Merge pull request 'Automated Manifest Update' (#6156) from auto/update-manifests into manifests

Reviewed-on: #6156

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-config-apprise.yaml

@@ -16,9 +16,13 @@ spec:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        ntfy-url: "{{ .endpoint }}/audiobookshelf"
+        ntfy-url: "{{ .endpoint }}/{{ .topic }}"
   data:
     - secretKey: endpoint
       remoteRef:
         key: /cl01tl/ntfy/users/cl01tl
         property: internal-endpoint-credential
+    - secretKey: topic
+      remoteRef:
+        key: /cl01tl/ntfy/topics
+        property: audiobookshelf

clusters/cl01tl/manifests/authentik/Ingress-authentik-tailscale.yaml

@@ -5,9 +5,9 @@ metadata:
   namespace: authentik
   labels:
     app.kubernetes.io/name: authentik-tailscale
-    tailscale.com/proxy-class: no-metrics
     app.kubernetes.io/instance: authentik
     app.kubernetes.io/part-of: authentik
+    tailscale.com/proxy-class: no-metrics
   annotations:
     tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
 spec:
@@ -26,4 +26,4 @@ spec:
               service:
                 name: authentik-server
                 port:
-                  number: 80
+                  name: http

clusters/cl01tl/manifests/cilium/HTTPRoute-hubble.yaml

@@ -21,8 +21,6 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - group: ''
+        - kind: Service
-          kind: Service
           name: hubble-ui
           port: 80
-          weight: 100

clusters/cl01tl/manifests/democratic-csi-synology-iscsi/DaemonSet-democratic-csi-synology-iscsi-node.yaml

@@ -205,7 +205,7 @@ spec:
             type: Directory
         - name: config
           secret:
-            secretName: synology-iscsi-config-secret
+            secretName: synology-iscsi-config
         - name: extra-ca-certs
           configMap:
             name: democratic-csi-synology-iscsi

clusters/cl01tl/manifests/democratic-csi-synology-iscsi/Deployment-democratic-csi-synology-iscsi-controller.yaml

@@ -178,7 +178,7 @@ spec:
           emptyDir: {}
         - name: config
           secret:
-            secretName: synology-iscsi-config-secret
+            secretName: synology-iscsi-config
         - name: extra-ca-certs
           configMap:
             name: democratic-csi-synology-iscsi

clusters/cl01tl/manifests/democratic-csi-synology-iscsi/ExternalSecret-synology-iscsi-config.yaml

@@ -1,16 +1,16 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: synology-iscsi-config-secret
+  name: synology-iscsi-config
   namespace: democratic-csi-synology-iscsi
   labels:
-    app.kubernetes.io/name: synology-iscsi-config-secret
+    app.kubernetes.io/name: synology-iscsi-config
     app.kubernetes.io/instance: democratic-csi-synology-iscsi
     app.kubernetes.io/part-of: democratic-csi-synology-iscsi
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: driver-config-file.yaml
       remoteRef:

clusters/cl01tl/manifests/directus/Deployment-directus.yaml

@@ -139,12 +139,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: OIDC_CLIENT_ID
-                  name: directus-oidc-secret
+                  name: directus-oidc-authentik
             - name: AUTH_AUTHENTIK_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
                   key: OIDC_CLIENT_SECRET
-                  name: directus-oidc-secret
+                  name: directus-oidc-authentik
             - name: AUTH_AUTHENTIK_SCOPE
               value: openid profile email
             - name: AUTH_AUTHENTIK_ISSUER_URL

clusters/cl01tl/manifests/directus/ExternalSecret-directus-bucket-garage.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:

clusters/cl01tl/manifests/directus/ExternalSecret-directus-config.yaml

@@ -10,8 +10,16 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
+    - secretKey: key
+      remoteRef:
+        key: /cl01tl/directus/key
+        property: key
+    - secretKey: secret
+      remoteRef:
+        key: /cl01tl/directus/key
+        property: secret
     - secretKey: admin-email
       remoteRef:
         key: /cl01tl/directus/config
@@ -20,11 +28,3 @@ spec:
       remoteRef:
         key: /cl01tl/directus/config
         property: admin-password
-    - secretKey: secret
-      remoteRef:
-        key: /cl01tl/directus/config
-        property: secret
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/directus/config
-        property: key

clusters/cl01tl/manifests/directus/ExternalSecret-directus-metric-token.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: metric-token
       remoteRef:

clusters/cl01tl/manifests/directus/ExternalSecret-directus-oidc-authentik.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: directus-oidc-secret
+  name: directus-oidc-authentik
   namespace: directus
   labels:
-    app.kubernetes.io/name: directus-oidc-secret
+    app.kubernetes.io/name: directus-oidc-authentik
     app.kubernetes.io/instance: directus
     app.kubernetes.io/part-of: directus
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/directus
+        key: /cl01tl/authentik/oidc/directus
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/directus
+        key: /cl01tl/authentik/oidc/directus
         property: secret

clusters/cl01tl/manifests/directus/ExternalSecret-directus-valkey-config.yaml

@@ -10,12 +10,8 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
-    - secretKey: default
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: password
     - secretKey: user
       remoteRef:
         key: /cl01tl/directus/valkey
@@ -24,3 +20,7 @@ spec:
       remoteRef:
         key: /cl01tl/directus/valkey
         property: password
+    - secretKey: default
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: password

clusters/cl01tl/manifests/external-dns/DNSEndpoint-iot-device-names.yaml

@@ -34,3 +34,13 @@ spec:
       recordType: A
       targets:
         - 10.230.0.100
+    - dnsName: dv01hr.alexlebens.net
+      recordTTL: 180
+      recordType: A
+      targets:
+        - 10.232.1.72
+    - dnsName: dv02kv.alexlebens.net
+      recordTTL: 180
+      recordType: A
+      targets:
+        - 10.232.1.71

clusters/cl01tl/manifests/external-dns/DNSEndpoint-server-host-names.yaml

@@ -34,3 +34,13 @@ spec:
       recordType: A
       targets:
         - 10.232.1.52
+    - dnsName: pd05wd.alexlebens.net
+      recordTTL: 180
+      recordType: A
+      targets:
+        - 10.230.0.115
+    - dnsName: pl02mc.alexlebens.net
+      recordTTL: 180
+      recordType: A
+      targets:
+        - 10.230.0.105

clusters/cl01tl/manifests/external-dns/ExternalSecret-external-dns-unifi-secret.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: api-key
       remoteRef:

clusters/cl01tl/manifests/freshrss/Deployment-freshrss.yaml

@@ -98,9 +98,9 @@ spec:
               value: preferred_username
           envFrom:
             - secretRef:
-                name: freshrss-oidc-secret
+                name: freshrss-oidc-authentik
             - secretRef:
-                name: freshrss-install-secret
+                name: freshrss-install-config
           image: freshrss/freshrss:1.28.1@sha256:9100f649f5c946f589f54cdb9be7a65996528f48f691ef90eb262a0e06e5a522
           name: main
           resources:

clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-install-config.yaml

@@ -1,26 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-install-secret
+  name: freshrss-install-config
   namespace: freshrss
   labels:
-    app.kubernetes.io/name: freshrss-install-secret
+    app.kubernetes.io/name: freshrss-install-config
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ADMIN_EMAIL
       remoteRef:
         key: /cl01tl/freshrss/config
-        property: ADMIN_EMAIL
+        property: admin-email
     - secretKey: ADMIN_PASSWORD
       remoteRef:
         key: /cl01tl/freshrss/config
-        property: ADMIN_PASSWORD
+        property: admin-password
     - secretKey: ADMIN_API_PASSWORD
       remoteRef:
         key: /cl01tl/freshrss/config
-        property: ADMIN_API_PASSWORD
+        property: admin-api-password

clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-oidc-authentik.yaml

@@ -1,26 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-oidc-secret
+  name: freshrss-oidc-authentik
   namespace: freshrss
   labels:
-    app.kubernetes.io/name: freshrss-oidc-secret
+    app.kubernetes.io/name: freshrss-oidc-authentik
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/freshrss
+        key: /cl01tl/authentik/oidc/freshrss
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/freshrss
+        key: /cl01tl/authentik/oidc/freshrss
         property: secret
     - secretKey: OIDC_CLIENT_CRYPTO_KEY
       remoteRef:
-        key: /authentik/oidc/freshrss
+        key: /cl01tl/freshrss/key
-        property: crypto-key
+        property: oidc-client-crypto-key

clusters/cl01tl/manifests/garage/Deployment-garage-server-1.yaml

@@ -49,7 +49,7 @@ spec:
       containers:
         - envFrom:
             - secretRef:
-                name: garage-token-secret
+                name: garage-token
           image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           name: main
           resources:

clusters/cl01tl/manifests/garage/Deployment-garage-server-2.yaml

@@ -49,7 +49,7 @@ spec:
       containers:
         - envFrom:
             - secretRef:
-                name: garage-token-secret
+                name: garage-token
           image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           name: main
           resources:

clusters/cl01tl/manifests/garage/Deployment-garage-server-3.yaml

@@ -49,7 +49,7 @@ spec:
       containers:
         - envFrom:
             - secretRef:
-                name: garage-token-secret
+                name: garage-token
           image: dxflrs/garage:v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           name: main
           resources:

clusters/cl01tl/manifests/garage/Deployment-garage-webui.yaml

@@ -45,7 +45,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: GARAGE_ADMIN_TOKEN
-                  name: garage-token-secret
+                  name: garage-token
           image: khairul169/garage-webui:1.1.0@sha256:17c793551873155065bf9a022dabcde874de808a1f26e648d4b82e168806439c
           name: main
           resources:

clusters/cl01tl/manifests/garage/ExternalSecret-garage-token.yaml

@@ -1,26 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: garage-token-secret
+  name: garage-token
   namespace: garage
   labels:
-    app.kubernetes.io/name: garage-token-secret
+    app.kubernetes.io/name: garage-token
     app.kubernetes.io/instance: garage
     app.kubernetes.io/part-of: garage
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: GARAGE_RPC_SECRET
       remoteRef:
-        key: /cl01tl/garage/token
+        key: /cl01tl/garage/config
-        property: rpc
+        property: rpc-secret
     - secretKey: GARAGE_ADMIN_TOKEN
       remoteRef:
-        key: /cl01tl/garage/token
+        key: /cl01tl/garage/config
-        property: admin
+        property: admin-token
     - secretKey: GARAGE_METRICS_TOKEN
       remoteRef:
-        key: /cl01tl/garage/token
+        key: /cl01tl/garage/config
-        property: metric
+        property: metrics-token

clusters/cl01tl/manifests/garage/Service-garage-main.yaml

@@ -27,6 +27,6 @@ spec:
       protocol: TCP
       targetPort: 3902
   selector:
-    app.kubernetes.io/instance: garage
     app.kubernetes.io/name: garage
+    app.kubernetes.io/instance: garage
     garage-type: server

clusters/cl01tl/manifests/garage/ServiceMonitor-garage.yaml

@@ -21,7 +21,7 @@ spec:
   endpoints:
     - bearerTokenSecret:
         key: GARAGE_METRICS_TOKEN
-        name: garage-token-secret
+        name: garage-token
       interval: 5m
       path: /metrics
       port: admin

clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml

@@ -50,17 +50,17 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: NTFY_TOKEN
-                  name: gatus-config-secret
+                  name: gatus-config
             - name: "OIDC_CLIENT_ID"
               valueFrom:
                 secretKeyRef:
                   key: OIDC_CLIENT_ID
-                  name: gatus-oidc-secret
+                  name: gatus-oidc-authentik
             - name: "OIDC_CLIENT_SECRET"
               valueFrom:
                 secretKeyRef:
                   key: OIDC_CLIENT_SECRET
-                  name: gatus-oidc-secret
+                  name: gatus-oidc-authentik
             - name: "POSTGRES_DB"
               valueFrom:
                 secretKeyRef:

clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-config.yaml

@@ -1,7 +1,7 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-config-secret
+  name: gatus-config
   namespace: gatus
   labels:
     app.kubernetes.io/name: gatus-config-secret
@@ -10,9 +10,9 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: NTFY_TOKEN
       remoteRef:
-        key: /ntfy/user/cl01tl
+        key: /cl01tl/ntfy/users/cl01tl
         property: token

clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-oidc-authentik.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-oidc-secret
+  name: gatus-oidc-authentik
   namespace: gatus
   labels:
-    app.kubernetes.io/name: gatus-oidc-secret
+    app.kubernetes.io/name: gatus-oidc-authentik
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/gatus
+        key: /cl01tl/authentik/oidc/gatus
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/gatus
+        key: /cl01tl/authentik/oidc/gatus
         property: secret

clusters/cl01tl/manifests/gitea/Deployment-gitea.yaml

@@ -111,7 +111,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: ISSUE_INDEXER_CONN_STR
-                  name: gitea-meilisearch-master-key-secret
+                  name: gitea-meilisearch-key
           volumeMounts:
             - name: config
               mountPath: /usr/sbinx
@@ -151,12 +151,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: key
-                  name: gitea-oidc-secret
+                  name: gitea-oidc-authentik
             - name: GITEA_OAUTH_SECRET_0
               valueFrom:
                 secretKeyRef:
                   key: secret
-                  name: gitea-oidc-secret
+                  name: gitea-oidc-authentik
             - name: GITEA_ADMIN_USERNAME
               value: "gitea_admin"
             - name: GITEA_ADMIN_PASSWORD

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-admin-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-admin-secret
-  namespace: gitea
-  labels:
-    app.kubernetes.io/name: gitea-admin-secret
-    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/part-of: gitea
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: username
-      remoteRef:
-        key: /cl01tl/gitea/auth/admin
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: /cl01tl/gitea/auth/admin
-        property: password

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-meilisearch-key.yaml

@@ -1,16 +1,16 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gitea-meilisearch-master-key-secret
+  name: gitea-meilisearch-key
   namespace: gitea
   labels:
-    app.kubernetes.io/name: gitea-meilisearch-master-key-secret
+    app.kubernetes.io/name: gitea-meilisearch-key
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/part-of: gitea
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
@@ -21,4 +21,4 @@ spec:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
         key: /cl01tl/gitea/meilisearch
-        property: MEILI_MASTER_KEY
+        property: master-key

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-oidc-authentik.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gitea-oidc-secret
+  name: gitea-oidc-authentik
   namespace: gitea
   labels:
-    app.kubernetes.io/name: gitea-oidc-secret
+    app.kubernetes.io/name: gitea-oidc-authentik
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/part-of: gitea
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: secret
       remoteRef:
-        key: /authentik/oidc/gitea
+        key: /cl01tl/authentik/oidc/gitea
         property: secret
     - secretKey: key
       remoteRef:
-        key: /authentik/oidc/gitea
+        key: /cl01tl/authentik/oidc/gitea
         property: client

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-secret.yaml

@@ -1,34 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-renovate-secret
-  namespace: gitea
-  labels:
-    app.kubernetes.io/name: gitea-renovate-secret
-    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/part-of: gitea
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: RENOVATE_ENDPOINT
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: RENOVATE_ENDPOINT
-    - secretKey: RENOVATE_GIT_AUTHOR
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: RENOVATE_GIT_AUTHOR
-    - secretKey: RENOVATE_TOKEN
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: RENOVATE_TOKEN
-    - secretKey: RENOVATE_GIT_PRIVATE_KEY
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: id_rsa
-    - secretKey: RENOVATE_GITHUB_COM_TOKEN
-      remoteRef:
-        key: /github/gitea-cl01tl
-        property: token

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-ssh-secret.yaml

@@ -1,26 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-renovate-ssh-secret
-  namespace: gitea
-  labels:
-    app.kubernetes.io/name: gitea-renovate-ssh-secret
-    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/part-of: gitea
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: ssh_config
-    - secretKey: id_rsa
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: id_rsa
-    - secretKey: id_rsa.pub
-      remoteRef:
-        key: /cl01tl/gitea/renovate
-        property: id_rsa.pub

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-runner-secret.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: token
       remoteRef:

clusters/cl01tl/manifests/gitea/HTTPRoute-gitea.yaml

@@ -21,8 +21,6 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - group: ''
+        - kind: Service
-          kind: Service
           name: gitea-http
           port: 3000
-          weight: 100

clusters/cl01tl/manifests/gitea/Ingress-gitea-tailscale.yaml

@@ -21,7 +21,7 @@ spec:
       http:
         paths:
           - path: /
-            pathType: ImplementationSpecific
+            pathType: Prefix
             backend:
               service:
                 name: gitea-http

clusters/cl01tl/manifests/gitea/ServiceMonitor-gitea-meilisearch.yaml

@@ -26,5 +26,5 @@ spec:
       interval: 1m
       scrapeTimeout: 10s
       bearerTokenSecret:
-        name: gitea-meilisearch-master-key-secret
+        name: gitea-meilisearch-key
         key: MEILI_MASTER_KEY

clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml

@@ -62,7 +62,7 @@ spec:
             - configMapRef:
                 name: gitea-meilisearch-environment
             - secretRef:
-                name: gitea-meilisearch-master-key-secret
+                name: gitea-meilisearch-key
           ports:
             - name: http
               containerPort: 7700

clusters/cl01tl/manifests/gitea/TCPRoute-gitea-ssh.yaml

@@ -16,8 +16,6 @@ spec:
       sectionName: ssh
   rules:
     - backendRefs:
-        - group: ''
+        - kind: Service
-          kind: Service
           name: gitea-ssh
           port: 22
-          weight: 100

clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-config.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grafana-auth-secret
+  name: grafana-config
   namespace: grafana-operator
   labels:
-    app.kubernetes.io/name: grafana-auth-secret
+    app.kubernetes.io/name: grafana-config
     app.kubernetes.io/instance: grafana-operator
     app.kubernetes.io/part-of: grafana-operator
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: admin-user
       remoteRef:
-        key: /cl01tl/grafana/auth
+        key: /cl01tl/grafana/config
         property: admin-user
     - secretKey: admin-password
       remoteRef:
-        key: /cl01tl/grafana/auth
+        key: /cl01tl/grafana/config
         property: admin-password

clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-oidc-authentik.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grafana-oauth-secret
+  name: grafana-oidc-authentik
   namespace: grafana-operator
   labels:
-    app.kubernetes.io/name: grafana-oauth-secret
+    app.kubernetes.io/name: grafana-oidc-authentik
     app.kubernetes.io/instance: grafana-operator
     app.kubernetes.io/part-of: grafana-operator
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: AUTH_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/grafana
+        key: /cl01tl/authentik/oidc/grafana
         property: client
     - secretKey: AUTH_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/grafana
+        key: /cl01tl/authentik/oidc/grafana
         property: secret

clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-operator-postgresql-18-cluster-backup-secret-garage.yaml

@@ -1,26 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: grafana-operator-postgresql-18-cluster-backup-secret-garage
-  namespace: grafana-operator
-  labels:
-    app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret-garage
-    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/part-of: grafana-operator
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /garage/home-infra/postgres-backups
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /garage/home-infra/postgres-backups
-        property: ACCESS_SECRET_KEY
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        key: /garage/home-infra/postgres-backups
-        property: ACCESS_REGION

clusters/cl01tl/manifests/grafana-operator/ExternalSecret-grafana-operator-postgresql-18-cluster-backup-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: grafana-operator-postgresql-18-cluster-backup-secret
-  namespace: grafana-operator
-  labels:
-    app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret
-    app.kubernetes.io/instance: grafana-operator
-    app.kubernetes.io/part-of: grafana-operator
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /digital-ocean/home-infra/postgres-backups
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /digital-ocean/home-infra/postgres-backups
-        property: secret

clusters/cl01tl/manifests/grafana-operator/Grafana-grafana-main.yaml

@@ -65,22 +65,22 @@ spec:
                 - name: AUTH_CLIENT_ID
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-oauth-secret
+                      name: grafana-oidc-authentik
                       key: AUTH_CLIENT_ID
                 - name: AUTH_CLIENT_SECRET
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-oauth-secret
+                      name: grafana-oidc-authentik
                       key: AUTH_CLIENT_SECRET
                 - name: ADMIN_USER
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-auth-secret
+                      name: grafana-config
                       key: admin-user
                 - name: ADMIN_PASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-auth-secret
+                      name: grafana-config
                       key: admin-password
                 - name: DB_HOST
                   valueFrom:

clusters/cl01tl/manifests/grimmory/Deployment-grimmory.yaml

@@ -52,7 +52,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: password
-                  name: grimmory-database-secret
+                  name: grimmory-database-config
             - name: GRIMMORY_PORT
               value: "6060"
             - name: SWAGGER_ENABLED

clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-data-replication-secret.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: grimmory-data-replication-secret
-  namespace: grimmory
-  labels:
-    app.kubernetes.io/name: grimmory-data-replication-secret
-    app.kubernetes.io/instance: grimmory
-    app.kubernetes.io/part-of: grimmory
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: psk.txt
-      remoteRef:
-        key: /cl01tl/grimmory/replication
-        property: psk.txt

clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-database-config.yaml

@@ -1,16 +1,16 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-secret
+  name: grimmory-database-config
   namespace: grimmory
   labels:
-    app.kubernetes.io/name: grimmory-database-secret
+    app.kubernetes.io/name: grimmory-database-config
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: password
       remoteRef:

clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-mariadb-cluster-backup-secret-external.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: access
       remoteRef:

clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-mariadb-cluster-backup-secret-garage.yaml

@@ -10,13 +10,13 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: access
       remoteRef:
         key: /garage/home-infra/mariadb-backups
-        property: access
+        property: ACCESS_KEY_ID
     - secretKey: secret
       remoteRef:
         key: /garage/home-infra/mariadb-backups
-        property: secret
+        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/grimmory/MariaDB-grimmory-mariadb-cluster.yaml

@@ -31,6 +31,6 @@ spec:
   rootPasswordSecretKeyRef:
     generate: false
     key: password
-    name: grimmory-database-secret
+    name: grimmory-database-config
   storage:
     size: 5Gi

clusters/cl01tl/manifests/grimmory/Namespace-grimmory.yaml

@@ -2,12 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: grimmory
-  annotations:
-    volsync.backube/privileged-movers: "true"
   labels:
     app.kubernetes.io/name: grimmory
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/manifests/grimmory/PersistentVolume-grimmory-books-import-nfs-storage.yaml

@@ -15,7 +15,7 @@ spec:
   accessModes:
     - ReadWriteMany
   nfs:
-    path: /volume2/Storage/Books Import
+    path: '/volume2/Storage/Books Import'
     server: synologybond.alexlebens.net
   mountOptions:
     - vers=4

clusters/cl01tl/manifests/harbor/ExternalSecret-harbor-secret.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: HARBOR_ADMIN_PASSWORD
       remoteRef:
@@ -18,12 +18,12 @@ spec:
         property: admin-password
     - secretKey: secretKey
       remoteRef:
-        key: /cl01tl/harbor/config
+        key: /cl01tl/harbor/key
-        property: secretKey
+        property: secret-key
     - secretKey: CSRF_KEY
       remoteRef:
-        key: /cl01tl/harbor/core
+        key: /cl01tl/harbor/key
-        property: CSRF_KEY
+        property: csrf-key
     - secretKey: secret
       remoteRef:
         key: /cl01tl/harbor/core
@@ -39,24 +39,20 @@ spec:
     - secretKey: JOBSERVICE_SECRET
       remoteRef:
         key: /cl01tl/harbor/jobservice
-        property: JOBSERVICE_SECRET
+        property: secret
     - secretKey: REGISTRY_HTTP_SECRET
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: REGISTRY_HTTP_SECRET
+        property: http-secret
-    - secretKey: REGISTRY_REDIS_PASSWORD
-      remoteRef:
-        key: /cl01tl/harbor/registry
-        property: REGISTRY_REDIS_PASSWORD
     - secretKey: REGISTRY_HTPASSWD
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: REGISTRY_HTPASSWD
+        property: ht-passwd
     - secretKey: REGISTRY_CREDENTIAL_PASSWORD
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: REGISTRY_CREDENTIAL_PASSWORD
+        property: credential-password
     - secretKey: REGISTRY_PASSWD
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: REGISTRY_CREDENTIAL_PASSWORD
+        property: credential-password

clusters/cl01tl/manifests/headlamp/ClusterRoleBinding-cluster-admin-oidc.yaml

@@ -8,13 +8,13 @@ metadata:
     app.kubernetes.io/instance: headlamp
     app.kubernetes.io/part-of: headlamp
 roleRef:
+  apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
 subjects:
-  - kind: User
+  - apiGroup: rbac.authorization.k8s.io
+    kind: User
     name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
-    apiGroup: rbac.authorization.k8s.io
   - kind: ServiceAccount
     name: headlamp-admin
     namespace: headlamp

clusters/cl01tl/manifests/headlamp/Deployment-headlamp.yaml

@@ -36,7 +36,7 @@ spec:
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
-                name: headlamp-oidc-secret
+                name: headlamp-oidc-authentik
           args:
             - "-in-cluster"
             - "-in-cluster-context-name=main"

clusters/cl01tl/manifests/headlamp/ExternalSecret-headlamp-oidc-authentik.yaml

@@ -1,38 +1,38 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: headlamp-oidc-secret
+  name: headlamp-oidc-authentik
   namespace: headlamp
   labels:
-    app.kubernetes.io/name: headlamp-oidc-secret
+    app.kubernetes.io/name: headlamp-oidc-authentik
     app.kubernetes.io/instance: headlamp
     app.kubernetes.io/part-of: headlamp
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
-        property: validator-issuer-url
+        property: issuer
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
-        property: validator-client-id
+        property: client

clusters/cl01tl/manifests/headlamp/HTTPRoute-headlamp.yaml

@@ -19,11 +19,9 @@ spec:
     - headlamp.alexlebens.net
   rules:
     - backendRefs:
-        - group: ""
+        - kind: Service
-          kind: Service
           name: headlamp
           port: 80
-          weight: 100
       matches:
         - path:
             type: PathPrefix

clusters/cl01tl/manifests/home-assistant/Deployment-home-assistant.yaml

@@ -48,7 +48,7 @@ spec:
               value: /config
           envFrom:
             - secretRef:
-                name: home-assistant-code-server-password-secret
+                name: home-assistant-code-server-password
           image: ghcr.io/linuxserver/code-server:4.116.0-ls333@sha256:4620adace18935dd6ca79d77e3bc1c379e21875392192f970cf5d6b0fb4aefcd
           name: code-server
           volumeMounts:

clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-code-server-password.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: home-assistant-code-server-password-secret
+  name: home-assistant-code-server-password
   namespace: home-assistant
   labels:
-    app.kubernetes.io/name: home-assistant-code-server-password-secret
+    app.kubernetes.io/name: home-assistant-code-server-password
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: PASSWORD
       remoteRef:
-        key: /cl01tl/home-assistant/code-server/auth
+        key: /cl01tl/home-assistant/code-server
-        property: PASSWORD
+        property: password
     - secretKey: SUDO_PASSWORD
       remoteRef:
-        key: /cl01tl/home-assistant/code-server/auth
+        key: /cl01tl/home-assistant/code-server
-        property: SUDO_PASSWORD
+        property: sudo-password

clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-metric-token.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: home-assistant-token-secret
+  name: home-assistant-metric-token
   namespace: home-assistant
   labels:
-    app.kubernetes.io/name: home-assistant-token-secret
+    app.kubernetes.io/name: home-assistant-metric-token
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: bearer-token
       remoteRef:
-        key: /cl01tl/home-assistant/auth
+        key: /cl01tl/home-assistant/config
         property: bearer-token

clusters/cl01tl/manifests/home-assistant/ServiceMonitor-home-assistant.yaml

@@ -21,7 +21,7 @@ spec:
   endpoints:
     - bearerTokenSecret:
         key: bearer-token
-        name: home-assistant-token-secret
+        name: home-assistant-metric-token
       interval: 3m
       path: /api/prometheus
       port: http

clusters/cl01tl/manifests/homepage/Deployment-homepage.yaml

@@ -44,7 +44,7 @@ spec:
               value: home.alexlebens.net
           envFrom:
             - secretRef:
-                name: homepage-keys-secret
+                name: homepage-secrets
           image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
           name: main
           resources:

clusters/cl01tl/manifests/homepage/ExternalSecret-homepage-secrets.yaml

@@ -1,20 +1,20 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: homepage-keys-secret
+  name: homepage-secrets
   namespace: homepage
   labels:
-    app.kubernetes.io/name: homepage-keys-secret
+    app.kubernetes.io/name: homepage-secrets
     app.kubernetes.io/instance: homepage
     app.kubernetes.io/part-of: homepage
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: HOMEPAGE_VAR_GITEA_API_TOKEN
       remoteRef:
-        key: /cl01tl/gitea/auth/homepage
+        key: /cl01tl/gitea/users/bot
         property: token
     - secretKey: HOMEPAGE_VAR_ARGOCD_API_TOKEN
       remoteRef:
@@ -34,47 +34,47 @@ spec:
         property: key
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_USER
       remoteRef:
-        key: /synology/auth/cl01tl
+        key: /synology/users/remote_stats
         property: user
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_PASSWORD
       remoteRef:
-        key: /synology/auth/cl01tl
+        key: /synology/users/remote_stats
         property: password
     - secretKey: HOMEPAGE_VAR_UNIFI_API_KEY
       remoteRef:
-        key: /unifi/auth/cl01tl
+        key: /unifi/users/cl01tl
         property: api-key
     - secretKey: HOMEPAGE_VAR_SONARR_KEY
       remoteRef:
-        key: /cl01tl/sonarr4/key
+        key: /cl01tl/sonarr/key
         property: key
     - secretKey: HOMEPAGE_VAR_SONARR4K_KEY
       remoteRef:
-        key: /cl01tl/sonarr4-4k/key
+        key: /cl01tl/sonarr-4k/key
         property: key
     - secretKey: HOMEPAGE_VAR_SONARRANIME_KEY
       remoteRef:
-        key: /cl01tl/sonarr4-anime/key
+        key: /cl01tl/sonarr-anime/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR_KEY
       remoteRef:
-        key: /cl01tl/radarr5/key
+        key: /cl01tl/radarr/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR4K_KEY
       remoteRef:
-        key: /cl01tl/radarr5-4k/key
+        key: /cl01tl/radarr-4k/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRANIME_KEY
       remoteRef:
-        key: /cl01tl/radarr5-anime/key
+        key: /cl01tl/radarr-anime/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRSTANDUP_KEY
       remoteRef:
-        key: /cl01tl/radarr5-standup/key
+        key: /cl01tl/radarr-standup/key
         property: key
     - secretKey: HOMEPAGE_VAR_LIDARR_KEY
       remoteRef:
-        key: /cl01tl/lidarr2/key
+        key: /cl01tl/lidarr/key
         property: key
     - secretKey: HOMEPAGE_VAR_PROWLARR_KEY
       remoteRef:

clusters/cl01tl/manifests/immich/Deployment-immich.yaml

@@ -21,13 +21,15 @@ spec:
       app.kubernetes.io/instance: immich
   template:
     metadata:
+      annotations:
+        checksum/secrets: 46a3f57ca394cccffc419e0c17f5d5f366374b0651c02c507636c53c0b5f33e6
       labels:
         app.kubernetes.io/controller: main
         app.kubernetes.io/instance: immich
         app.kubernetes.io/name: immich
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: immich
       automountServiceAccountToken: true
       hostIPC: false
       hostNetwork: false
@@ -112,9 +114,12 @@ spec:
             - mountPath: /usr/src/app/upload
               name: data
       volumes:
-        - name: config
+        - csi:
-          secret:
+            driver: secrets-store.csi.k8s.io
-            secretName: immich-config-secret
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: immich-config
+          name: config
         - name: data
           persistentVolumeClaim:
             claimName: immich

clusters/cl01tl/manifests/immich/ExternalSecret-immich-config-secret.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: immich-config-secret
-  namespace: immich
-  labels:
-    app.kubernetes.io/name: immich-config-secret
-    app.kubernetes.io/instance: immich
-    app.kubernetes.io/part-of: immich
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: immich.json
-      remoteRef:
-        key: /cl01tl/immich/config
-        property: immich.json

clusters/cl01tl/manifests/immich/Secret-immich-immich-sa-token.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: immich-immich-sa-token
+  labels:
+    app.kubernetes.io/instance: immich
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: immich
+    helm.sh/chart: immich-4.6.2
+  annotations:
+    kubernetes.io/service-account.name: immich
+  namespace: immich

clusters/cl01tl/manifests/immich/SecretProviderClass-immich-config.yaml

@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: immich-config
+  namespace: immich
+  labels:
+    app.kubernetes.io/name: immich-config
+    app.kubernetes.io/instance: immich
+    app.kubernetes.io/part-of: immich
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: immich
+    objects: |
+      - objectName: immich.json
+        fileName: immich.json
+        secretPath: secret/data/cl01tl/immich/config
+        secretKey: immich.json

clusters/cl01tl/manifests/immich/ServiceAccount-immich.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: immich
+  labels:
+    app.kubernetes.io/instance: immich
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: immich
+    helm.sh/chart: immich-4.6.2
+  namespace: immich
+secrets:
+  - name: immich-immich-sa-token

clusters/cl01tl/manifests/jellyfin/Deployment-jellyfin.yaml

@@ -55,7 +55,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: token
-                  name: jellyfin-exporter-secret
+                  name: jellyfin-metric-token
           image: rebelcore/jellyfin-exporter:v1.5.0@sha256:37e6d389654180ad9e1661210a48fee71a6dc355a160670235a00329da0dbf80
           name: exporter
         - env:

clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-meilisearch-key.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellyfin-meilisearch-master-key-secret
+  name: jellyfin-meilisearch-key
   namespace: jellyfin
   labels:
-    app.kubernetes.io/name: jellyfin-meilisearch-master-key-secret
+    app.kubernetes.io/name: jellyfin-meilisearch-key
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
         key: /cl01tl/jellyfin/meilisearch
-        property: MEILI_MASTER_KEY
+        property: master-key

clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-metric-token.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellyfin-exporter-secret
+  name: jellyfin-metric-token
   namespace: jellyfin
   labels:
-    app.kubernetes.io/name: jellyfin-exporter-secret
+    app.kubernetes.io/name: jellyfin-metric-token
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: token
       remoteRef:
-        key: /cl01tl/jellyfin/exporter
+        key: /cl01tl/jellyfin/metrics
         property: token

clusters/cl01tl/manifests/jellyfin/ServiceMonitor-jellyfin-meilisearch.yaml

@@ -26,5 +26,5 @@ spec:
       interval: 1m
       scrapeTimeout: 10s
       bearerTokenSecret:
-        name: jellyfin-meilisearch-master-key-secret
+        name: jellyfin-meilisearch-key
         key: MEILI_MASTER_KEY

clusters/cl01tl/manifests/jellyfin/StatefulSet-jellyfin-meilisearch.yaml

@@ -62,7 +62,7 @@ spec:
             - configMapRef:
                 name: jellyfin-meilisearch-environment
             - secretRef:
-                name: jellyfin-meilisearch-master-key-secret
+                name: jellyfin-meilisearch-key
           ports:
             - name: http
               containerPort: 7700

clusters/cl01tl/manifests/jellystat/Deployment-jellystat.yaml

@@ -41,17 +41,17 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: secret-key
-                  name: jellystat-secret
+                  name: jellystat-config
             - name: JS_USER
               valueFrom:
                 secretKeyRef:
                   key: user
-                  name: jellystat-secret
+                  name: jellystat-config
             - name: JS_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
-                  name: jellystat-secret
+                  name: jellystat-config
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:

clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-config.yaml

@@ -1,26 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellystat-secret
+  name: jellystat-config
   namespace: jellystat
   labels:
-    app.kubernetes.io/name: jellystat-secret
+    app.kubernetes.io/name: jellystat-config
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: secret-key
       remoteRef:
-        key: /cl01tl/jellystat/auth
+        key: /cl01tl/jellystat/key
         property: secret-key
     - secretKey: user
       remoteRef:
-        key: /cl01tl/jellystat/auth
+        key: /cl01tl/jellystat/config
         property: user
     - secretKey: password
       remoteRef:
-        key: /cl01tl/jellystat/auth
+        key: /cl01tl/jellystat/cconfig
         property: password

clusters/cl01tl/manifests/karakeep/Deployment-karakeep.yaml

@@ -54,21 +54,27 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: key
-                  name: karakeep-key-secret
+                  name: karakeep-key
             - name: PROMETHEUS_AUTH_TOKEN
               valueFrom:
                 secretKeyRef:
                   key: prometheus-token
-                  name: karakeep-key-secret
+                  name: karakeep-metric-token
             - name: ASSET_STORE_S3_ENDPOINT
-              value: http://garage-main.garage:3900
+              valueFrom:
+                secretKeyRef:
+                  key: ENDPOINT
+                  name: karakeep-bucket-garage
             - name: ASSET_STORE_S3_REGION
               valueFrom:
                 secretKeyRef:
                   key: ACCESS_REGION
                   name: karakeep-bucket-garage
             - name: ASSET_STORE_S3_BUCKET
-              value: karakeep-assets
+              valueFrom:
+                secretKeyRef:
+                  key: BUCKET
+                  name: karakeep-bucket-garage
             - name: ASSET_STORE_S3_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
@@ -87,7 +93,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: MEILI_MASTER_KEY
-                  name: karakeep-meilisearch-master-key-secret
+                  name: karakeep-meilisearch-key
             - name: BROWSER_WEB_URL
               value: http://karakeep.karakeep:9222
             - name: DISABLE_SIGNUPS
@@ -102,12 +108,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: AUTHENTIK_CLIENT_ID
-                  name: karakeep-oidc-secret
+                  name: karakeep-oidc-authentik
             - name: OAUTH_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
                   key: AUTHENTIK_CLIENT_SECRET
-                  name: karakeep-oidc-secret
+                  name: karakeep-oidc-authentik
             - name: OLLAMA_BASE_URL
               value: http://ollama-server-3.ollama:11434
             - name: OLLAMA_KEEP_ALIVE

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-bucket-garage.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -24,3 +24,11 @@ spec:
       remoteRef:
         key: /garage/home-infra/karakeep-assets
         property: ACCESS_REGION
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/karakeep-assets
+        property: BUCKET
+    - secretKey: ENDPOINT
+      remoteRef:
+        key: /garage/config
+        property: ENDPOINT_LOCAL

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-key.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: karakeep-key
+  namespace: karakeep
+  labels:
+    app.kubernetes.io/name: karakeep-key
+    app.kubernetes.io/instance: karakeep
+    app.kubernetes.io/part-of: karakeep
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: key
+      remoteRef:
+        key: /cl01tl/karakeep/key
+        property: key

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-meilisearch-key.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-meilisearch-master-key-secret
+  name: karakeep-meilisearch-key
   namespace: karakeep
   labels:
-    app.kubernetes.io/name: karakeep-meilisearch-master-key-secret
+    app.kubernetes.io/name: karakeep-meilisearch-key
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
         key: /cl01tl/karakeep/meilisearch
-        property: MEILI_MASTER_KEY
+        property: master-key

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-metric-token.yaml

@@ -1,7 +1,7 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-key-secret
+  name: karakeep-metric-token
   namespace: karakeep
   labels:
     app.kubernetes.io/name: karakeep-key-secret
@@ -10,13 +10,9 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/karakeep/key
-        property: key
     - secretKey: prometheus-token
       remoteRef:
-        key: /cl01tl/karakeep/key
+        key: /cl01tl/karakeep/metrics
-        property: prometheus-token
+        property: token

clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-oidc-authentik.yaml

@@ -1,22 +1,22 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-oidc-secret
+  name: karakeep-oidc-authentik
   namespace: karakeep
   labels:
-    app.kubernetes.io/name: karakeep-oidc-secret
+    app.kubernetes.io/name: karakeep-oidc-authentik
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: AUTHENTIK_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/karakeep
+        key: /cl01tl/authentik/oidc/karakeep
         property: client
     - secretKey: AUTHENTIK_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/karakeep
+        key: /cl01tl/authentik/oidc/karakeep
         property: secret

clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep-meilisearch.yaml

@@ -26,5 +26,5 @@ spec:
       interval: 1m
       scrapeTimeout: 10s
       bearerTokenSecret:
-        name: karakeep-meilisearch-master-key-secret
+        name: karakeep-meilisearch-key
         key: MEILI_MASTER_KEY

clusters/cl01tl/manifests/karakeep/ServiceMonitor-karakeep.yaml

@@ -21,7 +21,7 @@ spec:
     - authorization:
         credentials:
           key: prometheus-token
-          name: karakeep-key-secret
+          name: karakeep-metric-token
       interval: 30s
       path: /api/metrics
       port: http

clusters/cl01tl/manifests/karakeep/StatefulSet-karakeep-meilisearch.yaml

@@ -62,7 +62,7 @@ spec:
             - configMapRef:
                 name: karakeep-meilisearch-environment
             - secretRef:
-                name: karakeep-meilisearch-master-key-secret
+                name: karakeep-meilisearch-key
           ports:
             - name: http
               containerPort: 7700

clusters/cl01tl/manifests/komodo/Deployment-komodo-main.yaml

@@ -93,13 +93,13 @@ spec:
             - name: KOMODO_OIDC_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  key: oidc-client-id
+                  key: client
-                  name: komodo-secret
+                  name: komodo-oidc-authentik
             - name: KOMODO_OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  key: oidc-client-secret
+                  key: secret
-                  name: komodo-secret
+                  name: komodo-oidc-authentik
             - name: KOMODO_OIDC_USE_FULL_EMAIL
               value: "true"
           image: ghcr.io/moghtech/komodo-core:2.1.2@sha256:8a7dbba232e4e49797bb412be5f78207c89fcf22cc2727b38631ae30f7518a4c

clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-oidc-authentik.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: komodo-oidc-authentik
+  namespace: komodo
+  labels:
+    app.kubernetes.io/name: komodo-oidc-authentik
+    app.kubernetes.io/instance: komodo
+    app.kubernetes.io/part-of: komodo
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: client
+      remoteRef:
+        key: /cl01tl/authentik/oidc/komodo
+        property: client
+    - secretKey: secret
+      remoteRef:
+        key: /cl01tl/authentik/oidc/komodo
+        property: secret

clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-postgresql-17-fdb-cluster-ferret.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: uri
       remoteRef:

clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-secret.yaml

@@ -10,25 +10,17 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: passkey
       remoteRef:
-        key: /cl01tl/komodo/config
+        key: /cl01tl/komodo/key
         property: passkey
     - secretKey: jwt
       remoteRef:
-        key: /cl01tl/komodo/config
+        key: /cl01tl/komodo/key
         property: jwt
     - secretKey: webhook
       remoteRef:
-        key: /cl01tl/komodo/config
+        key: /cl01tl/komodo/key
         property: webhook
-    - secretKey: oidc-client-id
-      remoteRef:
-        key: /authentik/oidc/komodo
-        property: client
-    - secretKey: oidc-client-secret
-      remoteRef:
-        key: /authentik/oidc/komodo
-        property: secret

clusters/cl01tl/manifests/kube-prometheus-stack/Alertmanager-kube-prometheus-stack-alertmanager.yaml

@@ -26,7 +26,7 @@ spec:
   logLevel: "info"
   retention: "120h"
   secrets:
-    - alertmanager-config-secret
+    - alertmanager-ntfy-config
   alertmanagerConfigSelector: {}
   alertmanagerConfigNamespaceSelector: {}
   routePrefix: "/"

clusters/cl01tl/manifests/kube-prometheus-stack/Deployment-ntfy-alertmanager.yaml

@@ -21,13 +21,15 @@ spec:
       app.kubernetes.io/instance: kube-prometheus-stack
   template:
     metadata:
+      annotations:
+        checksum/secrets: 3c0d4bd47e7d4f71ba55611ddc7b74c5f3ec1cedcc474b15ac0a00daab9b791a
       labels:
         app.kubernetes.io/controller: main
         app.kubernetes.io/instance: kube-prometheus-stack
         app.kubernetes.io/name: kube-prometheus-stack
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: ntfy-alertmanager
       automountServiceAccountToken: true
       hostIPC: false
       hostNetwork: false
@@ -43,6 +45,9 @@ spec:
               readOnly: true
               subPath: config
       volumes:
-        - name: config
+        - csi:
-          secret:
+            driver: secrets-store.csi.k8s.io
-            secretName: ntfy-alertmanager-config-secret
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: ntfy-alertmanager-config
+          name: config

clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-alertmanager-ntfy-config.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: alertmanager-config-secret
+  name: alertmanager-ntfy-config
   namespace: kube-prometheus-stack
   labels:
-    app.kubernetes.io/name: alertmanager-config-secret
+    app.kubernetes.io/name: alertmanager-ntfy-config
     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ntfy_password
       remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        key: / cl01tl/ntfy/users/cl01tl
-        property: ntfy_password
+        property: password

clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-garage-metric-token.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: garage-metric-secret
+  name: garage-metric-token
   namespace: kube-prometheus-stack
   labels:
-    app.kubernetes.io/name: garage-metric-secret
+    app.kubernetes.io/name: garage-metric-token
     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: token
       remoteRef:
-        key: /garage/token
+        key: /ps10rp/garage/config
-        property: metric
+        property: metrics-token

clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-ntfy-alertmanager-config-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: ntfy-alertmanager-config-secret
-  namespace: kube-prometheus-stack
-  labels:
-    app.kubernetes.io/name: ntfy-alertmanager-config-secret
-    app.kubernetes.io/instance: kube-prometheus-stack
-    app.kubernetes.io/part-of: kube-prometheus-stack
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ntfy_password
-      remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
-        property: ntfy_password
-    - secretKey: config
-      remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
-        property: config

clusters/cl01tl/manifests/kube-prometheus-stack/ScrapeConfig-garage-https.yaml

@@ -20,4 +20,4 @@ spec:
     type: Bearer
     credentials:
       key: token
-      name: garage-metric-secret
+      name: garage-metric-token

clusters/cl01tl/manifests/kube-prometheus-stack/Secret-ntfy-alertmanager-ntfy-alertmanager-sa-token.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: ntfy-alertmanager-ntfy-alertmanager-sa-token
+  labels:
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kube-prometheus-stack
+    helm.sh/chart: ntfy-alertmanager-4.6.2
+  annotations:
+    kubernetes.io/service-account.name: ntfy-alertmanager
+  namespace: kube-prometheus-stack

clusters/cl01tl/manifests/kube-prometheus-stack/SecretProviderClass-ntfy-alertmanager-config.yaml

@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: ntfy-alertmanager-config
+  namespace: kube-prometheus-stack
+  labels:
+    app.kubernetes.io/name: ntfy-alertmanager-config
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/part-of: kube-prometheus-stack
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: ntfy-alertmanager
+    objects: |
+      - objectName: config
+        fileName: config
+        secretPath: secret/data/cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        secretKey: config

clusters/cl01tl/manifests/kube-prometheus-stack/ServiceAccount-ntfy-alertmanager.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ntfy-alertmanager
+  labels:
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kube-prometheus-stack
+    helm.sh/chart: ntfy-alertmanager-4.6.2
+  namespace: kube-prometheus-stack
+secrets:
+  - name: ntfy-alertmanager-ntfy-alertmanager-sa-token

clusters/cl01tl/manifests/kubelet-serving-cert-approver/Namespace-kubelet-serving-cert-approver.yaml

@@ -6,6 +6,6 @@ metadata:
     app.kubernetes.io/name: kubelet-serving-cert-approver
     app.kubernetes.io/instance: kubelet-serving-cert-approver
     app.kubernetes.io/part-of: kubelet-serving-cert-approver
-    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/manifests/kubernetes-cloudflare-ddns/ExternalSecret-kubernetes-cloudflare-ddns-secret.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: AUTH_KEY
       remoteRef: