feat: Added OpenEBS local storage

feat: Use pre-generated deploy key
chore: Added pre-commit hooks
2025-12-03 04:45:54 +01:00 · 2025-12-03 04:45:54 +01:00 · 2025-12-02 05:10:18 +01:00 · 2025-12-02 05:09:27 +01:00
107 changed files with 139 additions and 1426 deletions
--- a/.git-crypt/.gitattributes
+++ b/.git-crypt/.gitattributes
@@ -1,4 +0,0 @@
-# Do not edit this file.  To specify the files to encrypt, create your own
-# .gitattributes file in the directory where your files are.
-* !filter !diff
-*.gpg binary
--- a/.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg
+++ b/.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -2,7 +2,7 @@ creation_rules:
  - path_regex: .*.yaml
    encrypted_regex: ^(data|stringData)$
    pgp: >-
-      CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+      1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
    age: >-
      age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul,
      age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
--- a/.typos.toml
+++ b/.typos.toml
@@ -3,5 +3,4 @@ extend-ignore-re = [
  "(?Rm)^.*(#|//)\\s*spellchecker:disable-line$",
  "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on",
  "(#|//)\\s*spellchecker:ignore-next-line\\n.*",
-  "-{5}BEGIN AGE ENCRYPTED FILE-{5}(?:$|[^-]{63,}-{5}END)",
 ]
--- a/README.md
+++ b/README.md
@@ -1,7 +0,0 @@
-# SSH Key issues
-
-Here are some things to check when running into ssh key issues:
-
- Make sure that known hosts only contains a key of type ecdsa-sha2-nistp256 otherwise flux will fail to connect to the repository over ssh.
-
- Make sure the deploy key is read/write.
--- a/apps/artifacts.yaml
+++ b/apps/artifacts.yaml
@@ -1,21 +0,0 @@
-apiVersion: source.extensions.fluxcd.io/v1beta1
-kind: ArtifactGenerator
-metadata:
-  name: apps
-  namespace: flux-system
-spec:
-  sources:
-    - alias: foundation
-      kind: GitRepository
-      name: flux-system
-  artifacts:
-    - name: spegel
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/apps/spegel/**"
-          to: "@artifact/"
-    - name: lldap
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/apps/lldap/**"
-          to: "@artifact/"
--- a/apps/lldap/base/cluster-restore.yaml
+++ b/apps/lldap/base/cluster-restore.yaml
@@ -1,16 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: lldap-db
-spec:
-  bootstrap:
-    recovery:
-      source: source
-  externalClusters:
-    - name: source
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: garage-store
-          serverName: lldap-db
-  plugins: []
--- a/apps/lldap/base/cluster.yaml
+++ b/apps/lldap/base/cluster.yaml
@@ -1,15 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-  namespace: lldap
-  # TODO: Add labels?
-spec:
-  storage:
-    size: 8Gi
-    storageClass: local-path
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: garage-store
--- a/apps/lldap/base/deployment.yaml
+++ b/apps/lldap/base/deployment.yaml
@@ -1,80 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lldap
-  namespace: lldap
-  labels:
-    app.kubernetes.io/name: lldap
-    app.kubernetes.io/instance: lldap
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: lldap
-      app.kubernetes.io/instance: lldap
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: lldap
-        app.kubernetes.io/instance: lldap
-    spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: lldap
-              app.kubernetes.io/instance: lldap
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: lldap
-          image: lldap/lldap:2025-12-12-alpine-rootless
-          env:
-            - name: LLDAP_LDAP_BASE_DN
-              value: dc=huizinga,dc=dev
-            - name: LLDAP_LDAP_USER_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: credentials
-                  key: admin-pass
-            - name: LLDAP_KEY_SEED
-              valueFrom:
-                secretKeyRef:
-                  name: credentials
-                  key: key-seed
-            - name: LLDAP_JWT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: credentials
-                  key: jwt-secret
-            - name: LLDAP_DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: db-app
-                  key: uri
-            - name: TZ
-              value: CET
-          livenessProbe:
-            exec:
-              command:
-                - /app/lldap
-                - healthcheck
-            initialDelaySeconds: 5
-            periodSeconds: 30
-          ports:
-            - name: ldap
-              containerPort: 3890
-            - name: web
-              containerPort: 17170
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
--- a/apps/lldap/base/http-route.yaml
+++ b/apps/lldap/base/http-route.yaml
@@ -1,13 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: HTTPRoute
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  parentRefs:
-    - name: gateway
-      namespace: default
-  rules:
-    - backendRefs:
-        - name: lldap
-          port: 17170
--- a/apps/lldap/base/kustomization.yaml
+++ b/apps/lldap/base/kustomization.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - cluster.yaml
-  - schedule-backup.yaml
-  - deployment.yaml
-  - service.yaml
-  - http-route.yaml
-  - secret-s3-garage.yaml
-  - object-store.yaml
-
-# Uncomment to restore database from backup
-# patches:
-#   - path: cluster-restore.yaml
-#     target:
-#       kind: Cluster
--- a/apps/lldap/base/object-store.yaml
+++ b/apps/lldap/base/object-store.yaml
@@ -1,20 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: lldap
-spec:
-  configuration:
-    destinationPath: s3://cnpg-backup/lldap
-    s3Credentials:
-      accessKeyId:
-        name: s3-garage
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: s3-garage
-        key: ACCESS_SECRET_KEY
-      region:
-        name: s3-garage
-        key: REGION
-    wal:
-      compression: gzip
--- a/apps/lldap/base/schedule-backup.yaml
+++ b/apps/lldap/base/schedule-backup.yaml
@@ -1,13 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: daily-backup
-  namespace: lldap
-spec:
-  schedule: "0 0 0 * * *"
-  backupOwnerReference: self
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io
-  cluster:
-    name: db
--- a/apps/lldap/base/secret-s3-garage.yaml
+++ b/apps/lldap/base/secret-s3-garage.yaml
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: s3-garage
-  namespace: lldap
-  annotations:
-    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
-type: Opaque
-data: {}
--- a/apps/lldap/base/service.yaml
+++ b/apps/lldap/base/service.yaml
@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: lldap
-  namespace: lldap
-  labels:
-    app.kubernetes.io/name: lldap
-    app.kubernetes.io/instance: lldap
-spec:
-  selector:
-    app.kubernetes.io/name: lldap
-    app.kubernetes.io/instance: lldap
-  ports:
-    - name: ldap
-      port: 3890
-      targetPort: ldap
-    - name: web
-      port: 17170
-      targetPort: web
--- a/apps/lldap/lldap.yaml
+++ b/apps/lldap/lldap.yaml
@@ -1,21 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: lldap
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: cnpg
-  sourceRef:
-    kind: ExternalArtifact
-    name: lldap
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  path: ./${cluster_env}
-  prune: true
-  wait: true
--- a/apps/lldap/production/cluster.yaml
+++ b/apps/lldap/production/cluster.yaml
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 2
--- a/apps/lldap/production/deployment.yaml
+++ b/apps/lldap/production/deployment.yaml
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  replicas: 2
--- a/apps/lldap/production/http-route.yaml
+++ b/apps/lldap/production/http-route.yaml
@@ -1,8 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: HTTPRoute
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  hostnames:
-    - "users.huizinga.dev"
--- a/apps/lldap/production/kustomization.yaml
+++ b/apps/lldap/production/kustomization.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - secret-credentials.enc.yaml
-patches:
-  - path: deployment.yaml
-    target:
-      kind: Deployment
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-  - path: http-route.yaml
-    target:
-      kind: HTTPRoute
--- a/apps/lldap/production/secret-credentials.enc.yaml
+++ b/apps/lldap/production/secret-credentials.enc.yaml
@@ -1,59 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: credentials
-    namespace: lldap
-    labels:
-        app.kubernetes.io/name: lldap
-        app.kubernetes.io/instance: lldap
-type: Opaque
-data:
-    jwt-secret: ENC[AES256_GCM,data:yUAsoCIEXH491Ko4wEAAevSETdMFuhypNzuU2th5zlLd9hbVKqsjclvCTLDD8aW0Y9Lv70pzzAADPwFCKNH/rXx0DzaGOP139kLRYDHafz3RYeuoJjgBGw==,iv:x3EmPbbL/aj9CbwF8lleDL+nhlidPU8R3hwXygtj7D8=,tag:XD4C/pwFLFmDryBW7NqsWg==,type:str]
-    key-seed: ENC[AES256_GCM,data:3jWLtfny+ahtSkkmUdbg+wFbSGIcCxOv9BxVr0oNLTetXrAx+OcZ6dKp1ktj0J9aYEppqVuANUlfqyVzhIQXOT5GomQ+9jPC4uLmIz9tu1LAcfv9zuGl/w==,iv:e3aAI6JWq16YaUZqvKulkHyhLb8eWy9t2ni/jGeNFow=,tag:sZEEvxlq145klFkEMsUOuA==,type:str]
-    #ENC[AES256_GCM,data:AnCuvbVM6M62wuWmpUx3u/5WdaCo1T7eCvbY30okKbmWnvM0HQT2gGDTuhIaOlc=,iv:Ho+/CAvs69VJ+uwAIH8LVL344qlDaK5z3AvzWh/Jgm0=,tag:uNfN1P7lmWKBuCY7eiywDw==,type:comment]
-    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
-            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
-            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
-            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
-            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
-            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
-            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
-            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
-            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T02:58:02Z"
-    mac: ENC[AES256_GCM,data:yxmBIqS+KMr2Dp4eKslT1oNCcq2VEnGh4g3e7mkZzWjT6xPTdBEH8bT+c2XIFMWHJSUFoI7YyhvS1p5VgRBudaDyQCOk7tzyj0nkGiepZc1uYjSVO7VQ9CnfcdiD9AZ2srUjkcUoBaRfi2u6Qh2pPUUwMd4z8ms8v0CSk1qw0FE=,iv:V2rw624TN+pSGuq+JjVqM2bKozn7hGAykHV+638wo14=,tag:cdDascdYzzG33GztMd0Fdg==,type:str]
-    pgp:
-        - created_at: "2025-12-17T00:53:29Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
-            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
-            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
-            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
-            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
-            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
-            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
-            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
-            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
-            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
-            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
-            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
-            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
-            =j+fd
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/apps/lldap/staging/cluster.yaml
+++ b/apps/lldap/staging/cluster.yaml
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 1
--- a/apps/lldap/staging/deployment.yaml
+++ b/apps/lldap/staging/deployment.yaml
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  replicas: 1
--- a/apps/lldap/staging/http-route.yaml
+++ b/apps/lldap/staging/http-route.yaml
@@ -1,8 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: HTTPRoute
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  hostnames:
-    - "users.staging.huizinga.dev"
--- a/apps/lldap/staging/kustomization.yaml
+++ b/apps/lldap/staging/kustomization.yaml
@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - secret-credentials.enc.yaml
-patches:
-  - path: deployment.yaml
-    target:
-      kind: Deployment
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-  - path: object-store.yaml
-    target:
-      kind: ObjectStore
-  - path: http-route.yaml
-    target:
-      kind: HTTPRoute
--- a/apps/lldap/staging/object-store.yaml
+++ b/apps/lldap/staging/object-store.yaml
@@ -1,8 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: lldap
-spec:
-  configuration:
-    endpointURL: http://192.168.1.1:3900
--- a/apps/lldap/staging/secret-credentials.enc.yaml
+++ b/apps/lldap/staging/secret-credentials.enc.yaml
@@ -1,58 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: credentials
-    namespace: lldap
-    labels:
-        app.kubernetes.io/name: lldap
-        app.kubernetes.io/instance: lldap
-type: Opaque
-data:
-    jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
-    key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
-    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
-            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
-            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
-            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
-            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
-            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
-            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
-            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
-            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T00:53:29Z"
-    mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
-    pgp:
-        - created_at: "2025-12-17T00:53:29Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
-            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
-            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
-            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
-            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
-            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
-            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
-            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
-            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
-            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
-            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
-            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
-            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
-            =j+fd
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -4,7 +4,6 @@ root=$(git rev-parse --show-toplevel)

 tools=(talosctl cilium-cli yq helm)
 cilium_version=1.18.4
-flux_version=2.7.5

 for tool in "${tools[@]}"; do
 	command -v ${tool} > /dev/null || (echo "Missing: ${tool}" && exit -1)
@@ -128,7 +127,6 @@ echo "Bootstrapping flux..."
 flux bootstrap git \
 	--url ssh://git@huizinga.dev/infra/foundation \
 	--branch=main \
-	--private-key-file=clusters/${cluster_name}/deploy.key -s \
+	--private-key-file=clusters/${cluster_name}/deploy.key
 	--path=clusters/${cluster_name} \
-	--components-extra=source-watcher \
-	--version v${flux_version}
+	--components-extra=source-watcher
--- a/clusters/testing/deploy.key
+++ b/clusters/testing/deploy.key
--- a/clusters/testing/deploy.key.pub
+++ b/clusters/testing/deploy.key.pub
@@ -1 +1 @@
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK59NC6hLyDf+9zeOQ0stZeay51UyUpoBgONh0xxJFIlgra5ojyhrrQVlfjcUqdLe5yijWU1nCxKpaFGDPMdNE4= flux@testing
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJIjhlQCqpq97CQcM6hDThGBgt/jSqnvN9billcvouuNSyaKqZRdUFWxbauruXmVd5okuwjocyxU4FTuTtFyC5w= flux@testing
--- a/clusters/testing/flux-system/gotk-components.yaml
+++ b/clusters/testing/flux-system/gotk-components.yaml
@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.7.5
+# Flux Version: v2.7.3
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller,source-watcher
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: flux-system
@@ -19,7 +19,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: allow-egress
  namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: allow-scraping
  namespace: flux-system
 spec:
@@ -59,7 +59,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: allow-webhooks
  namespace: flux-system
 spec:
@@ -78,7 +78,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: critical-pods-flux-system
  namespace: flux-system
 spec:
@@ -98,7 +98,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +204,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: flux-edit-flux-system
@@ -212,7 +212,6 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
-  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -231,7 +230,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -240,7 +239,6 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
-  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -257,7 +255,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: cluster-reconciler-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -277,7 +275,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: crd-controller-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -315,7 +313,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: buckets.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1086,7 +1084,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: externalartifacts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1282,7 +1280,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: gitrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2236,7 +2234,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: helmcharts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2962,7 +2960,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: helmrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -3593,7 +3591,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: ocirepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -4419,7 +4417,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: source-controller
  namespace: flux-system
 ---
@@ -4430,7 +4428,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4451,7 +4449,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4472,7 +4470,7 @@ spec:
        app.kubernetes.io/component: source-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.3
    spec:
      containers:
      - args:
@@ -4495,7 +4493,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.7.4
+        image: ghcr.io/fluxcd/source-controller:v1.7.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -4559,7 +4557,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
  group: kustomize.toolkit.fluxcd.io
@@ -5929,7 +5927,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: kustomize-controller
  namespace: flux-system
 ---
@@ -5940,7 +5938,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: kustomize-controller
  namespace: flux-system
@@ -5959,7 +5957,7 @@ spec:
        app.kubernetes.io/component: kustomize-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.3
    spec:
      containers:
      - args:
@@ -5979,7 +5977,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
+        image: ghcr.io/fluxcd/kustomize-controller:v1.7.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -6036,7 +6034,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: helmreleases.helm.toolkit.fluxcd.io
 spec:
  group: helm.toolkit.fluxcd.io
@@ -8667,7 +8665,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: helm-controller
  namespace: flux-system
 ---
@@ -8678,7 +8676,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: helm-controller
  namespace: flux-system
@@ -8697,7 +8695,7 @@ spec:
        app.kubernetes.io/component: helm-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.3
    spec:
      containers:
      - args:
@@ -8717,7 +8715,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.4.5
+        image: ghcr.io/fluxcd/helm-controller:v1.4.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -8774,7 +8772,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: alerts.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9164,7 +9162,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: providers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9576,7 +9574,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: receivers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -10053,7 +10051,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: notification-controller
  namespace: flux-system
 ---
@@ -10064,7 +10062,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10085,7 +10083,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: webhook-receiver
  namespace: flux-system
@@ -10106,7 +10104,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10125,7 +10123,7 @@ spec:
        app.kubernetes.io/component: notification-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.3
    spec:
      containers:
      - args:
@@ -10143,7 +10141,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.7.5
+        image: ghcr.io/fluxcd/notification-controller:v1.7.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -10205,7 +10203,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: artifactgenerators.source.extensions.fluxcd.io
