alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 7 Actions Activity

Merge pull request 'Automated Manifest Update' (#5704) from auto/update-manifests into manifests

Browse Source 
Reviewed-on: #5704
This commit was merged in pull request #5704.
This commit is contained in:
Alex Lebens
2026-04-08 01:46:54 +00:00
parent d25ba97a3c 510bdd6678
commit ed30bcc84f
45 changed files with 107 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
clusters/cl01tl/manifests/harbor/Cluster-harbor-postgresql-18-cluster.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: harbor
labels:
app.kubernetes.io/name: harbor-postgresql-18-cluster
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
instances: 3

4
clusters/cl01tl/manifests/harbor/ExternalSecret-harbor-postgresql-18-backup-garage-local-secret.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: harbor
labels:
app.kubernetes.io/name: harbor-postgresql-18-backup-garage-local-secret
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
secretStoreRef:

4
clusters/cl01tl/manifests/harbor/ExternalSecret-harbor-postgresql-18-recovery-secret.yaml
View File

@@ -4,10 +4,10 @@ metadata:
name: harbor-postgresql-18-recovery-secret
namespace: harbor
labels:
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: harbor-postgresql-18-recovery-secret
spec:

4
clusters/cl01tl/manifests/harbor/ObjectStore-harbor-postgresql-18-backup-garage-local.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: harbor
labels:
app.kubernetes.io/name: harbor-postgresql-18-backup-garage-local
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
retentionPolicy: 7d

4
clusters/cl01tl/manifests/harbor/ObjectStore-harbor-postgresql-18-recovery.yaml
View File

@@ -4,10 +4,10 @@ metadata:
name: "harbor-postgresql-18-recovery"
namespace: harbor
labels:
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: "harbor-postgresql-18-recovery"
spec:

4
clusters/cl01tl/manifests/harbor/PrometheusRule-harbor-postgresql-18-alert-rules.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: harbor
labels:
app.kubernetes.io/name: harbor-postgresql-18-alert-rules
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
groups:

4
clusters/cl01tl/manifests/harbor/ScheduledBackup-harbor-postgresql-18-scheduled-backup-live-backup.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: harbor
labels:
app.kubernetes.io/name: "harbor-postgresql-18-scheduled-backup-live-backup"
helm.sh/chart: postgres-18-cluster-7.11.1
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: harbor
app.kubernetes.io/part-of: harbor
app.kubernetes.io/version: "7.11.1"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
immediate: true

2
clusters/cl01tl/manifests/tdarr/Deployment-tdarr-server.yaml
View File

@@ -60,7 +60,7 @@ spec:
value: "8266"
- name: webUIPort
value: "8265"
image: ghcr.io/haveagitgat/tdarr:2.67.01@sha256:dc23becc667f77d2489b1042bd3af87fdd2fd85c2802e126928ef2ced9a8f560
image: ghcr.io/haveagitgat/tdarr:2.67.01@sha256:048ae8ed4de8e9f0de51ad739b2105bee3e4d1a8575120df468cec5f6ef2b1da
name: main
resources:
requests:

2
clusters/cl01tl/manifests/tdarr/StatefulSet-tdarr-node.yaml
View File

@@ -69,7 +69,7 @@ spec:
value: tdarr-api
- name: serverPort
value: "8266"
image: ghcr.io/haveagitgat/tdarr_node:2.67.01@sha256:048ae8ed4de8e9f0de51ad739b2105bee3e4d1a8575120df468cec5f6ef2b1da
image: ghcr.io/haveagitgat/tdarr_node:2.67.01@sha256:dc23becc667f77d2489b1042bd3af87fdd2fd85c2802e126928ef2ced9a8f560
name: main
resources:
limits:

10
clusters/cl01tl/manifests/unpackerr/Deployment-unpackerr.yaml
View File

@@ -29,6 +29,9 @@ spec:
enableServiceLinks: false
serviceAccountName: default
automountServiceAccountToken: true
securityContext:
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
hostIPC: false
hostNetwork: false
hostPID: false
@@ -36,7 +39,7 @@ spec:
containers:
- env:
- name: TZ
value: US/Central
value: America/Chicago
- name: UN_WEBSERVER_METRICS
value: "true"
- name: UN_SONARR_0_URL
@@ -74,13 +77,12 @@ spec:
envFrom:
- secretRef:
name: unpackerr-key-secret
image: golift/unpackerr:0.15.2
imagePullPolicy: IfNotPresent
image: golift/unpackerr:0.15.2@sha256:057e34740d26c34d81ec8e2faf8ec11f8dbfc77489b7a42826f52b37e5ee1b6c
name: main
resources:
requests:
cpu: 10m
memory: 128Mi
memory: 10Mi
volumeMounts:
- mountPath: /mnt/store
name: storage

24
clusters/cl01tl/manifests/unpackerr/ExternalSecret-unpackerr-key-secret.yaml
View File

@@ -14,57 +14,33 @@ spec:
data:
- secretKey: UN_SONARR_0_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/sonarr4/key
metadataPolicy: None
property: key
- secretKey: UN_SONARR_1_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/sonarr4-4k/key
metadataPolicy: None
property: key
- secretKey: UN_SONARR_2_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/sonarr4-anime/key
metadataPolicy: None
property: key
- secretKey: UN_RADARR_0_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/radarr5/key
metadataPolicy: None
property: key
- secretKey: UN_RADARR_1_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/radarr5-4k/key
metadataPolicy: None
property: key
- secretKey: UN_RADARR_2_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/radarr5-anime/key
metadataPolicy: None
property: key
- secretKey: UN_RADARR_3_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/radarr5-standup/key
metadataPolicy: None
property: key
- secretKey: UN_LIDARR_0_API_KEY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/lidarr2/key
metadataPolicy: None
property: key

9
clusters/cl01tl/manifests/unpoller/Deployment-unpoller.yaml
View File

@@ -36,7 +36,7 @@ spec:
containers:
- env:
- name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS
value: "false"
value: "true"
- name: UP_UNIFI_CONTROLLER_0_SAVE_ANOMALIES
value: "false"
- name: UP_UNIFI_CONTROLLER_0_SAVE_DPI
@@ -44,7 +44,7 @@ spec:
- name: UP_UNIFI_CONTROLLER_0_SAVE_EVENTS
value: "false"
- name: UP_UNIFI_CONTROLLER_0_SAVE_IDS
value: "false"
value: "true"
- name: UP_UNIFI_CONTROLLER_0_SAVE_SITES
value: "true"
- name: UP_UNIFI_CONTROLLER_0_URL
@@ -64,10 +64,9 @@ spec:
envFrom:
- secretRef:
name: unpoller-unifi-secret
image: ghcr.io/unpoller/unpoller:v2.39.0
imagePullPolicy: IfNotPresent
image: ghcr.io/unpoller/unpoller:v2.39.0@sha256:1cf63ad43121acc6995da1bd636063de9023b4bfc16599a4297951a6fb6b7fd2
name: main
resources:
requests:
cpu: 10m
memory: 64Mi
memory: 20Mi

6
clusters/cl01tl/manifests/unpoller/ExternalSecret-unpoller-unifi-secret.yaml
View File

@@ -14,15 +14,9 @@ spec:
data:
- secretKey: UP_UNIFI_CONTROLLER_0_USER
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /unifi/auth/cl01tl
metadataPolicy: None
property: user
- secretKey: UP_UNIFI_CONTROLLER_0_PASS
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /unifi/auth/cl01tl
metadataPolicy: None
property: password

9
clusters/cl01tl/manifests/vault/CronJob-vault-snapshot.yaml
View File

@@ -12,11 +12,11 @@ metadata:
spec:
suspend: false
concurrencyPolicy: Forbid
startingDeadlineSeconds: 90
timeZone: US/Central
startingDeadlineSeconds: 30
timeZone: America/Chicago
schedule: "0 4 * * *"
successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 3
failedJobsHistoryLimit: 1
jobTemplate:
spec:
parallelism: 1
@@ -48,8 +48,7 @@ spec:
envFrom:
- secretRef:
name: vault-snapshot-agent-token
image: hashicorp/vault:1.21.4
imagePullPolicy: IfNotPresent
image: hashicorp/vault:1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
name: snapshot
volumeMounts:
- mountPath: /opt/backup

7
clusters/cl01tl/manifests/vault/Deployment-vault-unseal-unseal-1.yaml
View File

@@ -37,10 +37,9 @@ spec:
- envFrom:
- secretRef:
name: vault-unseal-config-1
image: ghcr.io/lrstanley/vault-unseal:0.7.2
imagePullPolicy: IfNotPresent
image: ghcr.io/lrstanley/vault-unseal:0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
name: main
resources:
requests:
cpu: 10m
memory: 24Mi
cpu: 1m
memory: 10Mi

7
clusters/cl01tl/manifests/vault/Deployment-vault-unseal-unseal-2.yaml
View File

@@ -37,10 +37,9 @@ spec:
- envFrom:
- secretRef:
name: vault-unseal-config-2
image: ghcr.io/lrstanley/vault-unseal:0.7.2
imagePullPolicy: IfNotPresent
image: ghcr.io/lrstanley/vault-unseal:0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
name: main
resources:
requests:
cpu: 10m
memory: 24Mi
cpu: 1m
memory: 10Mi

7
clusters/cl01tl/manifests/vault/Deployment-vault-unseal-unseal-3.yaml
View File

@@ -37,10 +37,9 @@ spec:
- envFrom:
- secretRef:
name: vault-unseal-config-3
image: ghcr.io/lrstanley/vault-unseal:0.7.2
imagePullPolicy: IfNotPresent
image: ghcr.io/lrstanley/vault-unseal:0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
name: main
resources:
requests:
cpu: 10m
memory: 24Mi
cpu: 1m
memory: 10Mi

9
clusters/cl01tl/manifests/vault/ExternalSecret-vault-backup-ntfy-secret.yaml
View File

@@ -14,22 +14,13 @@ spec:
data:
- secretKey: NTFY_TOKEN
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /ntfy/user/cl01tl
metadataPolicy: None
property: token
- secretKey: NTFY_ENDPOINT
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /ntfy/user/cl01tl
metadataPolicy: None
property: endpoint
- secretKey: NTFY_TOPIC
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/snapshot
metadataPolicy: None
property: NTFY_TOPIC

6
clusters/cl01tl/manifests/vault/ExternalSecret-vault-s3cmd-external-config.yaml
View File

@@ -14,15 +14,9 @@ spec:
data:
- secretKey: .s3cfg
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/vault-backup
metadataPolicy: None
property: s3cfg
- secretKey: BUCKET
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/vault-backup
metadataPolicy: None
property: BUCKET

6
clusters/cl01tl/manifests/vault/ExternalSecret-vault-s3cmd-local-config.yaml
View File

@@ -14,15 +14,9 @@ spec:
data:
- secretKey: .s3cfg
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/vault-backups
metadataPolicy: None
property: s3cfg-local
- secretKey: BUCKET
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/vault-backups
metadataPolicy: None
property: BUCKET

6
clusters/cl01tl/manifests/vault/ExternalSecret-vault-s3cmd-remote-config.yaml
View File

@@ -14,15 +14,9 @@ spec:
data:
- secretKey: .s3cfg
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/vault-backups
metadataPolicy: None
property: s3cfg-remote
- secretKey: BUCKET
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /garage/home-infra/vault-backups
metadataPolicy: None
property: BUCKET

6
clusters/cl01tl/manifests/vault/ExternalSecret-vault-snapshot-agent-token.yaml
View File

@@ -14,15 +14,9 @@ spec:
data:
- secretKey: VAULT_APPROLE_ROLE_ID
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/snapshot
metadataPolicy: None
property: VAULT_APPROLE_ROLE_ID
- secretKey: VAULT_APPROLE_SECRET_ID
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/snapshot
metadataPolicy: None
property: VAULT_APPROLE_SECRET_ID

18
clusters/cl01tl/manifests/vault/ExternalSecret-vault-token.yaml
View File

@@ -14,43 +14,25 @@ spec:
data:
- secretKey: token
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/token
metadataPolicy: None
property: token
- secretKey: unseal_key_1
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/token
metadataPolicy: None
property: unseal_key_1
- secretKey: unseal_key_2
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/token
metadataPolicy: None
property: unseal_key_2
- secretKey: unseal_key_3
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/token
metadataPolicy: None
property: unseal_key_3
- secretKey: unseal_key_4
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/token
metadataPolicy: None
property: unseal_key_4
- secretKey: unseal_key_5
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/token
metadataPolicy: None
property: unseal_key_5

27
clusters/cl01tl/manifests/vault/ExternalSecret-vault-unseal-config-1.yaml
View File

@@ -14,64 +14,37 @@ spec:
data:
- secretKey: ENVIRONMENT
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: ENVIRONMENT
- secretKey: CHECK_INTERVAL
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: CHECK_INTERVAL
- secretKey: MAX_CHECK_INTERVAL
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: MAX_CHECK_INTERVAL
- secretKey: NODES
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: NODES
- secretKey: TLS_SKIP_VERIFY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: TLS_SKIP_VERIFY
- secretKey: TOKENS
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: TOKENS
- secretKey: EMAIL_ENABLED
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: EMAIL_ENABLED
- secretKey: NOTIFY_MAX_ELAPSED
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: NOTIFY_MAX_ELAPSED
- secretKey: NOTIFY_QUEUE_DELAY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-1
metadataPolicy: None
property: NOTIFY_QUEUE_DELAY

27
clusters/cl01tl/manifests/vault/ExternalSecret-vault-unseal-config-2.yaml
View File

@@ -14,64 +14,37 @@ spec:
data:
- secretKey: ENVIRONMENT
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: ENVIRONMENT
- secretKey: CHECK_INTERVAL
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: CHECK_INTERVAL
- secretKey: MAX_CHECK_INTERVAL
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: MAX_CHECK_INTERVAL
- secretKey: NODES
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: NODES
- secretKey: TLS_SKIP_VERIFY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: TLS_SKIP_VERIFY
- secretKey: TOKENS
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: TOKENS
- secretKey: EMAIL_ENABLED
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: EMAIL_ENABLED
- secretKey: NOTIFY_MAX_ELAPSED
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: NOTIFY_MAX_ELAPSED
- secretKey: NOTIFY_QUEUE_DELAY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-2
metadataPolicy: None
property: NOTIFY_QUEUE_DELAY

27
clusters/cl01tl/manifests/vault/ExternalSecret-vault-unseal-config-3.yaml
View File

@@ -14,64 +14,37 @@ spec:
data:
- secretKey: ENVIRONMENT
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: ENVIRONMENT
- secretKey: CHECK_INTERVAL
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: CHECK_INTERVAL
- secretKey: MAX_CHECK_INTERVAL
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: MAX_CHECK_INTERVAL
- secretKey: NODES
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: NODES
- secretKey: TLS_SKIP_VERIFY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: TLS_SKIP_VERIFY
- secretKey: TOKENS
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: TOKENS
- secretKey: EMAIL_ENABLED
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: EMAIL_ENABLED
- secretKey: NOTIFY_MAX_ELAPSED
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: NOTIFY_MAX_ELAPSED
- secretKey: NOTIFY_QUEUE_DELAY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/vault/unseal/config-3
metadataPolicy: None
property: NOTIFY_QUEUE_DELAY

1
clusters/cl01tl/manifests/vault/HTTPRoute-vault.yaml
View File

@@ -25,4 +25,3 @@ spec:
kind: Service
name: vault-active
port: 8200
weight: 100

2
clusters/cl01tl/manifests/vault/Pod-vault-server-test.yaml
View File

@@ -8,7 +8,7 @@ metadata:
spec:
containers:
- name: vault-server-test
image: hashicorp/vault:1.21.4
image: hashicorp/vault:1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
imagePullPolicy: IfNotPresent
env:
- name: VAULT_ADDR

1
clusters/cl01tl/manifests/vault/Service-vault-active.yaml
View File

@@ -11,7 +11,6 @@ metadata:
vault-active: "true"
annotations:
spec:
type: ClusterIP
publishNotReadyAddresses: true
ports:
- name: http

20
clusters/cl01tl/manifests/vault/Service-vault-ui.yaml → clusters/cl01tl/manifests/vault/Service-vault-standby.yaml
View File

@@ -1,21 +1,25 @@
apiVersion: v1
kind: Service
metadata:
name: vault-ui
name: vault-standby
namespace: vault
labels:
helm.sh/chart: vault-0.32.0
app.kubernetes.io/name: vault-ui
app.kubernetes.io/instance: vault
app.kubernetes.io/managed-by: Helm
spec:
selector:
app.kubernetes.io/name: vault
app.kubernetes.io/instance: vault
component: server
app.kubernetes.io/managed-by: Helm
annotations:
spec:
publishNotReadyAddresses: true
ports:
- name: http
port: 8200
targetPort: 8200
type: ClusterIP
- name: https-internal
port: 8201
targetPort: 8201
selector:
app.kubernetes.io/name: vault
app.kubernetes.io/instance: vault
component: server
vault-active: "false"

1
clusters/cl01tl/manifests/vault/Service-vault.yaml
View File

@@ -10,7 +10,6 @@ metadata:
app.kubernetes.io/managed-by: Helm
annotations:
spec:
type: ClusterIP
publishNotReadyAddresses: true
ports:
- name: http

22
clusters/cl01tl/manifests/vault/StatefulSet-vault.yaml
View File

@@ -58,8 +58,8 @@ spec:
resources:
requests:
cpu: 50m
memory: 512Mi
image: hashicorp/vault:1.21.4
memory: 90Mi
image: hashicorp/vault:1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
imagePullPolicy: IfNotPresent
command:
- "/bin/sh"
@@ -101,11 +101,9 @@ spec:
value: "https://$(HOSTNAME).vault-internal:8201"
- name: HOME
value: "/home/vault"
- name: VAULT_LOG_LEVEL
value: "debug"
- name: VAULT_LOG_FORMAT
value: "standard"
volumeMounts:
- name: audit
mountPath: /vault/audit
- name: data
mountPath: /vault/data
- name: config
@@ -148,3 +146,15 @@ spec:
resources:
requests:
storage: 1Gi
storageClassName: ceph-block
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: audit
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi
storageClassName: ceph-block

8
clusters/cl01tl/manifests/vaultwarden/Cluster-vaultwarden-postgresql-18-cluster.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: vaultwarden
labels:
app.kubernetes.io/name: vaultwarden-postgresql-18-cluster
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
instances: 3
@@ -26,8 +26,8 @@ spec:
limits:
hugepages-2Mi: 256Mi
requests:
cpu: 100m
memory: 256Mi
cpu: 20m
memory: 80Mi
affinity:
enablePodAntiAffinity: true
topologyKey: kubernetes.io/hostname

5
clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden.yaml
View File

@@ -64,13 +64,12 @@ spec:
secretKeyRef:
key: secret
name: vaultwarden-oidc-secret
image: vaultwarden/server:1.35.4
imagePullPolicy: IfNotPresent
image: ghcr.io/vaultwarden/server:1.35.4@sha256:43498a94b22f9563f2a94b53760ab3e710eefc0d0cac2efda4b12b9eb8690664
name: main
resources:
requests:
cpu: 10m
memory: 128Mi
memory: 30Mi
volumeMounts:
- mountPath: /data
name: config

6
clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-oidc-secret.yaml
View File

@@ -14,15 +14,9 @@ spec:
data:
- secretKey: client
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /authentik/oidc/vaultwarden
metadataPolicy: None
property: client
- secretKey: secret
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /authentik/oidc/vaultwarden
metadataPolicy: None
property: secret

4
clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-postgresql-18-backup-garage-local-secret.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: vaultwarden
labels:
app.kubernetes.io/name: vaultwarden-postgresql-18-backup-garage-local-secret
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
secretStoreRef:

4
clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-postgresql-18-recovery-secret.yaml
View File

@@ -4,10 +4,10 @@ metadata:
name: vaultwarden-postgresql-18-recovery-secret
namespace: vaultwarden
labels:
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: vaultwarden-postgresql-18-recovery-secret
spec:

4
clusters/cl01tl/manifests/vaultwarden/ObjectStore-vaultwarden-postgresql-18-backup-garage-local.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: vaultwarden
labels:
app.kubernetes.io/name: vaultwarden-postgresql-18-backup-garage-local
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
retentionPolicy: 7d

4
clusters/cl01tl/manifests/vaultwarden/ObjectStore-vaultwarden-postgresql-18-recovery.yaml
View File

@@ -4,10 +4,10 @@ metadata:
name: "vaultwarden-postgresql-18-recovery"
namespace: vaultwarden
labels:
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: "vaultwarden-postgresql-18-recovery"
spec:

2
clusters/cl01tl/manifests/vaultwarden/PersistentVolumeClaim-vaultwarden-data.yaml
View File

@@ -7,8 +7,6 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: vaultwarden
helm.sh/chart: vaultwarden-4.6.2
annotations:
helm.sh/resource-policy: keep
namespace: vaultwarden
spec:
accessModes:

4
clusters/cl01tl/manifests/vaultwarden/PrometheusRule-vaultwarden-postgresql-18-alert-rules.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: vaultwarden
labels:
app.kubernetes.io/name: vaultwarden-postgresql-18-alert-rules
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
groups:

4
clusters/cl01tl/manifests/vaultwarden/ScheduledBackup-vaultwarden-postgresql-18-scheduled-backup-live-backup.yaml
View File

@@ -5,10 +5,10 @@ metadata:
namespace: vaultwarden
labels:
app.kubernetes.io/name: "vaultwarden-postgresql-18-scheduled-backup-live-backup"
helm.sh/chart: postgres-18-cluster-7.10.0
helm.sh/chart: postgres-18-cluster-7.11.2
app.kubernetes.io/instance: vaultwarden
app.kubernetes.io/part-of: vaultwarden
app.kubernetes.io/version: "7.10.0"
app.kubernetes.io/version: "7.11.2"
app.kubernetes.io/managed-by: Helm
spec:
immediate: true

2
clusters/cl01tl/manifests/version-checker/Deployment-version-checker.yaml
View File

@@ -45,7 +45,7 @@ spec:
resources:
requests:
cpu: 1m
memory: 40Mi
memory: 400Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:

16
clusters/cl01tl/manifests/version-checker/ServiceMonitor-version-checker.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: version-checker
namespace: version-checker
labels:
app.kubernetes.io/name: version-checker
app.kubernetes.io/instance: version-checker
app.kubernetes.io/part-of: version-checker
spec:
selector:
matchLabels:
app: version-checker
endpoints:
- port: web
path: /metrics

10
clusters/cl01tl/manifests/volsync/Deployment-volsync.yaml
View File

@@ -47,7 +47,7 @@ spec:
- --metrics-require-rbac=false
command:
- /manager
image: "quay.io/backube/volsync:0.15.0"
image: "0.15.0@sha256:4fedd41b3101dde090542009c4177f703d241bf4760d1767bd9df08fd8fd93a4"
imagePullPolicy: IfNotPresent
env:
- name: VOLSYNC_NAMESPACE
@@ -67,12 +67,10 @@ spec:
initialDelaySeconds: 5
periodSeconds: 10
resources:
limits:
cpu: 1000m
memory: 1Gi
limits: {}
requests:
cpu: 10m
memory: 128Mi
cpu: 1m
memory: 80Mi
securityContext:
allowPrivilegeEscalation: false
capabilities: