clusters/cl01tl/manifests/cert-manager/ClusterIssuer-letsencrypt-issuer.yaml

@@ -2,6 +2,11 @@ apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: letsencrypt-issuer
+  namespace: cert-manager
+  labels:
+    app.kubernetes.io/name: letsencrypt-issuer
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/part-of: cert-manager
 spec:
   acme:
     email: alexanderlebens@gmail.com

clusters/cl01tl/manifests/cert-manager/Deployment-cert-manager.yaml

@@ -64,6 +64,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
           livenessProbe:
             httpGet:
               port: http-healthz

clusters/cl01tl/manifests/cert-manager/ExternalSecret-cloudflare-api-token.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: api-token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cloudflare/alexlebens.net/clusterissuer
-        metadataPolicy: None
         property: token

clusters/cl01tl/manifests/cert-manager/PodDisruptionBudget-cert-manager.yaml

@@ -0,0 +1,20 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+  labels:
+    app: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/component: "controller"
+    app.kubernetes.io/version: "v1.20.0"
+    app.kubernetes.io/managed-by: Helm
+    helm.sh/chart: cert-manager-v1.20.0
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cert-manager
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/component: "controller"
+  minAvailable: 1

clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yaml

@@ -25,7 +25,7 @@ data:
   enable-gateway-api-alpn: "true"
   gateway-api-xff-num-trusted-hops: "0"
   gateway-api-service-externaltrafficpolicy: "Cluster"
-  gateway-api-secrets-namespace: "cilium-secrets"
+  gateway-api-secrets-namespace: "kube-system"
   gateway-api-hostnetwork-enabled: "false"
   gateway-api-hostnetwork-nodelabelselector: ""
   enable-policy-secrets-sync: "true"

clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: "e129393f7260ae593c00137d4b9c2c92e786de76c1125c2293f366cfe5b3512b"
+        cilium.io/cilium-configmap-checksum: "6c5e6123b63f6fc449922e9eb9bd248afa8fd228d8083cc40c920fff386079bb"
         kubectl.kubernetes.io/default-container: cilium-agent
       labels:
         k8s-app: cilium

clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yaml

@@ -22,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: "e129393f7260ae593c00137d4b9c2c92e786de76c1125c2293f366cfe5b3512b"
+        cilium.io/cilium-configmap-checksum: "6c5e6123b63f6fc449922e9eb9bd248afa8fd228d8083cc40c920fff386079bb"
       labels:
         io.cilium/app: operator
         name: cilium-operator

clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: cilium-gateway-secrets
-  namespace: "cilium-secrets"
+  namespace: "kube-system"
   labels:
     app.kubernetes.io/part-of: cilium
 rules:

clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: cilium-operator-gateway-secrets
-  namespace: "cilium-secrets"
+  namespace: "kube-system"
   labels:
     app.kubernetes.io/part-of: cilium
 rules:

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: cilium-gateway-secrets
-  namespace: "cilium-secrets"
+  namespace: "kube-system"
   labels:
     app.kubernetes.io/part-of: cilium
 roleRef:

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: cilium-operator-gateway-secrets
-  namespace: "cilium-secrets"
+  namespace: "kube-system"
   labels:
     app.kubernetes.io/part-of: cilium
 roleRef:

clusters/cl01tl/manifests/cloudnative-pg/Deployment-cloudnative-pg-plugin-barman-cloud.yaml

@@ -10,7 +10,7 @@ metadata:
   name: cloudnative-pg-plugin-barman-cloud
   namespace: cloudnative-pg
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
       app.kubernetes.io/name: plugin-barman-cloud
@@ -48,7 +48,10 @@ spec:
             periodSeconds: 10
             tcpSocket:
               port: 9090
-          resources: {}
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

clusters/cl01tl/manifests/cloudnative-pg/Deployment-cloudnative-pg.yaml

@@ -65,7 +65,10 @@ spec:
               port: webhook-server
               scheme: HTTPS
             initialDelaySeconds: 3
-          resources: {}
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: