Automated Manifest Update (#2184)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow. Reviewed-on: #2184 Co-authored-by: gitea-bot <gitea-bot@alexlebens.net> Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>
2025-12-03 02:49:22 +00:00
parent b03cfa613d
commit 989b180888
18 changed files with 77722 additions and 299 deletions
--- a/clusters/cl01tl/manifests/bazarr/bazarr.yaml
+++ b/clusters/cl01tl/manifests/bazarr/bazarr.yaml
@@ -138,7 +138,7 @@ spec:
            value: "1000"
          - name: PGID
            value: "1000"
-          image: ghcr.io/linuxserver/bazarr:1.5.3@sha256:2be164c02c0bb311b6c32e57d3d0ddc2813d524e89ab51a3408c1bf6fafecda5
+          image: ghcr.io/linuxserver/bazarr:1.5.3@sha256:ec11e988e8e13411c994a4d9f43ed9b97409aa92c1da54d9f23926c3da7c2032
          imagePullPolicy: IfNotPresent
          name: main
          resources:
--- a/clusters/cl01tl/manifests/cilium/cilium.yaml
+++ b/clusters/cl01tl/manifests/cilium/cilium.yaml
--- a/clusters/cl01tl/manifests/coredns/coredns.yaml
+++ b/clusters/cl01tl/manifests/coredns/coredns.yaml
@@ -0,0 +1,303 @@
+---
+# Source: coredns/charts/coredns/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: coredns
+  namespace: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+---
+# Source: coredns/charts/coredns/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+data:
+  Corefile: |-
+    dns://.:53 {
+        errors
+        health {
+            lameduck 5s
+        }
+        ready
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+            pods insecure
+            fallthrough in-addr.arpa ip6.arpa
+            ttl 30
+        }
+        prometheus :9153
+        forward . /etc/resolv.conf
+        cache 30
+        loop
+        reload
+        loadbalance
+    }
+    dns://alexlebens.net:53 {
+        errors
+        cache 30
+        forward . 10.111.232.172
+    }
+    dns://ts.net:53 {
+        errors
+        cache 30
+        forward . 10.97.20.219
+    }
+---
+# Source: coredns/charts/coredns/templates/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - services
+  - pods
+  - namespaces
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - list
+  - watch
+---
+# Source: coredns/charts/coredns/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: coredns
+subjects:
+- kind: ServiceAccount
+  name: coredns
+  namespace: coredns
+---
+# Source: coredns/charts/coredns/templates/service-metrics.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coredns-metrics
+  namespace: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+    app.kubernetes.io/component: metrics
+  annotations:
+    prometheus.io/port: "9153"
+    prometheus.io/scrape: "true"
+spec:
+  selector:
+    app.kubernetes.io/instance: "coredns"
+    k8s-app: coredns
+    app.kubernetes.io/name: coredns
+  ports:
+  - name: metrics
+    port: 9153
+    targetPort: 9153
+---
+# Source: coredns/charts/coredns/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-dns
+  namespace: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+spec:
+  selector:
+    app.kubernetes.io/instance: "coredns"
+    k8s-app: coredns
+    app.kubernetes.io/name: coredns
+  clusterIP: 10.96.0.10
+  clusterIPs:
+  
+    - 10.96.0.10
+  ports:
+  - {"name":"udp-53","port":53,"protocol":"UDP","targetPort":53}
+  - {"name":"tcp-53","port":53,"protocol":"TCP","targetPort":53}
+  type: ClusterIP
+---
+# Source: coredns/charts/coredns/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coredns
+  namespace: coredns
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+    app.kubernetes.io/version: "v1.13.1"
+spec:
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 25%
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: "coredns"
+      k8s-app: coredns
+      app.kubernetes.io/name: coredns
+  template:
+    metadata:
+      labels:
+        k8s-app: coredns
+        app.kubernetes.io/name: coredns
+        app.kubernetes.io/instance: "coredns"
+      annotations:
+        checksum/config: c88338e27f92b25d827831c17939bcc66b53e4896251fe02edb9a06a05de4fc8
+        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
+    spec:
+      terminationGracePeriodSeconds: 30
+      serviceAccountName: coredns
+      priorityClassName: "system-cluster-critical"
+      dnsPolicy: Default
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists
+        - effect: NoSchedule
+          key: node.cloudprovider.kubernetes.io/uninitialized
+          operator: Exists
+      nodeSelector:
+        kubernetes.io/os: linux
+      containers:
+      - name: "coredns"
+        image: "registry.k8s.io/coredns/coredns:v1.13.1"
+        imagePullPolicy: IfNotPresent
+        args: [ "-conf", "/etc/coredns/Corefile" ]
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/coredns
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 50m
+            memory: 128Mi
+        ports:
+        - {"containerPort":53,"name":"udp-53","protocol":"UDP"}
+        - {"containerPort":53,"name":"tcp-53","protocol":"TCP"}
+        - {"containerPort":9153,"name":"tcp-9153","protocol":"TCP"}
+        
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: 8181
+            scheme: HTTP
+          initialDelaySeconds: 30
+          periodSeconds: 5
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 1
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+      volumes:
+        - name: config-volume
+          configMap:
+            name: coredns
+            items:
+            - key: Corefile
+              path: Corefile
+---
+# Source: coredns/charts/coredns/templates/servicemonitor.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: coredns
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/managed-by: "Helm"
+    app.kubernetes.io/instance: "coredns"
+    helm.sh/chart: "coredns-1.45.0"
+    k8s-app: coredns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: coredns
+spec:
+  namespaceSelector:
+    matchNames:
+    - coredns
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: "coredns"
+      k8s-app: coredns
+      app.kubernetes.io/name: coredns
+      app.kubernetes.io/component: metrics
+  endpoints:
+    - port: metrics
--- a/clusters/cl01tl/manifests/garage/garage.yaml
+++ b/clusters/cl01tl/manifests/garage/garage.yaml
@@ -46,27 +46,6 @@ data:
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
-metadata:
-  name: garage-data
-  labels:
-    app.kubernetes.io/instance: garage
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: garage
-    helm.sh/chart: garage-4.4.0
-  annotations:
-    helm.sh/resource-policy: keep
