
@@ -4470,7 +4472,7 @@ spec:
         app.kubernetes.io/component: source-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
     spec:
       containers:
       - args:
@@ -4493,7 +4495,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.7.3
+        image: ghcr.io/fluxcd/source-controller:v1.7.4
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -4557,7 +4559,7 @@ metadata:
     app.kubernetes.io/component: kustomize-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
   group: kustomize.toolkit.fluxcd.io
@@ -5927,7 +5929,7 @@ metadata:
     app.kubernetes.io/component: kustomize-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: kustomize-controller
   namespace: flux-system
 ---
@@ -5938,7 +5940,7 @@ metadata:
     app.kubernetes.io/component: kustomize-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: kustomize-controller
   namespace: flux-system
@@ -5957,7 +5959,7 @@ spec:
         app.kubernetes.io/component: kustomize-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
     spec:
       containers:
       - args:
@@ -5977,7 +5979,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.7.2
+        image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -6034,7 +6036,7 @@ metadata:
     app.kubernetes.io/component: helm-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: helmreleases.helm.toolkit.fluxcd.io
 spec:
   group: helm.toolkit.fluxcd.io
@@ -8665,7 +8667,7 @@ metadata:
     app.kubernetes.io/component: helm-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: helm-controller
   namespace: flux-system
 ---
@@ -8676,7 +8678,7 @@ metadata:
     app.kubernetes.io/component: helm-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: helm-controller
   namespace: flux-system
@@ -8695,7 +8697,7 @@ spec:
         app.kubernetes.io/component: helm-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
     spec:
       containers:
       - args:
@@ -8715,7 +8717,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.4.3
+        image: ghcr.io/fluxcd/helm-controller:v1.4.5
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -8772,7 +8774,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: alerts.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -9162,7 +9164,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: providers.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -9574,7 +9576,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: receivers.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -10051,7 +10053,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: notification-controller
   namespace: flux-system
 ---
@@ -10062,7 +10064,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: notification-controller
   namespace: flux-system
@@ -10083,7 +10085,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: webhook-receiver
   namespace: flux-system
@@ -10104,7 +10106,7 @@ metadata:
     app.kubernetes.io/component: notification-controller
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: notification-controller
   namespace: flux-system
@@ -10123,7 +10125,7 @@ spec:
         app.kubernetes.io/component: notification-controller
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
     spec:
       containers:
       - args:
@@ -10141,7 +10143,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.7.4
+        image: ghcr.io/fluxcd/notification-controller:v1.7.5
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -10203,7 +10205,7 @@ metadata:
     app.kubernetes.io/component: source-watcher
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: artifactgenerators.source.extensions.fluxcd.io
 spec:
   group: source.extensions.fluxcd.io
@@ -10496,7 +10498,7 @@ metadata:
     app.kubernetes.io/component: source-watcher
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
   name: source-watcher
   namespace: flux-system
 ---
@@ -10507,7 +10509,7 @@ metadata:
     app.kubernetes.io/component: source-watcher
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: source-watcher
   name: source-watcher
   namespace: flux-system
@@ -10528,7 +10530,7 @@ metadata:
     app.kubernetes.io/component: source-watcher
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
     control-plane: controller
   name: source-watcher
   namespace: flux-system
@@ -10549,7 +10551,7 @@ spec:
         app.kubernetes.io/component: source-watcher
         app.kubernetes.io/instance: flux-system
         app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
     spec:
       containers:
       - args:
@@ -10570,7 +10572,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/source-watcher:v2.0.2
+        image: ghcr.io/fluxcd/source-watcher:v2.0.3
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:

clusters/testing/kustomization.yaml

@@ -2,9 +2,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - flux-system/
+
   - ../../controllers/artifacts.yaml
   - ../../controllers/cilium/cilium.yaml
   - ../../controllers/cert-manager/cert-manager.yaml
+  - ../../controllers/spegel/spegel.yaml
+  - ../../controllers/longhorn/longhorn.yaml
+  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
+
   - ../../configs/artifacts.yaml
   - ../../configs/letsencrypt/letsencrypt.yaml
   - ../../configs/certificates/certificates.yaml
+  - ../../configs/alerts/alerts.yaml
+  - ../../configs/longhorn-jobs/longhorn-jobs.yaml

