chore(deps): update temporalio/ui docker tag to v2.49.1

Reviewed-on: #6147

.gitea/workflows/renovate.yaml

@@ -13,7 +13,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.138.2@sha256:79765b2442117d5c87e17456aa79ae54b4e0e2a4d9212a10508e233706375556
+    container: ghcr.io/renovatebot/renovate:43.139.6@sha256:2ed9f867ea7a7d2448847ce704f78af09e9b881c63f843a1aa0f590691737c42
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

clusters/cl01tl/helm/actual/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/authentik/templates/ingress.yaml

@@ -5,8 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ .Release.Name }}-tailscale
-    {{- include "custom.labels" . | nindent 4 }}
     tailscale.com/proxy-class: no-metrics
+    {{- include "custom.labels" . | nindent 4 }}
   annotations:
     tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
 spec:
@@ -25,4 +25,4 @@ spec:
               service:
                 name: authentik-server
                 port:
-                  name: http
+                  number: 80

clusters/cl01tl/helm/blocky/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/cilium/templates/http-route.yaml

@@ -20,6 +20,8 @@ spec:
           type: PathPrefix
           value: /
       backendRefs:
-        - kind: Service
+        - group: ''
+          kind: Service
           name: hubble-ui
           port: 80
+          weight: 100

clusters/cl01tl/helm/cloudnative-pg/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/coredns/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/democratic-csi-synology-iscsi/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/democratic-csi-synology-iscsi/templates/external-secret.yaml

@@ -1,15 +1,16 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: synology-iscsi-config
+  name: synology-iscsi-config-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: synology-iscsi-config
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: synology-iscsi-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: driver-config-file.yaml
       remoteRef:

clusters/cl01tl/helm/democratic-csi-synology-iscsi/templates/namespace.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Release.Namespace }}
+  name: democratic-csi-synology-iscsi
   labels:
-    app.kubernetes.io/name: {{ .Release.Namespace }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: democratic-csi-synology-iscsi
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
     pod-security.kubernetes.io/audit: privileged
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/democratic-csi-synology-iscsi/values.yaml

@@ -3,7 +3,7 @@ democratic-csi:
     image:
       registry: ghcr.io/democratic-csi/democratic-csi
       tag: v1.9.5@@sha256:fc3b7d7ed3a616714139525075312758e23a5d425ffb539ad12c9bd20fb6001f
-    existingConfigSecret: synology-iscsi-config
+    existingConfigSecret: synology-iscsi-config-secret
     config:
       driver: synology-iscsi
     resources:

clusters/cl01tl/helm/descheduler/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/directus/Chart.yaml

@@ -5,7 +5,7 @@ description: Directus
 keywords:
   - directus
   - content-management-system
-home: https://docs.alexlebens.dev/applications/directus/
+home: https://docs.alexlebens.dev/applications/descheduler/
 sources:
   - https://github.com/directus/directus
   - https://github.com/directus/directus/pkgs/container/directus

clusters/cl01tl/helm/directus/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/directus/templates/external-secret.yaml

@@ -5,20 +5,13 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: directus-config
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/directus/key
-        property: key
-    - secretKey: secret
-      remoteRef:
-        key: /cl01tl/directus/key
-        property: secret
     - secretKey: admin-email
       remoteRef:
         key: /cl01tl/directus/config
@@ -27,6 +20,38 @@ spec:
       remoteRef:
         key: /cl01tl/directus/config
         property: admin-password
+    - secretKey: secret
+      remoteRef:
+        key: /cl01tl/directus/config
+        property: secret
+    - secretKey: key
+      remoteRef:
+        key: /cl01tl/directus/config
+        property: key
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: directus-oidc-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: directus-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: OIDC_CLIENT_ID
+      remoteRef:
+        key: /authentik/oidc/directus
+        property: client
+    - secretKey: OIDC_CLIENT_SECRET
+      remoteRef:
+        key: /authentik/oidc/directus
+        property: secret
 
 ---
 apiVersion: external-secrets.io/v1
@@ -36,67 +61,18 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: directus-metric-token
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: metric-token
       remoteRef:
         key: /cl01tl/directus/metrics
         property: metric-token
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-valkey-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-valkey-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: user
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: user
-    - secretKey: password
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: password
-    - secretKey: default
-      remoteRef:
-        key: /cl01tl/directus/valkey
-        property: password
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: directus-oidc-authentik
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: directus-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: OIDC_CLIENT_ID
-      remoteRef:
-        key: /cl01tl/authentik/oidc/directus
-        property: client
-    - secretKey: OIDC_CLIENT_SECRET
-      remoteRef:
-        key: /cl01tl/authentik/oidc/directus
-        property: secret
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -105,11 +81,12 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: directus-bucket-garage
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -123,3 +100,31 @@ spec:
       remoteRef:
         key: /garage/home-infra/directus-assets
         property: ACCESS_REGION
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: directus-valkey-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: directus-valkey-config
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: default
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: password
+    - secretKey: user
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: user
+    - secretKey: password
+      remoteRef:
+        key: /cl01tl/directus/valkey
+        property: password

clusters/cl01tl/helm/directus/values.yaml

@@ -113,12 +113,12 @@ directus:
             - name: AUTH_AUTHENTIK_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  name: directus-oidc-authentik
+                  name: directus-oidc-secret
                   key: OIDC_CLIENT_ID
             - name: AUTH_AUTHENTIK_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: directus-oidc-authentik
+                  name: directus-oidc-secret
                   key: OIDC_CLIENT_SECRET
             - name: AUTH_AUTHENTIK_SCOPE
               value: openid profile email

clusters/cl01tl/helm/elastic-operator/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/element-web/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/eraser/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/excalidraw/Chart.yaml

@@ -5,7 +5,7 @@ description: Excalidraw
 keywords:
   - excalidraw
   - drawing
-home: https://docs.alexlebens.dev/applications/excalidraw/
+home: https://docs.alexlebens.dev/applications/eraser/
 sources:
   - https://github.com/excalidraw/excalidraw
   - https://hub.docker.com/r/excalidraw/excalidraw

clusters/cl01tl/helm/excalidraw/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/external-dns/Chart.yaml

@@ -5,7 +5,7 @@ description: External DNS
 keywords:
   - external-dns
   - dns
-home: https://docs.alexlebens.dev/applications/external-dns/
+home: https://docs.alexlebens.dev/applications/eraser/
 sources:
   - https://github.com/kubernetes-sigs/external-dns
   - https://explore.ggcr.dev/?repo=registry.k8s.io%2Fexternal-dns%2Fexternal-dns

clusters/cl01tl/helm/external-dns/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/external-dns/templates/dns-endpoint.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: external-device-names
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   endpoints:
     # Unifi UDM
@@ -47,7 +48,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: iot-device-names
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   endpoints:
     # Airgradient
@@ -80,18 +82,6 @@ spec:
       recordType: A
       targets:
         - 10.230.0.100
-    # HD Homerun
-    - dnsName: dv01hr.alexlebens.net
-      recordTTL: 180
-      recordType: A
-      targets:
-        - 10.232.1.72
-    # Pi KVM
-    - dnsName: dv02kv.alexlebens.net
-      recordTTL: 180
-      recordType: A
-      targets:
-        - 10.232.1.71
 
 ---
 apiVersion: externaldns.k8s.io/v1alpha1
@@ -101,7 +91,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: server-host-names
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   endpoints:
     # Unifi Gateway
@@ -134,18 +125,6 @@ spec:
       recordType: A
       targets:
         - 10.232.1.52
-    # Desktop
-    - dnsName: pd05wd.alexlebens.net
-      recordTTL: 180
-      recordType: A
-      targets:
-        - 10.230.0.115
-    # Laptop
-    - dnsName: pl02mc.alexlebens.net
-      recordTTL: 180
-      recordType: A
-      targets:
-        - 10.230.0.105
 
 ---
 apiVersion: externaldns.k8s.io/v1alpha1
@@ -155,7 +134,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: cluster-service-names
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   endpoints:
     # Treafik Proxy

clusters/cl01tl/helm/external-dns/templates/external-secret.yaml

@@ -5,11 +5,12 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: external-dns-unifi-secret
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: api-key
       remoteRef:

clusters/cl01tl/helm/external-secrets/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/external-secrets/templates/cluster-role-binding.yaml

@@ -5,12 +5,13 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: external-secrets
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: system:auth-delegator
 subjects:
   - kind: ServiceAccount
-    name: {{ .Release.Name }}
+    name: external-secrets
     namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/external-secrets/templates/cluster-secret-store.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: vault
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   provider:
     vault:
@@ -25,7 +26,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: openbao
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   provider:
     vault:
@@ -37,7 +39,7 @@ spec:
           mountPath: kubernetes
           role: external-secrets
           serviceAccountRef:
-            name: {{ .Release.Name }}
-            namespace: {{ .Release.Namespace }}
+            name: external-secrets
+            namespace: {{ .Release.Name }}
             audiences:
               - openbao

clusters/cl01tl/helm/foldergram/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-NFS names
-*/}}
-{{- define "custom.storageNfsName" -}}
-foldergram-pictures-collections-nfs-storage
-{{- end -}}

clusters/cl01tl/helm/foldergram/templates/persistent-volume-claim.yaml

@@ -1,13 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: foldergram-pictures-collections-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: foldergram-pictures-collections-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: {{ include "custom.storageNfsName" . }}
+  volumeName: foldergram-pictures-collections-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/foldergram/templates/persistent-volume.yaml

@@ -1,11 +1,12 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: foldergram-pictures-collections-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: foldergram-pictures-collections-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   persistentVolumeReclaimPolicy: Retain
   storageClassName: nfs-client

clusters/cl01tl/helm/freshrss/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/freshrss/templates/external-secret.yaml

@@ -1,52 +1,54 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-install-config
+  name: freshrss-install-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: freshrss-install-config
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: freshrss-install-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: ADMIN_EMAIL
       remoteRef:
         key: /cl01tl/freshrss/config
-        property: admin-email
+        property: ADMIN_EMAIL
     - secretKey: ADMIN_PASSWORD
       remoteRef:
         key: /cl01tl/freshrss/config
-        property: admin-password
+        property: ADMIN_PASSWORD
     - secretKey: ADMIN_API_PASSWORD
       remoteRef:
         key: /cl01tl/freshrss/config
-        property: admin-api-password
+        property: ADMIN_API_PASSWORD
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss-oidc-authentik
+  name: freshrss-oidc-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: freshrss-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: freshrss-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /cl01tl/authentik/oidc/freshrss
+        key: /authentik/oidc/freshrss
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /cl01tl/authentik/oidc/freshrss
+        key: /authentik/oidc/freshrss
         property: secret
     - secretKey: OIDC_CLIENT_CRYPTO_KEY
       remoteRef:
-        key: /cl01tl/freshrss/key
-        property: oidc-client-crypto-key
+        key: /authentik/oidc/freshrss
+        property: crypto-key

clusters/cl01tl/helm/freshrss/values.yaml

@@ -73,9 +73,9 @@ freshrss:
               value: preferred_username
           envFrom:
             - secretRef:
-                name: freshrss-oidc-authentik
+                name: freshrss-oidc-secret
             - secretRef:
-                name: freshrss-install-config
+                name: freshrss-install-secret
           resources:
             requests:
               cpu: 1m

clusters/cl01tl/helm/garage/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/garage/templates/external-secret.yaml

@@ -1,25 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: garage-token
+  name: garage-token-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: garage-token
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: garage-token-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: GARAGE_RPC_SECRET
       remoteRef:
-        key: /cl01tl/garage/config
-        property: rpc-secret
+        key: /cl01tl/garage/token
+        property: rpc
     - secretKey: GARAGE_ADMIN_TOKEN
       remoteRef:
-        key: /cl01tl/garage/config
-        property: admin-token
+        key: /cl01tl/garage/token
+        property: admin
     - secretKey: GARAGE_METRICS_TOKEN
       remoteRef:
-        key: /cl01tl/garage/config
-        property: metrics-token
+        key: /cl01tl/garage/token
+        property: metric

clusters/cl01tl/helm/garage/templates/service.yaml

@@ -6,7 +6,8 @@ metadata:
   labels:
     app.kubernetes.io/name: garage-main
     app.kubernetes.io/service: garage-main
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   ports:
     - name: admin
@@ -26,6 +27,6 @@ spec:
       protocol: TCP
       targetPort: 3902
   selector:
-    app.kubernetes.io/name: garage
     app.kubernetes.io/instance: garage
+    app.kubernetes.io/name: garage
     garage-type: server

clusters/cl01tl/helm/garage/values.yaml

@@ -24,7 +24,7 @@ garage:
             tag: v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           envFrom:
             - secretRef:
-                name: garage-token
+                name: garage-token-secret
           resources:
             requests:
               cpu: 10m
@@ -53,7 +53,7 @@ garage:
             tag: v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           envFrom:
             - secretRef:
-                name: garage-token
+                name: garage-token-secret
           resources:
             requests:
               cpu: 10m
@@ -82,7 +82,7 @@ garage:
             tag: v2.3.0@sha256:866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690
           envFrom:
             - secretRef:
-                name: garage-token
+                name: garage-token-secret
           resources:
             requests:
               cpu: 10m
@@ -104,7 +104,7 @@ garage:
             - name: API_ADMIN_KEY
               valueFrom:
                 secretKeyRef:
-                  name: garage-token
+                  name: garage-token-secret
                   key: GARAGE_ADMIN_TOKEN
           resources:
             requests:
@@ -273,7 +273,7 @@ garage:
           scrapeTimeout: 2m
           path: /metrics
           bearerTokenSecret:
-            name: garage-token
+            name: garage-token-secret
             key: GARAGE_METRICS_TOKEN
   route:
     webui:

clusters/cl01tl/helm/gatus/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/gatus/templates/external-secret.yaml

@@ -1,40 +1,42 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-config
+  name: gatus-config-secret
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gatus-config-secret
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: NTFY_TOKEN
       remoteRef:
-        key: /cl01tl/ntfy/users/cl01tl
+        key: /ntfy/user/cl01tl
         property: token
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gatus-oidc-authentik
+  name: gatus-oidc-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: gatus-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: gatus-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /cl01tl/authentik/oidc/gatus
+        key: /authentik/oidc/gatus
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /cl01tl/authentik/oidc/gatus
+        key: /authentik/oidc/gatus
         property: secret

clusters/cl01tl/helm/gatus/values.yaml

@@ -20,17 +20,17 @@ gatus:
     NTFY_TOKEN:
       valueFrom:
         secretKeyRef:
-          name: gatus-config
+          name: gatus-config-secret
           key: NTFY_TOKEN
     OIDC_CLIENT_ID:
       valueFrom:
         secretKeyRef:
-          name: gatus-oidc-authentik
+          name: gatus-oidc-secret
           key: OIDC_CLIENT_ID
     OIDC_CLIENT_SECRET:
       valueFrom:
         secretKeyRef:
-          name: gatus-oidc-authentik
+          name: gatus-oidc-secret
           key: OIDC_CLIENT_SECRET
     POSTGRES_USER:
       valueFrom:

clusters/cl01tl/helm/generic-device-plugin/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/generic-device-plugin/templates/namespace.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Release.Namespace }}
+  name: generic-device-plugin
   labels:
-    app.kubernetes.io/name: {{ .Release.Namespace }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: generic-device-plugin
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
     pod-security.kubernetes.io/audit: privileged
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/gitea/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/gitea/templates/config-map.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gitea-custom-templates
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 data:
   header.tmpl: |
     <script defer src="https://rybbit.alexlebens.dev/api/script.js" data-site-id="b515c34a6dcc"></script>

clusters/cl01tl/helm/gitea/templates/external-secret.yaml

@@ -1,15 +1,64 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: gitea-admin-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gitea-admin-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: username
+      remoteRef:
+        key: /cl01tl/gitea/auth/admin
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: /cl01tl/gitea/auth/admin
+        property: password
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-oidc-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gitea-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: /authentik/oidc/gitea
+        property: secret
+    - secretKey: key
+      remoteRef:
+        key: /authentik/oidc/gitea
+        property: client
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: gitea-runner-secret
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gitea-runner-secret
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: token
       remoteRef:
@@ -20,15 +69,80 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: gitea-meilisearch-key
+  name: gitea-renovate-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: gitea-meilisearch-key
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: gitea-renovate-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
+  data:
+    - secretKey: RENOVATE_ENDPOINT
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: RENOVATE_ENDPOINT
+    - secretKey: RENOVATE_GIT_AUTHOR
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: RENOVATE_GIT_AUTHOR
+    - secretKey: RENOVATE_TOKEN
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: RENOVATE_TOKEN
+    - secretKey: RENOVATE_GIT_PRIVATE_KEY
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: id_rsa
+    - secretKey: RENOVATE_GITHUB_COM_TOKEN
+      remoteRef:
+        key: /github/gitea-cl01tl
+        property: token
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-renovate-ssh-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gitea-renovate-ssh-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: config
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: ssh_config
+    - secretKey: id_rsa
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: id_rsa
+    - secretKey: id_rsa.pub
+      remoteRef:
+        key: /cl01tl/gitea/renovate
+        property: id_rsa.pub
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-meilisearch-master-key-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gitea-meilisearch-master-key-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
   target:
     template:
       mergePolicy: Merge
@@ -39,27 +153,4 @@ spec:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
         key: /cl01tl/gitea/meilisearch
-        property: master-key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-oidc-authentik
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: /cl01tl/authentik/oidc/gitea
-        property: secret
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/authentik/oidc/gitea
-        property: client
+        property: MEILI_MASTER_KEY

clusters/cl01tl/helm/gitea/templates/http-route.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gitea
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   parentRefs:
     - group: gateway.networking.k8s.io
@@ -20,6 +21,8 @@ spec:
           type: PathPrefix
           value: /
       backendRefs:
-        - kind: Service
+        - group: ''
+          kind: Service
           name: gitea-http
           port: 3000
+          weight: 100

clusters/cl01tl/helm/gitea/templates/ingress.yaml

@@ -1,11 +1,12 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ .Release.Name }}-tailscale
+  name: gitea-tailscale
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ .Release.Name }}-tailscale
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: gitea-tailscale
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
     tailscale.com/proxy-class: no-metrics
   annotations:
     tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
@@ -20,7 +21,7 @@ spec:
       http:
         paths:
           - path: /
-            pathType: Prefix
+            pathType: ImplementationSpecific
             backend:
               service:
                 name: gitea-http

clusters/cl01tl/helm/gitea/templates/namespace.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Release.Namespace }}
+  name: gitea
   labels:
-    app.kubernetes.io/name: {{ .Release.Namespace }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
     pod-security.kubernetes.io/audit: privileged
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/gitea/templates/persistent-volume-claim.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gitea-themes-storage
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   volumeMode: Filesystem
   storageClassName: ceph-filesystem

clusters/cl01tl/helm/gitea/templates/service-monitor.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gitea
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   selector:
     matchLabels:

clusters/cl01tl/helm/gitea/templates/tcp-route.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: gitea-ssh
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   parentRefs:
     - group: gateway.networking.k8s.io
@@ -15,6 +16,8 @@ spec:
       sectionName: ssh
   rules:
     - backendRefs:
-        - kind: Service
+        - group: ''
+          kind: Service
           name: gitea-ssh
           port: 22
+          weight: 100

clusters/cl01tl/helm/gitea/values.yaml

@@ -59,7 +59,7 @@ gitea:
     oauth:
       - name: Authentik
         provider: openidConnect
-        existingSecret: gitea-oidc-authentik
+        existingSecret: gitea-oidc-secret
         autoDiscoverUrl: https://auth.alexlebens.dev/application/o/gitea/.well-known/openid-configuration
         iconUrl: https://goauthentik.io/img/icon.png
         scopes: "email profile"
@@ -137,7 +137,7 @@ gitea:
       - name: GITEA__INDEXER__ISSUE_INDEXER_CONN_STR
         valueFrom:
           secretKeyRef:
-            name: gitea-meilisearch-key
+            name: gitea-meilisearch-master-key-secret
             key: ISSUE_INDEXER_CONN_STR
   valkey-cluster:
     enabled: false
@@ -235,7 +235,7 @@ meilisearch:
     MEILI_ENV: production
     MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
   auth:
-    existingMasterKeySecret: gitea-meilisearch-key
+    existingMasterKeySecret: gitea-meilisearch-master-key-secret
   persistence:
     enabled: true
     storageClass: ceph-block

clusters/cl01tl/helm/grafana-operator/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/grafana-operator/templates/external-secret.yaml

@@ -1,44 +1,98 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grafana-config
+  name: grafana-auth-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grafana-config
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grafana-auth-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: admin-user
       remoteRef:
-        key: /cl01tl/grafana/config
+        key: /cl01tl/grafana/auth
         property: admin-user
     - secretKey: admin-password
       remoteRef:
-        key: /cl01tl/grafana/config
+        key: /cl01tl/grafana/auth
         property: admin-password
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grafana-oidc-authentik
+  name: grafana-oauth-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grafana-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grafana-oauth-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: AUTH_CLIENT_ID
       remoteRef:
-        key: /cl01tl/authentik/oidc/grafana
+        key: /authentik/oidc/grafana
         property: client
     - secretKey: AUTH_CLIENT_SECRET
       remoteRef:
-        key: /cl01tl/authentik/oidc/grafana
+        key: /authentik/oidc/grafana
         property: secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-operator-postgresql-18-cluster-backup-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        key: /digital-ocean/home-infra/postgres-backups
+        property: access
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        key: /digital-ocean/home-infra/postgres-backups
+        property: secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-operator-postgresql-18-cluster-backup-secret-garage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-operator-postgresql-18-cluster-backup-secret-garage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        key: /garage/home-infra/postgres-backups
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        key: /garage/home-infra/postgres-backups
+        property: ACCESS_SECRET_KEY
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        key: /garage/home-infra/postgres-backups
+        property: ACCESS_REGION

clusters/cl01tl/helm/grafana-operator/templates/grafana-dashboard.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-ceph
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -23,7 +24,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-coredns
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -41,7 +43,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-etcd
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -59,7 +62,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-garage
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -77,7 +81,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-loki
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -95,7 +100,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-node-full
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -113,7 +119,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-node-short
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -131,7 +138,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-pods
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -149,7 +157,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-argocd
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -167,7 +176,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-blocky
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -185,7 +195,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-cert-manager
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -203,7 +214,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-cloudnative-pg
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -221,7 +233,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-descheduler
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -239,7 +252,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-external-dns
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -257,7 +271,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-external-secrets
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -275,7 +290,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-gatus
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -293,7 +309,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-operator
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -311,7 +328,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-harbor
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -329,7 +347,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-speedtest-exporter
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -347,7 +366,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-spegel
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -365,7 +385,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-traefik
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -383,7 +404,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-tdarr
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -401,7 +423,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-unpoller
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -419,7 +442,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-version-checker-internal
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -437,7 +461,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-version-checker
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -455,7 +480,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-volsync
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -473,7 +499,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-s3
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -491,7 +518,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-authentik
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -509,7 +537,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-gitea
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -527,7 +556,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-ntfy
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -545,7 +575,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-openbao
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -563,7 +594,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-qbittorrent
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -581,7 +613,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-vault
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -599,7 +632,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-unpackerr
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -617,7 +651,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-airgradient
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -635,7 +670,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-server-power-consumption
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -653,7 +689,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-immich
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -671,7 +708,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-jellyfin
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -689,7 +727,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-navidrome
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -707,7 +746,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-radarr
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -725,7 +765,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-servarr
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -743,7 +784,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-dashboard-sonarr
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:

clusters/cl01tl/helm/grafana-operator/templates/grafana-datasource.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-datasource-prometheus
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   datasource:
     name: Prometheus
@@ -32,7 +33,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-datasource-loki
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   datasource:
     name: Loki

clusters/cl01tl/helm/grafana-operator/templates/grafana-folder.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-folder-application
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -39,7 +40,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-folder-iot
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -73,7 +75,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-folder-platform
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -107,7 +110,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-folder-service
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:
@@ -141,7 +145,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-folder-system
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   instanceSelector:
     matchLabels:

clusters/cl01tl/helm/grafana-operator/templates/grafana.yaml

@@ -5,7 +5,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grafana-main
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
     app: grafana-main
 spec:
   config:
@@ -65,22 +66,22 @@ spec:
                 - name: AUTH_CLIENT_ID
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-oidc-authentik
+                      name: grafana-oauth-secret
                       key: AUTH_CLIENT_ID
                 - name: AUTH_CLIENT_SECRET
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-oidc-authentik
+                      name: grafana-oauth-secret
                       key: AUTH_CLIENT_SECRET
                 - name: ADMIN_USER
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-config
+                      name: grafana-auth-secret
                       key: admin-user
                 - name: ADMIN_PASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: grafana-config
+                      name: grafana-auth-secret
                       key: admin-password
                 - name: DB_HOST
                   valueFrom:

clusters/cl01tl/helm/grimmory/templates/_helpers.tpl

@@ -1,24 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-NFS names
-*/}}
-{{- define "custom.booksNfsName" -}}
-grimmory-books-nfs-storage
-{{- end -}}
-{{- define "custom.booksImportNfsName" -}}
-grimmory-books-import-nfs-storage
-{{- end -}}

clusters/cl01tl/helm/grimmory/templates/external-secret.yaml

@@ -1,21 +1,42 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: grimmory-database-config
+  name: grimmory-database-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: grimmory-database-config
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grimmory-database-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: password
       remoteRef:
         key: /cl01tl/grimmory/database
         property: password
 
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grimmory-data-replication-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grimmory-data-replication-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: psk.txt
+      remoteRef:
+        key: /cl01tl/grimmory/replication
+        property: psk.txt
+
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -24,11 +45,12 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grimmory-mariadb-cluster-backup-secret-external
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: access
       remoteRef:
@@ -47,17 +69,18 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: grimmory-mariadb-cluster-backup-secret-garage
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: access
       remoteRef:
         key: /garage/home-infra/mariadb-backups
-        property: ACCESS_KEY_ID
+        property: access
     - secretKey: secret
       remoteRef:
         key: /garage/home-infra/mariadb-backups
-        property: ACCESS_SECRET_KEY
+        property: secret

clusters/cl01tl/helm/grimmory/templates/namespace.yaml

@@ -1,7 +1,13 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Release.Namespace }}
+  name: grimmory
+  annotations:
+    volsync.backube/privileged-movers: "true"
   labels:
-    app.kubernetes.io/name: {{ .Release.Namespace }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grimmory
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/grimmory/templates/persistent-volume-claim.yaml

@@ -1,13 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.booksNfsName" . }}
+  name: grimmory-books-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.booksNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grimmory-books-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: {{ include "custom.booksNfsName" . }}
+  volumeName: grimmory-books-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany
@@ -19,13 +20,14 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.booksImportNfsName" . }}
+  name: grimmory-books-import-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.booksImportNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grimmory-books-import-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: {{ include "custom.booksImportNfsName" . }}
+  volumeName: grimmory-books-import-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/grimmory/templates/persistent-volume.yaml

@@ -1,11 +1,12 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.booksNfsName" . }}
+  name: grimmory-books-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.booksNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grimmory-books-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   persistentVolumeReclaimPolicy: Retain
   storageClassName: nfs-client
@@ -25,11 +26,12 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.booksImportNfsName" . }}
+  name: grimmory-books-import-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.booksImportNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: grimmory-books-import-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   persistentVolumeReclaimPolicy: Retain
   storageClassName: nfs-client
@@ -38,7 +40,7 @@ spec:
   accessModes:
     - ReadWriteMany
   nfs:
-    path: '/volume2/Storage/Books Import'
+    path: /volume2/Storage/Books Import
     server: synologybond.alexlebens.net
   mountOptions:
     - vers=4

clusters/cl01tl/helm/grimmory/values.yaml

@@ -27,7 +27,7 @@ grimmory:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: grimmory-database-config
+                  name: grimmory-database-secret
                   key: password
             - name: GRIMMORY_PORT
               value: 6060
@@ -98,7 +98,7 @@ mariadb-cluster:
   mariadb:
     rootPasswordSecretKeyRef:
       generate: false
-      name: grimmory-database-config
+      name: grimmory-database-secret
       key: password
     storage:
       size: 5Gi

clusters/cl01tl/helm/harbor/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/harbor/templates/external-secret.yaml

@@ -5,11 +5,12 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: harbor-secret
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: HARBOR_ADMIN_PASSWORD
       remoteRef:
@@ -17,12 +18,12 @@ spec:
         property: admin-password
     - secretKey: secretKey
       remoteRef:
-        key: /cl01tl/harbor/key
-        property: secret-key
+        key: /cl01tl/harbor/config
+        property: secretKey
     - secretKey: CSRF_KEY
       remoteRef:
-        key: /cl01tl/harbor/key
-        property: csrf-key
+        key: /cl01tl/harbor/core
+        property: CSRF_KEY
     - secretKey: secret
       remoteRef:
         key: /cl01tl/harbor/core
@@ -38,20 +39,24 @@ spec:
     - secretKey: JOBSERVICE_SECRET
       remoteRef:
         key: /cl01tl/harbor/jobservice
-        property: secret
+        property: JOBSERVICE_SECRET
     - secretKey: REGISTRY_HTTP_SECRET
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: http-secret
+        property: REGISTRY_HTTP_SECRET
+    - secretKey: REGISTRY_REDIS_PASSWORD
+      remoteRef:
+        key: /cl01tl/harbor/registry
+        property: REGISTRY_REDIS_PASSWORD
     - secretKey: REGISTRY_HTPASSWD
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: ht-passwd
+        property: REGISTRY_HTPASSWD
     - secretKey: REGISTRY_CREDENTIAL_PASSWORD
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: credential-password
+        property: REGISTRY_CREDENTIAL_PASSWORD
     - secretKey: REGISTRY_PASSWD
       remoteRef:
         key: /cl01tl/harbor/registry
-        property: credential-password
+        property: REGISTRY_CREDENTIAL_PASSWORD

clusters/cl01tl/helm/headlamp/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-ServiceAccount name
-*/}}
-{{- define "custom.serviceAccountName" -}}
-headlamp-admin
-{{- end -}}

clusters/cl01tl/helm/headlamp/templates/cluster-role-binding.yaml

@@ -5,15 +5,16 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: cluster-admin-oidc
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 roleRef:
-  apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
 subjects:
-  - apiGroup: rbac.authorization.k8s.io
-    kind: User
+  - kind: User
     name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
+    apiGroup: rbac.authorization.k8s.io
   - kind: ServiceAccount
-    name: {{ include "custom.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    name: headlamp-admin
+    namespace: headlamp

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -1,37 +1,38 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: headlamp-oidc-authentik
+  name: headlamp-oidc-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: headlamp-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: headlamp-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /cl01tl/authentik/oidc/headlamp
+        key: /authentik/oidc/headlamp
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /cl01tl/authentik/oidc/headlamp
+        key: /authentik/oidc/headlamp
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
-        key: /cl01tl/authentik/oidc/headlamp
+        key: /authentik/oidc/headlamp
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
-        key: /cl01tl/authentik/oidc/headlamp
+        key: /authentik/oidc/headlamp
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
-        key: /cl01tl/authentik/oidc/headlamp
-        property: issuer
+        key: /authentik/oidc/headlamp
+        property: validator-issuer-url
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
-        key: /cl01tl/authentik/oidc/headlamp
-        property: client
+        key: /authentik/oidc/headlamp
+        property: validator-client-id

clusters/cl01tl/helm/headlamp/templates/service-account.yaml

@@ -1,8 +1,9 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "custom.serviceAccountName" . }}
+  name: headlamp-admin
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: headlamp-admin
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}

clusters/cl01tl/helm/headlamp/values.yaml

@@ -10,7 +10,7 @@ headlamp:
         create: false
       externalSecret:
         enabled: true
-        name: headlamp-oidc-authentik
+        name: headlamp-oidc-secret
     watchPlugins: true
   httpRoute:
     enabled: true
@@ -27,9 +27,11 @@ headlamp:
             type: PathPrefix
             value: /
         backendRefs:
-          - kind: Service
+          - group: ''
+            kind: Service
             name: headlamp
             port: 80
+            weight: 100
   resources:
     requests:
       cpu: 1m

clusters/cl01tl/helm/home-assistant/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/home-assistant/templates/external-secret.yaml

@@ -1,40 +1,42 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: home-assistant-code-server-password
+  name: home-assistant-code-server-password-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant-code-server-password
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: home-assistant-code-server-password-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: PASSWORD
       remoteRef:
-        key: /cl01tl/home-assistant/code-server
-        property: password
+        key: /cl01tl/home-assistant/code-server/auth
+        property: PASSWORD
     - secretKey: SUDO_PASSWORD
       remoteRef:
-        key: /cl01tl/home-assistant/code-server
-        property: sudo-password
+        key: /cl01tl/home-assistant/code-server/auth
+        property: SUDO_PASSWORD
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: home-assistant-metric-token
+  name: home-assistant-token-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant-metric-token
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: home-assistant-token-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: bearer-token
       remoteRef:
-        key: /cl01tl/home-assistant/config
+        key: /cl01tl/home-assistant/auth
         property: bearer-token

clusters/cl01tl/helm/home-assistant/values.yaml

@@ -35,7 +35,7 @@ home-assistant:
               value: /config
           envFrom:
             - secretRef:
-                name: home-assistant-code-server-password
+                name: home-assistant-code-server-password-secret
   service:
     main:
       controller: main
@@ -63,7 +63,7 @@ home-assistant:
           scrapeTimeout: 1m
           path: /api/prometheus
           bearerTokenSecret:
-            name: home-assistant-metric-token
+            name: home-assistant-token-secret
             key: bearer-token
   route:
     main:

clusters/cl01tl/helm/homepage/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-CluserRole Name
-*/}}
-{{- define "custom.clusterRoleName" -}}
-homepage
-{{- end -}}

clusters/cl01tl/helm/homepage/templates/cluster-role-binding.yaml

@@ -1,15 +1,16 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "custom.clusterRoleName" . }}
+  name: homepage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.clusterRoleName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: homepage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "custom.clusterRoleName" . }}
+  name: homepage
 subjects:
   - kind: ServiceAccount
     name: homepage

clusters/cl01tl/helm/homepage/templates/cluster-role.yaml

@@ -1,11 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "custom.clusterRoleName" . }}
+  name: homepage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.clusterRoleName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: homepage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 rules:
   - apiGroups:
       - ""

clusters/cl01tl/helm/homepage/templates/external-secret.yaml

@@ -1,19 +1,20 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: homepage-secrets
+  name: homepage-keys-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: homepage-secrets
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: homepage-keys-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: HOMEPAGE_VAR_GITEA_API_TOKEN
       remoteRef:
-        key: /cl01tl/gitea/users/bot
+        key: /cl01tl/gitea/auth/homepage
         property: token
     - secretKey: HOMEPAGE_VAR_ARGOCD_API_TOKEN
       remoteRef:
@@ -33,47 +34,47 @@ spec:
         property: key
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_USER
       remoteRef:
-        key: /synology/users/remote_stats
+        key: /synology/auth/cl01tl
         property: user
     - secretKey: HOMEPAGE_VAR_SYNOLOGY_PASSWORD
       remoteRef:
-        key: /synology/users/remote_stats
+        key: /synology/auth/cl01tl
         property: password
     - secretKey: HOMEPAGE_VAR_UNIFI_API_KEY
       remoteRef:
-        key: /unifi/users/cl01tl
+        key: /unifi/auth/cl01tl
         property: api-key
     - secretKey: HOMEPAGE_VAR_SONARR_KEY
       remoteRef:
-        key: /cl01tl/sonarr/key
+        key: /cl01tl/sonarr4/key
         property: key
     - secretKey: HOMEPAGE_VAR_SONARR4K_KEY
       remoteRef:
-        key: /cl01tl/sonarr-4k/key
+        key: /cl01tl/sonarr4-4k/key
         property: key
     - secretKey: HOMEPAGE_VAR_SONARRANIME_KEY
       remoteRef:
-        key: /cl01tl/sonarr-anime/key
+        key: /cl01tl/sonarr4-anime/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR_KEY
       remoteRef:
-        key: /cl01tl/radarr/key
+        key: /cl01tl/radarr5/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARR4K_KEY
       remoteRef:
-        key: /cl01tl/radarr-4k/key
+        key: /cl01tl/radarr5-4k/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRANIME_KEY
       remoteRef:
-        key: /cl01tl/radarr-anime/key
+        key: /cl01tl/radarr5-anime/key
         property: key
     - secretKey: HOMEPAGE_VAR_RADARRSTANDUP_KEY
       remoteRef:
-        key: /cl01tl/radarr-standup/key
+        key: /cl01tl/radarr5-standup/key
         property: key
     - secretKey: HOMEPAGE_VAR_LIDARR_KEY
       remoteRef:
-        key: /cl01tl/lidarr/key
+        key: /cl01tl/lidarr2/key
         property: key
     - secretKey: HOMEPAGE_VAR_PROWLARR_KEY
       remoteRef:

clusters/cl01tl/helm/homepage/values.yaml

@@ -22,7 +22,7 @@ homepage:
               value: home.alexlebens.net
           envFrom:
             - secretRef:
-                name: homepage-secrets
+                name: homepage-keys-secret
           resources:
             requests:
               cpu: 1m

clusters/cl01tl/helm/houndarr/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/immich/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/immich/templates/external-secrets.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: immich-config-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: immich.json
+      remoteRef:
+        key: /cl01tl/immich/config
+        property: immich.json

clusters/cl01tl/helm/immich/templates/secret-provider-class.yaml

@@ -1,18 +0,0 @@
-apiVersion: secrets-store.csi.x-k8s.io/v1
-kind: SecretProviderClass
-metadata:
-  name: immich-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: immich-config
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  provider: openbao
-  parameters:
-    baoAddress: "http://openbao-internal.openbao:8200"
-    roleName: immich
-    objects: |
-      - objectName: immich.json
-        fileName: immich.json
-        secretPath: secret/data/cl01tl/immich/config
-        secretKey: immich.json

clusters/cl01tl/helm/immich/values.yaml

@@ -4,8 +4,6 @@ immich:
       type: deployment
       replicas: 1
       strategy: Recreate
-      serviceAccount:
-        name: immich
       containers:
         main:
           image:
@@ -88,10 +86,6 @@ immich:
               gpu.intel.com/i915: 1
               cpu: 10m
               memory: 500Mi
-  serviceAccount:
-    immich:
-      enabled: true
-      staticToken: true
   service:
     main:
       controller: main
@@ -141,13 +135,9 @@ immich:
                 value: /
   persistence:
     config:
-      type: custom
-      volumeSpec:
-        csi:
-          driver: secrets-store.csi.k8s.io
-          readOnly: true
-          volumeAttributes:
-            secretProviderClass: immich-config
+      enabled: true
+      type: secret
+      name: immich-config-secret
       advancedMounts:
         main:
           main:

clusters/cl01tl/helm/intel-device-plugin/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/intel-device-plugin/templates/namespace.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Release.Namespace }}
+  name: intel-device-plugin
   labels:
-    app.kubernetes.io/name: {{ .Release.Namespace }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: intel-device-plugin
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
     pod-security.kubernetes.io/audit: privileged
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/warn: privileged

clusters/cl01tl/helm/jellyfin/templates/_helpers.tpl

@@ -1,24 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-NFS names
-*/}}
-{{- define "custom.storageNfsName" -}}
-jellyfin-nfs-storage
-{{- end -}}
-{{- define "custom.storageYoutubeNfsName" -}}
-jellyfin-youtube-nfs-storage
-{{- end -}}

clusters/cl01tl/helm/jellyfin/templates/external-secret.yaml

@@ -1,36 +1,38 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellyfin-metric-token
+  name: jellyfin-exporter-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: jellyfin-metric-token
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellyfin-exporter-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: token
       remoteRef:
-        key: /cl01tl/jellyfin/metrics
+        key: /cl01tl/jellyfin/exporter
         property: token
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellyfin-meilisearch-key
+  name: jellyfin-meilisearch-master-key-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: jellyfin-meilisearch-key
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellyfin-meilisearch-master-key-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
         key: /cl01tl/jellyfin/meilisearch
-        property: master-key
+        property: MEILI_MASTER_KEY

clusters/cl01tl/helm/jellyfin/templates/persistent-volume-claim.yaml

@@ -1,13 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: jellyfin-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellyfin-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: {{ include "custom.storageNfsName" . }}
+  volumeName: jellyfin-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany
@@ -19,13 +20,14 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageYoutubeNfsName" . }}
+  name: jellyfin-youtube-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageYoutubeNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellyfin-youtube-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: {{ include "custom.storageYoutubeNfsName" . }}
+  volumeName: jellyfin-youtube-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadOnlyMany

clusters/cl01tl/helm/jellyfin/templates/persistent-volume.yaml

@@ -1,11 +1,12 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: jellyfin-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellyfin-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   persistentVolumeReclaimPolicy: Retain
   storageClassName: nfs-client
@@ -25,11 +26,12 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: {{ include "custom.storageYoutubeNfsName" . }}
+  name: jellyfin-youtube-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageYoutubeNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellyfin-youtube-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   persistentVolumeReclaimPolicy: Retain
   storageClassName: nfs-client

clusters/cl01tl/helm/jellyfin/values.yaml

@@ -48,7 +48,7 @@ jellyfin:
             - name: TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: jellyfin-metric-token
+                  name: jellyfin-exporter-secret
                   key: token
   service:
     main:
@@ -133,7 +133,7 @@ meilisearch:
     MEILI_ENV: production
     MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
   auth:
-    existingMasterKeySecret: jellyfin-meilisearch-key
+    existingMasterKeySecret: jellyfin-meilisearch-master-key-secret
   persistence:
     enabled: true
     storageClass: ceph-block

clusters/cl01tl/helm/jellystat/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/jellystat/templates/external-secret.yaml

@@ -1,25 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: jellystat-config
+  name: jellystat-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: jellystat-config
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: jellystat-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: secret-key
       remoteRef:
-        key: /cl01tl/jellystat/key
+        key: /cl01tl/jellystat/auth
         property: secret-key
     - secretKey: user
       remoteRef:
-        key: /cl01tl/jellystat/config
+        key: /cl01tl/jellystat/auth
         property: user
     - secretKey: password
       remoteRef:
-        key: /cl01tl/jellystat/cconfig
+        key: /cl01tl/jellystat/auth
         property: password

clusters/cl01tl/helm/jellystat/values.yaml

@@ -15,17 +15,17 @@ jellystat:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-config
+                  name: jellystat-secret
                   key: secret-key
             - name: JS_USER
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-config
+                  name: jellystat-secret
                   key: user
             - name: JS_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: jellystat-config
+                  name: jellystat-secret
                   key: password
             - name: POSTGRES_USER
               valueFrom:

clusters/cl01tl/helm/karakeep/templates/_helpers.tpl

@@ -1,14 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}

clusters/cl01tl/helm/karakeep/templates/external-secret.yaml

@@ -1,80 +1,48 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-key
+  name: karakeep-key-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: karakeep-key
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: karakeep-key-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: key
       remoteRef:
         key: /cl01tl/karakeep/key
         property: key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: karakeep-metric-token
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: karakeep-key-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
     - secretKey: prometheus-token
       remoteRef:
-        key: /cl01tl/karakeep/metrics
-        property: token
+        key: /cl01tl/karakeep/key
+        property: prometheus-token
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-meilisearch-key
+  name: karakeep-oidc-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: karakeep-meilisearch-key
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: karakeep-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: MEILI_MASTER_KEY
-      remoteRef:
-        key: /cl01tl/karakeep/meilisearch
-        property: master-key
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: karakeep-oidc-authentik
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: karakeep-oidc-authentik
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: AUTHENTIK_CLIENT_ID
       remoteRef:
-        key: /cl01tl/authentik/oidc/karakeep
+        key: /authentik/oidc/karakeep
         property: client
     - secretKey: AUTHENTIK_CLIENT_SECRET
       remoteRef:
-        key: /cl01tl/authentik/oidc/karakeep
+        key: /authentik/oidc/karakeep
         property: secret
 
 ---
@@ -85,11 +53,12 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: karakeep-bucket-garage
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: openbao
+    name: vault
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -103,11 +72,23 @@ spec:
       remoteRef:
         key: /garage/home-infra/karakeep-assets
         property: ACCESS_REGION
-    - secretKey: BUCKET
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: karakeep-meilisearch-master-key-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: karakeep-meilisearch-master-key-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: MEILI_MASTER_KEY
       remoteRef:
-        key: /garage/home-infra/karakeep-assets
-        property: BUCKET
-    - secretKey: ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_LOCAL
+        key: /cl01tl/karakeep/meilisearch
+        property: MEILI_MASTER_KEY

clusters/cl01tl/helm/karakeep/values.yaml

@@ -19,28 +19,22 @@ karakeep:
             - name: NEXTAUTH_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-key
+                  name: karakeep-key-secret
                   key: key
             - name: PROMETHEUS_AUTH_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-metric-token
+                  name: karakeep-key-secret
                   key: prometheus-token
             - name: ASSET_STORE_S3_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: karakeep-bucket-garage
-                  key: ENDPOINT
+              value: http://garage-main.garage:3900
             - name: ASSET_STORE_S3_REGION
               valueFrom:
                 secretKeyRef:
                   name: karakeep-bucket-garage
                   key: ACCESS_REGION
             - name: ASSET_STORE_S3_BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: karakeep-bucket-garage
-                  key: BUCKET
+              value: karakeep-assets
             - name: ASSET_STORE_S3_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
@@ -58,7 +52,7 @@ karakeep:
             - name: MEILI_MASTER_KEY
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-meilisearch-key
+                  name: karakeep-meilisearch-master-key-secret
                   key: MEILI_MASTER_KEY
             - name: BROWSER_WEB_URL
               value: http://karakeep.karakeep:9222
@@ -73,12 +67,12 @@ karakeep:
             - name: OAUTH_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-oidc-authentik
+                  name: karakeep-oidc-secret
                   key: AUTHENTIK_CLIENT_ID
             - name: OAUTH_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-oidc-authentik
+                  name: karakeep-oidc-secret
                   key: AUTHENTIK_CLIENT_SECRET
             - name: OLLAMA_BASE_URL
               value: http://ollama-server-3.ollama:11434
@@ -132,7 +126,7 @@ karakeep:
           authorization:
             credentials:
               key: prometheus-token
-              name: karakeep-metric-token
+              name: karakeep-key-secret
   persistence:
     data:
       forceRename: karakeep
@@ -150,7 +144,7 @@ meilisearch:
     MEILI_ENV: production
     MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
   auth:
-    existingMasterKeySecret: karakeep-meilisearch-key
+    existingMasterKeySecret: karakeep-meilisearch-master-key-secret
   persistence:
     enabled: true
     storageClass: ceph-block

clusters/cl01tl/helm/kiwix/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Common labels
-*/}}
-{{- define "custom.labels" -}}
-{{ include "custom.selectorLabels" $ }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "custom.selectorLabels" -}}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/part-of: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-NFS names
-*/}}
-{{- define "custom.storageNfsName" -}}
-kiwix-nfs-storage
-{{- end -}}

clusters/cl01tl/helm/kiwix/templates/persistent-volume-claim.yaml

@@ -1,13 +1,14 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "custom.storageNfsName" . }}
+  name: kiwix-nfs-storage
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
-    {{- include "custom.labels" . | nindent 4 }}
+    app.kubernetes.io/name: kiwix-nfs-storage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  volumeName: {{ include "custom.storageNfsName" . }}
+  volumeName: kiwix-nfs-storage
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany