alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 12 Actions 5 Activity

Merge pull request 'Automated Manifest Update' (#6156) from auto/update-manifests into manifests

Browse Source 
Reviewed-on: #6156
This commit was merged in pull request #6156.
This commit is contained in:
Alex Lebens
2026-04-24 00:19:40 +00:00
parent cfe38d32cf ba20a96b0f
commit fb30160603
233 changed files with 1471 additions and 1345 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-config-apprise.yaml
View File

@@ -16,9 +16,13 @@ spec:
mergePolicy: Merge
engineVersion: v2
data:
ntfy-url: "{{ .endpoint }}/audiobookshelf"
ntfy-url: "{{ .endpoint }}/{{ .topic }}"
data:
- secretKey: endpoint
remoteRef:
key: /cl01tl/ntfy/users/cl01tl
property: internal-endpoint-credential
- secretKey: topic
remoteRef:
key: /cl01tl/ntfy/topics
property: audiobookshelf

4
clusters/cl01tl/manifests/authentik/Ingress-authentik-tailscale.yaml
View File

@@ -5,9 +5,9 @@ metadata:
namespace: authentik
labels:
app.kubernetes.io/name: authentik-tailscale
tailscale.com/proxy-class: no-metrics
app.kubernetes.io/instance: authentik
app.kubernetes.io/part-of: authentik
tailscale.com/proxy-class: no-metrics
annotations:
tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
spec:
@@ -26,4 +26,4 @@ spec:
service:
name: authentik-server
port:
number: 80
name: http

4
clusters/cl01tl/manifests/cilium/HTTPRoute-hubble.yaml
View File

@@ -21,8 +21,6 @@ spec:
type: PathPrefix
value: /
backendRefs:
- group: ''
kind: Service
- kind: Service
name: hubble-ui
port: 80
weight: 100

2
clusters/cl01tl/manifests/democratic-csi-synology-iscsi/DaemonSet-democratic-csi-synology-iscsi-node.yaml
View File

@@ -205,7 +205,7 @@ spec:
type: Directory
- name: config
secret:
secretName: synology-iscsi-config-secret
secretName: synology-iscsi-config
- name: extra-ca-certs
configMap:
name: democratic-csi-synology-iscsi

2
clusters/cl01tl/manifests/democratic-csi-synology-iscsi/Deployment-democratic-csi-synology-iscsi-controller.yaml
View File

@@ -178,7 +178,7 @@ spec:
emptyDir: {}
- name: config
secret:
secretName: synology-iscsi-config-secret
secretName: synology-iscsi-config
- name: extra-ca-certs
configMap:
name: democratic-csi-synology-iscsi

6
clusters/cl01tl/manifests/democratic-csi-synology-iscsi/ExternalSecret-synology-iscsi-config-secret.yaml → clusters/cl01tl/manifests/democratic-csi-synology-iscsi/ExternalSecret-synology-iscsi-config.yaml
View File

@@ -1,16 +1,16 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: synology-iscsi-config-secret
name: synology-iscsi-config
namespace: democratic-csi-synology-iscsi
labels:
app.kubernetes.io/name: synology-iscsi-config-secret
app.kubernetes.io/name: synology-iscsi-config
app.kubernetes.io/instance: democratic-csi-synology-iscsi
app.kubernetes.io/part-of: democratic-csi-synology-iscsi
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: driver-config-file.yaml
remoteRef:

4
clusters/cl01tl/manifests/directus/Deployment-directus.yaml
View File

@@ -139,12 +139,12 @@ spec:
valueFrom:
secretKeyRef:
key: OIDC_CLIENT_ID
name: directus-oidc-secret
name: directus-oidc-authentik
- name: AUTH_AUTHENTIK_CLIENT_SECRET
valueFrom:
secretKeyRef:
key: OIDC_CLIENT_SECRET
name: directus-oidc-secret
name: directus-oidc-authentik
- name: AUTH_AUTHENTIK_SCOPE
value: openid profile email
- name: AUTH_AUTHENTIK_ISSUER_URL

2
clusters/cl01tl/manifests/directus/ExternalSecret-directus-bucket-garage.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: ACCESS_KEY_ID
remoteRef:

18
clusters/cl01tl/manifests/directus/ExternalSecret-directus-config.yaml
View File

@@ -10,8 +10,16 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: key
remoteRef:
key: /cl01tl/directus/key
property: key
- secretKey: secret
remoteRef:
key: /cl01tl/directus/key
property: secret
- secretKey: admin-email
remoteRef:
key: /cl01tl/directus/config
@@ -20,11 +28,3 @@ spec:
remoteRef:
key: /cl01tl/directus/config
property: admin-password
- secretKey: secret
remoteRef:
key: /cl01tl/directus/config
property: secret
- secretKey: key
remoteRef:
key: /cl01tl/directus/config
property: key

2
clusters/cl01tl/manifests/directus/ExternalSecret-directus-metric-token.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: metric-token
remoteRef:

10
clusters/cl01tl/manifests/directus/ExternalSecret-directus-oidc-secret.yaml → clusters/cl01tl/manifests/directus/ExternalSecret-directus-oidc-authentik.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: directus-oidc-secret
name: directus-oidc-authentik
namespace: directus
labels:
app.kubernetes.io/name: directus-oidc-secret
app.kubernetes.io/name: directus-oidc-authentik
app.kubernetes.io/instance: directus
app.kubernetes.io/part-of: directus
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: OIDC_CLIENT_ID
remoteRef:
key: /authentik/oidc/directus
key: /cl01tl/authentik/oidc/directus
property: client
- secretKey: OIDC_CLIENT_SECRET
remoteRef:
key: /authentik/oidc/directus
key: /cl01tl/authentik/oidc/directus
property: secret

10
clusters/cl01tl/manifests/directus/ExternalSecret-directus-valkey-config.yaml
View File

@@ -10,12 +10,8 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: default
remoteRef:
key: /cl01tl/directus/valkey
property: password
- secretKey: user
remoteRef:
key: /cl01tl/directus/valkey
@@ -24,3 +20,7 @@ spec:
remoteRef:
key: /cl01tl/directus/valkey
property: password
- secretKey: default
remoteRef:
key: /cl01tl/directus/valkey
property: password

10
clusters/cl01tl/manifests/external-dns/DNSEndpoint-iot-device-names.yaml
View File

@@ -34,3 +34,13 @@ spec:
recordType: A
targets:
- 10.230.0.100
- dnsName: dv01hr.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 10.232.1.72
- dnsName: dv02kv.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 10.232.1.71

10
clusters/cl01tl/manifests/external-dns/DNSEndpoint-server-host-names.yaml
View File

@@ -34,3 +34,13 @@ spec:
recordType: A
targets:
- 10.232.1.52
- dnsName: pd05wd.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 10.230.0.115
- dnsName: pl02mc.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 10.230.0.105

2
clusters/cl01tl/manifests/external-dns/ExternalSecret-external-dns-unifi-secret.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: api-key
remoteRef:

4
clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml
View File

@@ -98,9 +98,9 @@ spec:
value: preferred_username
envFrom:
- secretRef:
name: freshrss-oidc-secret
name: freshrss-oidc-authentik
- secretRef:
name: freshrss-install-secret
name: freshrss-install-config
image: freshrss/freshrss:1.28.1@sha256:9100f649f5c946f589f54cdb9be7a65996528f48f691ef90eb262a0e06e5a522
name: main
resources:

12
clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-install-secret.yaml → clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-install-config.yaml
View File

@@ -1,26 +1,26 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: freshrss-install-secret
name: freshrss-install-config
namespace: freshrss
labels:
app.kubernetes.io/name: freshrss-install-secret
app.kubernetes.io/name: freshrss-install-config
app.kubernetes.io/instance: freshrss
app.kubernetes.io/part-of: freshrss
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: ADMIN_EMAIL
remoteRef:
key: /cl01tl/freshrss/config
property: ADMIN_EMAIL
property: admin-email
- secretKey: ADMIN_PASSWORD
remoteRef:
key: /cl01tl/freshrss/config
property: ADMIN_PASSWORD
property: admin-password
- secretKey: ADMIN_API_PASSWORD
remoteRef:
key: /cl01tl/freshrss/config
property: ADMIN_API_PASSWORD
property: admin-api-password

14
clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-oidc-secret.yaml → clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-oidc-authentik.yaml
View File

@@ -1,26 +1,26 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: freshrss-oidc-secret
name: freshrss-oidc-authentik
namespace: freshrss
labels:
app.kubernetes.io/name: freshrss-oidc-secret
app.kubernetes.io/name: freshrss-oidc-authentik
app.kubernetes.io/instance: freshrss
app.kubernetes.io/part-of: freshrss
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: OIDC_CLIENT_ID
remoteRef:
key: /authentik/oidc/freshrss
key: /cl01tl/authentik/oidc/freshrss
property: client
- secretKey: OIDC_CLIENT_SECRET
remoteRef:
key: /authentik/oidc/freshrss
key: /cl01tl/authentik/oidc/freshrss
property: secret
- secretKey: OIDC_CLIENT_CRYPTO_KEY
remoteRef:
key: /authentik/oidc/freshrss
property: crypto-key
key: /cl01tl/freshrss/key
property: oidc-client-crypto-key

2
clusters/cl01tl/manifests/garage/Deployment-garage-server-1.yaml
View File

@@ -49,7 +49,7 @@ spec:
containers:
- envFrom:
- secretRef:
name: garage-token-secret
name: garage-token
image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
name: main
resources:

2
clusters/cl01tl/manifests/garage/Deployment-garage-server-2.yaml
View File

@@ -49,7 +49,7 @@ spec:
containers:
- envFrom:
- secretRef:
name: garage-token-secret
name: garage-token
image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
name: main
resources:

2
clusters/cl01tl/manifests/garage/Deployment-garage-server-3.yaml
View File

@@ -49,7 +49,7 @@ spec:
containers:
- envFrom:
- secretRef:
name: garage-token-secret
name: garage-token
image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
name: main
resources:

2
clusters/cl01tl/manifests/garage/Deployment-garage-webui.yaml
View File

@@ -45,7 +45,7 @@ spec:
valueFrom:
secretKeyRef:
key: GARAGE_ADMIN_TOKEN
name: garage-token-secret
name: garage-token
image: khairul169/garage-webui:1.1.0@sha256:17c793551873155065bf9a022dabcde874de808a1f26e648d4b82e168806439c
name: main
resources:

18
clusters/cl01tl/manifests/garage/ExternalSecret-garage-token-secret.yaml → clusters/cl01tl/manifests/garage/ExternalSecret-garage-token.yaml
View File

@@ -1,26 +1,26 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: garage-token-secret
name: garage-token
namespace: garage
labels:
app.kubernetes.io/name: garage-token-secret
app.kubernetes.io/name: garage-token
app.kubernetes.io/instance: garage
app.kubernetes.io/part-of: garage
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: GARAGE_RPC_SECRET
remoteRef:
key: /cl01tl/garage/token
property: rpc
key: /cl01tl/garage/config
property: rpc-secret
- secretKey: GARAGE_ADMIN_TOKEN
remoteRef:
key: /cl01tl/garage/token
property: admin
key: /cl01tl/garage/config
property: admin-token
- secretKey: GARAGE_METRICS_TOKEN
remoteRef:
key: /cl01tl/garage/token
property: metric
key: /cl01tl/garage/config
property: metrics-token

2
clusters/cl01tl/manifests/garage/Service-garage-main.yaml
View File

@@ -27,6 +27,6 @@ spec:
protocol: TCP
targetPort: 3902
selector:
app.kubernetes.io/instance: garage
app.kubernetes.io/name: garage
app.kubernetes.io/instance: garage
garage-type: server

2
clusters/cl01tl/manifests/garage/ServiceMonitor-garage.yaml
View File

@@ -21,7 +21,7 @@ spec:
endpoints:
- bearerTokenSecret:
key: GARAGE_METRICS_TOKEN
name: garage-token-secret
name: garage-token
interval: 5m
path: /metrics
port: admin

6
clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml
View File

@@ -50,17 +50,17 @@ spec:
valueFrom:
secretKeyRef:
key: NTFY_TOKEN
name: gatus-config-secret
name: gatus-config
- name: "OIDC_CLIENT_ID"
valueFrom:
secretKeyRef:
key: OIDC_CLIENT_ID
name: gatus-oidc-secret
name: gatus-oidc-authentik
- name: "OIDC_CLIENT_SECRET"
valueFrom:
secretKeyRef:
key: OIDC_CLIENT_SECRET
name: gatus-oidc-secret
name: gatus-oidc-authentik
- name: "POSTGRES_DB"
valueFrom:
secretKeyRef:

6
clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-config-secret.yaml → clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-config.yaml
View File

@@ -1,7 +1,7 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gatus-config-secret
name: gatus-config
namespace: gatus
labels:
app.kubernetes.io/name: gatus-config-secret
@@ -10,9 +10,9 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: NTFY_TOKEN
remoteRef:
key: /ntfy/user/cl01tl
key: /cl01tl/ntfy/users/cl01tl
property: token

10
clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-oidc-secret.yaml → clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-oidc-authentik.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gatus-oidc-secret
name: gatus-oidc-authentik
namespace: gatus
labels:
app.kubernetes.io/name: gatus-oidc-secret
app.kubernetes.io/name: gatus-oidc-authentik
app.kubernetes.io/instance: gatus
app.kubernetes.io/part-of: gatus
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: OIDC_CLIENT_ID
remoteRef:
key: /authentik/oidc/gatus
key: /cl01tl/authentik/oidc/gatus
property: client
- secretKey: OIDC_CLIENT_SECRET
remoteRef:
key: /authentik/oidc/gatus
key: /cl01tl/authentik/oidc/gatus
property: secret