committed.toml

@@ -0,0 +1,2 @@
+style = "conventional"
+ignore_author_re = "Flux"

configs/alerts/alerts.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: alerts
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: alerts
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  path: ./
+  prune: true
+  wait: true

configs/alerts/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - telegram
+  - repo

configs/alerts/repo/alert.yaml

@@ -0,0 +1,12 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: repo
+  namespace: flux-system
+spec:
+  providerRef:
+    name: repo
+  eventSeverity: info
+  eventSources:
+    - kind: Kustomization
+      name: "*"

configs/alerts/repo/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret-repo.enc.yaml
+  - provider.yaml
+  - alert.yaml

configs/alerts/repo/provider.yaml

@@ -0,0 +1,10 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: repo
+  namespace: flux-system
+spec:
+  type: gitea
+  address: https://git.huizinga.dev/infra/foundation
+  secretRef:
+    name: repo

configs/alerts/repo/secret-repo.enc.yaml

@@ -0,0 +1,52 @@
+apiVersion: v1
+stringData:
+    token: ENC[AES256_GCM,data:RZLFgmuin4hjJ1gSOFZLFeLpF/KjIr6vBGgovhyfLD9PQKSQq6eg5g==,iv:VUTnjgcoqfVcZrDM1S2VqBdSCYXC6hj4lHx/mI8bw8s=,tag:QSj3c5OX6JqJxt6WnglAIw==,type:str]
+kind: Secret
+metadata:
+    name: repo
+    namespace: flux-system
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNmJhYUtTYnNRcTlvaXFE
+            WHNsWFVrUDMrZzUyTHJ4WGJTOU4rL29pRmtZCkNqRGVYa0hOWWljSThsUHlDSnVD
+            UGpBcS9UZDU2Q2NMOEtCaC9qcnREY0EKLS0tIERpQ01LVnh5dm5wRjFnUVlXWmxr
+            OUYvK29RUXNjeE02Q1l6TDZaNzhSNG8K5JPUi2txe31/cgLF0+WnEDmSpgDhMGdv
+            CDP4b7O0VpN32sE3t19cFeuZ38oS/kn0d4Lsw4eu7L+uuZheq2PN0Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MkJOdlF2YVVES3ZnTm1t
+            QXJLSUF6OWJrWmhOamVOK2JOY2lWdXFxT1h3CnRkOHpCY2dRU2xLRzdCKzVHY2R3
+            ZUdBTldwWVRYNkN0SUpiQjJTL2h5UzQKLS0tIEpXTWRNbTh2YW13V0psVzU0Zkxo
+            RE5SSzI4MmdOWGhBTGNzR2NPeHArSHcK8sOiSL6tfAT6KFLkFy0NpRuiVbFayJPR
+            vtki2eku7b0MKsQKCv/JPwSdOa7q/8Mxngiajxqwae0nObETSR+2TA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-15T00:11:25Z"
+    mac: ENC[AES256_GCM,data:xXPnZ5DP90FtT7yDUOPAMHl7vXgFM8JEnm/mpozB5/I4f3xxGP9b3RVfK3zESgqHREVUoD/hIQaTCwYHeqqWKwB7yQxc4ZuMKlTJ11iw0R8vsbj0Lk/a8v0kzCx5CDoTcvZE78go8LtIfYVxBKvcwP9ZN0Q9RuR235RVMW5Rz5M=,iv:oS9OUiyhliHzl1NEgfFr+eEfmgXlMX7VeeOcE382p1k=,tag:w6t9lNHqUYAFcEI3E4UBcQ==,type:str]
+    pgp:
+        - created_at: "2025-12-09T02:34:13Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAAxzvoy2eJdqO5p12H8PzOqp6viq2c6G8VGULDOOWUk7VG
+            DTfzEjOTjnGooz1dMHb0MdYGm5DVyuxp+6AW/i5XZmPSiV1fWuROUFaf9qb+EcVS
+            mq7Csor0MKbQAns2C7xWe1AZq73AL1cXsWAWOvNuAKnP510nLds08FHAUhirylkl
+            X2Jv/xys+gaY/XpyvkIPyRKfCfO1IzwjHy1OiIkvx+QZWaEjm5psP262ckZlMl+R
+            nf3rF/ZNzyo2Nli1wnUPKtcCXanfZXuDadgUlc+9ISMB2UEFlUC8lvQngXPwTdmN
+            etXYvy/OI2Hyx5ynVvewAGLSHhwOlCjH7/6xGvTOhFzVsi/Tk4TsJTKZu25/j0Jy
+            pgZ/WNPQegq0o/vxxiyU+OJdDv8SDew6f5mjgfD1wikvMDBBgW3TLrNnlQMqSPpr
+            KSLLlgkLkie21F0YVlDh3MK5MDWySZC6VZfuD/kZIpsqeatka3IRDsRRvFV6teGM
+            cJ1eNFRDAXnI9GB8KpuRH9sYLVzgQdmLBfP8ksadci/ykjtQp/92mwf7nMThT+09
+            cYG36Y8G5HCly0ZdY+Zl1Evw43W8vp5Va5Zc8EWvz51kk03gQd7jlOjGFgCarSOv
+            w3jKC1CUVKQi+JIfeufYb6vPWvYWJKTvP2yikw46nwoHkPixeRhelR27qWLWu3jS
+            XAF+wgVNKSJPC94eVbRBjpj51IN/gyj051ria/uw++Z8SuHVGiqT1B+gTd6pyVSU
+            cHGRCPkIC0g75q9Fgmxfob9hAkybGxJ+fWOzBTpmnzG+1VScNAYTbyXiOFVo
+            =fVSN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

configs/alerts/telegram/alert.yaml

@@ -0,0 +1,18 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: telegram
+  namespace: flux-system
+spec:
+  providerRef:
+    name: telegram
+  eventSeverity: error
+  eventSources:
+    - kind: GitRepository
+      name: "*"
+    - kind: Kustomization
+      name: "*"
+    - kind: HelmRepository
+      name: "*"
+    - kind: HelmRelease
+      name: "*"

configs/alerts/telegram/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret-telegram.enc.yaml
+  - provider.yaml
+  - alert.yaml

configs/alerts/telegram/provider.yaml

@@ -0,0 +1,11 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: telegram
+  namespace: flux-system
+spec:
+  type: telegram
+  # TODO: Would be nice if this was not hard coded
+  channel: "-4748034121"
+  secretRef:
+    name: telegram

configs/alerts/telegram/secret-telegram.enc.yaml

@@ -0,0 +1,52 @@
+apiVersion: v1
+stringData:
+    token: ENC[AES256_GCM,data:azBE1dVSbYNZzpagsQrmEoYGIGFn/URQ3VrksQRhUKuJyCrc6o6360u/k38NKg==,iv:iYpqz6Ndh5QESa8yGPU1nKD8/sb3dgloNLa3HFDihnU=,tag:2w0eslkZQOIb+qPYgNmHIQ==,type:str]
+kind: Secret
+metadata:
+    name: telegram
+    namespace: flux-system
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsN2VGQjBoZUp3TjU4YW1W
+            cnJ5QW9aY1FtdUFvcENZRnV5cXVjMkhEOFFjCkFMTm4yUjFZOG56YUVXRkE3SndI
+            eFQ2clF1ZDZicUtCNk9JYW15US9XSDQKLS0tIExHVDdsaVdyVktobWRaUmZPK2V1
+            NSsyVFRaeFJ6NUhOaDdPZy9yOVhVUXMK32YSPm1nDMvCFLbTTVcy3HdSVueUP2lS
+            dNr/myyFX3s8dkXHXJDj14XBu5O3Fk0ktHa2bFfvx+wosHPixG4TqQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0cDlERWorN1hXNlMxUnVp
+            TjZGcis4eVRBWWZVUG5nRzEwMy9Jd21DSFFvCk1ld2tEZWJvV3pHMmVsb2lDRk53
+            aitnbmJpaFE5NGxGd0N3VSt1N2N2WHcKLS0tIDRKMTN0bk9hcUNTNWpsaEMrY01R
+            ckU4YlF3Z0JXTGRaVnJnd1ZITHU3RzQKk/kNn84JwoWl/77wEyeljrTkYSTBSpAW
+            fDn4ddsrmays2kEb8ux0ZbqsNNrt3IhDYd0urks20INvS9BkXJMI0A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-09T01:52:28Z"
+    mac: ENC[AES256_GCM,data:EObi2Da0n+RpKOfpay2NQM140lniPUY12MNFQIw4wNlCS8EFzJHNrPk/SpFDOY5HqvT27wRfz//oTGVzt6+TNkfAU3GcGYuJZezwFvbAkkoRuVmGauZ/ZyfG8PmdPN1imYa2ajqaQW/gym06TbtaLaI54txeK0PE1z+oWXZIW14=,iv:fVU6mkfyuck/pu7ff5n2Gd6pGclLU7jt5Dy2vOOnctA=,tag:4JUDNvgVskKlAHlJ5MwsFA==,type:str]
+    pgp:
+        - created_at: "2025-12-09T01:52:28Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7pKPTYH5bqOARAAlVFcHIEsMcSUuPWKxOtpGBLdnWo/9d8GsQwUDsh9Kk8C
+            tLVJn8cXNGdvt28pmS22L3KDOX0o3WGNNWvZfe9D6cG4WPH1yug4axQoVTnMUpYE
+            a8nsqMRgfNdTkbDfOtU+EV4Aq9iMl2MVqy3D/Vc2MnPk/WvcQUGXd1viJJrOhBcP
+            S0mTDRQOUjdgrX4RIcinx2yQQgMTAiduxj0sSaK6BWEDaum50WjthV+/GlCz2hks
+            nf+BzY+MbCDFKMjfSbpdZhyQ0VvkV8Yu7UtoxaI6w9KUqH8zHjqaNjhELmLy2FKv
+            6kAiW/XUuR6BZTbo1MgLG4gJwQU6+pHELXAh/h+Qj+wX6agYOZNmQqAmQahnfQZ/
+            cy7mzGf4vQlMxeayOUdJVDbqhWlMpCVmGkWqtfBwAJKr7r7fjRP+VuZ06KyilGr0
+            NyibyKVp6+ostTXNlMmvTGBiQpNv+/9822PhFKN/ARde32igUmtnRiwoYyrZ644y
+            Y6BAmnEuu+mfpIDPODQ4gWP+t9vwuzBPTUP2DVqXgqHoOgK2HnGIeNtKh8PqPkG4
+            qPI/3b1LqN+yMOI9HU1fv2IUbRPksauNNq1rrK/9scasT1MqoKEBWjntdDJ7MuR6
+            RQ6S3xU8dyBW0jNe3JFa1dIvM+QlVysIpy8kCv81DeNDT/Yp8psTJXeBa25tcovS
+            XAHlK1OXm7zOchfPa46EWjbMMSwcIle9VVrJCAsjS2eFriOK8wMn3Awyl9V2zcEX
+            6F6+jzvVYUbxXZupCdJoZo7faaC8TyA10o2LxrcdFwLtjByVgVz3mYmpHVwQ
+            =BwkI
+            -----END PGP MESSAGE-----
+          fp: 1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

configs/artifacts.yaml

@@ -19,3 +19,13 @@ spec:
       copy:
         - from: "@foundation/configs/certificates/**"
           to: "@artifact/"
+    - name: alerts
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/configs/alerts/**"
+          to: "@artifact/"
+    - name: longhorn-jobs
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/configs/longhorn-jobs/**"
+          to: "@artifact/"

configs/certificates/certificates.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   interval: 1h
   retryInterval: 2m
-  timeout: 5m
+  timeout: 15m
   dependsOn:
     - name: letsencrypt
   sourceRef:

configs/letsencrypt/secret-cloudflare-token.enc.yaml

@@ -11,43 +11,43 @@ sops:
         - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZGVBS1dpRlVQemlRR2gv
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT1F1MWlqTHdOVUFPZURS
-            WFQraFRxV1hGTVZ1UlNPeXV5Z1VTQ0o2QVFjCjZmYzh0dmhDczllU1pUdGs3Ti82
+            TjZzRm04KzJobHp2Vy8xNHVBUW5WMko1bFU0ClpHSUphVWdFTGFsaytMRE1PSkR0
-            blBOZTAwSUVMTVlJcHNRNVA1NytTMk0KLS0tIGtwR0dYOUxOaUVWb041SXQ5cktU
+            UnVGVU84c2tmZ2tCTG5QTEJxOFdWMHcKLS0tIGNybUdXZS9QUlk5dk1PRFhtdXNQ
-            b0QwUVJNVDBTUkcwcWxmV3R4Rm4wNjQKC/hMgUvkTlROHPiBZcJ1ALu2zqknkFhw
+            Y3ZjOG5wMjlXYWpqeUYyUVFQYmQwSEUKd09GwvJx55mznG0JT8baa9LkkWcNT/ux
-            qDBjJmwpCApaLKrFMxgMEMySNbN2l04fnCQQtZ97ZH87C1lj5WFT8A==
+            p4qgxg9F9hHGRXNnrMNaYnEj8NV01cd4yXCha+C7IVL0MssBrmJW8Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOSDA1NkJGdUsyR3hUeG85
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaDQ0Mnp5NVV3Yi9uRkcw
-            TUpldmk1V054SDNyNHdlVEhtM3NSMlBjc3hJCk9yQXd5ajl5VnFsZytMWHA5dlNN
+            MFJOTFEzVldBYUFXejg0d2pPYVAwYndWMVU0CkFpMVJxUkFwa1BDeTFLZnJwdEp5
-            Q2pxNHVMd01mMEwwT0pKVnBBYjByWXMKLS0tIE9uQ3pzMW90MEhZUGtxVUkrZFJH
+            a3R3VlNqZnkyODEyZ3U1ZEZIK3dJL2MKLS0tIFZoaml2cndVYmJCQ2JsRFlrWURy
-            VXJSejR2bzRLamdoemhSRkwwRGxnVDAKOVvuGT6ZO+JB33RrCF0oqyA0GXAznGOE
+            SEFVKytlWDJnMmp1QTM2eGZuV3E1eUkKjfsfazFaec1x6EOkEht+GbBHSV/L4GUz
-            gT/7i9aMKuJfJr5RhfK1GY6JJf18mHt+jwM2epjtcFYzZpMjh2zjcg==
+            YpDx9vIMB2T0wUd5U6ecNdyea2HwYg4gzUtwzDf1AGYtoOv9doig3g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-01T01:33:08Z"
+    lastmodified: "2025-12-09T02:35:32Z"
-    mac: ENC[AES256_GCM,data:9pXCN0JoIFc7OXJvJFBtd/BGP9aByPFq+8KKUqv0MKXVWJWXxzTzN8yoinxsPrw0KSLOJ98ieDIHj2ukVMpuOILOzDELArDsiP0/TAq387V9S7vx+Z2OnCSVuHoW97fvvqSxqhyAuZ8a4alNQ83TtOdZ2gK6VMxWMKizZWdpGeI=,iv:KaEJ6avIlBSTBSIdi/xDF249WEbzubLviBTaDHSwp5A=,tag:TbwJvDuYJY8EdL6yxekWzQ==,type:str]
+    mac: ENC[AES256_GCM,data:4cprvZzT//nt0PHbJ+p46jnLjfiXF4VlaKA0p2bGKlXWoThvJd9lpUD8xVzXo860U5aGWzqIsdONRjuJcRY4zPz/mkgcRz+gZKkcOCtS2wDOUkk98n2EuwbbJ4+fBH+RbqtcZmocsiGPt6JOLPOPZHpe+t2iiFoBewFfLuND8PM=,iv:eFZ3mEPlEHOLvmWAaDepJjwaaHgcnGBw8v3FEFvOcVI=,tag:GL+bqXS1Qe+7BZEgLEYtNw==,type:str]
     pgp:
-        - created_at: "2025-12-01T01:33:08Z"
+        - created_at: "2025-12-09T02:35:37Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7pKPTYH5bqOAQ//XvRMEPLhIX1a7oAq5bBY/rl8o5NiBl2z78Bi2ddZ5Fnt
+            hQIMA51kG++kLewoARAAjNHNqLtH4I+qJoW+/DtUhSCy66V9gznDeqWwwhERaGCN
-            J1f9syNMfYCrtkrZ5dgGcbELYcdP0QFajyDYWDViz4elmdqsvdzIPY7DAdzj7NQU
+            LNNN43m7zD5rGei4G3dK12xyacMVExbjGxMQironUG/DdNw4dmYpZlktOxb8ec8Y
-            gZhoJyBSK5EP4x/89fFdd9zR54nVH8K9036bp4KEGzu611YxdwHT9EtheTSM12S/
+            NK669WI8TC1vltLaET/NLEXih0zKEEf5DO1xKEdTFpU4hG8yGg6X82vVHhnUTiaP
-            ZVvVrN0wq6ld9NH0PxEimGL1GhGn+dpVczN1CL1Qh81dz1FpvADd7AJQ7JprkbN8
+            ChtnjaOqPFz3HTk8oa2HvhQvYgZB1FCEI+jrCsxZVHp8j+6iN9NtxEFrpIcDsYVN
-            SBSG+omRBhuZaoXTurihgL702q/zzX0/ZyQ24ONsaQGWXJmdXx+lRBgfmWPL9w8b
+            XpYupukU3kymBHOYx3tptiufR4riOr7RnmNu+dEvJSsaOjax4E8l3k48jEBbNcHQ
-            6tcAwfCyOw6QTaTPipOvtHG3M6rhl3AxPWFm2eIv1oXtFGMAbmxOCDfGzy+Tkuva
+            CVQf2qf0iRcOQPNHrcy40QKlxUUacO2OJa2aq6G1rceaZosqE09PJmQZUfKi4zYq
-            JdlObrgU1v9CAxeKSeqetEZWHY/kPiUSlRUD+C4sHxJBO0MEzxQzNBlh7NgGBOPh
+            qho590mtdfdcub7h3xGVL9i84fdGpkL+BEJCLvf0PSj0VaVJDND2Mibqo+S9lGPb
-            Ldum/jZbcCJCOyPXS1Q4bW89gwaTVTeOVpadSwwsJap8+13E2sar3BES2tIGiGTZ
+            6dJIIaMeh1Dm5dK7uMBut7+dv4GPO+IljuwXjAWh0tDIUx7P7gWsLiUjJ/rhFw+f
-            e44S5pS/ycSMLQHxmPgyVnMTtMcRU5qtmEo6hjhrB05bppGQFAiCDilM6PHFJ+oN
+            7lSY2sRAzXcEGIbBZc+K0CdNx1fbHaagL4ENjEIoTr6Uxn5Qepxv+iXhYsZzJaOR
-            1IDOXCoqiDwS2Yxm7IQrw/7WvHqngTwwJyxjy6q4bgocgrnSqKzqoE0pBZvX1oGN
+            AG7v8KvlXAW5DcmndWYg8eyTc6+76iiFNDPCVlXaugcmzlqq87fObre2ZwBIq6re
-            1Num+9u+XwWAb2m9QUJAiWy9R16AgDD9Gp3ekArwztlMSWrXnIGz/zUL+ehh3avS
+            KZaHRz8gwEeXxZAOZEMhoRTNJkyQr2DiwDSa0CzW96N/VcbukjSPFzTRrO+eZEvS
-            XgH1P2d8+QPjhrXq9Hyu9wANeL1Z1qQFKTTe9ReqRUc+B4Ts8ACf26FYSneksgJd
+            XgGfoHUY+OWLWnxI3/Cu81DIAt0TRBtTN5jL1h9C450heaHfJ+wGC5hf/t1I6GTO
-            2lyesmgmrGlFzGCVdPCBOuCPCicP/w28WzYUI7amzraPa5kHEhl3wzkQiTE710c=
+            N6NqKiYRCNCepFQASuOqyzTi8jyNvwgbOeFL/UYGpzNX7Y8CIawVSfjncuRtTmQ=
-            =XaqU
+            =ta8P
             -----END PGP MESSAGE-----
-          fp: 1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

configs/longhorn-jobs/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - recurring-job-backup.yaml
+  - recurring-job-snapshot.yaml
+  - recurring-job-trim.yaml

configs/longhorn-jobs/longhorn-jobs.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn-jobs
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: longhorn
+  sourceRef:
+    kind: ExternalArtifact
+    name: longhorn-jobs
+  prune: true
+  wait: true

configs/longhorn-jobs/recurring-job-backup.yaml

@@ -0,0 +1,14 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: backup
+  namespace: longhorn-system
+spec:
+  cron: "0 5 * * *"
+  task: "backup"
+  retain: 14
+  concurrency: 1
+  groups:
+    - default
+  parameters:
+    full-backup-interval: "7"

configs/longhorn-jobs/recurring-job-snapshot.yaml

@@ -0,0 +1,12 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: snapshot
+  namespace: longhorn-system
+spec:
+  cron: "0 */12 * * *"
+  task: "snapshot"
+  retain: 14
+  concurrency: 1
+  groups:
+    - default

configs/longhorn-jobs/recurring-job-trim.yaml

@@ -0,0 +1,11 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: trim
+  namespace: longhorn-system
+spec:
+  cron: "0 0 7 * *"
+  task: "filesystem-trim"
+  concurrency: 1
+  groups:
+    - default

controllers/artifacts.yaml

@@ -19,3 +19,23 @@ spec:
       copy:
         - from: "@foundation/controllers/cert-manager/**"
           to: "@artifact/"
+    - name: spegel
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/spegel/**"
+          to: "@artifact/"
+    - name: openebs
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/openebs/**"
+          to: "@artifact/"
+    - name: longhorn
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/longhorn/**"
+          to: "@artifact/"
+    - name: local-path-provisioner
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/local-path-provisioner**"
+          to: "@artifact/"

controllers/cert-manager/oci-repository.yaml

@@ -10,4 +10,4 @@ spec:
     mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
     operation: copy
   ref:
-    semver: "1.x"
+    semver: "1.19.x"

controllers/cilium/base/helm-release.yaml

@@ -17,7 +17,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: "1.x"
+      version: "1.18.x"
       sourceRef:
         kind: HelmRepository
         name: cilium

controllers/local-path-provisioner/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - github.com/rancher/local-path-provisioner/deploy?ref=v0.0.32
+patches:
+  - patch: |-
+      kind: ConfigMap
+      apiVersion: v1
+      metadata:
+        name: local-path-config
+        namespace: local-path-storage
+      data:
+        config.json: |-
+          {
+                  "nodePathMap":[
+                  {
+                          "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
+                          "paths":["/var/mnt/local-path-provisioner"]
+                  }
+                  ]
+          }
+  - patch: |-
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: local-path-storage
+        labels:
+          pod-security.kubernetes.io/enforce: privileged

controllers/local-path-provisioner/local-path-provisioner.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: local-path-provisioner
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: local-path-provisioner
+  path: ./
+  prune: true
+  wait: true

controllers/longhorn/base/helm-release.yaml

@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: longhorn
+      version: "1.10.x"
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+      interval: 24h
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base
+    - kind: ConfigMap
+      name: values-overlay
+      optional: true

controllers/longhorn/base/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 24h
+  url: https://charts.longhorn.io

controllers/longhorn/base/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: longhorn-system
+    files:
+      - values.yaml

controllers/longhorn/base/name-reference.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

controllers/longhorn/base/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
+    pod-security.kubernetes.io/audit: privileged

controllers/longhorn/base/values.yaml

@@ -0,0 +1,13 @@
+defaultSettings:
+  defaultDataPath: /var/mnt/longhorn
+  replicaAutoBalance: best-effort
+  defaultDataLocality: best-effort
+  freezeFilesystemForSnapshot: true
+  storageReservedPercentageForDefaultDisk: 0
+  storageMinimalAvailablePercentage: 10
+  storageOverProvisioningPercentage: 25
+persistence:
+  defaultDataLocality: best-effort
+defaultBackupStore:
+  backupTarget: s3://longhorn-backup@garage/
+  backupTargetCredentialSecret: s3-garage

controllers/longhorn/longhorn.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: longhorn
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  path: ./${cluster_env}
+  prune: true
+  wait: true

controllers/longhorn/production/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: longhorn-system
+    files:
+      - values.yaml

controllers/longhorn/production/values.yaml

@@ -0,0 +1,4 @@
+defaultSettings:
+  defaultReplicaCount: 2
+persistence:
+  defaultClassReplicaCount: 2

controllers/longhorn/staging/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secret-s3-garage.yaml
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: longhorn-system
+    files:
+      - values.yaml

controllers/longhorn/staging/secret-s3-garage.yaml

@@ -0,0 +1,56 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-garage
+    namespace: longhorn-system
+type: Opaque
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Z61V0zZ0sApVz8gP+Yc6LTKQcW0jdRaWXa4=,iv:SpLgdgI4Yc48NYNb9wE3C28ixBg8vu5tTf7bUENMfrE=,tag:DDbqGvSbcpDxzPUpHbhLKA==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:FK/BS+rXAD2sXND6zHJ2G/GIcFIe01kL/1WP1RJNX86Jc9aCra26+FQQ4zU0Uanh8tQqSzf2qMwK1uMkr/SI4A==,iv:36UsdtiRN3fPr+HtRHSad7oEetiJh56sq+Ypyq/W5FA=,tag:rYHPuCOCHA+YoEKdfN8P0g==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:2iB2cf1E4ucxJEDGRpe2wiX9yMCZA1A=,iv:c+izWJ+i7lHybZlU9yKS5Q+Zj9lOGysCbewz9iRud3M=,tag:UX4zr9dguSAUBqm1xJnNJQ==,type:str]
+    AWS_DEFAULT_REGION: ENC[AES256_GCM,data:x8oa5+m6,iv:w7Ko7PithIEtO6UoW063hxpqcctD4kBw3dCGKYlmQxU=,tag:HskDJefMh4EGKVp8gf9eCw==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
+            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
+            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
+            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
+            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
+            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
+            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
+            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
+            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-13T00:39:37Z"
+    mac: ENC[AES256_GCM,data:H63bqddFd/4v4mGtam/wLa2PX6gn6xeHJMiETdbbrtUjPvspo8soHtFrtMjp1OoU4wYQbYs/0Dr4MRvSeEwVCrkYsOZeHkn8GecnrmqYqmn8eeL6fNSjoshO+eil6lBr0oWW9OPuzjN+avg/+Ucsl9HtnM+VbSIeDeO+7kGc6EI=,iv:DA7fugq5zibsHhbdKuepwHggmsqSmi9w4MIAOZnILvA=,tag:jsJxtFhSFzpZq9KZXCYN4A==,type:str]
+    pgp:
+        - created_at: "2025-12-11T23:56:15Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
+            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
+            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
+            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
+            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
+            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
+            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
+            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
+            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
+            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
+            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
+            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
+            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
+            =/yAN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

controllers/longhorn/staging/values.yaml

@@ -0,0 +1,4 @@
+defaultSettings:
+  defaultReplicaCount: 1
+persistence:
+  defaultClassReplicaCount: 1

controllers/openebs/helm-release.yaml

@@ -0,0 +1,49 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openebs
+  namespace: openebs
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: openebs
+      version: "4.x"
+      sourceRef:
+        kind: HelmRepository
+        name: openebs
+      interval: 24h
+  values:
+    loki:
+      enabled: false
+    alloy:
+      enabled: false
+    mayastor:
+      etcd:
+        replicaCount: 1
+      nats:
+        cluster:
+          replicas: 1
+      eventing:
+        enabled: false
+      obs:
+        callhome:
+          enabled: false
+      csi:
+        node:
+          initContainers:
+            enabled: false
+    engines:
+      local:
+        lvm:
+          enabled: false
+        zfs:
+          enabled: false

controllers/openebs/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: openebs
+  namespace: openebs
+spec:
+  interval: 24h
+  url: https://openebs.github.io/openebs

controllers/openebs/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml

controllers/openebs/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openebs
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
+    pod-security.kubernetes.io/audit: privileged

controllers/openebs/openebs.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openebs
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: openebs
+  path: ./
+  prune: true
+  wait: true

controllers/spegel/helm-release.yaml

@@ -0,0 +1,18 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  interval: 1m
+  chart:
+    spec:
+      chart: spegel
+      version: "0.5.x"
+      interval: 5m
+      sourceRef:
+        kind: HelmRepository
+        name: spegel
+  values:
+    spegel:
+      containerdRegistryConfigPath: /etc/cri/conf.d/hosts

controllers/spegel/helm-repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  type: "oci"
+  interval: 5m0s
+  url: oci://ghcr.io/spegel-org/helm-charts

controllers/spegel/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml

controllers/spegel/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spegel
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

controllers/spegel/spegel.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: spegel
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: spegel
+  path: ./
+  prune: true
+  wait: true