alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 8 Actions 1 Activity

Merge pull request 'Automated Manifest Update' (#5643) from auto/update-manifests into manifests

Browse Source 
Reviewed-on: #5643
This commit was merged in pull request #5643.
This commit is contained in:
Alex Lebens
2026-04-07 02:34:24 +00:00
parent 2bf392a1e3 85aff4c3b0
commit 46dea3cfef
18 changed files with 125 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-external.yaml
View File

@@ -23,6 +23,9 @@ spec:
monthly: 3 monthly: 3
weekly: 4 weekly: 4
yearly: 1 yearly: 1
moverSecurityContext:
runAsGroup: 1337
runAsUser: 1337
copyMethod: Snapshot copyMethod: Snapshot
storageClassName: ceph-block storageClassName: ceph-block
volumeSnapshotClassName: ceph-blockpool-snapshot volumeSnapshotClassName: ceph-blockpool-snapshot

3
clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-local.yaml
View File

@@ -23,6 +23,9 @@ spec:
monthly: 3 monthly: 3
weekly: 4 weekly: 4
yearly: 1 yearly: 1
moverSecurityContext:
runAsGroup: 1337
runAsUser: 1337
copyMethod: Snapshot copyMethod: Snapshot
storageClassName: ceph-block storageClassName: ceph-block
volumeSnapshotClassName: ceph-blockpool-snapshot volumeSnapshotClassName: ceph-blockpool-snapshot

3
clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-remote.yaml
View File

@@ -23,6 +23,9 @@ spec:
monthly: 3 monthly: 3
weekly: 4 weekly: 4
yearly: 1 yearly: 1
moverSecurityContext:
runAsGroup: 1337
runAsUser: 1337
copyMethod: Snapshot copyMethod: Snapshot
storageClassName: ceph-block storageClassName: ceph-block
volumeSnapshotClassName: ceph-blockpool-snapshot volumeSnapshotClassName: ceph-blockpool-snapshot

4
clusters/cl01tl/manifests/tailscale-operator/Deployment-operator.yaml
View File

@@ -22,7 +22,7 @@ spec:
secretName: operator-oauth secretName: operator-oauth
containers: containers:
- name: operator - name: operator
image: tailscale/k8s-operator:v1.94.2 image: tailscale/k8s-operator@sha256:7956bd50dca9dc804b98720df94d112b54af85449ed0bf8cc7fad0346b225067
imagePullPolicy: Always imagePullPolicy: Always
env: env:
- name: OPERATOR_INITIAL_TAGS - name: OPERATOR_INITIAL_TAGS
@@ -46,7 +46,7 @@ spec:
- name: CLIENT_SECRET_FILE - name: CLIENT_SECRET_FILE
value: /oauth/client_secret value: /oauth/client_secret
- name: PROXY_IMAGE - name: PROXY_IMAGE
value: tailscale/tailscale:v1.94.2 value: tailscale/tailscale@sha256:95e528798bebe75f39b10e74e7051cf51188ee615934f232ba7ad06a3390ffa1
- name: PROXY_TAGS - name: PROXY_TAGS
value: tag:k8s value: tag:k8s
- name: APISERVER_PROXY - name: APISERVER_PROXY

6
clusters/cl01tl/manifests/tailscale-operator/ExternalSecret-operator-oauth.yaml
View File

@@ -14,15 +14,9 @@ spec:
data: data:
- secretKey: client_id - secretKey: client_id
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /tailscale/k8s-operator key: /tailscale/k8s-operator
metadataPolicy: None
property: clientId property: clientId
- secretKey: client_secret - secretKey: client_secret
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /tailscale/k8s-operator key: /tailscale/k8s-operator
metadataPolicy: None
property: clientSecret property: clientSecret

137
clusters/cl01tl/manifests/talos/ConfigMap-talos-prune-script.yaml
View File

@@ -12,91 +12,138 @@ data:
DATE_RANGE=$(date -d @$(( $(date +%s) - $DATE_RANGE_SECONDS )) +%Y-%m-%dT%H:%M:%SZ); DATE_RANGE=$(date -d @$(( $(date +%s) - $DATE_RANGE_SECONDS )) +%Y-%m-%dT%H:%M:%SZ);
FILE_MATCH="${BUCKET}/cl01tl/etcd/cl01tl-${DATE_RANGE}.snap.age"; FILE_MATCH="${BUCKET}/cl01tl/etcd/cl01tl-${DATE_RANGE}.snap.age";
ERROR=false; ERROR=false;
MESSAGE="";
echo " "; echo "";
echo ">> Running S3 prune for Talos backup repository ${TARGET} ..."; echo ">> Running S3 prune for Talos backup repository ${TARGET} ...";
echo " "; echo "";
echo ">> Configured Date Range is $(date -u -d @${DATE_RANGE_SECONDS} +"%j days, %H hours, %M minutes")"; echo ">> Configured Date Range is $(date -u -d @${DATE_RANGE_SECONDS} +"%j days, %H hours, %M minutes")";
echo ">> Backups prior to '$DATE_RANGE' will be removed"; echo ">> Backups prior to '$DATE_RANGE' will be removed";
echo "";
FILES=$(s3cmd ls --no-check-certificate ${BUCKET}/cl01tl/etcd/ | FILES=$(s3cmd ls --no-check-certificate ${BUCKET}/cl01tl/etcd/ |
awk -v file_match="$FILE_MATCH" '$4 < file_match {print $4}'); awk -v file_match="$FILE_MATCH" '$4 < file_match {print $4}');
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
ERROR=true; echo "";
echo " ";
echo ">> Detected error, will send message to ntfy"; echo ">> Detected error, will send message to ntfy";
ERROR=true;
MESSAGE="Error collecting files to delete from '${TARGET}'";
elif [ -n "${FILES}" ]; then elif [ -n "${FILES}" ]; then
echo " "; echo "";
echo ">> Backups to be removed:"; echo ">> Backups to be removed:";
echo "$FILES" echo "";
echo " "; echo "$FILES";
echo "";
echo ">> Deleting ..."; echo ">> Deleting ...";
$FILES | while read file; do
s3cmd del --no-check-certificate -v "$file"; for file in $FILES; do
s3cmd del --no-check-certificate -v "${file}";
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
ERROR=true;
echo ">> Detected error, will send message to ntfy"; echo ">> Detected error, will send message to ntfy";
ERROR=true;
MESSAGE="Error deleting file from '${TARGET}'";
fi; fi;
done; done;
else else
echo " "; echo "";
echo ">> No backups to remove"; echo ">> No backups to remove";
exit 0;
fi; fi;
if [ "$ERROR" = "true" ]; then MAX_RETRIES=5;
SUCCESS=false;
MAX_RETRIES=5; echo "";
SUCCESS=false; echo ">> Sending message to ntfy using curl ...";
echo " "; echo "";
echo ">> Sending message to ntfy using curl ..."; echo ">> Verifying required commands ...";
echo " "; for i in $(seq 1 "$MAX_RETRIES"); do
echo ">> Verifying required commands ..."; if apk update >/dev/null 2>&1; then
echo ">> Attempt $i: Repositories are reachable";
for i in $(seq 1 "$MAX_RETRIES"); do SUCCESS=true;
if apk update 2>&1 >/dev/null; then
echo ">> Attempt $i: Repositories are reachable";
SUCCESS=true;
break;
else
echo ">> Attempt $i: Connection failed, retrying in 5 seconds ...";
sleep 5;
fi;
done;
if [ "$SUCCESS" = false ]; then break;
echo ">> ERROR: Could not connect to apk repositories after $MAX_RETRIES attempts, exiting ...";
exit 1; else
fi echo ">> Attempt $i: Connection failed, retrying in 5 seconds ...";
sleep 5;
if ! command -v curl 2>&1 >/dev/null; then
echo ">> Command curl could not be found, installing";
apk add --no-cache -q curl;
if [ $? -eq 0 ]; then
echo ">> Installation successful";
else
echo ">> Installation failed with exit code $?";
exit 1;
fi;
fi; fi;
done;
echo " "; if [ "$SUCCESS" = false ]; then
echo ">> Sending to NTFY ..."; echo ">> ERROR: Could not connect to apk repositories after $MAX_RETRIES attempts, exiting ...";
exit 1;
fi
if ! command -v curl >/dev/null 2>&1; then
echo ">> Command curl could not be found, installing";
apk add --no-cache -q curl;
if [ $? -eq 0 ]; then
echo ">> Installation successful";
else
echo ">> Installation failed with exit code $?";
exit 1;
fi;
fi;
echo "";
echo ">> Sending to NTFY ...";
if [ "$ERROR" = "true" ]; then
HTTP_STATUS=$(curl \ HTTP_STATUS=$(curl \
--silent \ --silent \
--write-out '%{http_code}' \ --write-out '%{http_code}' \
-H "Authorization: Bearer ${NTFY_TOKEN}" \ -H "Authorization: Bearer ${NTFY_TOKEN}" \
-H "X-Priority: 5" \ -H "X-Priority: 5" \
-H "X-Tags: warning" \ -H "X-Tags: warning" \
-H "X-Title: Talos Backup Failed for ${TARGET}" \ -H "X-Title: Talos Backup Prune Failed for ${TARGET}" \
-d "$MESSAGE" \ -d "$MESSAGE" \
${NTFY_ENDPOINT}/${NTFY_TOPIC} ${NTFY_ENDPOINT}/${NTFY_TOPIC}
); );
echo ">> HTTP Status Code: $HTTP_STATUS";
exit 1;
else
MESSAGE="Pruned $(echo "$FILES" | wc -l) files"
HTTP_STATUS=$(curl \
--silent \
--write-out '%{http_code}' \
-H "Authorization: Bearer ${NTFY_TOKEN}" \
-H "X-Priority: 5" \
-H "X-Tags: warning" \
-H "X-Title: Talos Backup Prune Success for ${TARGET}" \
-d "$MESSAGE" \
${NTFY_ENDPOINT}/${NTFY_TOPIC}
);
echo ">> HTTP Status Code: $HTTP_STATUS"; echo ">> HTTP Status Code: $HTTP_STATUS";
fi; fi;
echo " "; echo "";
echo ">> Completed S3 prune for Talos backup repository ${TARGET}"; echo ">> Completed S3 prune for Talos backup repository ${TARGET}";

7
clusters/cl01tl/manifests/talos/CronJob-etcd-defrag-defrag-1.yaml
View File

@@ -12,8 +12,8 @@ metadata:
spec: spec:
suspend: false suspend: false
concurrencyPolicy: Forbid concurrencyPolicy: Forbid
startingDeadlineSeconds: 90 startingDeadlineSeconds: 30
timeZone: US/Central timeZone: America/Chicago
schedule: "0 0 * * 0" schedule: "0 0 * * 0"
successfulJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1 failedJobsHistoryLimit: 1
@@ -51,8 +51,7 @@ spec:
env: env:
- name: TALOSCONFIG - name: TALOSCONFIG
value: /tmp/.talos/config value: /tmp/.talos/config
image: ghcr.io/siderolabs/talosctl:v1.12.6 image: ghcr.io/siderolabs/talosctl:v1.12.6@sha256:a027cf02cf74a75eee83ccffa201f3a9455d77e795d092b87cae5e637f143e54
imagePullPolicy: IfNotPresent
name: main name: main
volumeMounts: volumeMounts:
- mountPath: /tmp/.talos/config - mountPath: /tmp/.talos/config

7
clusters/cl01tl/manifests/talos/CronJob-etcd-defrag-defrag-2.yaml
View File

@@ -12,8 +12,8 @@ metadata:
spec: spec:
suspend: false suspend: false
concurrencyPolicy: Forbid concurrencyPolicy: Forbid
startingDeadlineSeconds: 90 startingDeadlineSeconds: 30
timeZone: US/Central timeZone: America/Chicago
schedule: "10 0 * * 0" schedule: "10 0 * * 0"
successfulJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1 failedJobsHistoryLimit: 1
@@ -51,8 +51,7 @@ spec:
env: env:
- name: TALOSCONFIG - name: TALOSCONFIG
value: /tmp/.talos/config value: /tmp/.talos/config
image: ghcr.io/siderolabs/talosctl:v1.12.6 image: ghcr.io/siderolabs/talosctl:v1.12.6@sha256:a027cf02cf74a75eee83ccffa201f3a9455d77e795d092b87cae5e637f143e54
imagePullPolicy: IfNotPresent
name: main name: main
volumeMounts: volumeMounts:
- mountPath: /tmp/.talos/config - mountPath: /tmp/.talos/config

7
clusters/cl01tl/manifests/talos/CronJob-etcd-defrag-defrag-3.yaml
View File

@@ -12,8 +12,8 @@ metadata:
spec: spec:
suspend: false suspend: false
concurrencyPolicy: Forbid concurrencyPolicy: Forbid
startingDeadlineSeconds: 90 startingDeadlineSeconds: 30
timeZone: US/Central timeZone: America/Chicago
schedule: "20 0 * * 0" schedule: "20 0 * * 0"
successfulJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1 failedJobsHistoryLimit: 1
@@ -51,8 +51,7 @@ spec:
env: env:
- name: TALOSCONFIG - name: TALOSCONFIG
value: /tmp/.talos/config value: /tmp/.talos/config
image: ghcr.io/siderolabs/talosctl:v1.12.6 image: ghcr.io/siderolabs/talosctl:v1.12.6@sha256:a027cf02cf74a75eee83ccffa201f3a9455d77e795d092b87cae5e637f143e54
imagePullPolicy: IfNotPresent
name: main name: main
volumeMounts: volumeMounts:
- mountPath: /tmp/.talos/config - mountPath: /tmp/.talos/config

10
clusters/cl01tl/manifests/talos/CronJob-talos-external.yaml
View File

@@ -12,8 +12,8 @@ metadata:
spec: spec:
suspend: false suspend: false
concurrencyPolicy: Forbid concurrencyPolicy: Forbid
startingDeadlineSeconds: 90 startingDeadlineSeconds: 30
timeZone: US/Central timeZone: America/Chicago
schedule: "0 4 * * *" schedule: "0 4 * * *"
successfulJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1 failedJobsHistoryLimit: 1
@@ -73,8 +73,7 @@ spec:
name: talos-etcd-backup-external-secret name: talos-etcd-backup-external-secret
- name: USE_PATH_STYLE - name: USE_PATH_STYLE
value: "false" value: "false"
image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3-5-g07d09ec@sha256:96054af026b6255ec14d198f2f10ad6c813b335a2e21a76804365c053dd4ba7b image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3-7-ge8e193c@sha256:d6f98bf2817bb0bd46be49e41251e24d713945a6af6e893529cc17d524187953
imagePullPolicy: IfNotPresent
name: backup name: backup
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
@@ -111,8 +110,7 @@ spec:
name: talos-etcd-backup-external-secret name: talos-etcd-backup-external-secret
- secretRef: - secretRef:
name: talos-backup-ntfy-secret name: talos-backup-ntfy-secret
image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be image: d3fk/s3cmd:latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
imagePullPolicy: IfNotPresent
name: s3-prune name: s3-prune
volumeMounts: volumeMounts:
- mountPath: /scripts/prune.sh - mountPath: /scripts/prune.sh

10
clusters/cl01tl/manifests/talos/CronJob-talos-local.yaml
View File

@@ -12,8 +12,8 @@ metadata:
spec: spec:
suspend: false suspend: false
concurrencyPolicy: Forbid concurrencyPolicy: Forbid
startingDeadlineSeconds: 90 startingDeadlineSeconds: 30
timeZone: US/Central timeZone: America/Chicago
schedule: "0 2 * * *" schedule: "0 2 * * *"
successfulJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1 failedJobsHistoryLimit: 1
@@ -73,8 +73,7 @@ spec:
name: talos-etcd-backup-local-secret name: talos-etcd-backup-local-secret
- name: USE_PATH_STYLE - name: USE_PATH_STYLE
value: "false" value: "false"
image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3@sha256:05c86663b251a407551dc948097e32e163a345818117eb52c573b0447bd0c7a7 image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3-7-ge8e193c@sha256:d6f98bf2817bb0bd46be49e41251e24d713945a6af6e893529cc17d524187953
imagePullPolicy: IfNotPresent
name: backup name: backup
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
@@ -111,8 +110,7 @@ spec:
name: talos-etcd-backup-local-secret name: talos-etcd-backup-local-secret
- secretRef: - secretRef:
name: talos-backup-ntfy-secret name: talos-backup-ntfy-secret
image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be image: d3fk/s3cmd:latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
imagePullPolicy: IfNotPresent
name: s3-prune name: s3-prune
volumeMounts: volumeMounts:
- mountPath: /scripts/prune.sh - mountPath: /scripts/prune.sh

12
clusters/cl01tl/manifests/talos/CronJob-talos-remote.yaml
View File

@@ -10,10 +10,10 @@ metadata:
helm.sh/chart: etcd-backup-4.6.2 helm.sh/chart: etcd-backup-4.6.2
namespace: talos namespace: talos
spec: spec:
suspend: true suspend: false
concurrencyPolicy: Forbid concurrencyPolicy: Forbid
startingDeadlineSeconds: 90 startingDeadlineSeconds: 30
timeZone: US/Central timeZone: America/Chicago
schedule: "0 3 * * *" schedule: "0 3 * * *"
successfulJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1 failedJobsHistoryLimit: 1
@@ -73,8 +73,7 @@ spec:
name: talos-etcd-backup-remote-secret name: talos-etcd-backup-remote-secret
- name: USE_PATH_STYLE - name: USE_PATH_STYLE
value: "false" value: "false"
image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3@sha256:05c86663b251a407551dc948097e32e163a345818117eb52c573b0447bd0c7a7 image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3-7-ge8e193c@sha256:d6f98bf2817bb0bd46be49e41251e24d713945a6af6e893529cc17d524187953
imagePullPolicy: IfNotPresent
name: backup name: backup
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
@@ -111,8 +110,7 @@ spec:
name: talos-etcd-backup-remote-secret name: talos-etcd-backup-remote-secret
- secretRef: - secretRef:
name: talos-backup-ntfy-secret name: talos-backup-ntfy-secret
image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be image: d3fk/s3cmd:latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
imagePullPolicy: IfNotPresent
name: s3-prune name: s3-prune
volumeMounts: volumeMounts:
- mountPath: /scripts/prune.sh - mountPath: /scripts/prune.sh

9
clusters/cl01tl/manifests/talos/ExternalSecret-talos-backup-ntfy-secret.yaml
View File

@@ -14,22 +14,13 @@ spec:
data: data:
- secretKey: NTFY_TOKEN - secretKey: NTFY_TOKEN
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /ntfy/user/cl01tl key: /ntfy/user/cl01tl
metadataPolicy: None
property: token property: token
- secretKey: NTFY_ENDPOINT - secretKey: NTFY_ENDPOINT
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /ntfy/user/cl01tl key: /ntfy/user/cl01tl
metadataPolicy: None
property: endpoint property: endpoint
- secretKey: NTFY_TOPIC - secretKey: NTFY_TOPIC
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/talos/etcd-backup key: /cl01tl/talos/etcd-backup
metadataPolicy: None
property: NTFY_TOPIC property: NTFY_TOPIC

15
clusters/cl01tl/manifests/talos/ExternalSecret-talos-etcd-backup-external-secret.yaml
View File

@@ -14,36 +14,21 @@ spec:
data: data:
- secretKey: AWS_ACCESS_KEY_ID - secretKey: AWS_ACCESS_KEY_ID
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/etcd-backup key: /digital-ocean/home-infra/etcd-backup
metadataPolicy: None
property: AWS_ACCESS_KEY_ID property: AWS_ACCESS_KEY_ID
- secretKey: AWS_SECRET_ACCESS_KEY - secretKey: AWS_SECRET_ACCESS_KEY
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/etcd-backup key: /digital-ocean/home-infra/etcd-backup
metadataPolicy: None
property: AWS_SECRET_ACCESS_KEY property: AWS_SECRET_ACCESS_KEY
- secretKey: .s3cfg - secretKey: .s3cfg
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/etcd-backup key: /digital-ocean/home-infra/etcd-backup
metadataPolicy: None
property: s3cfg property: s3cfg
- secretKey: BUCKET - secretKey: BUCKET
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/etcd-backup key: /digital-ocean/home-infra/etcd-backup
metadataPolicy: None
property: BUCKET property: BUCKET
- secretKey: AGE_X25519_PUBLIC_KEY - secretKey: AGE_X25519_PUBLIC_KEY
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/talos/etcd-backup key: /cl01tl/talos/etcd-backup
metadataPolicy: None
property: AGE_X25519_PUBLIC_KEY property: AGE_X25519_PUBLIC_KEY

15
clusters/cl01tl/manifests/talos/ExternalSecret-talos-etcd-backup-local-secret.yaml
View File

@@ -14,36 +14,21 @@ spec:
data: data:
- secretKey: AWS_ACCESS_KEY_ID - secretKey: AWS_ACCESS_KEY_ID
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: ACCESS_KEY_ID property: ACCESS_KEY_ID
- secretKey: AWS_SECRET_ACCESS_KEY - secretKey: AWS_SECRET_ACCESS_KEY
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: ACCESS_SECRET_KEY property: ACCESS_SECRET_KEY
- secretKey: .s3cfg - secretKey: .s3cfg
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: s3cfg-local property: s3cfg-local
- secretKey: BUCKET - secretKey: BUCKET
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: BUCKET property: BUCKET
- secretKey: AGE_X25519_PUBLIC_KEY - secretKey: AGE_X25519_PUBLIC_KEY
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/talos/etcd-backup key: /cl01tl/talos/etcd-backup
metadataPolicy: None
property: AGE_X25519_PUBLIC_KEY property: AGE_X25519_PUBLIC_KEY

15
clusters/cl01tl/manifests/talos/ExternalSecret-talos-etcd-backup-remote-secret.yaml
View File

@@ -14,36 +14,21 @@ spec:
data: data:
- secretKey: AWS_ACCESS_KEY_ID - secretKey: AWS_ACCESS_KEY_ID
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: ACCESS_KEY_ID property: ACCESS_KEY_ID
- secretKey: AWS_SECRET_ACCESS_KEY - secretKey: AWS_SECRET_ACCESS_KEY
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: ACCESS_SECRET_KEY property: ACCESS_SECRET_KEY
- secretKey: .s3cfg - secretKey: .s3cfg
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: s3cfg-remote property: s3cfg-remote
- secretKey: BUCKET - secretKey: BUCKET
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/talos-backups key: /garage/home-infra/talos-backups
metadataPolicy: None
property: BUCKET property: BUCKET
- secretKey: AGE_X25519_PUBLIC_KEY - secretKey: AGE_X25519_PUBLIC_KEY
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/talos/etcd-backup key: /cl01tl/talos/etcd-backup
metadataPolicy: None
property: AGE_X25519_PUBLIC_KEY property: AGE_X25519_PUBLIC_KEY

3
clusters/cl01tl/manifests/talos/ExternalSecret-talos-etcd-defrag-secret.yaml
View File

@@ -14,8 +14,5 @@ spec:
data: data:
- secretKey: config - secretKey: config
remoteRef: remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/talos/etcd-defrag key: /cl01tl/talos/etcd-defrag
metadataPolicy: None
property: config property: config

3
clusters/cl01tl/manifests/vault/CronJob-vault-snapshot.yaml
View File

@@ -75,7 +75,6 @@ spec:
- secretRef: - secretRef:
name: vault-backup-ntfy-secret name: vault-backup-ntfy-secret
image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
imagePullPolicy: IfNotPresent
name: s3-backup-external name: s3-backup-external
volumeMounts: volumeMounts:
- mountPath: /opt/backup - mountPath: /opt/backup
@@ -105,7 +104,6 @@ spec:
- secretRef: - secretRef:
name: vault-backup-ntfy-secret name: vault-backup-ntfy-secret
image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
imagePullPolicy: IfNotPresent
name: s3-backup-local name: s3-backup-local
volumeMounts: volumeMounts:
- mountPath: /opt/backup - mountPath: /opt/backup
@@ -135,7 +133,6 @@ spec:
- secretRef: - secretRef:
name: vault-backup-ntfy-secret name: vault-backup-ntfy-secret
image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be image: d3fk/s3cmd:latest@sha256:e3965f8205dfb96fb00e66cee54a0d171f1829a3cc6a1bbb980ab076730e54be
imagePullPolicy: IfNotPresent
name: s3-backup-remote name: s3-backup-remote
volumeMounts: volumeMounts:
- mountPath: /opt/backup - mountPath: /opt/backup