6
clusters/cl01tl/manifests/gitea/Deployment-gitea.yaml
View File

@@ -111,7 +111,7 @@ spec:
valueFrom:
secretKeyRef:
key: ISSUE_INDEXER_CONN_STR
name: gitea-meilisearch-master-key-secret
name: gitea-meilisearch-key
volumeMounts:
- name: config
mountPath: /usr/sbinx
@@ -151,12 +151,12 @@ spec:
valueFrom:
secretKeyRef:
key: key
name: gitea-oidc-secret
name: gitea-oidc-authentik
- name: GITEA_OAUTH_SECRET_0
valueFrom:
secretKeyRef:
key: secret
name: gitea-oidc-secret
name: gitea-oidc-authentik
- name: GITEA_ADMIN_USERNAME
value: "gitea_admin"
- name: GITEA_ADMIN_PASSWORD

22
clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-admin-secret.yaml
View File

@@ -1,22 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-admin-secret
namespace: gitea
labels:
app.kubernetes.io/name: gitea-admin-secret
app.kubernetes.io/instance: gitea
app.kubernetes.io/part-of: gitea
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: username
remoteRef:
key: /cl01tl/gitea/auth/admin
property: username
- secretKey: password
remoteRef:
key: /cl01tl/gitea/auth/admin
property: password

8
clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-meilisearch-master-key-secret.yaml → clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-meilisearch-key.yaml
View File

@@ -1,16 +1,16 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-meilisearch-master-key-secret
name: gitea-meilisearch-key
namespace: gitea
labels:
app.kubernetes.io/name: gitea-meilisearch-master-key-secret
app.kubernetes.io/name: gitea-meilisearch-key
app.kubernetes.io/instance: gitea
app.kubernetes.io/part-of: gitea
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
target:
template:
mergePolicy: Merge
@@ -21,4 +21,4 @@ spec:
- secretKey: MEILI_MASTER_KEY
remoteRef:
key: /cl01tl/gitea/meilisearch
property: MEILI_MASTER_KEY
property: master-key

10
clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-oidc-secret.yaml → clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-oidc-authentik.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-oidc-secret
name: gitea-oidc-authentik
namespace: gitea
labels:
app.kubernetes.io/name: gitea-oidc-secret
app.kubernetes.io/name: gitea-oidc-authentik
app.kubernetes.io/instance: gitea
app.kubernetes.io/part-of: gitea
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: secret
remoteRef:
key: /authentik/oidc/gitea
key: /cl01tl/authentik/oidc/gitea
property: secret
- secretKey: key
remoteRef:
key: /authentik/oidc/gitea
key: /cl01tl/authentik/oidc/gitea
property: client

34
clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-secret.yaml
View File

@@ -1,34 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-renovate-secret
namespace: gitea
labels:
app.kubernetes.io/name: gitea-renovate-secret
app.kubernetes.io/instance: gitea
app.kubernetes.io/part-of: gitea
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: RENOVATE_ENDPOINT
remoteRef:
key: /cl01tl/gitea/renovate
property: RENOVATE_ENDPOINT
- secretKey: RENOVATE_GIT_AUTHOR
remoteRef:
key: /cl01tl/gitea/renovate
property: RENOVATE_GIT_AUTHOR
- secretKey: RENOVATE_TOKEN
remoteRef:
key: /cl01tl/gitea/renovate
property: RENOVATE_TOKEN
- secretKey: RENOVATE_GIT_PRIVATE_KEY
remoteRef:
key: /cl01tl/gitea/renovate
property: id_rsa
- secretKey: RENOVATE_GITHUB_COM_TOKEN
remoteRef:
key: /github/gitea-cl01tl
property: token

26
clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-ssh-secret.yaml
View File

@@ -1,26 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-renovate-ssh-secret
namespace: gitea
labels:
app.kubernetes.io/name: gitea-renovate-ssh-secret
app.kubernetes.io/instance: gitea
app.kubernetes.io/part-of: gitea
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: config
remoteRef:
key: /cl01tl/gitea/renovate
property: ssh_config
- secretKey: id_rsa
remoteRef:
key: /cl01tl/gitea/renovate
property: id_rsa
- secretKey: id_rsa.pub
remoteRef:
key: /cl01tl/gitea/renovate
property: id_rsa.pub

2
clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-runner-secret.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: token
remoteRef:

4
clusters/cl01tl/manifests/gitea/HTTPRoute-gitea.yaml
View File

@@ -21,8 +21,6 @@ spec:
type: PathPrefix
value: /
backendRefs:
- group: ''
kind: Service
- kind: Service
name: gitea-http
port: 3000
weight: 100

2
clusters/cl01tl/manifests/gitea/Ingress-gitea-tailscale.yaml
View File

@@ -21,7 +21,7 @@ spec:
http:
paths:
- path: /
pathType: ImplementationSpecific
pathType: Prefix
backend:
service:
name: gitea-http

2
clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-meilisearch.yaml
View File

@@ -26,5 +26,5 @@ spec:
interval: 1m
scrapeTimeout: 10s
bearerTokenSecret:
name: gitea-meilisearch-master-key-secret
name: gitea-meilisearch-key
key: MEILI_MASTER_KEY

2
clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
View File

@@ -62,7 +62,7 @@ spec:
- configMapRef:
name: gitea-meilisearch-environment
- secretRef:
name: gitea-meilisearch-master-key-secret
name: gitea-meilisearch-key
ports:
- name: http
containerPort: 7700

4
clusters/cl01tl/manifests/gitea/TCPRoute-gitea-ssh.yaml
View File

@@ -16,8 +16,6 @@ spec:
sectionName: ssh
rules:
- backendRefs:
- group: ''
kind: Service
- kind: Service
name: gitea-ssh
port: 22
weight: 100

10
clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-auth-secret.yaml → clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-config.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: grafana-auth-secret
name: grafana-config
namespace: grafana-operator
labels:
app.kubernetes.io/name: grafana-auth-secret
app.kubernetes.io/name: grafana-config
app.kubernetes.io/instance: grafana-operator
app.kubernetes.io/part-of: grafana-operator
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: admin-user
remoteRef:
key: /cl01tl/grafana/auth
key: /cl01tl/grafana/config
property: admin-user
- secretKey: admin-password
remoteRef:
key: /cl01tl/grafana/auth
key: /cl01tl/grafana/config
property: admin-password

10
clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-oauth-secret.yaml → clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-oidc-authentik.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: grafana-oauth-secret
name: grafana-oidc-authentik
namespace: grafana-operator
labels:
app.kubernetes.io/name: grafana-oauth-secret
app.kubernetes.io/name: grafana-oidc-authentik
app.kubernetes.io/instance: grafana-operator
app.kubernetes.io/part-of: grafana-operator
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: AUTH_CLIENT_ID
remoteRef:
key: /authentik/oidc/grafana
key: /cl01tl/authentik/oidc/grafana
property: client
- secretKey: AUTH_CLIENT_SECRET
remoteRef:
key: /authentik/oidc/grafana
key: /cl01tl/authentik/oidc/grafana
property: secret

26
clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-operator-postgresql-18-cluster-backup-secret-garage.yaml
View File

@@ -1,26 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: grafana-operator-postgresql-18-cluster-backup-secret-garage
namespace: grafana-operator
labels:
app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret-garage
app.kubernetes.io/instance: grafana-operator
app.kubernetes.io/part-of: grafana-operator
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: ACCESS_KEY_ID
remoteRef:
key: /garage/home-infra/postgres-backups
property: ACCESS_KEY_ID
- secretKey: ACCESS_SECRET_KEY
remoteRef:
key: /garage/home-infra/postgres-backups
property: ACCESS_SECRET_KEY
- secretKey: ACCESS_REGION
remoteRef:
key: /garage/home-infra/postgres-backups
property: ACCESS_REGION

22
clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-operator-postgresql-18-cluster-backup-secret.yaml
View File

@@ -1,22 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: grafana-operator-postgresql-18-cluster-backup-secret
namespace: grafana-operator
labels:
app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret
app.kubernetes.io/instance: grafana-operator
app.kubernetes.io/part-of: grafana-operator
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: ACCESS_KEY_ID
remoteRef:
key: /digital-ocean/home-infra/postgres-backups
property: access
- secretKey: ACCESS_SECRET_KEY
remoteRef:
key: /digital-ocean/home-infra/postgres-backups
property: secret

8
clusters/cl01tl/manifests/grafana-operator/Grafana-grafana-main.yaml
View File

@@ -65,22 +65,22 @@ spec:
- name: AUTH_CLIENT_ID
valueFrom:
secretKeyRef:
name: grafana-oauth-secret
name: grafana-oidc-authentik
key: AUTH_CLIENT_ID
- name: AUTH_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: grafana-oauth-secret
name: grafana-oidc-authentik
key: AUTH_CLIENT_SECRET
- name: ADMIN_USER
valueFrom:
secretKeyRef:
name: grafana-auth-secret
name: grafana-config
key: admin-user
- name: ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: grafana-auth-secret
name: grafana-config
key: admin-password
- name: DB_HOST
valueFrom:

2
clusters/cl01tl/manifests/grimmory/Deployment-grimmory.yaml
View File

@@ -52,7 +52,7 @@ spec:
valueFrom:
secretKeyRef:
key: password
name: grimmory-database-secret
name: grimmory-database-config
- name: GRIMMORY_PORT
value: "6060"
- name: SWAGGER_ENABLED

18
clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-data-replication-secret.yaml
View File

@@ -1,18 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: grimmory-data-replication-secret
namespace: grimmory
labels:
app.kubernetes.io/name: grimmory-data-replication-secret
app.kubernetes.io/instance: grimmory
app.kubernetes.io/part-of: grimmory
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: psk.txt
remoteRef:
key: /cl01tl/grimmory/replication
property: psk.txt

6
clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-database-secret.yaml → clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-database-config.yaml
View File

@@ -1,16 +1,16 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: grimmory-database-secret
name: grimmory-database-config
namespace: grimmory
labels:
app.kubernetes.io/name: grimmory-database-secret
app.kubernetes.io/name: grimmory-database-config
app.kubernetes.io/instance: grimmory
app.kubernetes.io/part-of: grimmory
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: password
remoteRef:

2
clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-mariadb-cluster-backup-secret-external.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: access
remoteRef:

6
clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-mariadb-cluster-backup-secret-garage.yaml
View File

@@ -10,13 +10,13 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: access
remoteRef:
key: /garage/home-infra/mariadb-backups
property: access
property: ACCESS_KEY_ID
- secretKey: secret
remoteRef:
key: /garage/home-infra/mariadb-backups
property: secret
property: ACCESS_SECRET_KEY

2
clusters/cl01tl/manifests/grimmory/MariaDB-grimmory-mariadb-cluster.yaml
View File

@@ -31,6 +31,6 @@ spec:
rootPasswordSecretKeyRef:
generate: false
key: password
name: grimmory-database-secret
name: grimmory-database-config
storage:
size: 5Gi

5
clusters/cl01tl/manifests/grimmory/Namespace-grimmory.yaml
View File

@@ -2,12 +2,7 @@ apiVersion: v1
kind: Namespace
metadata:
name: grimmory
annotations:
volsync.backube/privileged-movers: "true"
labels:
app.kubernetes.io/name: grimmory
app.kubernetes.io/instance: grimmory
app.kubernetes.io/part-of: grimmory
pod-security.kubernetes.io/audit: privileged
pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/warn: privileged

2
clusters/cl01tl/manifests/grimmory/PersistentVolume-grimmory-books-import-nfs-storage.yaml
View File

@@ -15,7 +15,7 @@ spec:
accessModes:
- ReadWriteMany
nfs:
path: /volume2/Storage/Books Import
path: '/volume2/Storage/Books Import'
server: synologybond.alexlebens.net
mountOptions:
- vers=4

24
clusters/cl01tl/manifests/harbor/ExternalSecret-harbor-secret.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: HARBOR_ADMIN_PASSWORD
remoteRef:
@@ -18,12 +18,12 @@ spec:
property: admin-password
- secretKey: secretKey
remoteRef:
key: /cl01tl/harbor/config
property: secretKey
key: /cl01tl/harbor/key
property: secret-key
- secretKey: CSRF_KEY
remoteRef:
key: /cl01tl/harbor/core
property: CSRF_KEY
key: /cl01tl/harbor/key
property: csrf-key
- secretKey: secret
remoteRef:
key: /cl01tl/harbor/core
@@ -39,24 +39,20 @@ spec:
- secretKey: JOBSERVICE_SECRET
remoteRef:
key: /cl01tl/harbor/jobservice
property: JOBSERVICE_SECRET
property: secret
- secretKey: REGISTRY_HTTP_SECRET
remoteRef:
key: /cl01tl/harbor/registry
property: REGISTRY_HTTP_SECRET
- secretKey: REGISTRY_REDIS_PASSWORD
remoteRef:
key: /cl01tl/harbor/registry
property: REGISTRY_REDIS_PASSWORD
property: http-secret
- secretKey: REGISTRY_HTPASSWD
remoteRef:
key: /cl01tl/harbor/registry
property: REGISTRY_HTPASSWD
property: ht-passwd
- secretKey: REGISTRY_CREDENTIAL_PASSWORD
remoteRef:
key: /cl01tl/harbor/registry
property: REGISTRY_CREDENTIAL_PASSWORD
property: credential-password
- secretKey: REGISTRY_PASSWD
remoteRef:
key: /cl01tl/harbor/registry
property: REGISTRY_CREDENTIAL_PASSWORD
property: credential-password

6
clusters/cl01tl/manifests/headlamp/ClusterRoleBinding-cluster-admin-oidc.yaml
View File

@@ -8,13 +8,13 @@ metadata:
app.kubernetes.io/instance: headlamp
app.kubernetes.io/part-of: headlamp
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: User
- apiGroup: rbac.authorization.k8s.io
kind: User
name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
name: headlamp-admin
namespace: headlamp

2
clusters/cl01tl/manifests/headlamp/Deployment-headlamp.yaml
View File

@@ -36,7 +36,7 @@ spec:
imagePullPolicy: IfNotPresent
envFrom:
- secretRef:
name: headlamp-oidc-secret
name: headlamp-oidc-authentik
args:
- "-in-cluster"
- "-in-cluster-context-name=main"

22
clusters/cl01tl/manifests/headlamp/ExternalSecret-headlamp-oidc-secret.yaml → clusters/cl01tl/manifests/headlamp/ExternalSecret-headlamp-oidc-authentik.yaml
View File

@@ -1,38 +1,38 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: headlamp-oidc-secret
name: headlamp-oidc-authentik
namespace: headlamp
labels:
app.kubernetes.io/name: headlamp-oidc-secret
app.kubernetes.io/name: headlamp-oidc-authentik
app.kubernetes.io/instance: headlamp
app.kubernetes.io/part-of: headlamp
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: OIDC_CLIENT_ID
remoteRef:
key: /authentik/oidc/headlamp
key: /cl01tl/authentik/oidc/headlamp
property: client
- secretKey: OIDC_CLIENT_SECRET
remoteRef:
key: /authentik/oidc/headlamp
key: /cl01tl/authentik/oidc/headlamp
property: secret
- secretKey: OIDC_ISSUER_URL
remoteRef:
key: /authentik/oidc/headlamp
key: /cl01tl/authentik/oidc/headlamp
property: issuer
- secretKey: OIDC_SCOPES
remoteRef:
key: /authentik/oidc/headlamp
key: /cl01tl/authentik/oidc/headlamp
property: scopes
- secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
remoteRef:
key: /authentik/oidc/headlamp
property: validator-issuer-url
key: /cl01tl/authentik/oidc/headlamp
property: issuer
- secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
remoteRef:
key: /authentik/oidc/headlamp
property: validator-client-id
key: /cl01tl/authentik/oidc/headlamp
property: client

4
clusters/cl01tl/manifests/headlamp/HTTPRoute-headlamp.yaml
View File

@@ -19,11 +19,9 @@ spec:
- headlamp.alexlebens.net
rules:
- backendRefs:
- group: ""
kind: Service
- kind: Service
name: headlamp
port: 80
weight: 100
matches:
- path:
type: PathPrefix

2
clusters/cl01tl/manifests/home-assistant/Deployment-home-assistant.yaml
View File

@@ -48,7 +48,7 @@ spec:
value: /config
envFrom:
- secretRef:
name: home-assistant-code-server-password-secret
name: home-assistant-code-server-password
image: ghcr.io/linuxserver/code-server:4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
name: code-server
volumeMounts:

14
clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-code-server-password-secret.yaml → clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-code-server-password.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: home-assistant-code-server-password-secret
name: home-assistant-code-server-password
namespace: home-assistant
labels:
app.kubernetes.io/name: home-assistant-code-server-password-secret
app.kubernetes.io/name: home-assistant-code-server-password
app.kubernetes.io/instance: home-assistant
app.kubernetes.io/part-of: home-assistant
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: PASSWORD
remoteRef:
key: /cl01tl/home-assistant/code-server/auth
property: PASSWORD
key: /cl01tl/home-assistant/code-server
property: password
- secretKey: SUDO_PASSWORD
remoteRef:
key: /cl01tl/home-assistant/code-server/auth
property: SUDO_PASSWORD
key: /cl01tl/home-assistant/code-server
property: sudo-password

8
clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-token-secret.yaml → clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-metric-token.yaml
View File

@@ -1,18 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: home-assistant-token-secret
name: home-assistant-metric-token
namespace: home-assistant
labels:
app.kubernetes.io/name: home-assistant-token-secret
app.kubernetes.io/name: home-assistant-metric-token
app.kubernetes.io/instance: home-assistant
app.kubernetes.io/part-of: home-assistant
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: bearer-token
remoteRef:
key: /cl01tl/home-assistant/auth
key: /cl01tl/home-assistant/config
property: bearer-token

2
clusters/cl01tl/manifests/home-assistant/ServiceMonitor-home-assistant.yaml
View File

@@ -21,7 +21,7 @@ spec:
endpoints:
- bearerTokenSecret:
key: bearer-token
name: home-assistant-token-secret
name: home-assistant-metric-token
interval: 3m
path: /api/prometheus
port: http

2
clusters/cl01tl/manifests/homepage/Deployment-homepage.yaml
View File

@@ -44,7 +44,7 @@ spec:
value: home.alexlebens.net
envFrom:
- secretRef:
name: homepage-keys-secret
name: homepage-secrets
image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
name: main
resources:

30
clusters/cl01tl/manifests/homepage/ExternalSecret-homepage-keys-secret.yaml → clusters/cl01tl/manifests/homepage/ExternalSecret-homepage-secrets.yaml
View File

@@ -1,20 +1,20 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: homepage-keys-secret
name: homepage-secrets
namespace: homepage
labels:
app.kubernetes.io/name: homepage-keys-secret
app.kubernetes.io/name: homepage-secrets
app.kubernetes.io/instance: homepage
app.kubernetes.io/part-of: homepage
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: HOMEPAGE_VAR_GITEA_API_TOKEN
remoteRef:
key: /cl01tl/gitea/auth/homepage
key: /cl01tl/gitea/users/bot
property: token
- secretKey: HOMEPAGE_VAR_ARGOCD_API_TOKEN
remoteRef:
@@ -34,47 +34,47 @@ spec:
property: key
- secretKey: HOMEPAGE_VAR_SYNOLOGY_USER
remoteRef:
key: /synology/auth/cl01tl
key: /synology/users/remote_stats
property: user
- secretKey: HOMEPAGE_VAR_SYNOLOGY_PASSWORD
remoteRef:
key: /synology/auth/cl01tl
key: /synology/users/remote_stats
property: password
- secretKey: HOMEPAGE_VAR_UNIFI_API_KEY
remoteRef:
key: /unifi/auth/cl01tl
key: /unifi/users/cl01tl
property: api-key
- secretKey: HOMEPAGE_VAR_SONARR_KEY
remoteRef:
key: /cl01tl/sonarr4/key
key: /cl01tl/sonarr/key
property: key
- secretKey: HOMEPAGE_VAR_SONARR4K_KEY
remoteRef:
key: /cl01tl/sonarr4-4k/key
key: /cl01tl/sonarr-4k/key
property: key
- secretKey: HOMEPAGE_VAR_SONARRANIME_KEY
remoteRef:
key: /cl01tl/sonarr4-anime/key
key: /cl01tl/sonarr-anime/key
property: key
- secretKey: HOMEPAGE_VAR_RADARR_KEY
remoteRef:
key: /cl01tl/radarr5/key
key: /cl01tl/radarr/key
property: key
- secretKey: HOMEPAGE_VAR_RADARR4K_KEY
remoteRef:
key: /cl01tl/radarr5-4k/key
key: /cl01tl/radarr-4k/key
property: key
- secretKey: HOMEPAGE_VAR_RADARRANIME_KEY
remoteRef:
key: /cl01tl/radarr5-anime/key
key: /cl01tl/radarr-anime/key
property: key
- secretKey: HOMEPAGE_VAR_RADARRSTANDUP_KEY
remoteRef:
key: /cl01tl/radarr5-standup/key
key: /cl01tl/radarr-standup/key
property: key
- secretKey: HOMEPAGE_VAR_LIDARR_KEY
remoteRef:
key: /cl01tl/lidarr2/key
key: /cl01tl/lidarr/key
property: key
- secretKey: HOMEPAGE_VAR_PROWLARR_KEY
remoteRef:

13
clusters/cl01tl/manifests/immich/Deployment-immich.yaml
View File

@@ -21,13 +21,15 @@ spec:
app.kubernetes.io/instance: immich
template:
metadata:
annotations:
checksum/secrets: 46a3f57ca394cccffc419e0c17f5d5f366374b0651c02c507636c53c0b5f33e6
labels:
app.kubernetes.io/controller: main
app.kubernetes.io/instance: immich
app.kubernetes.io/name: immich
spec:
enableServiceLinks: false
serviceAccountName: default
serviceAccountName: immich
automountServiceAccountToken: true
hostIPC: false
hostNetwork: false
@@ -112,9 +114,12 @@ spec:
- mountPath: /usr/src/app/upload
name: data
volumes:
- name: config
secret:
secretName: immich-config-secret
- csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: immich-config
name: config
- name: data
persistentVolumeClaim:
claimName: immich

18
clusters/cl01tl/manifests/immich/ExternalSecret-immich-config-secret.yaml
View File

@@ -1,18 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: immich-config-secret
namespace: immich
labels:
app.kubernetes.io/name: immich-config-secret
app.kubernetes.io/instance: immich
app.kubernetes.io/part-of: immich
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: immich.json
remoteRef:
key: /cl01tl/immich/config
property: immich.json

13
clusters/cl01tl/manifests/immich/Secret-immich-immich-sa-token.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: immich-immich-sa-token
labels:
app.kubernetes.io/instance: immich
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: immich
helm.sh/chart: immich-4.6.2
annotations:
kubernetes.io/service-account.name: immich
namespace: immich

19
clusters/cl01tl/manifests/immich/SecretProviderClass-immich-config.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
name: immich-config
namespace: immich
labels:
app.kubernetes.io/name: immich-config
app.kubernetes.io/instance: immich
app.kubernetes.io/part-of: immich
spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: immich
objects: |
- objectName: immich.json
fileName: immich.json
secretPath: secret/data/cl01tl/immich/config
secretKey: immich.json

12
clusters/cl01tl/manifests/immich/ServiceAccount-immich.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: immich
labels:
app.kubernetes.io/instance: immich
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: immich
helm.sh/chart: immich-4.6.2
namespace: immich
secrets:
- name: immich-immich-sa-token

2
clusters/cl01tl/manifests/jellyfin/Deployment-jellyfin.yaml
View File

@@ -55,7 +55,7 @@ spec:
valueFrom:
secretKeyRef:
key: token
name: jellyfin-exporter-secret
name: jellyfin-metric-token
image: rebelcore/jellyfin-exporter:v1.5.0@sha256:37e6d389654180ad9e1661210a48fee71a6dc355a160670235a00329da0dbf80
name: exporter
- env:

8
clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-meilisearch-master-key-secret.yaml → clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-meilisearch-key.yaml
View File

@@ -1,18 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: jellyfin-meilisearch-master-key-secret
name: jellyfin-meilisearch-key
namespace: jellyfin
labels:
app.kubernetes.io/name: jellyfin-meilisearch-master-key-secret
app.kubernetes.io/name: jellyfin-meilisearch-key
app.kubernetes.io/instance: jellyfin
app.kubernetes.io/part-of: jellyfin
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: MEILI_MASTER_KEY
remoteRef:
key: /cl01tl/jellyfin/meilisearch
property: MEILI_MASTER_KEY
property: master-key

8
clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-exporter-secret.yaml → clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-metric-token.yaml
View File

@@ -1,18 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: jellyfin-exporter-secret
name: jellyfin-metric-token
namespace: jellyfin
labels:
app.kubernetes.io/name: jellyfin-exporter-secret
app.kubernetes.io/name: jellyfin-metric-token
app.kubernetes.io/instance: jellyfin
app.kubernetes.io/part-of: jellyfin
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: token
remoteRef:
key: /cl01tl/jellyfin/exporter
key: /cl01tl/jellyfin/metrics
property: token

2
clusters/cl01tl/manifests/jellyfin/ServiceMonitor-jellyfin-meilisearch.yaml
View File

@@ -26,5 +26,5 @@ spec:
interval: 1m
scrapeTimeout: 10s
bearerTokenSecret:
name: jellyfin-meilisearch-master-key-secret
name: jellyfin-meilisearch-key
key: MEILI_MASTER_KEY

2
clusters/cl01tl/manifests/jellyfin/StatefulSet-jellyfin-meilisearch.yaml
View File

@@ -62,7 +62,7 @@ spec:
- configMapRef:
name: jellyfin-meilisearch-environment
- secretRef:
name: jellyfin-meilisearch-master-key-secret
name: jellyfin-meilisearch-key
ports:
- name: http
containerPort: 7700

6
clusters/cl01tl/manifests/jellystat/Deployment-jellystat.yaml
View File

@@ -41,17 +41,17 @@ spec:
valueFrom:
secretKeyRef:
key: secret-key
name: jellystat-secret
name: jellystat-config
- name: JS_USER
valueFrom:
secretKeyRef:
key: user
name: jellystat-secret
name: jellystat-config
- name: JS_PASSWORD
valueFrom:
secretKeyRef:
key: password
name: jellystat-secret
name: jellystat-config
- name: POSTGRES_USER
valueFrom:
secretKeyRef:

12
clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-secret.yaml → clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-config.yaml
View File

@@ -1,26 +1,26 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: jellystat-secret
name: jellystat-config
namespace: jellystat
labels:
app.kubernetes.io/name: jellystat-secret
app.kubernetes.io/name: jellystat-config
app.kubernetes.io/instance: jellystat
app.kubernetes.io/part-of: jellystat
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: secret-key
remoteRef:
key: /cl01tl/jellystat/auth
key: /cl01tl/jellystat/key
property: secret-key
- secretKey: user
remoteRef:
key: /cl01tl/jellystat/auth
key: /cl01tl/jellystat/config
property: user
- secretKey: password
remoteRef:
key: /cl01tl/jellystat/auth
key: /cl01tl/jellystat/cconfig
property: password

20
clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml
View File

@@ -54,21 +54,27 @@ spec:
valueFrom:
secretKeyRef:
key: key
name: karakeep-key-secret
name: karakeep-key
- name: PROMETHEUS_AUTH_TOKEN
valueFrom:
secretKeyRef:
key: prometheus-token
name: karakeep-key-secret
name: karakeep-metric-token
- name: ASSET_STORE_S3_ENDPOINT
value: http://garage-main.garage:3900
valueFrom:
secretKeyRef:
key: ENDPOINT
name: karakeep-bucket-garage
- name: ASSET_STORE_S3_REGION
valueFrom:
secretKeyRef:
key: ACCESS_REGION
name: karakeep-bucket-garage
- name: ASSET_STORE_S3_BUCKET
value: karakeep-assets
valueFrom:
secretKeyRef:
key: BUCKET
name: karakeep-bucket-garage
- name: ASSET_STORE_S3_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
@@ -87,7 +93,7 @@ spec:
valueFrom:
secretKeyRef:
key: MEILI_MASTER_KEY
name: karakeep-meilisearch-master-key-secret
name: karakeep-meilisearch-key
- name: BROWSER_WEB_URL
value: http://karakeep.karakeep:9222
- name: DISABLE_SIGNUPS
@@ -102,12 +108,12 @@ spec:
valueFrom:
secretKeyRef:
key: AUTHENTIK_CLIENT_ID
name: karakeep-oidc-secret
name: karakeep-oidc-authentik
- name: OAUTH_CLIENT_SECRET
valueFrom:
secretKeyRef:
key: AUTHENTIK_CLIENT_SECRET
name: karakeep-oidc-secret
name: karakeep-oidc-authentik
- name: OLLAMA_BASE_URL
value: http://ollama-server-3.ollama:11434
- name: OLLAMA_KEEP_ALIVE

10
clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-bucket-garage.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: ACCESS_KEY_ID
remoteRef:
@@ -24,3 +24,11 @@ spec:
remoteRef:
key: /garage/home-infra/karakeep-assets
property: ACCESS_REGION
- secretKey: BUCKET
remoteRef:
key: /garage/home-infra/karakeep-assets
property: BUCKET
- secretKey: ENDPOINT
remoteRef:
key: /garage/config
property: ENDPOINT_LOCAL

18
clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-key.yaml Normal file
View File

@@ -0,0 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: karakeep-key
namespace: karakeep
labels:
app.kubernetes.io/name: karakeep-key
app.kubernetes.io/instance: karakeep
app.kubernetes.io/part-of: karakeep
spec:
secretStoreRef:
kind: ClusterSecretStore
name: openbao
data:
- secretKey: key
remoteRef:
key: /cl01tl/karakeep/key
property: key

8
clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-meilisearch-master-key-secret.yaml → clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-meilisearch-key.yaml
View File

@@ -1,18 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: karakeep-meilisearch-master-key-secret
name: karakeep-meilisearch-key
namespace: karakeep
labels:
app.kubernetes.io/name: karakeep-meilisearch-master-key-secret
app.kubernetes.io/name: karakeep-meilisearch-key
app.kubernetes.io/instance: karakeep
app.kubernetes.io/part-of: karakeep
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: MEILI_MASTER_KEY
remoteRef:
key: /cl01tl/karakeep/meilisearch
property: MEILI_MASTER_KEY
property: master-key

12
clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-key-secret.yaml → clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-metric-token.yaml
View File

@@ -1,7 +1,7 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: karakeep-key-secret
name: karakeep-metric-token
namespace: karakeep
labels:
app.kubernetes.io/name: karakeep-key-secret
@@ -10,13 +10,9 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: key
remoteRef:
key: /cl01tl/karakeep/key
property: key
- secretKey: prometheus-token
remoteRef:
key: /cl01tl/karakeep/key
property: prometheus-token
key: /cl01tl/karakeep/metrics
property: token

10
clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-oidc-secret.yaml → clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-oidc-authentik.yaml
View File

@@ -1,22 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: karakeep-oidc-secret
name: karakeep-oidc-authentik
namespace: karakeep
labels:
app.kubernetes.io/name: karakeep-oidc-secret
app.kubernetes.io/name: karakeep-oidc-authentik
app.kubernetes.io/instance: karakeep
app.kubernetes.io/part-of: karakeep
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: AUTHENTIK_CLIENT_ID
remoteRef:
key: /authentik/oidc/karakeep
key: /cl01tl/authentik/oidc/karakeep
property: client
- secretKey: AUTHENTIK_CLIENT_SECRET
remoteRef:
key: /authentik/oidc/karakeep
key: /cl01tl/authentik/oidc/karakeep
property: secret

2
clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep-meilisearch.yaml
View File

@@ -26,5 +26,5 @@ spec:
interval: 1m
scrapeTimeout: 10s
bearerTokenSecret:
name: karakeep-meilisearch-master-key-secret
name: karakeep-meilisearch-key
key: MEILI_MASTER_KEY

2
clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep.yaml
View File

@@ -21,7 +21,7 @@ spec:
- authorization:
credentials:
key: prometheus-token
name: karakeep-key-secret
name: karakeep-metric-token
interval: 30s
path: /api/metrics
port: http

2
clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml
View File

@@ -62,7 +62,7 @@ spec:
- configMapRef:
name: karakeep-meilisearch-environment
- secretRef:
name: karakeep-meilisearch-master-key-secret
name: karakeep-meilisearch-key
ports:
- name: http
containerPort: 7700

8
clusters/cl01tl/manifests/komodo/Deployment-komodo-main.yaml
View File

@@ -93,13 +93,13 @@ spec:
- name: KOMODO_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
key: oidc-client-id
name: komodo-secret
key: client
name: komodo-oidc-authentik
- name: KOMODO_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
key: oidc-client-secret
name: komodo-secret
key: secret
name: komodo-oidc-authentik
- name: KOMODO_OIDC_USE_FULL_EMAIL
value: "true"
image: ghcr.io/moghtech/komodo-core:2.1.2@sha256:8a7dbba232e4e49797bb412be5f78207c89fcf22cc2727b38631ae30f7518a4c

22
clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-oidc-authentik.yaml Normal file
View File

@@ -0,0 +1,22 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: komodo-oidc-authentik
namespace: komodo
labels:
app.kubernetes.io/name: komodo-oidc-authentik
app.kubernetes.io/instance: komodo
app.kubernetes.io/part-of: komodo
spec:
secretStoreRef:
kind: ClusterSecretStore
name: openbao
data:
- secretKey: client
remoteRef:
key: /cl01tl/authentik/oidc/komodo
property: client
- secretKey: secret
remoteRef:
key: /cl01tl/authentik/oidc/komodo
property: secret

2
clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-postgresql-17-fdb-cluster-ferret.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: uri
remoteRef:

16
clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-secret.yaml
View File

@@ -10,25 +10,17 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: passkey
remoteRef:
key: /cl01tl/komodo/config
key: /cl01tl/komodo/key
property: passkey
- secretKey: jwt
remoteRef:
key: /cl01tl/komodo/config
key: /cl01tl/komodo/key
property: jwt
- secretKey: webhook
remoteRef:
key: /cl01tl/komodo/config
key: /cl01tl/komodo/key
property: webhook
- secretKey: oidc-client-id
remoteRef:
key: /authentik/oidc/komodo
property: client
- secretKey: oidc-client-secret
remoteRef:
key: /authentik/oidc/komodo
property: secret

2
clusters/cl01tl/manifests/kube-prometheus-stack/Alertmanager-kube-prometheus-stack-alertmanager.yaml
View File

@@ -26,7 +26,7 @@ spec:
logLevel: "info"
retention: "120h"
secrets:
- alertmanager-config-secret
- alertmanager-ntfy-config
alertmanagerConfigSelector: {}
alertmanagerConfigNamespaceSelector: {}
routePrefix: "/"

13
clusters/cl01tl/manifests/kube-prometheus-stack/Deployment-ntfy-alertmanager.yaml
View File

@@ -21,13 +21,15 @@ spec:
app.kubernetes.io/instance: kube-prometheus-stack
template:
metadata:
annotations:
checksum/secrets: 3c0d4bd47e7d4f71ba55611ddc7b74c5f3ec1cedcc474b15ac0a00daab9b791a
labels:
app.kubernetes.io/controller: main
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/name: kube-prometheus-stack
spec:
enableServiceLinks: false
serviceAccountName: default
serviceAccountName: ntfy-alertmanager
automountServiceAccountToken: true
hostIPC: false
hostNetwork: false
@@ -43,6 +45,9 @@ spec:
readOnly: true
subPath: config
volumes:
- name: config
secret:
secretName: ntfy-alertmanager-config-secret
- csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: ntfy-alertmanager-config
name: config

10
clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-alertmanager-config-secret.yaml → clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-alertmanager-ntfy-config.yaml
View File

@@ -1,18 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: alertmanager-config-secret
name: alertmanager-ntfy-config
namespace: kube-prometheus-stack
labels:
app.kubernetes.io/name: alertmanager-config-secret
app.kubernetes.io/name: alertmanager-ntfy-config
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/part-of: kube-prometheus-stack
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: ntfy_password
remoteRef:
key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
property: ntfy_password
key: / cl01tl/ntfy/users/cl01tl
property: password

10
clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-garage-metric-secret.yaml → clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-garage-metric-token.yaml
View File

@@ -1,18 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: garage-metric-secret
name: garage-metric-token
namespace: kube-prometheus-stack
labels:
app.kubernetes.io/name: garage-metric-secret
app.kubernetes.io/name: garage-metric-token
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/part-of: kube-prometheus-stack
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: token
remoteRef:
key: /garage/token
property: metric
key: /ps10rp/garage/config
property: metrics-token

22
clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-ntfy-alertmanager-config-secret.yaml
View File

@@ -1,22 +0,0 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: ntfy-alertmanager-config-secret
namespace: kube-prometheus-stack
labels:
app.kubernetes.io/name: ntfy-alertmanager-config-secret
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/part-of: kube-prometheus-stack
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: ntfy_password
remoteRef:
key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
property: ntfy_password
- secretKey: config
remoteRef:
key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
property: config

2
clusters/cl01tl/manifests/kube-prometheus-stack/ScrapeConfig-garage-https.yaml
View File

@@ -20,4 +20,4 @@ spec:
type: Bearer
credentials:
key: token
name: garage-metric-secret
name: garage-metric-token

13
clusters/cl01tl/manifests/kube-prometheus-stack/Secret-ntfy-alertmanager-ntfy-alertmanager-sa-token.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: ntfy-alertmanager-ntfy-alertmanager-sa-token
labels:
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kube-prometheus-stack
helm.sh/chart: ntfy-alertmanager-4.6.2
annotations:
kubernetes.io/service-account.name: ntfy-alertmanager
namespace: kube-prometheus-stack

19
clusters/cl01tl/manifests/kube-prometheus-stack/SecretProviderClass-ntfy-alertmanager-config.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
name: ntfy-alertmanager-config
namespace: kube-prometheus-stack
labels:
app.kubernetes.io/name: ntfy-alertmanager-config
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/part-of: kube-prometheus-stack
spec:
provider: openbao
parameters:
baoAddress: "http://openbao-internal.openbao:8200"
roleName: ntfy-alertmanager
objects: |
- objectName: config
fileName: config
secretPath: secret/data/cl01tl/kube-prometheus-stack/ntfy-alertmanager
secretKey: config

12
clusters/cl01tl/manifests/kube-prometheus-stack/ServiceAccount-ntfy-alertmanager.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: ntfy-alertmanager
labels:
app.kubernetes.io/instance: kube-prometheus-stack
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kube-prometheus-stack
helm.sh/chart: ntfy-alertmanager-4.6.2
namespace: kube-prometheus-stack
secrets:
- name: ntfy-alertmanager-ntfy-alertmanager-sa-token

6
clusters/cl01tl/manifests/kubelet-serving-cert-approver/Namespace-kubelet-serving-cert-approver.yaml
View File

@@ -6,6 +6,6 @@ metadata:
app.kubernetes.io/name: kubelet-serving-cert-approver
app.kubernetes.io/instance: kubelet-serving-cert-approver
app.kubernetes.io/part-of: kubelet-serving-cert-approver
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/audit: privileged
pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/warn: privileged

2
clusters/cl01tl/manifests/kubernetes-cloudflare-ddns/ExternalSecret-kubernetes-cloudflare-ddns-secret.yaml
View File

@@ -10,7 +10,7 @@ metadata:
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
name: openbao
data:
- secretKey: AUTH_KEY
remoteRef:

Some files were not shown because too many files have changed in this diff Show More