 spec:
  group: source.extensions.fluxcd.io
@@ -10498,7 +10496,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
  name: source-watcher
  namespace: flux-system
 ---
@@ -10509,7 +10507,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: source-watcher
  name: source-watcher
  namespace: flux-system
@@ -10530,7 +10528,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.5
+    app.kubernetes.io/version: v2.7.3
    control-plane: controller
  name: source-watcher
  namespace: flux-system
@@ -10551,7 +10549,7 @@ spec:
        app.kubernetes.io/component: source-watcher
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.5
+        app.kubernetes.io/version: v2.7.3
    spec:
      containers:
      - args:
@@ -10572,7 +10570,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-watcher:v2.0.3
+        image: ghcr.io/fluxcd/source-watcher:v2.0.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
--- a/clusters/testing/kustomization.yaml
+++ b/clusters/testing/kustomization.yaml
@@ -2,21 +2,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - flux-system/
-
  - ../../controllers/artifacts.yaml
  - ../../controllers/cilium/cilium.yaml
  - ../../controllers/cert-manager/cert-manager.yaml
-  - ../../controllers/longhorn/longhorn.yaml
-  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
-  - ../../controllers/cnpg/cnpg.yaml
-  - ../../controllers/reflector/reflector.yaml
-
+  - ../../controllers/spegel/spegel.yaml
+  - ../../controllers/openebs/openebs.yaml
  - ../../configs/artifacts.yaml
-  - ../../configs/cilium-config/cilium-config.yaml
+  - ../../configs/letsencrypt/letsencrypt.yaml
  - ../../configs/certificates/certificates.yaml
-  - ../../configs/alerts/alerts.yaml
-  - ../../configs/longhorn-jobs/longhorn-jobs.yaml
-
-  - ../../apps/artifacts.yaml
-  - ../../apps/spegel/spegel.yaml
-  - ../../apps/lldap/lldap.yaml
--- a/configs/alerts/alerts.yaml
+++ b/configs/alerts/alerts.yaml
@@ -1,19 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: alerts
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: ExternalArtifact
-    name: alerts
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  path: ./
-  prune: true
-  wait: true
--- a/configs/alerts/kustomization.yaml
+++ b/configs/alerts/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - telegram
-  - repo
--- a/configs/alerts/repo/alert.yaml
+++ b/configs/alerts/repo/alert.yaml
@@ -1,12 +0,0 @@
-apiVersion: notification.toolkit.fluxcd.io/v1beta3
-kind: Alert
-metadata:
-  name: repo
-  namespace: flux-system
-spec:
-  providerRef:
-    name: repo
-  eventSeverity: info
-  eventSources:
-    - kind: Kustomization
-      name: "*"
--- a/configs/alerts/repo/provider.yaml
+++ b/configs/alerts/repo/provider.yaml
@@ -1,10 +0,0 @@
-apiVersion: notification.toolkit.fluxcd.io/v1beta3
-kind: Provider
-metadata:
-  name: repo
-  namespace: flux-system
-spec:
-  type: gitea
-  address: https://git.huizinga.dev/infra/foundation
-  secretRef:
-    name: repo
--- a/configs/alerts/repo/secret-repo.enc.yaml
+++ b/configs/alerts/repo/secret-repo.enc.yaml
@@ -1,52 +0,0 @@
-apiVersion: v1
-stringData:
-    token: ENC[AES256_GCM,data:RZLFgmuin4hjJ1gSOFZLFeLpF/KjIr6vBGgovhyfLD9PQKSQq6eg5g==,iv:VUTnjgcoqfVcZrDM1S2VqBdSCYXC6hj4lHx/mI8bw8s=,tag:QSj3c5OX6JqJxt6WnglAIw==,type:str]
-kind: Secret
-metadata:
-    name: repo
-    namespace: flux-system
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNmJhYUtTYnNRcTlvaXFE
-            WHNsWFVrUDMrZzUyTHJ4WGJTOU4rL29pRmtZCkNqRGVYa0hOWWljSThsUHlDSnVD
-            UGpBcS9UZDU2Q2NMOEtCaC9qcnREY0EKLS0tIERpQ01LVnh5dm5wRjFnUVlXWmxr
-            OUYvK29RUXNjeE02Q1l6TDZaNzhSNG8K5JPUi2txe31/cgLF0+WnEDmSpgDhMGdv
-            CDP4b7O0VpN32sE3t19cFeuZ38oS/kn0d4Lsw4eu7L+uuZheq2PN0Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MkJOdlF2YVVES3ZnTm1t
-            QXJLSUF6OWJrWmhOamVOK2JOY2lWdXFxT1h3CnRkOHpCY2dRU2xLRzdCKzVHY2R3
-            ZUdBTldwWVRYNkN0SUpiQjJTL2h5UzQKLS0tIEpXTWRNbTh2YW13V0psVzU0Zkxo
-            RE5SSzI4MmdOWGhBTGNzR2NPeHArSHcK8sOiSL6tfAT6KFLkFy0NpRuiVbFayJPR
-            vtki2eku7b0MKsQKCv/JPwSdOa7q/8Mxngiajxqwae0nObETSR+2TA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-15T00:11:25Z"
-    mac: ENC[AES256_GCM,data:xXPnZ5DP90FtT7yDUOPAMHl7vXgFM8JEnm/mpozB5/I4f3xxGP9b3RVfK3zESgqHREVUoD/hIQaTCwYHeqqWKwB7yQxc4ZuMKlTJ11iw0R8vsbj0Lk/a8v0kzCx5CDoTcvZE78go8LtIfYVxBKvcwP9ZN0Q9RuR235RVMW5Rz5M=,iv:oS9OUiyhliHzl1NEgfFr+eEfmgXlMX7VeeOcE382p1k=,tag:w6t9lNHqUYAFcEI3E4UBcQ==,type:str]
-    pgp:
-        - created_at: "2025-12-09T02:34:13Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoARAAxzvoy2eJdqO5p12H8PzOqp6viq2c6G8VGULDOOWUk7VG
-            DTfzEjOTjnGooz1dMHb0MdYGm5DVyuxp+6AW/i5XZmPSiV1fWuROUFaf9qb+EcVS
-            mq7Csor0MKbQAns2C7xWe1AZq73AL1cXsWAWOvNuAKnP510nLds08FHAUhirylkl
-            X2Jv/xys+gaY/XpyvkIPyRKfCfO1IzwjHy1OiIkvx+QZWaEjm5psP262ckZlMl+R
-            nf3rF/ZNzyo2Nli1wnUPKtcCXanfZXuDadgUlc+9ISMB2UEFlUC8lvQngXPwTdmN
-            etXYvy/OI2Hyx5ynVvewAGLSHhwOlCjH7/6xGvTOhFzVsi/Tk4TsJTKZu25/j0Jy
-            pgZ/WNPQegq0o/vxxiyU+OJdDv8SDew6f5mjgfD1wikvMDBBgW3TLrNnlQMqSPpr
-            KSLLlgkLkie21F0YVlDh3MK5MDWySZC6VZfuD/kZIpsqeatka3IRDsRRvFV6teGM
-            cJ1eNFRDAXnI9GB8KpuRH9sYLVzgQdmLBfP8ksadci/ykjtQp/92mwf7nMThT+09
-            cYG36Y8G5HCly0ZdY+Zl1Evw43W8vp5Va5Zc8EWvz51kk03gQd7jlOjGFgCarSOv
-            w3jKC1CUVKQi+JIfeufYb6vPWvYWJKTvP2yikw46nwoHkPixeRhelR27qWLWu3jS
-            XAF+wgVNKSJPC94eVbRBjpj51IN/gyj051ria/uw++Z8SuHVGiqT1B+gTd6pyVSU
-            cHGRCPkIC0g75q9Fgmxfob9hAkybGxJ+fWOzBTpmnzG+1VScNAYTbyXiOFVo
-            =fVSN
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/configs/alerts/telegram/alert.yaml
+++ b/configs/alerts/telegram/alert.yaml
@@ -1,18 +0,0 @@
-apiVersion: notification.toolkit.fluxcd.io/v1beta3
-kind: Alert
-metadata:
-  name: telegram
-  namespace: flux-system
-spec:
-  providerRef:
-    name: telegram
-  eventSeverity: error
-  eventSources:
-    - kind: GitRepository
-      name: "*"
-    - kind: Kustomization
-      name: "*"
-    - kind: HelmRepository
-      name: "*"
-    - kind: HelmRelease
-      name: "*"
--- a/configs/alerts/telegram/kustomization.yaml
+++ b/configs/alerts/telegram/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - secret-telegram.enc.yaml
-  - provider.yaml
-  - alert.yaml
--- a/configs/alerts/telegram/provider.yaml
+++ b/configs/alerts/telegram/provider.yaml
@@ -1,11 +0,0 @@
-apiVersion: notification.toolkit.fluxcd.io/v1beta3
-kind: Provider
-metadata:
-  name: telegram
-  namespace: flux-system
-spec:
-  type: telegram
-  # TODO: Would be nice if this was not hard coded
-  channel: "-4748034121"
-  secretRef:
-    name: telegram
--- a/configs/alerts/telegram/secret-telegram.enc.yaml
+++ b/configs/alerts/telegram/secret-telegram.enc.yaml
@@ -1,52 +0,0 @@
-apiVersion: v1
-stringData:
-    token: ENC[AES256_GCM,data:azBE1dVSbYNZzpagsQrmEoYGIGFn/URQ3VrksQRhUKuJyCrc6o6360u/k38NKg==,iv:iYpqz6Ndh5QESa8yGPU1nKD8/sb3dgloNLa3HFDihnU=,tag:2w0eslkZQOIb+qPYgNmHIQ==,type:str]
-kind: Secret
-metadata:
-    name: telegram
-    namespace: flux-system
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsN2VGQjBoZUp3TjU4YW1W
-            cnJ5QW9aY1FtdUFvcENZRnV5cXVjMkhEOFFjCkFMTm4yUjFZOG56YUVXRkE3SndI
-            eFQ2clF1ZDZicUtCNk9JYW15US9XSDQKLS0tIExHVDdsaVdyVktobWRaUmZPK2V1
-            NSsyVFRaeFJ6NUhOaDdPZy9yOVhVUXMK32YSPm1nDMvCFLbTTVcy3HdSVueUP2lS
-            dNr/myyFX3s8dkXHXJDj14XBu5O3Fk0ktHa2bFfvx+wosHPixG4TqQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0cDlERWorN1hXNlMxUnVp
-            TjZGcis4eVRBWWZVUG5nRzEwMy9Jd21DSFFvCk1ld2tEZWJvV3pHMmVsb2lDRk53
-            aitnbmJpaFE5NGxGd0N3VSt1N2N2WHcKLS0tIDRKMTN0bk9hcUNTNWpsaEMrY01R
-            ckU4YlF3Z0JXTGRaVnJnd1ZITHU3RzQKk/kNn84JwoWl/77wEyeljrTkYSTBSpAW
-            fDn4ddsrmays2kEb8ux0ZbqsNNrt3IhDYd0urks20INvS9BkXJMI0A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-09T01:52:28Z"
-    mac: ENC[AES256_GCM,data:EObi2Da0n+RpKOfpay2NQM140lniPUY12MNFQIw4wNlCS8EFzJHNrPk/SpFDOY5HqvT27wRfz//oTGVzt6+TNkfAU3GcGYuJZezwFvbAkkoRuVmGauZ/ZyfG8PmdPN1imYa2ajqaQW/gym06TbtaLaI54txeK0PE1z+oWXZIW14=,iv:fVU6mkfyuck/pu7ff5n2Gd6pGclLU7jt5Dy2vOOnctA=,tag:4JUDNvgVskKlAHlJ5MwsFA==,type:str]
-    pgp:
-        - created_at: "2025-12-09T01:52:28Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7pKPTYH5bqOARAAlVFcHIEsMcSUuPWKxOtpGBLdnWo/9d8GsQwUDsh9Kk8C
-            tLVJn8cXNGdvt28pmS22L3KDOX0o3WGNNWvZfe9D6cG4WPH1yug4axQoVTnMUpYE
-            a8nsqMRgfNdTkbDfOtU+EV4Aq9iMl2MVqy3D/Vc2MnPk/WvcQUGXd1viJJrOhBcP
-            S0mTDRQOUjdgrX4RIcinx2yQQgMTAiduxj0sSaK6BWEDaum50WjthV+/GlCz2hks
-            nf+BzY+MbCDFKMjfSbpdZhyQ0VvkV8Yu7UtoxaI6w9KUqH8zHjqaNjhELmLy2FKv
-            6kAiW/XUuR6BZTbo1MgLG4gJwQU6+pHELXAh/h+Qj+wX6agYOZNmQqAmQahnfQZ/
-            cy7mzGf4vQlMxeayOUdJVDbqhWlMpCVmGkWqtfBwAJKr7r7fjRP+VuZ06KyilGr0
-            NyibyKVp6+ostTXNlMmvTGBiQpNv+/9822PhFKN/ARde32igUmtnRiwoYyrZ644y
-            Y6BAmnEuu+mfpIDPODQ4gWP+t9vwuzBPTUP2DVqXgqHoOgK2HnGIeNtKh8PqPkG4
-            qPI/3b1LqN+yMOI9HU1fv2IUbRPksauNNq1rrK/9scasT1MqoKEBWjntdDJ7MuR6
-            RQ6S3xU8dyBW0jNe3JFa1dIvM+QlVysIpy8kCv81DeNDT/Yp8psTJXeBa25tcovS
-            XAHlK1OXm7zOchfPa46EWjbMMSwcIle9VVrJCAsjS2eFriOK8wMn3Awyl9V2zcEX
-            6F6+jzvVYUbxXZupCdJoZo7faaC8TyA10o2LxrcdFwLtjByVgVz3mYmpHVwQ
-            =BwkI
-            -----END PGP MESSAGE-----
-          fp: 1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/configs/artifacts.yaml
+++ b/configs/artifacts.yaml
@@ -9,23 +9,13 @@ spec:
      kind: GitRepository
      name: flux-system
  artifacts:
-    - name: cilium-config
+    - name: letsencrypt
      originRevision: "@foundation"
      copy:
-        - from: "@foundation/configs/cilium-config/**"
+        - from: "@foundation/configs/letsencrypt/**"
          to: "@artifact/"
    - name: certificates
      originRevision: "@foundation"
      copy:
        - from: "@foundation/configs/certificates/**"
          to: "@artifact/"
-    - name: alerts
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/configs/alerts/**"
-          to: "@artifact/"
-    - name: longhorn-jobs
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/configs/longhorn-jobs/**"
-          to: "@artifact/"
--- a/configs/certificates/base/certificate-huizinga-dev.yaml
+++ b/configs/certificates/base/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: default
+  namespace: certificates
 spec:
  secretName: huizinga-dev-tls
  issuerRef:
--- a/configs/certificates/base/kustomization.yaml
+++ b/configs/certificates/base/kustomization.yaml
@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - certificate-huizinga-dev.yaml
-  - secret-cloudflare-token.enc.yaml
-  - cluster-issuer.yaml
--- a/configs/certificates/base/namespace.yaml
+++ b/configs/certificates/base/namespace.yaml
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: lldap
+  name: certificates
--- a/configs/certificates/base/secret-cloudflare-token.enc.yaml
+++ b/configs/certificates/base/secret-cloudflare-token.enc.yaml
@@ -1,53 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: cloudflare-token
-    namespace: cert-manager
-type: Opaque
-stringData:
-    token: ENC[AES256_GCM,data:uwFPBz9+EMnpXUgvkJ0u9/iEFbpJ2Rz+oX2pqwcJrH04r8E91weFOA==,iv:m9yka2XMfbuu0d/12RvG7UPWvxJEZ0UeDG+OMqxTpkg=,tag:F7EDh3PCHk2yE0MDIjmo2g==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT1F1MWlqTHdOVUFPZURS
-            TjZzRm04KzJobHp2Vy8xNHVBUW5WMko1bFU0ClpHSUphVWdFTGFsaytMRE1PSkR0
-            UnVGVU84c2tmZ2tCTG5QTEJxOFdWMHcKLS0tIGNybUdXZS9QUlk5dk1PRFhtdXNQ
-            Y3ZjOG5wMjlXYWpqeUYyUVFQYmQwSEUKd09GwvJx55mznG0JT8baa9LkkWcNT/ux
-            p4qgxg9F9hHGRXNnrMNaYnEj8NV01cd4yXCha+C7IVL0MssBrmJW8Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaDQ0Mnp5NVV3Yi9uRkcw
-            MFJOTFEzVldBYUFXejg0d2pPYVAwYndWMVU0CkFpMVJxUkFwa1BDeTFLZnJwdEp5
-            a3R3VlNqZnkyODEyZ3U1ZEZIK3dJL2MKLS0tIFZoaml2cndVYmJCQ2JsRFlrWURy
-            SEFVKytlWDJnMmp1QTM2eGZuV3E1eUkKjfsfazFaec1x6EOkEht+GbBHSV/L4GUz
-            YpDx9vIMB2T0wUd5U6ecNdyea2HwYg4gzUtwzDf1AGYtoOv9doig3g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-09T02:35:32Z"
-    mac: ENC[AES256_GCM,data:4cprvZzT//nt0PHbJ+p46jnLjfiXF4VlaKA0p2bGKlXWoThvJd9lpUD8xVzXo860U5aGWzqIsdONRjuJcRY4zPz/mkgcRz+gZKkcOCtS2wDOUkk98n2EuwbbJ4+fBH+RbqtcZmocsiGPt6JOLPOPZHpe+t2iiFoBewFfLuND8PM=,iv:eFZ3mEPlEHOLvmWAaDepJjwaaHgcnGBw8v3FEFvOcVI=,tag:GL+bqXS1Qe+7BZEgLEYtNw==,type:str]
-    pgp:
-        - created_at: "2025-12-09T02:35:37Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoARAAjNHNqLtH4I+qJoW+/DtUhSCy66V9gznDeqWwwhERaGCN
-            LNNN43m7zD5rGei4G3dK12xyacMVExbjGxMQironUG/DdNw4dmYpZlktOxb8ec8Y
-            NK669WI8TC1vltLaET/NLEXih0zKEEf5DO1xKEdTFpU4hG8yGg6X82vVHhnUTiaP
-            ChtnjaOqPFz3HTk8oa2HvhQvYgZB1FCEI+jrCsxZVHp8j+6iN9NtxEFrpIcDsYVN
-            XpYupukU3kymBHOYx3tptiufR4riOr7RnmNu+dEvJSsaOjax4E8l3k48jEBbNcHQ
-            CVQf2qf0iRcOQPNHrcy40QKlxUUacO2OJa2aq6G1rceaZosqE09PJmQZUfKi4zYq
-            qho590mtdfdcub7h3xGVL9i84fdGpkL+BEJCLvf0PSj0VaVJDND2Mibqo+S9lGPb
-            6dJIIaMeh1Dm5dK7uMBut7+dv4GPO+IljuwXjAWh0tDIUx7P7gWsLiUjJ/rhFw+f
-            7lSY2sRAzXcEGIbBZc+K0CdNx1fbHaagL4ENjEIoTr6Uxn5Qepxv+iXhYsZzJaOR
-            AG7v8KvlXAW5DcmndWYg8eyTc6+76iiFNDPCVlXaugcmzlqq87fObre2ZwBIq6re
-            KZaHRz8gwEeXxZAOZEMhoRTNJkyQr2DiwDSa0CzW96N/VcbukjSPFzTRrO+eZEvS
-            XgGfoHUY+OWLWnxI3/Cu81DIAt0TRBtTN5jL1h9C450heaHfJ+wGC5hf/t1I6GTO
-            N6NqKiYRCNCepFQASuOqyzTi8jyNvwgbOeFL/UYGpzNX7Y8CIawVSfjncuRtTmQ=
-            =ta8P
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/configs/certificates/certificates.yaml
+++ b/configs/certificates/certificates.yaml
@@ -6,16 +6,12 @@ metadata:
 spec:
  interval: 1h
  retryInterval: 2m
-  timeout: 15m
+  timeout: 5m
  dependsOn:
-    - name: cert-manager
+    - name: letsencrypt
  sourceRef:
    kind: ExternalArtifact
    name: certificates
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
  path: ./${cluster_env}
  prune: true
  wait: true
--- a/configs/certificates/production/certificate-huizinga-dev.yaml
+++ b/configs/certificates/production/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: default
+  namespace: certificates
 spec:
  commonName: "huizinga.dev"
  dnsNames:
--- a/configs/certificates/staging/certificate-huizinga-dev.yaml
+++ b/configs/certificates/staging/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: default
+  namespace: certificates
 spec:
  commonName: "staging.huizinga.dev"
  dnsNames:
--- a/configs/cilium-config/base/cilium-l2-announcement-policy.yaml
+++ b/configs/cilium-config/base/cilium-l2-announcement-policy.yaml
@@ -1,9 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: default-policy
-spec:
-  interfaces:
-    - ^eth[0-9]+
-  externalIPs: true
-  loadBalancerIPs: true
--- a/configs/cilium-config/base/gateway.yaml
+++ b/configs/cilium-config/base/gateway.yaml
@@ -1,24 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: gateway
-  namespace: default
-spec:
-  gatewayClassName: cilium
-  listeners:
-    - name: http
-      protocol: HTTP
-      port: 80
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      protocol: HTTPS
-      port: 443
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: huizinga-dev-tls
-      allowedRoutes:
-        namespaces:
-          from: All
--- a/configs/cilium-config/base/http-route-http-filter-redirect.yaml
+++ b/configs/cilium-config/base/http-route-http-filter-redirect.yaml
@@ -1,15 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-filter-redirect
-  namespace: default
-spec:
-  parentRefs:
-    - name: gateway
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
--- a/configs/cilium-config/base/kustomization.yaml
+++ b/configs/cilium-config/base/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cilium-l2-announcement-policy.yaml
-  - gateway.yaml
-  - http-route-http-filter-redirect.yaml
--- a/configs/cilium-config/cilium-config.yaml
+++ b/configs/cilium-config/cilium-config.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cilium-config
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 15m
-  dependsOn:
-    - name: cilium
-  sourceRef:
-    kind: ExternalArtifact
-    name: cilium-config
-  path: ./${cluster_env}
-  prune: true
-  wait: true
--- a/configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml
+++ b/configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml
@@ -1,7 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: default-pool
-spec:
-  blocks:
-    - cidr: 10.0.2.100/24
--- a/configs/cilium-config/production/kustomization.yaml
+++ b/configs/cilium-config/production/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - cilium-load-balancer-ip-pool.yaml
--- a/configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml
+++ b/configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml
@@ -1,8 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: default-pool
-spec:
-  blocks:
-    - start: 192.168.1.100
-      stop: 192.168.1.200
--- a/configs/cilium-config/staging/kustomization.yaml
+++ b/configs/cilium-config/staging/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - cilium-load-balancer-ip-pool.yaml
--- a/configs/certificates/base/cluster-issuer.yaml
+++ b/configs/certificates/base/cluster-issuer.yaml
--- a/configs/letsencrypt/kustomization.yaml
+++ b/configs/letsencrypt/kustomization.yaml
@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - secret-repo.enc.yaml
-  - provider.yaml
-  - alert.yaml
+  - secret-cloudflare-token.enc.yaml
+  - cluster-issuer.yaml
--- a/configs/letsencrypt/letsencrypt.yaml
+++ b/configs/letsencrypt/letsencrypt.yaml
@@ -1,21 +1,21 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cnpg
+  name: letsencrypt
  namespace: flux-system
 spec:
  interval: 1h
  retryInterval: 2m
  timeout: 5m
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
  dependsOn:
    - name: cert-manager
  sourceRef:
    kind: ExternalArtifact
-    name: cnpg
-  path: ./${cluster_env}
+    name: letsencrypt
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  path: ./
  prune: true
  wait: true
--- a/configs/letsencrypt/secret-cloudflare-token.enc.yaml
+++ b/configs/letsencrypt/secret-cloudflare-token.enc.yaml
@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-token
+    namespace: cert-manager
+type: Opaque
+stringData:
+    token: ENC[AES256_GCM,data:uwFPBz9+EMnpXUgvkJ0u9/iEFbpJ2Rz+oX2pqwcJrH04r8E91weFOA==,iv:m9yka2XMfbuu0d/12RvG7UPWvxJEZ0UeDG+OMqxTpkg=,tag:F7EDh3PCHk2yE0MDIjmo2g==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZGVBS1dpRlVQemlRR2gv
+            WFQraFRxV1hGTVZ1UlNPeXV5Z1VTQ0o2QVFjCjZmYzh0dmhDczllU1pUdGs3Ti82
+            blBOZTAwSUVMTVlJcHNRNVA1NytTMk0KLS0tIGtwR0dYOUxOaUVWb041SXQ5cktU
+            b0QwUVJNVDBTUkcwcWxmV3R4Rm4wNjQKC/hMgUvkTlROHPiBZcJ1ALu2zqknkFhw
+            qDBjJmwpCApaLKrFMxgMEMySNbN2l04fnCQQtZ97ZH87C1lj5WFT8A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOSDA1NkJGdUsyR3hUeG85
+            TUpldmk1V054SDNyNHdlVEhtM3NSMlBjc3hJCk9yQXd5ajl5VnFsZytMWHA5dlNN
+            Q2pxNHVMd01mMEwwT0pKVnBBYjByWXMKLS0tIE9uQ3pzMW90MEhZUGtxVUkrZFJH
+            VXJSejR2bzRLamdoemhSRkwwRGxnVDAKOVvuGT6ZO+JB33RrCF0oqyA0GXAznGOE
+            gT/7i9aMKuJfJr5RhfK1GY6JJf18mHt+jwM2epjtcFYzZpMjh2zjcg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-01T01:33:08Z"
+    mac: ENC[AES256_GCM,data:9pXCN0JoIFc7OXJvJFBtd/BGP9aByPFq+8KKUqv0MKXVWJWXxzTzN8yoinxsPrw0KSLOJ98ieDIHj2ukVMpuOILOzDELArDsiP0/TAq387V9S7vx+Z2OnCSVuHoW97fvvqSxqhyAuZ8a4alNQ83TtOdZ2gK6VMxWMKizZWdpGeI=,iv:KaEJ6avIlBSTBSIdi/xDF249WEbzubLviBTaDHSwp5A=,tag:TbwJvDuYJY8EdL6yxekWzQ==,type:str]
+    pgp:
+        - created_at: "2025-12-01T01:33:08Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7pKPTYH5bqOAQ//XvRMEPLhIX1a7oAq5bBY/rl8o5NiBl2z78Bi2ddZ5Fnt
+            J1f9syNMfYCrtkrZ5dgGcbELYcdP0QFajyDYWDViz4elmdqsvdzIPY7DAdzj7NQU
+            gZhoJyBSK5EP4x/89fFdd9zR54nVH8K9036bp4KEGzu611YxdwHT9EtheTSM12S/
+            ZVvVrN0wq6ld9NH0PxEimGL1GhGn+dpVczN1CL1Qh81dz1FpvADd7AJQ7JprkbN8
+            SBSG+omRBhuZaoXTurihgL702q/zzX0/ZyQ24ONsaQGWXJmdXx+lRBgfmWPL9w8b
+            6tcAwfCyOw6QTaTPipOvtHG3M6rhl3AxPWFm2eIv1oXtFGMAbmxOCDfGzy+Tkuva
+            JdlObrgU1v9CAxeKSeqetEZWHY/kPiUSlRUD+C4sHxJBO0MEzxQzNBlh7NgGBOPh
+            Ldum/jZbcCJCOyPXS1Q4bW89gwaTVTeOVpadSwwsJap8+13E2sar3BES2tIGiGTZ
+            e44S5pS/ycSMLQHxmPgyVnMTtMcRU5qtmEo6hjhrB05bppGQFAiCDilM6PHFJ+oN
+            1IDOXCoqiDwS2Yxm7IQrw/7WvHqngTwwJyxjy6q4bgocgrnSqKzqoE0pBZvX1oGN
+            1Num+9u+XwWAb2m9QUJAiWy9R16AgDD9Gp3ekArwztlMSWrXnIGz/zUL+ehh3avS
+            XgH1P2d8+QPjhrXq9Hyu9wANeL1Z1qQFKTTe9ReqRUc+B4Ts8ACf26FYSneksgJd
+            2lyesmgmrGlFzGCVdPCBOuCPCicP/w28WzYUI7amzraPa5kHEhl3wzkQiTE710c=
+            =XaqU
+            -----END PGP MESSAGE-----
+          fp: 1E0CF38FF7C9ADAED58B436ABA4A3D3607E5BA8E!
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/configs/longhorn-jobs/kustomization.yaml
+++ b/configs/longhorn-jobs/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - recurring-job-backup.yaml
-  - recurring-job-snapshot.yaml
-  - recurring-job-trim.yaml
--- a/configs/longhorn-jobs/longhorn-jobs.yaml
+++ b/configs/longhorn-jobs/longhorn-jobs.yaml
@@ -1,16 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: longhorn-jobs
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: longhorn
-  sourceRef:
-    kind: ExternalArtifact
-    name: longhorn-jobs
-  prune: true
-  wait: true
--- a/configs/longhorn-jobs/recurring-job-backup.yaml
+++ b/configs/longhorn-jobs/recurring-job-backup.yaml
@@ -1,14 +0,0 @@
-apiVersion: longhorn.io/v1beta2
-kind: RecurringJob
-metadata:
-  name: backup
-  namespace: longhorn-system
-spec:
-  cron: "0 5 * * *"
-  task: "backup"
-  retain: 14
-  concurrency: 1
-  groups:
-    - default
-  parameters:
-    full-backup-interval: "7"
--- a/configs/longhorn-jobs/recurring-job-snapshot.yaml
+++ b/configs/longhorn-jobs/recurring-job-snapshot.yaml
@@ -1,12 +0,0 @@
-apiVersion: longhorn.io/v1beta2
-kind: RecurringJob
-metadata:
-  name: snapshot
-  namespace: longhorn-system
-spec:
-  cron: "0 */12 * * *"
-  task: "snapshot"
-  retain: 14
-  concurrency: 1
-  groups:
-    - default
--- a/configs/longhorn-jobs/recurring-job-trim.yaml
+++ b/configs/longhorn-jobs/recurring-job-trim.yaml
@@ -1,11 +0,0 @@
-apiVersion: longhorn.io/v1beta2
-kind: RecurringJob
-metadata:
-  name: trim
-  namespace: longhorn-system
-spec:
-  cron: "0 0 7 * *"
-  task: "filesystem-trim"
-  concurrency: 1
-  groups:
-    - default
--- a/controllers/artifacts.yaml
+++ b/controllers/artifacts.yaml
@@ -19,28 +19,13 @@ spec:
      copy:
        - from: "@foundation/controllers/cert-manager/**"
          to: "@artifact/"
+    - name: spegel
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/spegel/**"
+          to: "@artifact/"
    - name: openebs
      originRevision: "@foundation"
      copy:
        - from: "@foundation/controllers/openebs/**"
          to: "@artifact/"
-    - name: longhorn
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/longhorn/**"
-          to: "@artifact/"
-    - name: local-path-provisioner
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/local-path-provisioner**"
-          to: "@artifact/"
-    - name: cnpg
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/cnpg/**"
-          to: "@artifact/"
-    - name: reflector
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/reflector/**"
-          to: "@artifact/"
--- a/controllers/cert-manager/oci-repository.yaml
+++ b/controllers/cert-manager/oci-repository.yaml
@@ -10,4 +10,4 @@ spec:
    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
    operation: copy
  ref:
-    semver: "1.19.x"
+    semver: "1.x"
--- a/controllers/cilium/base/helm-release.yaml
+++ b/controllers/cilium/base/helm-release.yaml
@@ -17,7 +17,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      version: "1.18.x"
+      version: "1.x"
      sourceRef:
        kind: HelmRepository
        name: cilium
--- a/controllers/cnpg/base/helm-release.yaml
+++ b/controllers/cnpg/base/helm-release.yaml
@@ -1,29 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cnpg
-  namespace: cnpg-system
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: cloudnative-pg
-      version: "0.27.x"
-      sourceRef:
-        kind: HelmRepository
-        name: cnpg
-      interval: 24h
-  valuesFrom:
-    - kind: ConfigMap
-      name: values-base
-    - kind: ConfigMap
-      name: values-overlay
-      optional: true
--- a/controllers/cnpg/base/helm-repository.yaml
+++ b/controllers/cnpg/base/helm-repository.yaml
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cnpg
-  namespace: cnpg-system
-spec:
-  interval: 24h
-  url: https://cloudnative-pg.github.io/charts
--- a/controllers/cnpg/base/kustomization.yaml
+++ b/controllers/cnpg/base/kustomization.yaml
@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
-  - https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.9.0/manifest.yaml
-
-configurations:
-  - name-reference.yaml
-
-configMapGenerator:
-  - name: values-base
-    namespace: cnpg-system
-    files:
-      - values.yaml
--- a/controllers/cnpg/base/name-reference.yaml
+++ b/controllers/cnpg/base/name-reference.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: ConfigMap
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
--- a/controllers/cnpg/base/namespace.yaml
+++ b/controllers/cnpg/base/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cnpg-system
--- a/controllers/cnpg/base/values.yaml
+++ b/controllers/cnpg/base/values.yaml
--- a/controllers/cnpg/production/kustomization.yaml
+++ b/controllers/cnpg/production/kustomization.yaml
@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: cnpg-system
-    files:
-      - values.yaml
--- a/controllers/cnpg/production/values.yaml
+++ b/controllers/cnpg/production/values.yaml
@@ -1 +0,0 @@
-replicaCount: 2
--- a/controllers/cnpg/staging/kustomization.yaml
+++ b/controllers/cnpg/staging/kustomization.yaml
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - secret-s3-garage.enc.yaml
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: cnpg-system
-    files:
-      - values.yaml
--- a/controllers/cnpg/staging/secret-s3-garage.enc.yaml
+++ b/controllers/cnpg/staging/secret-s3-garage.enc.yaml
@@ -1,57 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: s3-garage
-    namespace: cnpg-system
-    annotations:
-        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-type: Opaque
-stringData:
-    ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
-    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:INipEOcpPSij6TDu+bCuMOdsGm58nEBC4UJfEGRqeMmXZ9A+EBrMiRL6z3s29uz4qdqwZ3C8E4PVz01/41bMEA==,iv:x+gku8q7efHaaMpD/dc19IrwmK2gDp04bjH8WN/xhkc=,tag:QiSF6B8IqMrCsOUCe8c0bw==,type:str]
-    REGION: ENC[AES256_GCM,data:WIGPWwii,iv:ZdP5uNYqa8CZxa/xyrYXxGvE9fzt95slzwpzSzRy9DY=,tag:yANYtLzJCL/1pcvBXY7X7g==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
-            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
-            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
-            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
-            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
-            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
-            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
-            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
-            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-18T02:50:50Z"
-    mac: ENC[AES256_GCM,data:+kfs0EDnnZNnHMf91P6rAN52lugHFO4XcNJiKLpXt7bfTSMbiwgVbvRElXGTbLXLVSz70uZyzV/mt0ZcfEfPbwE/Pdh6SmFiWwQwLT1M50MdrxAWWYvSCS9r4h1Cow3N3K2/dXH7N/4AVHTg3ohXlP92fxVh1wL0cVnke/lcQgY=,iv:M5n9+lgq0fBx5Yg1e0N6v0obbnmarvVwIHAjCr5XmM4=,tag:NBA01MtG40T3nST7b00tiw==,type:str]
-    pgp:
-        - created_at: "2025-12-11T23:56:15Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
-            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
-            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
-            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
-            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
-            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
-            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
-            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
-            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
-            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
-            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
-            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
-            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
-            =/yAN
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/controllers/cnpg/staging/values.yaml
+++ b/controllers/cnpg/staging/values.yaml
@@ -1 +0,0 @@
-replicaCount: 1
--- a/controllers/local-path-provisioner/kustomization.yaml
+++ b/controllers/local-path-provisioner/kustomization.yaml
@@ -1,28 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - github.com/rancher/local-path-provisioner/deploy?ref=v0.0.32
-patches:
-  - patch: |-
-      kind: ConfigMap
-      apiVersion: v1
-      metadata:
-        name: local-path-config
-        namespace: local-path-storage
-      data:
-        config.json: |-
-          {
-                  "nodePathMap":[
-                  {
-                          "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
-                          "paths":["/var/mnt/local-path-provisioner"]
-                  }
-                  ]
-          }
-  - patch: |-
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: local-path-storage
-        labels:
-          pod-security.kubernetes.io/enforce: privileged
--- a/controllers/local-path-provisioner/local-path-provisioner.yaml
+++ b/controllers/local-path-provisioner/local-path-provisioner.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: local-path-provisioner
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: ExternalArtifact
-    name: local-path-provisioner
-  path: ./
-  prune: true
-  wait: true
--- a/controllers/longhorn/base/helm-release.yaml
+++ b/controllers/longhorn/base/helm-release.yaml
@@ -1,29 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: longhorn
-      version: "1.10.x"
-      sourceRef:
-        kind: HelmRepository
-        name: longhorn
-      interval: 24h
-  valuesFrom:
-    - kind: ConfigMap
-      name: values-base
-    - kind: ConfigMap
-      name: values-overlay
-      optional: true
--- a/controllers/longhorn/base/helm-repository.yaml
+++ b/controllers/longhorn/base/helm-repository.yaml
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 24h
-  url: https://charts.longhorn.io
--- a/controllers/longhorn/base/kustomization.yaml
+++ b/controllers/longhorn/base/kustomization.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
-
-configurations:
-  - name-reference.yaml
-
-configMapGenerator:
-  - name: values-base
-    namespace: longhorn-system
-    files:
-      - values.yaml
--- a/controllers/longhorn/base/name-reference.yaml
+++ b/controllers/longhorn/base/name-reference.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: ConfigMap
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
--- a/controllers/longhorn/base/namespace.yaml
+++ b/controllers/longhorn/base/namespace.yaml
@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: longhorn-system
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged
-    pod-security.kubernetes.io/audit: privileged
--- a/controllers/longhorn/base/values.yaml
+++ b/controllers/longhorn/base/values.yaml
@@ -1,13 +0,0 @@
-defaultSettings:
-  defaultDataPath: /var/mnt/longhorn
-  replicaAutoBalance: best-effort
-  defaultDataLocality: best-effort
-  freezeFilesystemForSnapshot: true
-  storageReservedPercentageForDefaultDisk: 0
-  storageMinimalAvailablePercentage: 10
-  storageOverProvisioningPercentage: 25
-persistence:
-  defaultDataLocality: best-effort
-defaultBackupStore:
-  backupTarget: s3://longhorn-backup@garage/
-  backupTargetCredentialSecret: s3-garage
--- a/controllers/longhorn/longhorn.yaml
+++ b/controllers/longhorn/longhorn.yaml
@@ -1,19 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: longhorn
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: ExternalArtifact
-    name: longhorn
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  path: ./${cluster_env}
-  prune: true
-  wait: true
--- a/controllers/longhorn/production/kustomization.yaml
+++ b/controllers/longhorn/production/kustomization.yaml
@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: longhorn-system
-    files:
-      - values.yaml
--- a/controllers/longhorn/production/values.yaml
+++ b/controllers/longhorn/production/values.yaml
@@ -1,4 +0,0 @@
-defaultSettings:
-  defaultReplicaCount: 2
-persistence:
-  defaultClassReplicaCount: 2
--- a/controllers/longhorn/staging/kustomization.yaml
+++ b/controllers/longhorn/staging/kustomization.yaml
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - secret-s3-garage.enc.yaml
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: longhorn-system
-    files:
-      - values.yaml
--- a/controllers/longhorn/staging/secret-s3-garage.enc.yaml
+++ b/controllers/longhorn/staging/secret-s3-garage.enc.yaml
@@ -1,55 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: s3-garage
-    namespace: longhorn-system
-type: Opaque
-stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Z61V0zZ0sApVz8gP+Yc6LTKQcW0jdRaWXa4=,iv:SpLgdgI4Yc48NYNb9wE3C28ixBg8vu5tTf7bUENMfrE=,tag:DDbqGvSbcpDxzPUpHbhLKA==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:FK/BS+rXAD2sXND6zHJ2G/GIcFIe01kL/1WP1RJNX86Jc9aCra26+FQQ4zU0Uanh8tQqSzf2qMwK1uMkr/SI4A==,iv:36UsdtiRN3fPr+HtRHSad7oEetiJh56sq+Ypyq/W5FA=,tag:rYHPuCOCHA+YoEKdfN8P0g==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:2iB2cf1E4ucxJEDGRpe2wiX9yMCZA1A=,iv:c+izWJ+i7lHybZlU9yKS5Q+Zj9lOGysCbewz9iRud3M=,tag:UX4zr9dguSAUBqm1xJnNJQ==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
-            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
-            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
-            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
-            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
-            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
-            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
-            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
-            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-15T03:54:35Z"
-    mac: ENC[AES256_GCM,data:mXl4RyNkiUa0siCcB74fcRb2WLkak64qCVwaPnx3dG+BE1pwfLJUocXs13ueaVFlAwqAFD5ZN0B+yiEqxk7DXvga5/S1zewJIFHAeOdG9sW3lNJaCHXjgkg4GBOpCii173bUIl5QTp9fgEFLsc6IFsXcalhXOIdiJtV9zj5xlHQ=,iv:4atqqw9claajWbXH2YBQ0cA89ZdaiqFHwKrhOxMBVLk=,tag:NtwG2L1XZCCuTp5Q8ygJ5g==,type:str]
-    pgp:
-        - created_at: "2025-12-11T23:56:15Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
-            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
-            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
-            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
-            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
-            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
-            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
-            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
-            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
-            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
-            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
-            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
-            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
-            =/yAN
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/controllers/longhorn/staging/values.yaml
+++ b/controllers/longhorn/staging/values.yaml
@@ -1,4 +0,0 @@
-defaultSettings:
-  defaultReplicaCount: 1
-persistence:
-  defaultClassReplicaCount: 1
--- a/controllers/openebs/helm-release.yaml
+++ b/controllers/openebs/helm-release.yaml
@@ -22,26 +22,16 @@ spec:
        name: openebs
      interval: 24h
  values:
-    loki:
-      enabled: false
-    alloy:
-      enabled: false
    mayastor:
-      etcd:
-        replicaCount: 1
-      nats:
-        cluster:
-          replicas: 1
-      eventing:
-        enabled: false
-      obs:
-        callhome:
-          enabled: false
      csi:
        node:
          initContainers:
            enabled: false
    engines:
+      # Disable for now while we set up local storage
+      replicated:
+        mayastor:
+          enabled: false
      local:
        lvm:
          enabled: false
--- a/controllers/openebs/namespace.yaml
+++ b/controllers/openebs/namespace.yaml
@@ -4,5 +4,3 @@ metadata:
  name: openebs
  labels:
    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged
-    pod-security.kubernetes.io/audit: privileged
--- a/controllers/reflector/helm-release.yaml
+++ b/controllers/reflector/helm-release.yaml
@@ -1,23 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: reflector
-  namespace: reflector
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: reflector
-      version: "9.1.x"
-      sourceRef:
-        kind: HelmRepository
-        name: reflector
-      interval: 24h
--- a/controllers/reflector/helm-repository.yaml
+++ b/controllers/reflector/helm-repository.yaml
@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: reflector
-  namespace: reflector
-spec:
-  type: "oci"
-  interval: 24h
-  url: oci://ghcr.io/emberstack/helm-charts
--- a/controllers/reflector/kustomization.yaml
+++ b/controllers/reflector/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dreaded_X	71283a3ef7	feat: Added OpenEBS local storage	2025-12-03 04:45:54 +01:00
Dreaded_X	b6f6ee65c5	feat: Use pre-generated deploy key	2025-12-03 04:45:54 +01:00
Dreaded_X	e19e14e761	chore: Added pre-commit hooks	2025-12-02 05:10:18 +01:00
Dreaded_X	8fc8a589b7	feat: Added spegel	2025-12-02 05:09:27 +01:00