-  namespace: garage
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "800Gi"
-  storageClassName: "synology-iscsi-delete"
---
-# Source: garage/charts/garage/templates/common.yaml
-kind: PersistentVolumeClaim
-apiVersion: v1
 metadata:
  name: garage-db
  labels:
@@ -107,6 +86,51 @@ spec:
  storageClassName: "synology-iscsi-delete"
 ---
 # Source: garage/charts/garage/templates/common.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: garage-data
+  labels:
+    app.kubernetes.io/instance: garage
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: garage
+    helm.sh/chart: garage-4.4.0
+  annotations:
+    helm.sh/resource-policy: keep
+  namespace: garage
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "800Gi"
+  storageClassName: "synology-iscsi-delete"
+---
+# Source: garage/charts/garage/templates/common.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-webui
+  labels:
+    app.kubernetes.io/instance: garage
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: garage
+    app.kubernetes.io/service: garage-webui
+    helm.sh/chart: garage-4.4.0
+  namespace: garage
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3909
+      targetPort: 3909
+      protocol: TCP
+      name: webui
+  selector:
+    app.kubernetes.io/controller: webui
+    app.kubernetes.io/instance: garage
+    app.kubernetes.io/name: garage
+---
+# Source: garage/charts/garage/templates/common.yaml
 apiVersion: v1
 kind: Service
 metadata:
@@ -143,30 +167,6 @@ spec:
    app.kubernetes.io/name: garage
 ---
 # Source: garage/charts/garage/templates/common.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: garage-webui
-  labels:
-    app.kubernetes.io/instance: garage
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: garage
-    app.kubernetes.io/service: garage-webui
-    helm.sh/chart: garage-4.4.0
-  namespace: garage
-spec:
-  type: ClusterIP
-  ports:
-    - port: 3909
-      targetPort: 3909
-      protocol: TCP
-      name: webui
-  selector:
-    app.kubernetes.io/controller: webui
-    app.kubernetes.io/instance: garage
-    app.kubernetes.io/name: garage
---
-# Source: garage/charts/garage/templates/common.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
--- a/clusters/cl01tl/manifests/generic-device-plugin/generic-device-plugin.yaml
+++ b/clusters/cl01tl/manifests/generic-device-plugin/generic-device-plugin.yaml
@@ -21,8 +21,8 @@ metadata:
    app.kubernetes.io/instance: generic-device-plugin
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: generic-device-plugin
-    app.kubernetes.io/version: 0.15.0
-    helm.sh/chart: generic-device-plugin-0.20.1
+    app.kubernetes.io/version: 0.20.3
+    helm.sh/chart: generic-device-plugin-0.20.3
  namespace: generic-device-plugin
 data:
  config.yaml: |
@@ -43,8 +43,8 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: generic-device-plugin
    app.kubernetes.io/service: generic-device-plugin
-    app.kubernetes.io/version: 0.15.0
-    helm.sh/chart: generic-device-plugin-0.20.1
+    app.kubernetes.io/version: 0.20.3
+    helm.sh/chart: generic-device-plugin-0.20.3
  namespace: generic-device-plugin
 spec:
  type: ClusterIP
@@ -68,8 +68,8 @@ metadata:
    app.kubernetes.io/instance: generic-device-plugin
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: generic-device-plugin
-    app.kubernetes.io/version: 0.15.0
-    helm.sh/chart: generic-device-plugin-0.20.1
+    app.kubernetes.io/version: 0.20.3
+    helm.sh/chart: generic-device-plugin-0.20.3
  namespace: generic-device-plugin
 spec:
  revisionHistoryLimit: 3
@@ -110,7 +110,7 @@ spec:
            value: /var/lib/kubelet/device-plugins
          - name: DOMAIN
            value: devic.es
-          image: ghcr.io/squat/generic-device-plugin:latest@sha256:ef5deb09dcf7e577c8603857ae56ef479d91be6ab6f40dd2427166d510b0745f
+          image: ghcr.io/squat/generic-device-plugin:latest@sha256:4896ffd516624d6eb7572e102bc4397e91f8bc3b2fb38b5bfefd758baae3dcf2
          imagePullPolicy: Always
          name: main
          securityContext:
@@ -142,8 +142,8 @@ metadata:
    app.kubernetes.io/instance: generic-device-plugin
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: generic-device-plugin
-    app.kubernetes.io/version: 0.15.0
-    helm.sh/chart: generic-device-plugin-0.20.1
+    app.kubernetes.io/version: 0.20.3
+    helm.sh/chart: generic-device-plugin-0.20.3
  namespace: generic-device-plugin
 spec:
  jobLabel: "generic-device-plugin"
--- a/clusters/cl01tl/manifests/harbor/harbor.yaml
+++ b/clusters/cl01tl/manifests/harbor/harbor.yaml
@@ -74,9 +74,9 @@ metadata:
    app.kubernetes.io/version: "2.14.0"
 type: Opaque
 data:
-  tls.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRekNDQWl1Z0F3SUJBZ0lSQU8zUjFYVDk3c3diU3JsaktoMWh1QXd3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSmFHRnlZbTl5TFdOaE1CNFhEVEkxTVRJd01qQXpNRFl4TWxvWERUSTJNVEl3TWpBegpNRFl4TWxvd0lERWVNQndHQTFVRUF4TVZhR0Z5WW05eUxtRnNaWGhzWldKbGJuTXVibVYwTUlJQklqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeENtL09kZGN4MTZvWDFMb0RwblRNWVF2ZUJPTlVIY1QKK3kwbnA3MWI5VDlLTmROQkpSd2F6MFg3VkpPUmNSWXRzaWFHTFNnWWJVRkhKYmp1Tmd5OXFSRk5VTUt3SGhKUwpPNDA1bndXR1lGVFowa3htOFNoaWdxRVArc0hnUW8vbldxeUJYdWFxZklJZXNib1BjN2RLMzIzV1V2QlNxbGQwCmV2NE9XY01Ma0NIemlmWTAyM2wycVFUYW0yQXZvem9Za3YvTDZzTll4QU5CVU5GdXlkSVNJSTFIRHFKd09GOWcKQVZWMTZsTks3RThiNmhJc1VwRC9Lb2hDQzEzWUdBMGMvM3RVWFVzeVBZbjZUNm80ZXN1Q210Q1FIVkVLVVRqcwplODA0cFFSSEh4K1owaldJbkF3cmpiYnlSV1R3SEpycDFLTWdWN3RFS0dWSFc5TGZINy9Ya3dJREFRQUJvNEdECk1JR0FNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUgKQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JUSWxSNzY1TDh0b2E0bGJXSDlNT2dYTm1XVQpkakFnQmdOVkhSRUVHVEFYZ2hWb1lYSmliM0l1WVd4bGVHeGxZbVZ1Y3k1dVpYUXdEUVlKS29aSWh2Y05BUUVMCkJRQURnZ0VCQUZyT3JUQ0dpNlBuY2NZd0dRSFpEdUhuYmY0aDdtcGZ6Q2M1TUJETmdUb2U1clpvclBmZ2xZZ24KQU1BQk5PSjhiTHJIRjR4WExqV2R2blBqQTBaTG9OZUYwbGdhMUx2NkpDNGQyODBzbHRWU0NuQnI5N2NXVk1STQozYWd3SDRUTWJpYW51Mmp6SFo3WVNXT1lJUDUyc25QUkthV3dzVmdHalBJMmZsQStUVGRqZnh3N0VqWGJGaEhRCkdMYkFwMEN0eWxLMFhQZWlpRFhLRUdzbmNSUjdMOEFOQjFucDNRQ0J1cGhRUnRyS2J2V3p2K09lRytkMk5HQVEKNTFKd1NPVmMzcmp1Tmg5NFRmY2NLQld6UVNKQzkrU0gxbmwybS93ZllYcnV3dnVjdkRGb1lLR2JsQzdzM1BITwp4TkJ1MDBveXFkdU05UDVxSHZQenZHTk5qcDdkYW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-  tls.key: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBeENtL09kZGN4MTZvWDFMb0RwblRNWVF2ZUJPTlVIY1QreTBucDcxYjlUOUtOZE5CCkpSd2F6MFg3VkpPUmNSWXRzaWFHTFNnWWJVRkhKYmp1Tmd5OXFSRk5VTUt3SGhKU080MDVud1dHWUZUWjBreG0KOFNoaWdxRVArc0hnUW8vbldxeUJYdWFxZklJZXNib1BjN2RLMzIzV1V2QlNxbGQwZXY0T1djTUxrQ0h6aWZZMAoyM2wycVFUYW0yQXZvem9Za3YvTDZzTll4QU5CVU5GdXlkSVNJSTFIRHFKd09GOWdBVlYxNmxOSzdFOGI2aElzClVwRC9Lb2hDQzEzWUdBMGMvM3RVWFVzeVBZbjZUNm80ZXN1Q210Q1FIVkVLVVRqc2U4MDRwUVJISHgrWjBqV0kKbkF3cmpiYnlSV1R3SEpycDFLTWdWN3RFS0dWSFc5TGZINy9Ya3dJREFRQUJBb0lCQVFDWStZVnE4Z3drWGlrbgp6VnV5cHpzUGptb0dWaGtKK3hMVitpekdudUVyckNPUFBpTzdjT05uYU1mSytSbWUreEMvc1ZOSnU4N3d4TXRiCkc1Q0pEZjZKN2poQkZ0S0pZUGhJQUtaQzRPZ2VENDJlZG42QTZtR0lSVnBVendTNFk4aWo2WXNxR3ZBeEVMZ24KR1ZZYmc0RWNKR2ZUWGg3WlFFSlI5L1h4QWkzdVEyMGZNOXdIOXpUNllaVEtKcytoZlU0UVFtVWQzalpIR0xPcQo0Wk1MUCtUSmJkcnVvZTJiR2I2NFpabWdnYmtpWFlrUFBNNXNYVHZpQWwycTJxQmFFYlpYWWNRQ0hQS3p6bUlWCm1WKzVyd0dZMjFWRm1QWCtvRThlSkFSR0RJaklLdk9wNGRjZ3l0elBXYm40TGk3NFhTeUJNQklqVTZiU011ZVEKRkxEaTBaTWhBb0dCQVBNZ0MvQ0FMOUtoUzVNb2lPcmxSdXU0UXd0NlVhZWcyODRMVEFEM1ExWGltZlh3WWhRTwovK3ordEx3dkZmNFlPTk5oQUpGR3pwT1ZBZUh1aUpmbmpSOXNtTlpEMllxV1Znaml4M0lxZUxKSER4NnRTNm15Clc5TUtvLzBLUk93LzVIdWVna3Ixd1pWZU1BbmdwcmxrTTBPcUJ0MnFTS0FvS0swaHNQWHFSMkl2QW9HQkFNNk4KRGFlSklrUG8xZC9uWkc3cWtMMldNUjBxSHdDc2QwZW53R0tqWmV2N0xXRWYzcmt2QVpkc3pBaUFuZ3UyQlFrRQpkZzdPM3l1eGJIMlVXS2FjS2NEbU5zUmR3dzZkUjViRE5DSmRKeU9Pc21mTHJLNGFFdFBEdTlnZGlkZzcxckxJCjVwYUpQOHljeFVYenZUeDZXa2ZkZlNyL2ZIelNQdFp3dXJOZjVQdmRBb0dCQUp5eUY5L2V6blBEcjFEZVBEaWcKb3pBRHAzcDdVS3RvV3FLVzExcDhBdk1VeEVRbHRTRFdkZzVLTHpSbWFKZEhCMEQ5Y1A4eEVxMDl5V1BUZUVmbgpYaVpWdUwvSUpTcFVNSWt6bUhZMWQycjNyNEFIRXhBQk8zdHVqVGptYUh1WHhtd0NRbG1Md1VQQzI5VlI3RUxxCm1MdlFsdkpBOE9RQVhnOFArdHpVTFVQVEFvR0FRSldDUzN4cHBtcExWYk40aCtYNFZBOStVK3d6dlhZdjVjdmkKTC9WL2pRWUE3bm1VbnJxLytLVWdOeGhnVXJFYmFmSm5KOEl2cmUzUVNvUDBKRVI0R2NUaUl3eGVUVmVJWnUrcQpnWVEzRkxzdHRaN040N0pyYUtPdlBLZ2Z6ZWtIL09jc2txMWZzWTdqY0RnQ1Y4SzZML1psaU9oUitJV1UrR0JQClFIOGZqbEVDZ1lCMC96V2Z4eDZDeFlMMlVFYUROVDhHYUdIV2JmamRzWnRYNEpKUTBHY09GR1VBcDk2cCtuYmsKdisxZHFhRlIwa0tSTDI1NUlIMEtqY2VzMEpLQ3Vsayt4b2lMQlVXSXkrRTRrYnFCdi9xU3REYmZuT3phdFRLZwowQUhSUDYyaXRGaVh4VlExb1hwVVF1bXhlcjBVY3oxY1V5d2lTaTgwOXNSTGkySFV3V0lmWFE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo="
-  ca.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRWU5JZVN5NFVsSnRoNGE5bEY3WUJWekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsb1lYSmliM0l0WTJFd0hoY05NalV4TWpBeU1ETXdOakV5V2hjTk1qWXhNakF5TURNdwpOakV5V2pBVU1SSXdFQVlEVlFRREV3bG9ZWEppYjNJdFkyRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFdldFFyN2JMNEZ3OW14by9xNG44Uk1RU0FpcjFFaU9wK3ppbVNRZis3VjFqdmw1OVAKOHZmb0l3cU50bGFzZVlhMFIxclZOaFFFeWx0RUwzUDU1Q2tBT3lxbDRRWkR6dXpuQmhIY05xb2FieFJwRU1QUwpXbUJNWnE5RUpaRHEzV0ZsNUZRUzJRdkIwRGpHcUMvUmVZNmJGVllhY1FsdUFLZURxRTVJMDhGcW96NlFmRjlSCnMvZHlVaXhKSVcxUzlKVGhnM05SeHpRbCtHalg4ejNuWkUwS0kxMHhwNzlJeGROZ0k0ZTY5QmJWa2VIZHArNS8Kc2pJZTlUcFlkOU1IUmcwSVE4ejZpdGhpcTJ1ZU1UNlBuRS9ZQ3FSTmdSUmZMQjFIdlYxb1AvWE1udFpJcGlvYgpqKzRjVk5HTkxJRHNnekdYNTIxUkZ4REdrRG9YeHdVbURoWHZBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV5SlVlK3VTL0xhR3VKVzFoL1REb0Z6WmxsSFl3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFNdXI2UFJaZ2dTRzI1VWxRcnZGODBQenRkSGZhdEdjUFNNVk1QRUNuaEgyRHB4TUtVMXpqSUU4CkJFT2NiZzZMNUZqc0pRbldtakkwSkl2TTJaeC96UTNVYVdPT1NlaW91d1RLWHZudzY2WGlldlQza1pvRTVMT3MKSVJXZXJZQUsvOTJDa0xqNTRsSkhaZThFK3dJd09IY3VveU85aDdpcnFsUjJiV1l1QkFXamxEd1doaThMK3lMcgpkRndHREF1YWFaV3R4aTVzeWFGZ2IzaGxFdlNXampJU29Hb0N2L0RtN2krV0dLVWRGOG5FRitIY0FFMGNMYW94CkZJYlNucHBDVFJuK1orQm40Q2RuUlJLK1RYR2ZOUFFQSFBtZGlJbzhianJKcG0veFdvZ0pMWDRZeUxjWUx2MnYKMHgyemlLOE13NDZFWVBUeVBCTW4rOHpwblRjbXcwZz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
+  tls.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRekNDQWl1Z0F3SUJBZ0lSQVA5MjQ4Ry9hYlZhYVFnZ0RHZjgvRkF3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSmFHRnlZbTl5TFdOaE1CNFhEVEkxTVRJd016QXlNVE15TWxvWERUSTJNVEl3TXpBeQpNVE15TWxvd0lERWVNQndHQTFVRUF4TVZhR0Z5WW05eUxtRnNaWGhzWldKbGJuTXVibVYwTUlJQklqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeHpaNEdHSEExZkxLWVR5amFmNkt5MUN0ZHlKNXk4aEEKVmgzRlhVTWR5cExMWWhpTERGZDhuNlJNdHphenAyOWNKSDREODNoWERnR0ppNEcxWW5zdzRkcTMwS1JxY202WQp3MG5aZEtJbmJhSEhuZ2NwY1ZycDJGVTdLQVBsM1lONUowQ1lqeTNWZmFaaHMwc0RKb3l1L3R1V2FndVJFMFR6ClhaOG1rL1I0cVB6bE1qS05tNFc5eUpLTzEydlNEWHlhTEI4SmRkLzlNWDE4Z0U5OXNMSnhPOTZuRnJoaXBHbGEKQWxZNXZ5WitHc3R5KytaUTd3VnczeTBnZFl3Y2xZaVNaNElNL3JPdkl1dVBnczVxSWFJTnRrMGVNK3lYL2VINgpRVW8vdEVCWkNOR2lTdTVDc3U4SmZuS1RYK05GLzYreG1yOWczVjBQQSs2ZXJxYlZSK296OHdJREFRQUJvNEdECk1JR0FNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUgKQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JSV0ZkWm8rU0hiV0txaDJMd0NFdjRya3BCZQpkREFnQmdOVkhSRUVHVEFYZ2hWb1lYSmliM0l1WVd4bGVHeGxZbVZ1Y3k1dVpYUXdEUVlKS29aSWh2Y05BUUVMCkJRQURnZ0VCQUlyaEJkTXJUcDB2ZENxUW5RdSs4MTZZWlo5SndaaG52ZGZFa013by9Qd0Q0Q3AzLzEyZjVYY00KRmJ1QmxGWWpvYlJmMzcxRTZ5RWkzeXhiL3QwbFVCaUNLYldUM3RSOXBUTVY3dDVXYVhzY1ZJcTg2eWhFcDI5WgpMTWFUUXhBRTN2a0UvL2dXTXp3RVo2aFhUNHVpTU94ZHhKNllwcXdCUXBXMm14cFRSN2JUSnVnNFpXUGhoQTFpCkpMZDlIY0JXeS9Bc2RsYjl6N0dzelFPRnQ0SkEvdERZazdRNFgxaExCV2lvakovcnZSOElkVzR3elZXQkVDejUKVGo0UHQvTnNNZkhhT2VtR1dyWGZFV0FkWWM0RlQ3TnVNSzBwelIvRlJQM3lZRzI4OTFoNG4rckovdUVITmZ3agp2c1FnUzFzTC9McmhlL1M2V1l3WjdGVDQzWVZRSXA0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+  tls.key: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeHpaNEdHSEExZkxLWVR5amFmNkt5MUN0ZHlKNXk4aEFWaDNGWFVNZHlwTExZaGlMCkRGZDhuNlJNdHphenAyOWNKSDREODNoWERnR0ppNEcxWW5zdzRkcTMwS1JxY202WXcwblpkS0luYmFISG5nY3AKY1ZycDJGVTdLQVBsM1lONUowQ1lqeTNWZmFaaHMwc0RKb3l1L3R1V2FndVJFMFR6WFo4bWsvUjRxUHpsTWpLTgptNFc5eUpLTzEydlNEWHlhTEI4SmRkLzlNWDE4Z0U5OXNMSnhPOTZuRnJoaXBHbGFBbFk1dnlaK0dzdHkrK1pRCjd3VnczeTBnZFl3Y2xZaVNaNElNL3JPdkl1dVBnczVxSWFJTnRrMGVNK3lYL2VINlFVby90RUJaQ05HaVN1NUMKc3U4SmZuS1RYK05GLzYreG1yOWczVjBQQSs2ZXJxYlZSK296OHdJREFRQUJBb0lCQVFDTENmUkdLQ3Y3NTJuaQo5ZnlrSlBsZ01CM3g4WWtLZHVpWWNrem02OG9tTWRCcjFlOXVuTDBwZXZYa1JmU2Izdmh6cTlROElQaTVtTThVCkpHS2hxcE9TZnlJZUtETDNUVU9ud2FwWllqZWNwL1ozMEUzWGhQbURlUEZCMjM2YTNZRTRxVGdSYm83OEZKMUsKRXdmTzV3L1laeENUVVNGZlRwZUE5MnhvaFkrVmVUZ25YRk9lQWtrL2U5YW1FUSt2QTd6ZklOV1Z0TlVsOFQ2UAozTXVuSmF6WDJTTXpFZ0NRc1JVR1hjRE1ZWFhZVVc4cjEweUJkeVZkamtMRzYyL29mdW14d1JMWWRpUEhvUXViClQ5ejdWY1ZDZnZReHpaaGw1N3cySXdVMUVyYmJ1YW8rU1I4Rnp0dW1JUU1HN2Npcm8vQXd0dVZmUTNIbkwyTWMKRlZ0SWZJWnhBb0dCQU0yQmtZMEpTclU0ZDhSTlFwYzlaMVRkYmNaeGZleWRKREVSNVdEUjVEb3dIczlGTllmbwo0Y1lQdG5rckdBQ2Q2NlprQk5Kb1pMc0ltcVlxK2lDNnVTV1lvei8yN3o0OGkyeUY0ZE9US0hWZ0xRdGIxTnBQCmYyMU9MWCtDMFZPR3NYdnVRZzFIR0piZFFxN0hHK255ekFCd1hPWWhKRzE1a21xSFBzbCtpMkdMQW9HQkFQZ3AKQzZNSC9IL3YxS1FhRlNPTmFaam9ENjRpcitCODhPc2QyUHNwVzVQSDRNSFQ0MzFXQmhES25xNnZVb29nWHJKYQpzZHZKRjBSTEcvK3BEQ1VEY1ludzRKbUZTUWdpMGptRXR3bDJQaFpaMUVHbW9yZkJ6Z3ZiTU1wc1k5cyt0RmNaClBjTFcvTngxVVBPejQrN2d6OUE4SmZIWmUyQnVJTzdHTkpadzIvUTVBb0dBQnFITzA3RmdFdGNlcmx3YjhRdVAKUVNMZ1B3NDhsUjFCSk1CQ0djek1ROEIzemhLYXRxY2lXaVQ1cTVGamRlbWl5RHprRnZJOWhmZXlIZmkzRjhWTwo0bEs1dWYrN0d0UVRYODQyU29DdVJwTnpBTEhXL2JDaEdTTHp2dkMyMXE0N0hoZkRVL0JlYjhmMk5mUEJCOXpKCkRwNlJzTytTNEdHVEF4TVlTS0puMXg4Q2dZQlMvWDhMeFpiMnZpRHh4RnMvYVlKZ0JYT0ErODZ2bDNrR1dCUUIKWXNKaWVKeThsWHpscElnZ3czSXYzeWdPVTJiMzVJYkloc2FHSzB3d3dycnlBZVhOaU1YRDhhUUwyWUZPaFFpbApYR3JGRk1OOE5Sc0Rzd2VTUlhwYXA4YjVRazRUTnJqRjJSbjFMREtuWFlpamtZRk9GVjluTXlFa2pZL3I2bE1aCjRLSmVXUUtCZ0RmT0xMeTdjME1KalhRZmdKQWFUMjYrdTVQajNybVdSU2FYT3hMdnN5NzdNTENsVFFhVGk5cFkKYTlQWEF2Q0QxUW1BWnl0bTlmbUdYUllWVU1PdVZ0d0tPbzd6NmpGdGVabWlvRzVDcmJxaUkxdmVla3VnNEp5UwpibnFhYktvdnYzdngzUUVYamc5Rm0ybm9lUWh5TjU3NHNGendjbTUyZWR0OWphbERMUVp4Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="
+  ca.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtWd2p1eVA1amFGMjdFSDNYYlM4NFF3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSmFHRnlZbTl5TFdOaE1CNFhEVEkxTVRJd016QXlNVE15TWxvWERUSTJNVEl3TXpBeQpNVE15TWxvd0ZERVNNQkFHQTFVRUF4TUphR0Z5WW05eUxXTmhNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFxMnMzSEQ2WnQ4ZkQ3K0xHbDhhalJhbEZnb2doQXFKb3VjWlMxMGFhemczZVFhbHkKWWlaQjAvVC9qamoyZGtnRlNmMkxLTC9VRXlrRDVXOExWWEpwcDB6dWRIMlZTMGVncENIK3FLbTFXcUs4VCtDawovSDFkd3d2QmNIWGNZckJqakJpZXQzUmNkVUpaaWZSVHhjZVRCMnR5THhvVTJPbllZOFhmK241VmdvZEw4M0VCCkZoRmUzNkluMDFFbG8rSUcvSFNBclNJU1MzcGJLUDg1WmpkVGZ4NyttbFlUUWxvUWU3dFN5OGlCYWNTK0VhMGUKYVVUUVZwR3BzZURuT2g5djlhcVF1TCt4NmhuWlRuL3RLTSsxRnkrOUFneG9aSURJOUprZGRKaVlqMU1Lc2M3Mgo3TkpWeUF4V3VobVd5dG1Va25reXhPWUtsdXRrMThNRVlodnVwUUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRllWMW1qNUlkdFlxcUhZdkFJUy9pdVNrRjUwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQnRmdnp6K3VxRFo4Z3FDYWhBY3NvNDEwSHlRZmd1NjUvUkU5dmd1UjJsc0libU5MNnBsKysvCjRnMHBEOGRvLzdNYWNGRVRZTTFVT0ZlaEp3Qkx5R1BaRXZmVnYyYlBZYVllSDRyT3RlNnpVWjJkNmMwSlRpbGEKVWpaODI2TWk1L1pCRkhjWmllVUZlK2Z0elpKMWJMOFRFYTh6dldZL0dmSU14Z1haUGJlc0lPNE9XaUxiMlpEbQpOYTZGZlpZTVFhczduaXFXT0ZHV2RoRHFoelB4Y2JYUENOMkN1ZjN0aDZsbkhMZHFUMi9FNmx6Qy9hWmszWWJDCkhLbnRTSXNwc1Bvbm5Ba2lFTUFlbkowaEwvVFI2NEI4U0h6SlF4c1QycGQ4SVJ2SGZLTUtmTnBOQTRWODdoZ0oKOStBK2ZaNnBJZTljaHhGYnF3ZkhFbi9aR0djUEd2dFQKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
 ---
 # Source: harbor/charts/harbor/templates/registry/registry-secret.yaml
 apiVersion: v1
@@ -1268,7 +1268,7 @@ spec:
        app.kubernetes.io/component: nginx
      annotations:
        checksum/configmap: 55921b41f4478ded4d60da7edb83b828382ba722214816271ce3ffd2a77aed35
-        checksum/secret: 48b3446687938149e3ee094fd5a1ad116455ce9b7e16d80eebe285fc8182be65
+        checksum/secret: 1917ed1f7dd89e9c1996cbb3dbe20a46cfc18579b5f7f3f547e430e875e3f7ef
    spec:
      securityContext:
        runAsUser: 10000
@@ -1758,11 +1758,11 @@ metadata:
  name: harbor-postgresql-17-cluster
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  instances: 3
@@ -2103,11 +2103,11 @@ metadata:
  name: "harbor-postgresql-17-external-backup"
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  retentionPolicy: 30d
@@ -2129,11 +2129,11 @@ metadata:
  name: "harbor-postgresql-17-garage-local-backup"
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  retentionPolicy: 3d
@@ -2158,11 +2158,11 @@ metadata:
  name: "harbor-postgresql-17-recovery"
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  configuration:
@@ -2189,11 +2189,11 @@ metadata:
  name: harbor-postgresql-17-alert-rules
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  groups:
@@ -2495,11 +2495,11 @@ metadata:
  name: "harbor-postgresql-17-daily-backup-scheduled-backup"
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  immediate: false
@@ -2521,11 +2521,11 @@ metadata:
  name: "harbor-postgresql-17-live-backup-scheduled-backup"
  namespace: harbor
  labels:
-    helm.sh/chart: postgres-17-cluster-6.16.0
+    helm.sh/chart: postgres-17-cluster-6.16.1
    app.kubernetes.io/name: harbor-postgresql-17
    app.kubernetes.io/instance: harbor
    app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "6.16.0"
+    app.kubernetes.io/version: "6.16.1"
    app.kubernetes.io/managed-by: Helm
 spec:
  immediate: true
--- a/clusters/cl01tl/manifests/immich/immich.yaml
+++ b/clusters/cl01tl/manifests/immich/immich.yaml
@@ -68,6 +68,30 @@ spec:
 # Source: immich/charts/immich/templates/common.yaml
 apiVersion: v1
 kind: Service
+metadata:
+  name: immich-machine-learning
+  labels:
+    app.kubernetes.io/instance: immich
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: immich
+    app.kubernetes.io/service: immich-machine-learning
+    helm.sh/chart: immich-4.4.0
+  namespace: immich
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3003
+      targetPort: 3003
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/controller: machine-learning
+    app.kubernetes.io/instance: immich
+    app.kubernetes.io/name: immich
+---
+# Source: immich/charts/immich/templates/common.yaml
+apiVersion: v1
+kind: Service
 metadata:
  name: immich-main
  labels:
@@ -98,30 +122,6 @@ spec:
    app.kubernetes.io/name: immich
 ---
 # Source: immich/charts/immich/templates/common.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: immich-machine-learning
-  labels:
-    app.kubernetes.io/instance: immich
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: immich
-    app.kubernetes.io/service: immich-machine-learning
-    helm.sh/chart: immich-4.4.0
-  namespace: immich
-spec:
-  type: ClusterIP
-  ports:
-    - port: 3003
-      targetPort: 3003
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/controller: machine-learning
-    app.kubernetes.io/instance: immich
-    app.kubernetes.io/name: immich
---
-# Source: immich/charts/immich/templates/common.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
--- a/clusters/cl01tl/manifests/kubelet-serving-cert-approver/kubelet-serving-cert-approver.yaml
+++ b/clusters/cl01tl/manifests/kubelet-serving-cert-approver/kubelet-serving-cert-approver.yaml
@@ -0,0 +1,254 @@
+---
+# Source: kubelet-serving-cert-approver/templates/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/warn: restricted
+---
+# Source: kubelet-serving-cert-approver/charts/kubelet-serving-cert-approver/templates/common.yaml
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    helm.sh/chart: kubelet-serving-cert-approver-4.4.0
+  namespace: kubelet-serving-cert-approver
+secrets:
+  - name: kubelet-serving-cert-approver-kubelet-serving-cert-approver-sa-token
+---
+# Source: kubelet-serving-cert-approver/charts/kubelet-serving-cert-approver/templates/common.yaml
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: kubelet-serving-cert-approver-kubelet-serving-cert-approver-sa-token
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    helm.sh/chart: kubelet-serving-cert-approver-4.4.0
+  annotations:
+    kubernetes.io/service-account.name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+---
+# Source: kubelet-serving-cert-approver/templates/cluster-role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "certificates-kubelet-serving-cert-approver"
+  namespace: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/name: "certificates-kubelet-serving-cert-approver"
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+rules:
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests/approval
+    verbs:
+      - update
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - certificates.k8s.io
+    resourceNames:
+      - kubernetes.io/kubelet-serving
+    resources:
+      - signers
+    verbs:
+      - approve
+---
+# Source: kubelet-serving-cert-approver/templates/cluster-role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "events-kubelet-serving-cert-approver"
+  namespace: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/name: "events-kubelet-serving-cert-approver"
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+---
+# Source: kubelet-serving-cert-approver/templates/cluster-role-binding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "certificates-kubelet-serving-cert-approver"
+subjects:
+  - kind: ServiceAccount
+    name: kubelet-serving-cert-approver
+    namespace: kubelet-serving-cert-approver
+---
+# Source: kubelet-serving-cert-approver/templates/role-binding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "events-kubelet-serving-cert-approver"
+  namespace: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/name: "events-kubelet-serving-cert-approver"
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "events-kubelet-serving-cert-approver"
+subjects:
+  - kind: ServiceAccount
+    name: kubelet-serving-cert-approver
+    namespace: kubelet-serving-cert-approver
+---
+# Source: kubelet-serving-cert-approver/charts/kubelet-serving-cert-approver/templates/common.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/service: kubelet-serving-cert-approver
+    helm.sh/chart: kubelet-serving-cert-approver-4.4.0
+  namespace: kubelet-serving-cert-approver
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: 8080
+      protocol: TCP
+      name: health
+    - port: 9090
+      targetPort: 9090
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+---
+# Source: kubelet-serving-cert-approver/charts/kubelet-serving-cert-approver/templates/common.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    helm.sh/chart: kubelet-serving-cert-approver-4.4.0
+  namespace: kubelet-serving-cert-approver
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/controller: main
+      app.kubernetes.io/name: kubelet-serving-cert-approver
+      app.kubernetes.io/instance: kubelet-serving-cert-approver
+  template:
+    metadata:
+      annotations: 
+        checksum/secrets: 591a33eca0bc5c4a8475d0538f3f4840841582c86a3ac2c97147b2b00e5774c5
+      labels: 
+        app.kubernetes.io/controller: main
+        app.kubernetes.io/instance: kubelet-serving-cert-approver
+        app.kubernetes.io/name: kubelet-serving-cert-approver
+    spec: 
+      enableServiceLinks: false
+      serviceAccountName: kubelet-serving-cert-approver
+      automountServiceAccountToken: true
+      priorityClassName: system-cluster-critical
+      securityContext: 
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - preference:
+              matchExpressions:
+              - key: node-role.kubernetes.io/master
+                operator: DoesNotExist
+              - key: node-role.kubernetes.io/control-plane
+                operator: DoesNotExist
+            weight: 100
+      tolerations: 
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists
+      containers: 
+        - args:
+          - serve
+          env:
+          - name: NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          image: ghcr.io/alex1989hu/kubelet-serving-cert-approver:0.10.0
+          imagePullPolicy: Always
+          name: main
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
--- a/clusters/cl01tl/manifests/matrix-synapse/matrix-synapse.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/matrix-synapse.yaml
@@ -14,7 +14,7 @@ stringData:
  config.yaml: |
    ## Registration ##

-    registration_shared_secret: "78qf09lp4y9ddCAOIHzIZl8w"
+    registration_shared_secret: "6fAFKKt3SEB7izipqAi3NuAi"

    ## API Configuration ##

@@ -552,7 +552,7 @@ spec:
    metadata:
      annotations:
        checksum/config: e77b3b25301ed2f4b5eac2f16ed5d058374ed1ffcd7e9ca4d8eef44867647feb
-        checksum/secrets: b64796d44c09bd998e1ed681b5f911cb93f96ef424e2077226f933b022640d59
+        checksum/secrets: 436898f25e6954bf4f044ddd56f93cc4ed6982a1a4e018fee77823a9a637be45
      labels:
        app.kubernetes.io/name: matrix-synapse
        app.kubernetes.io/instance: matrix-synapse
--- a/clusters/cl01tl/manifests/metrics-server/metrics-server.yaml
+++ b/clusters/cl01tl/manifests/metrics-server/metrics-server.yaml
@@ -0,0 +1,285 @@
+---
+# Source: metrics-server/charts/metrics-server/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: metrics-server/charts/metrics-server/templates/clusterrole-aggregated-reader.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:metrics-server-aggregated-reader
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+---
+# Source: metrics-server/charts/metrics-server/templates/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:metrics-server
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+rules:
+  - apiGroups:
+    - ""
+    resources:
+    - nodes/metrics
+    verbs:
+    - get
+  - apiGroups:
+    - ""
+    resources:
+      - pods
+      - nodes
+      - namespaces
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+---
+# Source: metrics-server/charts/metrics-server/templates/clusterrolebinding-auth-delegator.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-server:system:auth-delegator
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: metrics-server
+---
+# Source: metrics-server/charts/metrics-server/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:metrics-server
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:metrics-server
+subjects:
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: metrics-server
+---
+# Source: metrics-server/charts/metrics-server/templates/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metrics-server-auth-reader
+  namespace: kube-system
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: metrics-server
+---
+# Source: metrics-server/charts/metrics-server/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: https
+      appProtocol: https
+  selector:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+---
+# Source: metrics-server/charts/metrics-server/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: metrics-server
+      app.kubernetes.io/instance: metrics-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: metrics-server
+        app.kubernetes.io/instance: metrics-server
+    spec:
+      serviceAccountName: metrics-server
+      priorityClassName: "system-cluster-critical"
+      containers:
+        - name: metrics-server
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          image: registry.k8s.io/metrics-server/metrics-server:v0.8.0
+          imagePullPolicy: IfNotPresent
+          args:
+            - --secure-port=10250
+            - --cert-dir=/tmp
+            - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+            - --kubelet-use-node-status-port
+            - --metric-resolution=15s
+            - --kubelet-insecure-tls
+            - --authorization-always-allow-paths=/metrics
+          ports:
+          - name: https
+            protocol: TCP
+            containerPort: 10250
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /livez
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 0
+            periodSeconds: 10
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /readyz
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 100m
+              memory: 200Mi
+      volumes:
+        - name: tmp
+          emptyDir: {}
+---
+# Source: metrics-server/charts/metrics-server/templates/apiservice.yaml
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1beta1.metrics.k8s.io
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+spec:
+  group: metrics.k8s.io
+  groupPriorityMinimum: 100
+  insecureSkipTLSVerify: true
+  service:
+    name: metrics-server
+    namespace: metrics-server
+    port: 443
+  version: v1beta1
+  versionPriority: 100
+---
+# Source: metrics-server/charts/metrics-server/templates/servicemonitor.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    helm.sh/chart: metrics-server-3.13.0
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  jobLabel: app.kubernetes.io/instance
+  namespaceSelector:
+    matchNames:
+      - metrics-server
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: metrics-server
+      app.kubernetes.io/instance: metrics-server
+  endpoints:
+    - port: https
+      path: /metrics
+      scheme: https
+      tlsConfig:
+        insecureSkipVerify: true
+      interval: 1m
+      scrapeTimeout: 10s
--- a/clusters/cl01tl/manifests/n8n/n8n.yaml
+++ b/clusters/cl01tl/manifests/n8n/n8n.yaml
@@ -22,30 +22,6 @@ spec:
 # Source: n8n/charts/n8n/templates/common.yaml
 apiVersion: v1
 kind: Service
-metadata:
-  name: n8n-worker
-  labels:
-    app.kubernetes.io/instance: n8n
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: n8n
-    app.kubernetes.io/service: n8n-worker
-    helm.sh/chart: n8n-4.4.0
-  namespace: n8n
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: 5678
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/controller: worker
-    app.kubernetes.io/instance: n8n
-    app.kubernetes.io/name: n8n
---
-# Source: n8n/charts/n8n/templates/common.yaml
-apiVersion: v1
-kind: Service
 metadata:
  name: n8n-main
  labels:
@@ -92,6 +68,30 @@ spec:
    app.kubernetes.io/name: n8n
 ---
 # Source: n8n/charts/n8n/templates/common.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n-worker
+  labels:
+    app.kubernetes.io/instance: n8n
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: n8n
+    app.kubernetes.io/service: n8n-worker
+    helm.sh/chart: n8n-4.4.0
+  namespace: n8n
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 5678
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/controller: worker
+    app.kubernetes.io/instance: n8n
+    app.kubernetes.io/name: n8n
+---
+# Source: n8n/charts/n8n/templates/common.yaml
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
--- a/clusters/cl01tl/manifests/ollama/ollama.yaml
+++ b/clusters/cl01tl/manifests/ollama/ollama.yaml
@@ -3,48 +3,6 @@
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
-metadata:
-  name: ollama-server-1
-  labels:
-    app.kubernetes.io/instance: ollama
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: ollama
-    helm.sh/chart: ollama-4.4.0
-  annotations:
-    helm.sh/resource-policy: keep
-  namespace: ollama
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "40Gi"
-  storageClassName: "ceph-block"
---
-# Source: ollama/charts/ollama/templates/common.yaml
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: ollama-server-2
-  labels:
-    app.kubernetes.io/instance: ollama
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: ollama
-    helm.sh/chart: ollama-4.4.0
-  annotations:
-    helm.sh/resource-policy: keep
-  namespace: ollama
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "40Gi"
-  storageClassName: "ceph-block"
---
-# Source: ollama/charts/ollama/templates/common.yaml
-kind: PersistentVolumeClaim
-apiVersion: v1
 metadata:
  name: ollama-server-3
  labels:
@@ -85,6 +43,48 @@ spec:
  storageClassName: "ceph-block"
 ---
 # Source: ollama/charts/ollama/templates/common.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: ollama-server-1
+  labels:
+    app.kubernetes.io/instance: ollama
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: ollama
+    helm.sh/chart: ollama-4.4.0
+  annotations:
+    helm.sh/resource-policy: keep
+  namespace: ollama
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "40Gi"
+  storageClassName: "ceph-block"
+---
+# Source: ollama/charts/ollama/templates/common.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: ollama-server-2
+  labels:
+    app.kubernetes.io/instance: ollama
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: ollama
+    helm.sh/chart: ollama-4.4.0
+  annotations:
+    helm.sh/resource-policy: keep
+  namespace: ollama
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "40Gi"
+  storageClassName: "ceph-block"
+---
+# Source: ollama/charts/ollama/templates/common.yaml
 apiVersion: v1
 kind: Service
 metadata:
--- a/clusters/cl01tl/manifests/prometheus-operator-crds/prometheus-operator-crds.yaml
+++ b/clusters/cl01tl/manifests/prometheus-operator-crds/prometheus-operator-crds.yaml
--- a/clusters/cl01tl/manifests/qbittorrent/qbittorrent.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/qbittorrent.yaml
@@ -254,27 +254,6 @@ spec:
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
-metadata:
-  name: qbittorrent-theme-data
-  labels:
-    app.kubernetes.io/instance: qbittorrent
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: qbittorrent
-    helm.sh/chart: qbittorrent-4.4.0
-  annotations:
-    helm.sh/resource-policy: keep
-  namespace: qbittorrent
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "1Gi"
-  storageClassName: "ceph-block"
---
-# Source: qbittorrent/charts/qbittorrent/templates/common.yaml
-kind: PersistentVolumeClaim
-apiVersion: v1
 metadata:
  name: qbittorrent-qbit-manage-config-data
  labels:
@@ -314,6 +293,27 @@ spec:
      storage: "1Gi"
  storageClassName: "ceph-block"
 ---
+# Source: qbittorrent/charts/qbittorrent/templates/common.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: qbittorrent-theme-data
+  labels:
+    app.kubernetes.io/instance: qbittorrent
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: qbittorrent
+    helm.sh/chart: qbittorrent-4.4.0
+  annotations:
+    helm.sh/resource-policy: keep
+  namespace: qbittorrent
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "ceph-block"
+---
 # Source: qbittorrent/templates/persistent-volume-claim.yaml
 apiVersion: v1
 kind: PersistentVolumeClaim
--- a/clusters/cl01tl/manifests/s3-exporter/s3-exporter.yaml
+++ b/clusters/cl01tl/manifests/s3-exporter/s3-exporter.yaml
@@ -2,30 +2,6 @@
 # Source: s3-exporter/charts/s3-exporter/templates/common.yaml
 apiVersion: v1
 kind: Service
-metadata:
-  name: s3-exporter-ceph-directus
-  labels:
-    app.kubernetes.io/instance: s3-exporter
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: s3-exporter
-    app.kubernetes.io/service: s3-exporter-ceph-directus
-    helm.sh/chart: s3-exporter-4.4.0
-  namespace: s3-exporter
-spec:
-  type: ClusterIP
-  ports:
-    - port: 9655
-      targetPort: 9655
-      protocol: TCP
-      name: metrics
-  selector:
-    app.kubernetes.io/controller: ceph-directus
-    app.kubernetes.io/instance: s3-exporter
-    app.kubernetes.io/name: s3-exporter
---
-# Source: s3-exporter/charts/s3-exporter/templates/common.yaml
-apiVersion: v1
-kind: Service
 metadata:
  name: s3-exporter-digital-ocean
  labels:
@@ -96,6 +72,30 @@ spec:
    app.kubernetes.io/name: s3-exporter
 ---
 # Source: s3-exporter/charts/s3-exporter/templates/common.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: s3-exporter-ceph-directus
+  labels:
+    app.kubernetes.io/instance: s3-exporter
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: s3-exporter
+    app.kubernetes.io/service: s3-exporter-ceph-directus
+    helm.sh/chart: s3-exporter-4.4.0
+  namespace: s3-exporter
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9655
+      targetPort: 9655
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/controller: ceph-directus
+    app.kubernetes.io/instance: s3-exporter
+    app.kubernetes.io/name: s3-exporter
+---
+# Source: s3-exporter/charts/s3-exporter/templates/common.yaml
 ---
 apiVersion: apps/v1
 kind: Deployment
--- a/clusters/cl01tl/manifests/searxng/searxng.yaml
+++ b/clusters/cl01tl/manifests/searxng/searxng.yaml
@@ -89,71 +89,6 @@ spec:
 # Source: searxng/charts/searxng/templates/common.yaml
 apiVersion: apps/v1
 kind: Deployment
-metadata:
-  name: searxng-browser
-  labels:
-    app.kubernetes.io/controller: browser
-    app.kubernetes.io/instance: searxng
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: searxng
-    helm.sh/chart: searxng-4.4.0
-  namespace: searxng
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: browser
-      app.kubernetes.io/name: searxng
-      app.kubernetes.io/instance: searxng
-  template:
-    metadata:
-      labels: 
-        app.kubernetes.io/controller: browser
-        app.kubernetes.io/instance: searxng
-        app.kubernetes.io/name: searxng
-    spec: 
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers: 
-        - env:
-          - name: SEARXNG_BASE_URL
-            value: https://searxng.alexlebens.net/
-          - name: SEARXNG_QUERY_URL
-            value: https://searxng.alexlebens.net/search?q=<query>
-          - name: SEARXNG_HOSTNAME
-            value: searxng.alexlebens.net
-          - name: SEARXNG_REDIS_URL
-            value: redis://redis-replication-searxng-master.searxng:6379/0
-          - name: UWSGI_WORKERS
-            value: "4"
-          - name: UWSGI_THREADS
-            value: "4"
-          image: searxng/searxng:latest@sha256:277cb4b82fbdd69d88812089a5755860d379de907f09fb511443ff03d35191af
-          imagePullPolicy: IfNotPresent
-          name: main
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
-          volumeMounts:
-          - mountPath: /etc/searxng
-            name: browser-data
-      volumes: 
-        - name: browser-data
-          persistentVolumeClaim:
-            claimName: searxng-browser-data
---
-# Source: searxng/charts/searxng/templates/common.yaml
-apiVersion: apps/v1
-kind: Deployment
 metadata:
  name: searxng-api
  labels:
@@ -235,6 +170,71 @@ spec:
          secret:
            secretName: searxng-api-config-secret
 ---
+# Source: searxng/charts/searxng/templates/common.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng-browser
+  labels:
+    app.kubernetes.io/controller: browser
+    app.kubernetes.io/instance: searxng
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: searxng
+    helm.sh/chart: searxng-4.4.0
+  namespace: searxng
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/controller: browser
+      app.kubernetes.io/name: searxng
+      app.kubernetes.io/instance: searxng
+  template:
+    metadata:
+      labels: 
+        app.kubernetes.io/controller: browser
+        app.kubernetes.io/instance: searxng
+        app.kubernetes.io/name: searxng
+    spec: 
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers: 
+        - env:
+          - name: SEARXNG_BASE_URL
+            value: https://searxng.alexlebens.net/
+          - name: SEARXNG_QUERY_URL
+            value: https://searxng.alexlebens.net/search?q=<query>
+          - name: SEARXNG_HOSTNAME
+            value: searxng.alexlebens.net
+          - name: SEARXNG_REDIS_URL
+            value: redis://redis-replication-searxng-master.searxng:6379/0
+          - name: UWSGI_WORKERS
+            value: "4"
+          - name: UWSGI_THREADS
+            value: "4"
+          image: searxng/searxng:latest@sha256:277cb4b82fbdd69d88812089a5755860d379de907f09fb511443ff03d35191af
+          imagePullPolicy: IfNotPresent
+          name: main
+          resources:
+            requests:
+              cpu: 10m
+              memory: 256Mi
+          volumeMounts:
+          - mountPath: /etc/searxng
+            name: browser-data
+      volumes: 
+        - name: browser-data
+          persistentVolumeClaim:
+            claimName: searxng-browser-data
+---
 # Source: searxng/templates/external-secret.yaml
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
--- a/clusters/cl01tl/manifests/stack/stack.yaml
+++ b/clusters/cl01tl/manifests/stack/stack.yaml
@@ -38,6 +38,202 @@ spec:
      - PruneLast=true
      - RespectIgnoreDifferences=true
 ---
+# Source: stack/templates/application.yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: cilium
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/part-of: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: http://gitea-http.gitea:3000/alexlebens/infrastructure
+    targetRevision: manifests
+    path: clusters/cl01tl/manifests/cilium
+  destination:
+    name: in-cluster
+    namespace: kube-system
+  revisionHistoryLimit: 3
+  ignoreDifferences:
+    - group: monitoring.coreos.com
+      kind: ServiceMonitor
+      jqPathExpressions:
+        - .spec.endpoints[]?.relabelings[]?.action
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
+    retry:
+      limit: 3
+      backoff:
+        duration: 1m
+        factor: 2
+        maxDuration: 15m
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+      - PruneLast=true
+      - RespectIgnoreDifferences=true
+---
+# Source: stack/templates/application.yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: coredns
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: coredns
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/part-of: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: http://gitea-http.gitea:3000/alexlebens/infrastructure
+    targetRevision: manifests
+    path: clusters/cl01tl/manifests/coredns
+  destination:
+    name: in-cluster
+    namespace: kube-system
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    retry:
+      limit: 3
+      backoff:
+        duration: 1m
+        factor: 2
+        maxDuration: 15m
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+      - PruneLast=true
+---
+# Source: stack/templates/application.yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/part-of: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: http://gitea-http.gitea:3000/alexlebens/infrastructure
+    targetRevision: manifests
+    path: clusters/cl01tl/manifests/metrics-server
+  destination:
+    name: in-cluster
+    namespace: kube-system
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    retry:
+      limit: 3
+      backoff:
+        duration: 1m
+        factor: 2
+        maxDuration: 15m
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+      - PruneLast=true
+---
+# Source: stack/templates/application.yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kubelet-serving-cert-approver
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/part-of: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: http://gitea-http.gitea:3000/alexlebens/infrastructure
+    targetRevision: manifests
+    path: clusters/cl01tl/manifests/kubelet-serving-cert-approver
+  destination:
+    name: in-cluster
+    namespace: kubelet-serving-cert-approver
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
+    retry:
+      limit: 3
+      backoff:
+        duration: 1m
+        factor: 2
+        maxDuration: 15m
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+      - PruneLast=true
+---
+# Source: stack/templates/application.yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: prometheus-operator-crds
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: prometheus-operator-crds
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/part-of: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: http://gitea-http.gitea:3000/alexlebens/infrastructure
+    targetRevision: manifests
+    path: clusters/cl01tl/manifests/prometheus-operator-crds
+  destination:
+    name: in-cluster
+    namespace: kube-system
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
+    retry:
+      limit: 3
+      backoff:
+        duration: 1m
+        factor: 2
+        maxDuration: 15m
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+      - PruneLast=true
+---
 # Source: stack/templates/application-set.yaml
 apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
@@ -60,6 +256,16 @@ spec:
          - path: clusters/cl01tl/manifests/*
          - path: clusters/cl01tl/manifests/stack
            exclude: true
+          - path: clusters/cl01tl/manifests/cilium
+            exclude: true
+          - path: clusters/cl01tl/manifests/coredns
+            exclude: true
+          - path: clusters/cl01tl/manifests/metrics-server
+            exclude: true
+          - path: clusters/cl01tl/manifests/kubelet-serving-cert-approver
+            exclude: true
+          - path: clusters/cl01tl/manifests/prometheus-operator-crds
+            exclude: true
  template:
    metadata:
      name: '{{path.basename}}'
--- a/clusters/cl01tl/manifests/tdarr/tdarr.yaml
+++ b/clusters/cl01tl/manifests/tdarr/tdarr.yaml
@@ -111,30 +111,6 @@ spec:
 # Source: tdarr/charts/tdarr/templates/common.yaml
 apiVersion: v1
 kind: Service
-metadata:
-  name: tdarr-web
-  labels:
-    app.kubernetes.io/instance: tdarr
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: tdarr
-    app.kubernetes.io/service: tdarr-web
-    helm.sh/chart: tdarr-4.4.0
-  namespace: tdarr
-spec:
-  type: ClusterIP
-  ports:
-    - port: 8265
-      targetPort: 8265
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/controller: server
-    app.kubernetes.io/instance: tdarr
-    app.kubernetes.io/name: tdarr
---
-# Source: tdarr/charts/tdarr/templates/common.yaml
-apiVersion: v1
-kind: Service
 metadata:
  name: tdarr-api
  labels:
@@ -157,6 +133,30 @@ spec:
    app.kubernetes.io/name: tdarr
 ---
 # Source: tdarr/charts/tdarr/templates/common.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: tdarr-web
+  labels:
+    app.kubernetes.io/instance: tdarr
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: tdarr
+    app.kubernetes.io/service: tdarr-web
+    helm.sh/chart: tdarr-4.4.0
+  namespace: tdarr
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8265
+      targetPort: 8265
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/controller: server
+    app.kubernetes.io/instance: tdarr
+    app.kubernetes.io/name: tdarr
+---
+# Source: tdarr/charts/tdarr/templates/common.yaml
 apiVersion: apps/v1
 kind: DaemonSet
 metadata: