Consolidate BIND DNS into one bind-internal namespace (#225)

**HOLD until v0.1.3 is tagged/built** (operator #4 merged + tagged) — this PR bumps the operator to v0.1.3, whose CRD adds the `clusterRef` field these keys use.

## Why
Put all BIND DNS services in one `bind-internal` namespace and name the StatefulSets clearly.

## Changes
- 3 clusters consolidated into `bind-internal`, StatefulSets renamed **bind-authoritative** / **bind-resolvers** / **bind-externaldns**; LBs kept on 198.18.200.6/.7/.8; external-dns hostnames renamed to match
- `clusterRef` added to `transfer-key` (→ bind-authoritative) and `externaldns-key` (→ bind-externaldns) so keys are scoped per cluster
- removed the old `ns-auth`/`ns-resolver`/`ns-externaldns` apps; ApplicationSet + AppProject now list `bind-internal`
- bumped `bind-system` operator to **v0.1.3** (CRD link + image)
- operator stays in `bind-system`

## Deploy impact
ArgoCD prunes the old ns-* namespaces (StatefulSets/PVCs — data is only seed SOA+NS, no migrated records yet) and creates the renamed clusters in bind-internal.

## Validated
`kustomize build` → 28 docs (3 BindCluster, 20 BindZone, 2 catalog, 2 keys, ns); kubeconform clean.

Reviewed-on: #225
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

.pre-commit-config.yaml

@@ -7,6 +7,7 @@ repos:
       - id: check-json
       - id: check-added-large-files
         args: ['--maxkb=500']
+        exclude: '^schemas/'
       - id: check-merge-conflict
       - id: check-shebang-scripts-are-executable
       - id: check-symlinks
@@ -19,6 +20,7 @@ repos:
       - id: end-of-file-fixer
       - id: forbid-new-submodules
       - id: pretty-format-json
+        args: ['--autofix']
       - id: trailing-whitespace
 
   # YAML linting

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build clean
+.PHONY: build clean schemas
 
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap
@@ -6,6 +6,10 @@ build:
 	@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
 	@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
 
+# Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
+schemas:
+	@ci/generate-schemas.sh schemas
+
 # kubeconform
 kubeconform:
 	@ci/validate-apps.sh && \

apps/base/age-api/deployment.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: age-api
+  namespace: age-api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: age-api
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: age-api
+    spec:
+      containers:
+        - name: age-api
+          image: git.unkin.net/unkin/age-api:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: CONFIG_PATH
+              value: /etc/age-api/config.yaml
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          volumeMounts:
+            - mountPath: /etc/age-api/config.yaml
+              name: config
+              subPath: config.yaml
+      restartPolicy: Always
+      volumes:
+        - name: config
+          configMap:
+            name: age-api-config

apps/base/age-api/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: age-api.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: age-api.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: age-api
+  namespace: age-api
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: age-api.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: age-api.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: age-api-tls
+        mode: Terminate

apps/base/age-api/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: age-api-http-redirect
+  namespace: age-api
+spec:
+  hostnames:
+    - age-api.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: age-api
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: age-api
+  namespace: age-api
+spec:
+  hostnames:
+    - age-api.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: age-api
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: age-api
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/age-api/kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - service.yaml
+
+configMapGenerator:
+  - name: age-api-config
+    files:
+      - config.yaml=resources/config.yaml
+    options:
+      disableNameSuffixHash: true

apps/base/age-api/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: age-api

apps/base/age-api/resources/config.yaml

@@ -0,0 +1,7 @@
+people:
+  - name: jaidi
+    birthtime: 1773135720
+  - name: ben
+    birthtime: 559663200
+  - name: sudaporn
+    birthtime: 686757600

apps/base/age-api/service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: age-api
+  namespace: age-api
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: age-api
+  sessionAffinity: None
+  type: ClusterIP

apps/base/artifactapi/api-deployment.yaml

@@ -35,7 +35,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.5.0
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
@@ -46,7 +46,7 @@ spec:
                 name: api-env
                 optional: false
             - secretRef:
-                name: environment2
+                name: environment
                 optional: false
           volumeMounts:
             - name: combined-certs

apps/base/artifactapi/artifactapi-deployment.yaml

@@ -1,92 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: artifactapi-deployment
-  namespace: artifactapi
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  selector:
-    matchLabels:
-      app: artifactapi
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    spec:
-      automountServiceAccountToken: true
-      containers:
-        - name: artifactapi
-          image: git.unkin.net/unkin/artifactapi:v2.7.2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8000
-              name: http
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: artifactapi-env
-                optional: false
-            - secretRef:
-                name: environment
-                optional: false
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "1"
-              memory: 4Gi
-            requests:
-              cpu: 100m
-              memory: 256Mi
-          volumeMounts:
-            - mountPath: /etc/artifactapi/conf.d/config.yaml
-              name: remotes-config
-              subPath: config.yaml
-            - mountPath: /etc/artifactapi/conf.d/local-generic.yaml
-              name: remotes-config
-              subPath: local-generic.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
-              name: remotes-config
-              subPath: remote-alpine.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
-              name: remotes-config
-              subPath: remote-docker.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
-              name: remotes-config
-              subPath: remote-generic.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
-              name: remotes-config
-              subPath: remote-helm.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
-              name: remotes-config
-              subPath: remote-rpm.yaml
-            - mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
-              name: remotes-config
-              subPath: virtual-helm.yaml
-      restartPolicy: Always
-      volumes:
-        - configMap:
-            name: remotes-config
-            optional: false
-          name: remotes-config

apps/base/artifactapi/artifactapi-hpa.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: artifactapi-hpa
-  namespace: artifactapi
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: artifactapi-deployment
-  minReplicas: 2
-  maxReplicas: 10
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 60
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 30
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 10
-          periodSeconds: 60
-        - type: Pods
-          value: 2
-          periodSeconds: 60

apps/base/artifactapi/configmap.yaml

@@ -1,34 +1,6 @@
 ---
 apiVersion: v1
 kind: ConfigMap
-metadata:
-  name: artifactapi-env
-  namespace: artifactapi
-data:
-  CONFIG_PATH: /etc/artifactapi/conf.d/
-  DBHOST: postgres-service
-  DBNAME: artifacts
-  DBPORT: "5432"
-  DBUSER: artifacts
-  MINIO_BUCKET: artifactapi
-  MINIO_ENDPOINT: radosgw.service.consul
-  MINIO_SECURE: "true"
-  REDIS_URL: redis://redis-service:6379
-  REQUESTS_CA_BUNDLE: /etc/pki/tls/certs/ca-bundle.crt
-  SSL_CERT_FILE: /etc/pki/tls/certs/ca-bundle.crt
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: postgres-env
-  namespace: artifactapi
-data:
-  POSTGRES_DB: artifacts
-  POSTGRES_USER: artifacts
-###
----
-apiVersion: v1
-kind: ConfigMap
 metadata:
   name: api-env
   namespace: artifactapi

apps/base/artifactapi/httproute.yaml

@@ -2,7 +2,7 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: artifactapi-http-redirect
+  name: http-redirect
   namespace: artifactapi
 spec:
   hostnames:
@@ -26,7 +26,7 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: artifactapi
+  name: api-route
   namespace: artifactapi
 spec:
   hostnames:
@@ -40,7 +40,17 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: artifactapi-api
+          name: ui
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /ui
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: artifactapi
           port: 80
           weight: 1
       matches:

apps/base/artifactapi/kustomization.yaml

@@ -3,41 +3,17 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - artifactapi-deployment.yaml
-  - artifactapi-hpa.yaml
-  - httproute.yaml
-  - postgres-deployment.yaml
-  - redis-deployment.yaml
-  - pvc.yaml
-  # shared
-  - configmap.yaml
-  - services.yaml
-  - gateway.yaml
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  # new
   - api-deployment.yaml
   - api-hpa.yaml
+  - configmap.yaml
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - redis-deployment.yaml
+  - services.yaml
   - ui-deployment.yaml
   - ui-hpa.yaml
-  # to copy still
+  - vaultauth.yaml
-  # - httproute.yaml
+  - vaultstaticsecret.yaml
-  # - redis-deployment.yaml
-
-
-configMapGenerator:
-  - name: remotes-config
-    files:
-      - resources/conf.d/config.yaml
-      - resources/conf.d/local-generic.yaml
-      - resources/conf.d/remote-generic.yaml
-      - resources/conf.d/remote-alpine.yaml
-      - resources/conf.d/remote-rpm.yaml
-      - resources/conf.d/remote-docker.yaml
-      - resources/conf.d/remote-helm.yaml
-      - resources/conf.d/virtual-helm.yaml
-    options:
-      disableNameSuffixHash: true

apps/base/artifactapi/postgres-deployment.yaml

@@ -1,76 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: postgres-deployment
-  namespace: artifactapi
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: postgres
-  strategy:
-    type: Recreate
-  template:
-    spec:
-      automountServiceAccountToken: true
-      containers:
-        - name: postgres
-          image: postgres:15-alpine
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 5432
-              name: postgres
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: postgres-env
-                optional: false
-            - secretRef:
-                name: postgres-password
-                optional: false
-          readinessProbe:
-            exec:
-              command:
-                - pg_isready
-                - -U
-                - artifacts
-                - -d
-                - artifacts
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          livenessProbe:
-            exec:
-              command:
-                - pg_isready
-                - -U
-                - artifacts
-                - -d
-                - artifacts
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /var/lib/postgresql/data
-              mountPropagation: None
-              name: pgdata
-              subPath: pgdata
-      restartPolicy: Always
-      volumes:
-        - name: pgdata
-          persistentVolumeClaim:
-            claimName: artifactapi-postgres-pgdata

apps/base/artifactapi/pvc.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: artifactapi-postgres-pgdata
-  namespace: artifactapi
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: artifactapi-redis-data
-  namespace: artifactapi
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/artifactapi/redis-deployment.yaml

@@ -2,23 +2,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
+  name: redis
-    deployment.kubernetes.io/revision: "1"
-  name: redis-deployment
   namespace: artifactapi
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: redis
-  strategy:
-    type: Recreate
   template:
+    metadata:
+      labels:
+        app: redis
     spec:
       containers:
         - name: redis
           image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
           command:
             - redis-server
             - --save
@@ -28,6 +26,13 @@ spec:
             - containerPort: 6379
               name: redis
               protocol: TCP
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
           livenessProbe:
             exec:
               command:
@@ -48,19 +53,4 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              mountPropagation: None
-              name: data
       restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: artifactapi-redis-data

apps/base/artifactapi/resources/conf.d/config.yaml

@@ -1,3 +0,0 @@
-# Global artifactapi configuration.
-# S3, Redis, and database connection settings are injected via environment variables.
-# Add any top-level overrides here if needed.

apps/base/artifactapi/resources/conf.d/local-generic.yaml

@@ -1,7 +0,0 @@
-locals:
-  local-generic:
-    package: "generic"
-    description: "Local generic file repository"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 0

apps/base/artifactapi/resources/conf.d/remote-alpine.yaml

@@ -1,10 +0,0 @@
-remotes:
-  alpine:
-    base_url: "https://dl-cdn.alpinelinux.org"
-    package: "alpine"
-    description: "Alpine Linux APK package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.apk$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -1,103 +0,0 @@
-remotes:
-  ghcr:
-    base_url: "https://ghcr.io"
-    package: "docker"
-    description: "GitHub Container Registry"
-    immutable_patterns:
-      - "^cloudnative-pg/cloudnative-pg"
-      - "^emberstack/helm-charts"
-      - "^open-webui/open-webui"
-      - "^openvoxproject/"
-      - "^stakater/reloader"
-      - "^stalwartlabs/stalwart"
-      - "^voxpupuli/puppetboard"
-      - "^woodpecker-ci/helm"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  dockerhub:
-    base_url: "https://registry-1.docker.io"
-    package: "docker"
-    description: "Docker Hub registry"
-    immutable_patterns:
-      - "^library/almalinux"
-      - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
-      - "^library/nginx"
-      - "^library/postgres"
-      - "^library/redis"
-      - "^beats/filebeat"
-      - "^bitnami/"
-      - "^curlimages/curl"
-      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/consul"
-      - "^hashicorp/vault"
-      - "^jfrog/"
-      - "^kanidm/"
-      - "^rancher/"
-      - "^rspamd/rspamd"
-      - "^tozd/postfix"
-      - "^traefik/"
-      - "^valkey/valkey"
-      - "^ubi9/ubi-minimal"
-      - "^victoriametrics/"
-      - "^woodpeckerci/"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  quay:
-    base_url: "https://quay.io"
-    package: "docker"
-    description: "Quay.io container registry"
-    immutable_patterns:
-      - "^brancz/kube-rbac-proxy"
-      - "^cephcsi/cephcsi"
-      - "^jetstack/cert-manager-"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  k8s-registry:
-    base_url: "https://registry.k8s.io"
-    package: "docker"
-    description: "Kubernetes container registry"
-    immutable_patterns:
-      - "^external-dns/external-dns"
-      - "^sig-storage/"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  gitlab:
-    base_url: "https://registry.gitlab.com"
-    package: "docker"
-    description: "GitLab container registry"
-    immutable_patterns:
-      - "^purelb/purelb"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  elastic:
-    base_url: "https://docker.elastic.co"
-    package: "docker"
-    description: "Elastic container registry"
-    immutable_patterns:
-      - "^eck/eck-operator"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  gcr:
-    base_url: "https://gcr.io"
-    package: "docker"
-    description: "Google Container Registry"
-    immutable_patterns:
-      - "^k8s-staging-nfd/charts"
-      - "^k8s-staging-nfd/node-feature-discovery"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -1,134 +0,0 @@
-remotes:
-  github:
-    base_url: "https://github.com"
-    package: "generic"
-    description: "GitHub releases and files"
-    mutable_patterns:
-      - ".*/archive/refs/heads/.*.tar.gz$"
-      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
-    immutable_patterns:
-      - ".*/archive/refs/tags/.*.tar.gz$"
-      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
-      - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
-      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
-      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
-      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
-      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
-      - "coder/code-server/.*/code-server-.*-amd64.rpm$"
-      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
-      - "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
-      - "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
-      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
-      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
-      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
-      - "hadolint/hadolint/.*/hadolint-linux-x86_64$"
-      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
-      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
-      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
-      - "lxc/incus/.*.tar.gz$"
-      - "mikefarah/yq/.*/yq_linux_amd64$"
-      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
-      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
-      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
-      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
-      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
-      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
-      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
-      - "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
-      - "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
-      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
-      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
-      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  github_user:
-    base_url: "https://raw.githubusercontent.com"
-    package: "generic"
-    description: "GitHub User Content"
-    immutable_patterns:
-      - "argoproj/argo-cd/.*.yaml$"
-      - "yannh/kubernetes-json-schema/master/.*.json$"
-      - "datreeio/CRDs-catalog/main/.*.json$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  gitea-dl:
-    base_url: "https://dl.gitea.com"
-    package: "generic"
-    description: "Gitea download site"
-    immutable_patterns:
-      - "act_runner/.*/act_runner-.*-linux-amd64$"
-      - "gitea/.*/gitea-.*-linux-amd64$"
-      - "gitea/.*/gitea-.*-linux-amd64.xz$"
-      - "tea/.*/tea-.*-linux-amd64$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  hashicorp-releases:
-    base_url: "https://releases.hashicorp.com"
-    package: "generic"
-    description: "HashiCorp product releases"
-    immutable_patterns:
-      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
-      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
-      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
-      - "vault/.*vault_.*_linux_amd64\\.zip$"
-      - "vault/.*vault_.*_windows_amd64\\.zip$"
-      - "vault/.*vault_.*_darwin_amd64\\.zip$"
-      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
-      - "consul/.*/consul_.*_linux_amd64\\.zip$"
-      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
-      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
-      - "packer/.*/packer_.*_linux_amd64\\.zip$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  rarlab:
-    base_url: "https://www.rarlab.com"
-    package: "generic"
-    description: "RARLab"
-    immutable_patterns:
-      - "rar/rarlinux-x64-.*.tar.gz"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  claude-ai:
-    base_url: "https://downloads.claude.ai"
-    package: "generic"
-    description: "Anthropic Claude Code binary releases"
-    mutable_patterns:
-      - "claude-code-releases/.*/manifest.json$"
-    immutable_patterns:
-      - "claude-code-releases/.*/linux-x64/claude$"
-      - "claude-code-releases/.*/linux-arm64/claude$"
-      - "claude-code-releases/.*/linux-x64-musl/claude$"
-      - "claude-code-releases/.*/linux-arm64-musl/claude$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-helm.yaml

@@ -1,143 +0,0 @@
-remotes:
-  ceph-csi:
-    base_url: "https://ceph.github.io/csi-charts"
-    package: "helm"
-    description: "Ceph CSI driver Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  cnpg:
-    base_url: "https://cloudnative-pg.github.io/charts"
-    package: "helm"
-    description: "CloudNativePG operator Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  elastic-helm:
-    base_url: "https://helm.elastic.co"
-    package: "helm"
-    description: "Elastic stack Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  external-dns:
-    base_url: "https://kubernetes-sigs.github.io/external-dns/"
-    package: "helm"
-    description: "ExternalDNS Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  hashicorp-helm:
-    base_url: "https://helm.releases.hashicorp.com"
-    package: "helm"
-    description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  intel-helm:
-    base_url: "https://intel.github.io/helm-charts/"
-    package: "helm"
-    description: "Intel Helm charts (device plugins)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  jetstack:
-    base_url: "https://charts.jetstack.io"
-    package: "helm"
-    description: "Jetstack Helm charts (cert-manager)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  purelb:
-    base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
-    package: "helm"
-    description: "PureLB load balancer Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  rancher-stable:
-    base_url: "https://releases.rancher.com/server-charts/stable"
-    package: "helm"
-    description: "Rancher stable Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  stakater:
-    base_url: "https://stakater.github.io/stakater-charts"
-    package: "helm"
-    description: "Stakater Helm charts (Reloader)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  traefik:
-    base_url: "https://traefik.github.io/charts"
-    package: "helm"
-    description: "Traefik Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  victoriametrics:
-    base_url: "https://victoriametrics.github.io/helm-charts/"
-    package: "helm"
-    description: "VictoriaMetrics observability Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  argo-helm:
-    base_url: "https://argoproj.github.io/argo-helm"
-    package: "helm"
-    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600

apps/base/artifactapi/resources/conf.d/remote-rpm.yaml

@@ -1,172 +0,0 @@
-remotes:
-  almalinux:
-    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
-    package: "rpm"
-    description: "AlmaLinux RPM package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  almalinux-vault:
-    base_url: "https://vault.almalinux.org"
-    package: "rpm"
-    description: "AlmaLinux Vault RPM package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-reef:
-    base_url: "https://download.ceph.com/rpm-reef/"
-    package: "rpm"
-    description: "Ceph Reef 18"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-squid:
-    base_url: "https://download.ceph.com/rpm-squid/"
-    package: "rpm"
-    description: "Ceph Squid 19"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-tentacle:
-    base_url: "https://download.ceph.com/rpm-tentacle/"
-    package: "rpm"
-    description: "Ceph Tentacle 20"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  epel:
-    base_url: "https://gsl-syd.mm.fcix.net/epel"
-    package: "rpm"
-    description: "EPEL (Extra Packages for Enterprise Linux)"
-    immutable_patterns:
-      - ".*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - "RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  fedora:
-    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
-    package: "rpm"
-    description: "Fedora Linux RPM package repository"
-    immutable_patterns:
-      - "releases/.*/Everything/x86_64/.*\\.rpm$"
-      - "updates/.*/Everything/x86_64/.*\\.rpm$"
-      - "development/.*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  frr:
-    base_url: "https://rpm.frrouting.org/repo"
-    package: "rpm"
-    description: "FRR RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  mariadb:
-    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
-    package: "rpm"
-    description: "MariaDB RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  openvox:
-    base_url: "https://yum.voxpupuli.org"
-    package: "rpm"
-    description: "OpenVox RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  postgresql:
-    base_url: "https://download.postgresql.org/pub/repos/yum"
-    package: "rpm"
-    description: "PostgreSQL RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-      - ".*/PGDG-RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  rke2:
-    base_url: "https://rpm.rancher.io"
-    package: "rpm"
-    description: "RKE2 RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "public.key$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  zfs:
-    base_url: "http://download.zfsonlinux.org"
-    package: "rpm"
-    description: "ZFS RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/virtual-helm.yaml

@@ -1,18 +0,0 @@
-virtuals:
-  helm:
-    package: "helm"
-    description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
-    members:
-      - ceph-csi
-      - cnpg
-      - elastic-helm
-      - external-dns
-      - hashicorp-helm
-      - intel-helm
-      - jetstack
-      - purelb
-      - rancher-stable
-      - stakater
-      - traefik
-      - victoriametrics
-      - argo-helm

apps/base/artifactapi/services.yaml

@@ -1,58 +1,6 @@
 ---
 apiVersion: v1
 kind: Service
-metadata:
-  name: artifactapi-api
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: artifactapi
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres-service
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: postgres
-      port: 5432
-      protocol: TCP
-      targetPort: postgres
-  selector:
-    app: postgres
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis-service
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
-      targetPort: redis
-  selector:
-    app: redis
-  sessionAffinity: None
-  type: ClusterIP
-####
----
-apiVersion: v1
-kind: Service
 metadata:
   name: artifactapi
   namespace: artifactapi

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.5.0
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80
@@ -31,7 +31,7 @@ spec:
           livenessProbe:
             failureThreshold: 3
             httpGet:
-              path: /
+              path: /ui
               port: http
               scheme: HTTP
             initialDelaySeconds: 15
@@ -41,7 +41,7 @@ spec:
           readinessProbe:
             failureThreshold: 3
             httpGet:
-              path: /
+              path: /ui
               port: http
               scheme: HTTP
             initialDelaySeconds: 5

apps/base/artifactapi/vaultauth.yaml

@@ -4,25 +4,6 @@ kind: VaultAuth
 metadata:
   name: default
   namespace: artifactapi
-spec:
-  allowedNamespaces:
-    - artifactapi
-  kubernetes:
-    audiences:
-      - vault
-    role: artifactapi
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-### change to default from default1
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default1
-  namespace: artifactapi
 spec:
   allowedNamespaces:
     - artifactapi

apps/base/artifactapi/vaultstaticsecret.yaml

@@ -1,41 +1,6 @@
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
-metadata:
-  name: environment
-  namespace: artifactapi
-spec:
-  destination:
-    create: true
-    name: environment
-    overwrite: false
-  hmacSecretData: true
-  mount: kv
-  path: service/artifactapi/environment
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-password
-  namespace: artifactapi
-spec:
-  destination:
-    create: true
-    name: postgres-password
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: service/artifactapi/postgres-password
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
-### change auth ref to default from default1
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
 metadata:
   name: postgres-credentials
   namespace: artifactapi
@@ -49,12 +14,12 @@ spec:
   path: kubernetes/namespace/artifactapi/default/postgres-credentials
   refreshAfter: 5m
   type: kv-v2
-  vaultAuthRef: default1
+  vaultAuthRef: default
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
-  name: environment2
+  name: environment
   namespace: artifactapi
 spec:
   destination:
@@ -66,4 +31,4 @@ spec:
   path: kubernetes/namespace/artifactapi/default/environment
   refreshAfter: 5m
   type: kv-v2
-  vaultAuthRef: default1
+  vaultAuthRef: default

apps/base/authentik/cnpg_cluster.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: authentik
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: authentik
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: authentik
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/authentik/cnpg_pooler.yaml

@@ -0,0 +1,66 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: postgres-pooler-rw
+  namespace: authentik
+spec:
+  cluster:
+    name: postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler-rw
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler-rw
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: postgres-pooler-ro
+  namespace: authentik
+spec:
+  cluster:
+    name: postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler-ro
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler-ro
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: ro

apps/base/authentik/gateway.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: identity.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: authentik
+  namespace: authentik
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: authentik-tls
+        mode: Terminate
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: http-internal
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: https-internal
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: authentik-tls
+        mode: Terminate

apps/base/authentik/httproute.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-http-redirect
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: http
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: http-internal
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: https
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: https-internal
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/authentik/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - ldap-gateway.yaml
+  - ldap-httproute.yaml
+  - ldap-service.yaml
+  - ldap-tlsroute.yaml
+  - namespace.yaml
+  - redis-deployment.yaml
+  - redis-pvc.yaml
+  - redis-service.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml

apps/base/authentik/ldap-gateway.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: ldap.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.k8s.syd1.au.unkin.net
+      name: ldaps-internal
+      port: 636
+      protocol: TLS
+      tls:
+        mode: Passthrough
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.main.unkin.net
+      name: ldaps-main
+      port: 636
+      protocol: TLS
+      tls:
+        mode: Passthrough
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.k8s.syd1.au.unkin.net
+      name: http-dns
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.main.unkin.net
+      name: http-dns-main
+      port: 80
+      protocol: HTTP

apps/base/authentik/ldap-httproute.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-ldap-dns
+  namespace: authentik
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: ldap.k8s.syd1.au.unkin.net,ldap.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  hostnames:
+    - ldap.k8s.syd1.au.unkin.net
+    - ldap.main.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: http-dns
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: http-dns-main
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/authentik/ldap-service.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: ldaps
+      port: 6636
+      protocol: TCP
+      targetPort: 6636
+  selector:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/component: ldap
+  sessionAffinity: None
+  type: ClusterIP

apps/base/authentik/ldap-tlsroute.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TLSRoute
+metadata:
+  name: authentik-ldaps
+  namespace: authentik
+spec:
+  hostnames:
+    - ldap.k8s.syd1.au.unkin.net
+    - ldap.main.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: ldaps-internal
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: ldaps-main
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-ldap
+          port: 6636
+          weight: 1

apps/base/authentik/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

apps/base/authentik/redis-deployment.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: authentik
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          imagePullPolicy: IfNotPresent
+          args:
+            - --save
+            - "20"
+            - "1"
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - mountPath: /data
+              name: redis-data
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: redis-data

apps/base/authentik/redis-pvc.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data
+  namespace: authentik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-delete

apps/base/authentik/redis-service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: authentik
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: redis
+      port: 6379
+      protocol: TCP
+      targetPort: redis
+  selector:
+    app: redis
+  sessionAffinity: None
+  type: ClusterIP

apps/base/authentik/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: authentik
+spec:
+  allowedNamespaces:
+    - authentik
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/authentik/vaultstaticsecret.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: authentik-credentials
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: authentik-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/authentik-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: s3-credentials
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: s3-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/s3-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/bind-internal/authoritative/cluster.yaml

@@ -0,0 +1,37 @@
+---
+# Authoritative masters (replaces the 3x Puppet authoritative servers).
+# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: bind-authoritative
+  namespace: bind-internal
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.6
+      external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so new BindZones auto-provision onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: bind-authoritative-catalog
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key

apps/base/bind-internal/authoritative/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cluster.yaml
+  - tsigkey.yaml
+  - zones.yaml

apps/base/bind-internal/authoritative/tsigkey.yaml

@@ -0,0 +1,11 @@
+---
+# Zone-transfer / catalog key. The operator generates the material into a
+# Secret (transfer-key-tsig); nothing sensitive is committed to git.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: transfer-key
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  algorithm: hmac-sha256

apps/base/bind-internal/authoritative/zones.yaml

@@ -0,0 +1,204 @@
+# Authoritative zones migrated from puppet-prod
+# (profiles::dns::master::zones in hieradata/roles/infra/dns/master.yaml).
+# type primary, static (puppet dynamic:false); TTL 600 as in the puppet zone header.
+# Record data is populated by PuppetDB exported resources upstream, so it is
+# NOT in this repo — migrate it into these zones (AXFR from the current masters,
+# or DNSRecord CRs) as a follow-up. The zones start with SOA+NS only.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: unkin.net
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: main-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: main.unkin.net
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 13-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 13.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 14-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 14.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 15-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 15.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 16-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 16.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 17-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 17.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 19-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 19.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 20-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 20.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 21-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 21.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 22-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 22.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 23-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 23.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 24-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 24.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 25-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 25.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 26-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 26.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 27-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 27.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 28-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 28.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 29-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 29.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600

apps/base/bind-internal/externaldns/cluster.yaml

@@ -0,0 +1,39 @@
+---
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: bind-externaldns
+  namespace: bind-internal
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.8
+      external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
+# (external-dns writes to the primary; secondaries IXFR the result).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: bind-externaldns-catalog
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  zoneName: catalog.externaldns.internal
+  transferKeyRef: externaldns-key

apps/base/bind-internal/externaldns/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cluster.yaml
+  - tsigkey.yaml
+  - zones.yaml

apps/base/bind-internal/externaldns/tsigkey.yaml

@@ -0,0 +1,11 @@
+---
+# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
+# updates to the primary. The operator generates the material into a Secret.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: externaldns-key
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  algorithm: hmac-sha256

apps/base/bind-internal/externaldns/zones.yaml

@@ -0,0 +1,34 @@
+# k8s external-dns zones migrated from puppet-prod
+# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
+# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
+# records here via RFC2136 authenticated with externaldns-key.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: k8s-syd1-au-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  zoneName: k8s.syd1.au.unkin.net
+  type: primary
+  defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 200-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  zoneName: 200.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key

apps/base/bind-internal/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - authoritative
+  - resolvers
+  - externaldns

apps/base/bind-internal/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bind-internal

apps/base/bind-internal/resolvers/cluster.yaml

@@ -0,0 +1,29 @@
+---
+# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
+# Three identical recursive servers; no zone replication.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: bind-resolvers
+  namespace: bind-internal
+spec:
+  mode: resolver
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.7
+      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
+  forwarders:
+    - 1.1.1.1
+    - 9.9.9.9
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/bind-internal/resolvers/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cluster.yaml

apps/base/bind-system/deployment.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bind-operator
+  namespace: bind-system
+  labels:
+    app.kubernetes.io/name: bind-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: bind-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: bind-operator
+    spec:
+      serviceAccountName: bind-operator
+      securityContext:
+        runAsNonRoot: true
+      containers:
+        - name: operator
+          image: git.unkin.net/unkin/bind-operator:v0.1.3
+          args:
+            - --metrics-bind-address=:8080
+            - --health-probe-bind-address=:8081
+            - --leader-elect
+          ports:
+            - containerPort: 8080
+              name: metrics
+            - containerPort: 8081
+              name: health
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/base/bind-system/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  # CRDs are pulled from the bind-operator repo at the matching tag rather than
+  # vendored here, so they never drift from the operator.
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.3/config/crd/install.yaml
+  - rbac.yaml
+  - deployment.yaml

apps/base/bind-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bind-system

apps/base/bind-system/rbac.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bind-operator
+  namespace: bind-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bind-operator
+rules:
+  - apiGroups: ["bind.unkin.net"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["services", "configmaps", "secrets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create", "get"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: bind-operator
+subjects:
+  - kind: ServiceAccount
+    name: bind-operator
+    namespace: bind-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: bind-operator

apps/base/woodpecker/kustomization.yaml

@@ -7,7 +7,11 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - serviceaccount_terraform_artifactapi.yaml
+  - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_git.yaml
+  - serviceaccount_terraform_prowlarr.yaml
+  - serviceaccount_terraform_radarr.yaml
+  - serviceaccount_terraform_sonarr.yaml
   - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_authentik.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-authentik
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_terraform_prowlarr.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-prowlarr
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_terraform_radarr.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-radarr
+  namespace: woodpecker

apps/base/woodpecker/serviceaccount_terraform_sonarr.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-sonarr
+  namespace: woodpecker

apps/overlays/au-syd1/age-api/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/age-api

apps/overlays/au-syd1/authentik/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/authentik
+
+helmCharts:
+  - name: authentik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "2026.5.3"
+    releaseName: authentik
+    namespace: authentik
+    valuesFile: values.yaml

apps/overlays/au-syd1/authentik/values.yaml

@@ -0,0 +1,105 @@
+global:
+  env:
+    # PostgreSQL primary (via pooler)
+    - name: AUTHENTIK_POSTGRESQL__HOST
+      value: postgres-pooler-rw
+    - name: AUTHENTIK_POSTGRESQL__PORT
+      value: "5432"
+    - name: AUTHENTIK_POSTGRESQL__NAME
+      value: authentik
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: postgres-credentials
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: postgres-credentials
+          key: password
+    # PostgreSQL read replica (via pooler)
+    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__HOST
+      value: postgres-pooler-ro
+    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PORT
+      value: "5432"
+    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__NAME
+      value: authentik
+    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__USER
+      valueFrom:
+        secretKeyRef:
+          name: postgres-credentials
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: postgres-credentials
+          key: password
+    # PostgreSQL pooler settings
+    - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
+      value: "true"
+    - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
+      value: "0"
+    - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
+      value: "true"
+    # Redis
+    - name: AUTHENTIK_REDIS__HOST
+      value: redis
+    - name: AUTHENTIK_REDIS__PORT
+      value: "6379"
+    # S3 storage
+    - name: AUTHENTIK_STORAGE__BACKEND
+      value: s3
+    - name: AUTHENTIK_STORAGE__S3__ENDPOINT
+      value: https://radosgw.service.consul/
+    - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
+      value: authentik
+    - name: AUTHENTIK_STORAGE__S3__ADDRESSING_STYLE
+      value: path
+    - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: s3-credentials
+          key: AUTHENTIK_STORAGE__S3__ACCESS_KEY
+    - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
+      valueFrom:
+        secretKeyRef:
+          name: s3-credentials
+          key: AUTHENTIK_STORAGE__S3__SECRET_KEY
+    # Secret key
+    - name: AUTHENTIK_SECRET_KEY
+      valueFrom:
+        secretKeyRef:
+          name: authentik-credentials
+          key: AUTHENTIK_SECRET_KEY
+
+server:
+  replicas: 3
+  annotations:
+    reloader.stakater.com/auto: "true"
+  ingress:
+    enabled: false
+  resources:
+    limits:
+      cpu: "2"
+      memory: 2Gi
+    requests:
+      cpu: 250m
+      memory: 512Mi
+
+worker:
+  replicas: 2
+  annotations:
+    reloader.stakater.com/auto: "true"
+  resources:
+    limits:
+      cpu: "2"
+      memory: 2Gi
+    requests:
+      cpu: 250m
+      memory: 512Mi
+
+postgresql:
+  enabled: false
+
+redis:
+  enabled: false

apps/overlays/au-syd1/bind-internal/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/bind-internal

apps/overlays/au-syd1/bind-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/bind-system

argocd/applicationsets/platform.yaml

@@ -10,7 +10,11 @@ spec:
       repoURL: https://git.unkin.net/unkin/argocd-apps
       revision: HEAD
       directories:
+      - path: apps/overlays/*/authentik
       - path: apps/overlays/*/artifactapi
+      - path: apps/overlays/*/bind-system
+      - path: apps/overlays/*/bind-internal
+      - path: apps/overlays/*/age-api
       - path: apps/overlays/*/cattle-system
       - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/certificates

argocd/projects/platform.yaml

@@ -17,6 +17,12 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'artifactapi'
       server: https://kubernetes.default.svc
+    - namespace: 'age-api'
+      server: https://kubernetes.default.svc
+    - namespace: 'authentik'
+      server: https://kubernetes.default.svc
+    - namespace: 'bind-internal'
+      server: https://kubernetes.default.svc
     - namespace: 'cert-manager'
       server: https://kubernetes.default.svc
     - namespace: 'certificates'

ci/generate-schemas.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCHEMA_DIR="${1:-schemas}"
+rm -rf "$SCHEMA_DIR"
+mkdir -p "$SCHEMA_DIR"
+
+echo "==> Fetching CRDs from cluster..." >&2
+kubectl get crds -o json | python3 -c "
+import sys, json, os
+
+def write_schema(schema, schema_dir, group, kind, version):
+    def strip_descriptions(obj):
+        if isinstance(obj, dict):
+            return {k: strip_descriptions(v) for k, v in obj.items() if k != 'description'}
+        if isinstance(obj, list):
+            return [strip_descriptions(i) for i in obj]
+        return obj
+
+    schema = strip_descriptions(schema)
+    group_dir = os.path.join(schema_dir, group)
+    os.makedirs(group_dir, exist_ok=True)
+    fname = f'{kind}_{version}.json'.lower()
+    with open(os.path.join(group_dir, fname), 'w') as f:
+        json.dump(schema, f, indent=2, sort_keys=True)
+        f.write('\n')
+    print(f'  Generated: {group}/{fname}', file=sys.stderr)
+
+data = json.load(sys.stdin)
+for crd in data.get('items', []):
+    spec = crd.get('spec', {})
+    group = spec.get('group', '')
+    kind = spec.get('names', {}).get('kind', '')
+    for ver in spec.get('versions', []):
+        version = ver.get('name', '')
+        openapi = ver.get('schema', {}).get('openAPIV3Schema', {})
+        if not openapi:
+            continue
+        schema = dict(openapi)
+        schema['\$schema'] = 'http://json-schema.org/draft-07/schema#'
+        schema['type'] = 'object'
+        schema.setdefault('properties', {})
+        schema['properties'].setdefault('apiVersion', {'type': 'string'})
+        schema['properties'].setdefault('kind', {'type': 'string'})
+        schema['properties'].setdefault('metadata', {'type': 'object'})
+        write_schema(schema, '$SCHEMA_DIR', group, kind, version)
+"
+
+total=$(find "$SCHEMA_DIR" -name '*.json' | wc -l)
+echo "==> Schema generation complete: $total schemas in $SCHEMA_DIR" >&2

ci/validate-apps.sh

@@ -3,9 +3,12 @@ set -euo pipefail
 
 KUBE_VERSION="1.33.7"
 
+SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
+
 schema_args=(
-  -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
+  -schema-location "$SCHEMA_DIR/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
-  -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
+  -schema-location "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
+  -schema-location "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
 )
 
 while IFS= read -r -d "" k; do
@@ -18,6 +21,6 @@ while IFS= read -r -d "" k; do
         -summary \
         -output pretty \
         -verbose \
-        -skip CustomResourceDefinition,GpuDevicePlugin,LBNodeAgent,ServiceGroup \
+        -skip CustomResourceDefinition \
         "${schema_args[@]}"
 done < <(find apps/overlays -name kustomization.yaml -print0)

ci/validate-clusters.sh

@@ -3,9 +3,12 @@ set -euo pipefail
 
 KUBE_VERSION="1.33.7"
 
+SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
+
 schema_args=(
-  -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
+  -schema-location "$SCHEMA_DIR/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
-  -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
+  -schema-location "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
+  -schema-location "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
 )
 
 while IFS= read -r -d "" k; do

schemas/acme.cert-manager.io/order_v1.json

@@ -0,0 +1,162 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "commonName": {
+          "type": "string"
+        },
+        "dnsNames": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "x-kubernetes-list-type": "atomic"
+        },
+        "duration": {
+          "type": "string"
+        },
+        "ipAddresses": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "x-kubernetes-list-type": "atomic"
+        },
+        "issuerRef": {
+          "properties": {
+            "group": {
+              "type": "string"
+            },
+            "kind": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "profile": {
+          "type": "string"
+        },
+        "request": {
+          "format": "byte",
+          "type": "string"
+        }
+      },
+      "required": [
+        "issuerRef",
+        "request"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "authorizations": {
+          "items": {
+            "properties": {
+              "challenges": {
+                "items": {
+                  "properties": {
+                    "token": {
+                      "type": "string"
+                    },
+                    "type": {
+                      "type": "string"
+                    },
+                    "url": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "token",
+                    "type",
+                    "url"
+                  ],
+                  "type": "object"
+                },
+                "type": "array",
+                "x-kubernetes-list-type": "atomic"
+              },
+              "identifier": {
+                "type": "string"
+              },
+              "initialState": {
+                "enum": [
+                  "valid",
+                  "ready",
+                  "pending",
+                  "processing",
+                  "invalid",
+                  "expired",
+                  "errored"
+                ],
+                "type": "string"
+              },
+              "url": {
+                "type": "string"
+              },
+              "wildcard": {
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "url"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-type": "atomic"
+        },
+        "certificate": {
+          "format": "byte",
+          "type": "string"
+        },
+        "failureTime": {
+          "format": "date-time",
+          "type": "string"
+        },
+        "finalizeURL": {
+          "type": "string"
+        },
+        "reason": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "valid",
+            "ready",
+            "pending",
+            "processing",
+            "invalid",
+            "expired",
+            "errored"
+          ],
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "metadata",
+    "spec"
+  ],
+  "type": "object"
+}

schemas/addons.cluster.x-k8s.io/clusterresourceset_v1alpha3.json

@@ -0,0 +1,130 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic"
+        },
+        "resources": {
+          "items": {
+            "properties": {
+              "kind": {
+                "enum": [
+                  "Secret",
+                  "ConfigMap"
+                ],
+                "type": "string"
+              },
+              "name": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "strategy": {
+          "enum": [
+            "ApplyOnce"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "clusterSelector"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "severity": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string"
+              },
+              "type": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/addons.cluster.x-k8s.io/clusterresourceset_v1alpha4.json

@@ -0,0 +1,130 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic"
+        },
+        "resources": {
+          "items": {
+            "properties": {
+              "kind": {
+                "enum": [
+                  "Secret",
+                  "ConfigMap"
+                ],
+                "type": "string"
+              },
+              "name": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "strategy": {
+          "enum": [
+            "ApplyOnce"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "clusterSelector"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "severity": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string"
+              },
+              "type": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/addons.cluster.x-k8s.io/clusterresourceset_v1beta1.json

@@ -0,0 +1,198 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic"
+        },
+        "resources": {
+          "items": {
+            "properties": {
+              "kind": {
+                "enum": [
+                  "Secret",
+                  "ConfigMap"
+                ],
+                "type": "string"
+              },
+              "name": {
+                "maxLength": 253,
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "name"
+            ],
+            "type": "object"
+          },
+          "maxItems": 100,
+          "type": "array"
+        },
+        "strategy": {
+          "enum": [
+            "ApplyOnce",
+            "Reconcile"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "clusterSelector"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 10240,
+                "minLength": 1,
+                "type": "string"
+              },
+              "reason": {
+                "maxLength": 256,
+                "minLength": 1,
+                "type": "string"
+              },
+              "severity": {
+                "maxLength": 32,
+                "type": "string"
+              },
+              "status": {
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 256,
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "v1beta2": {
+          "properties": {
+            "conditions": {
+              "items": {
+                "properties": {
+                  "lastTransitionTime": {
+                    "format": "date-time",
+                    "type": "string"
+                  },
+                  "message": {
+                    "maxLength": 32768,
+                    "type": "string"
+                  },
+                  "observedGeneration": {
+                    "format": "int64",
+                    "minimum": 0,
+                    "type": "integer"
+                  },
+                  "reason": {
+                    "maxLength": 1024,
+                    "minLength": 1,
+                    "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                    "type": "string"
+                  },
+                  "status": {
+                    "enum": [
+                      "True",
+                      "False",
+                      "Unknown"
+                    ],
+                    "type": "string"
+                  },
+                  "type": {
+                    "maxLength": 316,
+                    "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "lastTransitionTime",
+                  "message",
+                  "reason",
+                  "status",
+                  "type"
+                ],
+                "type": "object"
+              },
+              "maxItems": 32,
+              "type": "array",
+              "x-kubernetes-list-map-keys": [
+                "type"
+              ],
+              "x-kubernetes-list-type": "map"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/addons.cluster.x-k8s.io/clusterresourcesetbinding_v1alpha3.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "bindings": {
+          "items": {
+            "properties": {
+              "clusterResourceSetName": {
+                "type": "string"
+              },
+              "resources": {
+                "items": {
+                  "properties": {
+                    "applied": {
+                      "type": "boolean"
+                    },
+                    "hash": {
+                      "type": "string"
+                    },
+                    "kind": {
+                      "enum": [
+                        "Secret",
+                        "ConfigMap"
+                      ],
+                      "type": "string"
+                    },
+                    "lastAppliedTime": {
+                      "format": "date-time",
+                      "type": "string"
+                    },
+                    "name": {
+                      "minLength": 1,
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "applied",
+                    "kind",
+                    "name"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "clusterResourceSetName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/addons.cluster.x-k8s.io/clusterresourcesetbinding_v1alpha4.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "bindings": {
+          "items": {
+            "properties": {
+              "clusterResourceSetName": {
+                "type": "string"
+              },
+              "resources": {
+                "items": {
+                  "properties": {
+                    "applied": {
+                      "type": "boolean"
+                    },
+                    "hash": {
+                      "type": "string"
+                    },
+                    "kind": {
+                      "enum": [
+                        "Secret",
+                        "ConfigMap"
+                      ],
+                      "type": "string"
+                    },
+                    "lastAppliedTime": {
+                      "format": "date-time",
+                      "type": "string"
+                    },
+                    "name": {
+                      "minLength": 1,
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "applied",
+                    "kind",
+                    "name"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "clusterResourceSetName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/addons.cluster.x-k8s.io/clusterresourcesetbinding_v1beta1.json

@@ -0,0 +1,80 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "bindings": {
+          "items": {
+            "properties": {
+              "clusterResourceSetName": {
+                "maxLength": 253,
+                "minLength": 1,
+                "type": "string"
+              },
+              "resources": {
+                "items": {
+                  "properties": {
+                    "applied": {
+                      "type": "boolean"
+                    },
+                    "hash": {
+                      "maxLength": 256,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "kind": {
+                      "enum": [
+                        "Secret",
+                        "ConfigMap"
+                      ],
+                      "type": "string"
+                    },
+                    "lastAppliedTime": {
+                      "format": "date-time",
+                      "type": "string"
+                    },
+                    "name": {
+                      "maxLength": 253,
+                      "minLength": 1,
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "applied",
+                    "kind",
+                    "name"
+                  ],
+                  "type": "object"
+                },
+                "maxItems": 100,
+                "type": "array"
+              }
+            },
+            "required": [
+              "clusterResourceSetName"
+            ],
+            "type": "object"
+          },
+          "maxItems": 100,
+          "type": "array"
+        },
+        "clusterName": {
+          "maxLength": 63,
+          "minLength": 1,
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/agent.k8s.elastic.co/agent_v1alpha1.json

@@ -0,0 +1,693 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "config": {
+          "type": "object",
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "configRef": {
+          "properties": {
+            "secretName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "daemonSet": {
+          "properties": {
+            "podTemplate": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "updateStrategy": {
+              "properties": {
+                "rollingUpdate": {
+                  "properties": {
+                    "maxSurge": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "maxUnavailable": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "deployment": {
+          "properties": {
+            "podTemplate": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "replicas": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "strategy": {
+              "properties": {
+                "rollingUpdate": {
+                  "properties": {
+                    "maxSurge": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "maxUnavailable": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "elasticsearchRefs": {
+          "items": {
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "namespace": {
+                "type": "string"
+              },
+              "outputName": {
+                "type": "string"
+              },
+              "secretName": {
+                "type": "string"
+              },
+              "serviceName": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "fleetServerEnabled": {
+          "type": "boolean"
+        },
+        "fleetServerRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "secretName": {
+              "type": "string"
+            },
+            "serviceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "http": {
+          "properties": {
+            "service": {
+              "properties": {
+                "metadata": {
+                  "properties": {
+                    "annotations": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object"
+                    },
+                    "finalizers": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    },
+                    "labels": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object"
+                    },
+                    "name": {
+                      "type": "string"
+                    },
+                    "namespace": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "spec": {
+                  "properties": {
+                    "allocateLoadBalancerNodePorts": {
+                      "type": "boolean"
+                    },
+                    "clusterIP": {
+                      "type": "string"
+                    },
+                    "clusterIPs": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "externalIPs": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "externalName": {
+                      "type": "string"
+                    },
+                    "externalTrafficPolicy": {
+                      "type": "string"
+                    },
+                    "healthCheckNodePort": {
+                      "format": "int32",
+                      "type": "integer"
+                    },
+                    "internalTrafficPolicy": {
+                      "type": "string"
+                    },
+                    "ipFamilies": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "ipFamilyPolicy": {
+                      "type": "string"
+                    },
+                    "loadBalancerClass": {
+                      "type": "string"
+                    },
+                    "loadBalancerIP": {
+                      "type": "string"
+                    },
+                    "loadBalancerSourceRanges": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "ports": {
+                      "items": {
+                        "properties": {
+                          "appProtocol": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          },
+                          "nodePort": {
+                            "format": "int32",
+                            "type": "integer"
+                          },
+                          "port": {
+                            "format": "int32",
+                            "type": "integer"
+                          },
+                          "protocol": {
+                            "default": "TCP",
+                            "type": "string"
+                          },
+                          "targetPort": {
+                            "anyOf": [
+                              {
+                                "type": "integer"
+                              },
+                              {
+                                "type": "string"
+                              }
+                            ],
+                            "x-kubernetes-int-or-string": true
+                          }
+                        },
+                        "required": [
+                          "port"
+                        ],
+                        "type": "object"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-map-keys": [
+                        "port",
+                        "protocol"
+                      ],
+                      "x-kubernetes-list-type": "map"
+                    },
+                    "publishNotReadyAddresses": {
+                      "type": "boolean"
+                    },
+                    "selector": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object",
+                      "x-kubernetes-map-type": "atomic"
+                    },
+                    "sessionAffinity": {
+                      "type": "string"
+                    },
+                    "sessionAffinityConfig": {
+                      "properties": {
+                        "clientIP": {
+                          "properties": {
+                            "timeoutSeconds": {
+                              "format": "int32",
+                              "type": "integer"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      },
+                      "type": "object"
+                    },
+                    "trafficDistribution": {
+                      "type": "string"
+                    },
+                    "type": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "tls": {
+              "properties": {
+                "certificate": {
+                  "properties": {
+                    "secretName": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "selfSignedCertificate": {
+                  "properties": {
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "subjectAltNames": {
+                      "items": {
+                        "properties": {
+                          "dns": {
+                            "type": "string"
+                          },
+                          "ip": {
+                            "type": "string"
+                          }
+                        },
+                        "type": "object"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "image": {
+          "type": "string"
+        },
+        "kibanaRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "secretName": {
+              "type": "string"
+            },
+            "serviceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "mode": {
+          "enum": [
+            "standalone",
+            "fleet"
+          ],
+          "type": "string"
+        },
+        "policyID": {
+          "type": "string"
+        },
+        "revisionHistoryLimit": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "secureSettings": {
+          "items": {
+            "properties": {
+              "entries": {
+                "items": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "secretName": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "secretName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "serviceAccountName": {
+          "type": "string"
+        },
+        "statefulSet": {
+          "properties": {
+            "podManagementPolicy": {
+              "default": "Parallel",
+              "enum": [
+                "OrderedReady",
+                "Parallel"
+              ],
+              "type": "string"
+            },
+            "podTemplate": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "replicas": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "serviceName": {
+              "type": "string"
+            },
+            "volumeClaimTemplates": {
+              "items": {
+                "properties": {
+                  "apiVersion": {
+                    "type": "string"
+                  },
+                  "kind": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "properties": {
+                      "annotations": {
+                        "additionalProperties": {
+                          "type": "string"
+                        },
+                        "type": "object"
+                      },
+                      "finalizers": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array"
+                      },
+                      "labels": {
+                        "additionalProperties": {
+                          "type": "string"
+                        },
+                        "type": "object"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "namespace": {
+                        "type": "string"
+                      }
+                    },
+                    "type": "object"
+                  },
+                  "spec": {
+                    "properties": {
+                      "accessModes": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "dataSource": {
+                        "properties": {
+                          "apiGroup": {
+                            "type": "string"
+                          },
+                          "kind": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "kind",
+                          "name"
+                        ],
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "dataSourceRef": {
+                        "properties": {
+                          "apiGroup": {
+                            "type": "string"
+                          },
+                          "kind": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          },
+                          "namespace": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "kind",
+                          "name"
+                        ],
+                        "type": "object"
+                      },
+                      "resources": {
+                        "properties": {
+                          "limits": {
+                            "additionalProperties": {
+                              "anyOf": [
+                                {
+                                  "type": "integer"
+                                },
+                                {
+                                  "type": "string"
+                                }
+                              ],
+                              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                              "x-kubernetes-int-or-string": true
+                            },
+                            "type": "object"
+                          },
+                          "requests": {
+                            "additionalProperties": {
+                              "anyOf": [
+                                {
+                                  "type": "integer"
+                                },
+                                {
+                                  "type": "string"
+                                }
+                              ],
+                              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                              "x-kubernetes-int-or-string": true
+                            },
+                            "type": "object"
+                          }
+                        },
+                        "type": "object"
+                      },
+                      "selector": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchLabels": {
+                            "additionalProperties": {
+                              "type": "string"
+                            },
+                            "type": "object"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "storageClassName": {
+                        "type": "string"
+                      },
+                      "volumeAttributesClassName": {
+                        "type": "string"
+                      },
+                      "volumeMode": {
+                        "type": "string"
+                      },
+                      "volumeName": {
+                        "type": "string"
+                      }
+                    },
+                    "type": "object"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "version"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "availableNodes": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "elasticsearchAssociationsStatus": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "expectedNodes": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "fleetServerAssociationStatus": {
+          "type": "string"
+        },
+        "health": {
+          "type": "string"
+        },
+        "kibanaAssociationStatus": {
+          "type": "string"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/apm.k8s.elastic.co/apmserver_v1.json

@@ -0,0 +1,364 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "config": {
+          "type": "object",
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "count": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "elasticsearchRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "secretName": {
+              "type": "string"
+            },
+            "serviceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "http": {
+          "properties": {
+            "service": {
+              "properties": {
+                "metadata": {
+                  "properties": {
+                    "annotations": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object"
+                    },
+                    "finalizers": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    },
+                    "labels": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object"
+                    },
+                    "name": {
+                      "type": "string"
+                    },
+                    "namespace": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "spec": {
+                  "properties": {
+                    "allocateLoadBalancerNodePorts": {
+                      "type": "boolean"
+                    },
+                    "clusterIP": {
+                      "type": "string"
+                    },
+                    "clusterIPs": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "externalIPs": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "externalName": {
+                      "type": "string"
+                    },
+                    "externalTrafficPolicy": {
+                      "type": "string"
+                    },
+                    "healthCheckNodePort": {
+                      "format": "int32",
+                      "type": "integer"
+                    },
+                    "internalTrafficPolicy": {
+                      "type": "string"
+                    },
+                    "ipFamilies": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "ipFamilyPolicy": {
+                      "type": "string"
+                    },
+                    "loadBalancerClass": {
+                      "type": "string"
+                    },
+                    "loadBalancerIP": {
+                      "type": "string"
+                    },
+                    "loadBalancerSourceRanges": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "ports": {
+                      "items": {
+                        "properties": {
+                          "appProtocol": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          },
+                          "nodePort": {
+                            "format": "int32",
+                            "type": "integer"
+                          },
+                          "port": {
+                            "format": "int32",
+                            "type": "integer"
+                          },
+                          "protocol": {
+                            "default": "TCP",
+                            "type": "string"
+                          },
+                          "targetPort": {
+                            "anyOf": [
+                              {
+                                "type": "integer"
+                              },
+                              {
+                                "type": "string"
+                              }
+                            ],
+                            "x-kubernetes-int-or-string": true
+                          }
+                        },
+                        "required": [
+                          "port"
+                        ],
+                        "type": "object"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-map-keys": [
+                        "port",
+                        "protocol"
+                      ],
+                      "x-kubernetes-list-type": "map"
+                    },
+                    "publishNotReadyAddresses": {
+                      "type": "boolean"
+                    },
+                    "selector": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object",
+                      "x-kubernetes-map-type": "atomic"
+                    },
+                    "sessionAffinity": {
+                      "type": "string"
+                    },
+                    "sessionAffinityConfig": {
+                      "properties": {
+                        "clientIP": {
+                          "properties": {
+                            "timeoutSeconds": {
+                              "format": "int32",
+                              "type": "integer"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      },
+                      "type": "object"
+                    },
+                    "trafficDistribution": {
+                      "type": "string"
+                    },
+                    "type": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "tls": {
+              "properties": {
+                "certificate": {
+                  "properties": {
+                    "secretName": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "selfSignedCertificate": {
+                  "properties": {
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "subjectAltNames": {
+                      "items": {
+                        "properties": {
+                          "dns": {
+                            "type": "string"
+                          },
+                          "ip": {
+                            "type": "string"
+                          }
+                        },
+                        "type": "object"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "image": {
+          "type": "string"
+        },
+        "kibanaRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "secretName": {
+              "type": "string"
+            },
+            "serviceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "podTemplate": {
+          "type": "object",
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "revisionHistoryLimit": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "secureSettings": {
+          "items": {
+            "properties": {
+              "entries": {
+                "items": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "secretName": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "secretName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "serviceAccountName": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "version"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "availableNodes": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "count": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "elasticsearchAssociationStatus": {
+          "type": "string"
+        },
+        "health": {
+          "type": "string"
+        },
+        "kibanaAssociationStatus": {
+          "type": "string"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "secretTokenSecret": {
+          "type": "string"
+        },
+        "selector": {
+          "type": "string"
+        },
+        "service": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/apm.k8s.elastic.co/apmserver_v1alpha1.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/apm.k8s.elastic.co/apmserver_v1beta1.json

@@ -0,0 +1,317 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "config": {
+          "type": "object",
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "count": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "elasticsearchRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "http": {
+          "properties": {
+            "service": {
+              "properties": {
+                "metadata": {
+                  "properties": {
+                    "annotations": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object"
+                    },
+                    "finalizers": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    },
+                    "labels": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object"
+                    },
+                    "name": {
+                      "type": "string"
+                    },
+                    "namespace": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "spec": {
+                  "properties": {
+                    "allocateLoadBalancerNodePorts": {
+                      "type": "boolean"
+                    },
+                    "clusterIP": {
+                      "type": "string"
+                    },
+                    "clusterIPs": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "externalIPs": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "externalName": {
+                      "type": "string"
+                    },
+                    "externalTrafficPolicy": {
+                      "type": "string"
+                    },
+                    "healthCheckNodePort": {
+                      "format": "int32",
+                      "type": "integer"
+                    },
+                    "internalTrafficPolicy": {
+                      "type": "string"
+                    },
+                    "ipFamilies": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "ipFamilyPolicy": {
+                      "type": "string"
+                    },
+                    "loadBalancerClass": {
+                      "type": "string"
+                    },
+                    "loadBalancerIP": {
+                      "type": "string"
+                    },
+                    "loadBalancerSourceRanges": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    },
+                    "ports": {
+                      "items": {
+                        "properties": {
+                          "appProtocol": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          },
+                          "nodePort": {
+                            "format": "int32",
+                            "type": "integer"
+                          },
+                          "port": {
+                            "format": "int32",
+                            "type": "integer"
+                          },
+                          "protocol": {
+                            "default": "TCP",
+                            "type": "string"
+                          },
+                          "targetPort": {
+                            "anyOf": [
+                              {
+                                "type": "integer"
+                              },
+                              {
+                                "type": "string"
+                              }
+                            ],
+                            "x-kubernetes-int-or-string": true
+                          }
+                        },
+                        "required": [
+                          "port"
+                        ],
+                        "type": "object"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-map-keys": [
+                        "port",
+                        "protocol"
+                      ],
+                      "x-kubernetes-list-type": "map"
+                    },
+                    "publishNotReadyAddresses": {
+                      "type": "boolean"
+                    },
+                    "selector": {
+                      "additionalProperties": {
+                        "type": "string"
+                      },
+                      "type": "object",
+                      "x-kubernetes-map-type": "atomic"
+                    },
+                    "sessionAffinity": {
+                      "type": "string"
+                    },
+                    "sessionAffinityConfig": {
+                      "properties": {
+                        "clientIP": {
+                          "properties": {
+                            "timeoutSeconds": {
+                              "format": "int32",
+                              "type": "integer"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      },
+                      "type": "object"
+                    },
+                    "trafficDistribution": {
+                      "type": "string"
+                    },
+                    "type": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "tls": {
+              "properties": {
+                "certificate": {
+                  "properties": {
+                    "secretName": {
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "selfSignedCertificate": {
+                  "properties": {
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "subjectAltNames": {
+                      "items": {
+                        "properties": {
+                          "dns": {
+                            "type": "string"
+                          },
+                          "ip": {
+                            "type": "string"
+                          }
+                        },
+                        "type": "object"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "image": {
+          "type": "string"
+        },
+        "podTemplate": {
+          "type": "object",
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "secureSettings": {
+          "items": {
+            "properties": {
+              "entries": {
+                "items": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "secretName": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "secretName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "associationStatus": {
+          "type": "string"
+        },
+        "availableNodes": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "health": {
+          "type": "string"
+        },
+        "secretTokenSecret": {
+          "type": "string"
+        },
+        "service": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/argoproj.io/appproject_v1alpha1.json

@@ -0,0 +1,321 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterResourceBlacklist": {
+          "items": {
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "group",
+              "kind"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "clusterResourceWhitelist": {
+          "items": {
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "group",
+              "kind"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "destinationServiceAccounts": {
+          "items": {
+            "properties": {
+              "defaultServiceAccount": {
+                "type": "string"
+              },
+              "namespace": {
+                "type": "string"
+              },
+              "server": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "defaultServiceAccount",
+              "server"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "destinations": {
+          "items": {
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "namespace": {
+                "type": "string"
+              },
+              "server": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "namespaceResourceBlacklist": {
+          "items": {
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "group",
+              "kind"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "namespaceResourceWhitelist": {
+          "items": {
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "group",
+              "kind"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "orphanedResources": {
+          "properties": {
+            "ignore": {
+              "items": {
+                "properties": {
+                  "group": {
+                    "type": "string"
+                  },
+                  "kind": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "type": "string"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            },
+            "warn": {
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
+        "permitOnlyProjectScopedClusters": {
+          "type": "boolean"
+        },
+        "roles": {
+          "items": {
+            "properties": {
+              "groups": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "jwtTokens": {
+                "items": {
+                  "properties": {
+                    "exp": {
+                      "format": "int64",
+                      "type": "integer"
+                    },
+                    "iat": {
+                      "format": "int64",
+                      "type": "integer"
+                    },
+                    "id": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "iat"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "name": {
+                "type": "string"
+              },
+              "policies": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "signatureKeys": {
+          "items": {
+            "properties": {
+              "keyID": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "keyID"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "sourceNamespaces": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sourceRepos": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "syncWindows": {
+          "items": {
+            "properties": {
+              "andOperator": {
+                "type": "boolean"
+              },
+              "applications": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "clusters": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "duration": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              },
+              "manualSync": {
+                "type": "boolean"
+              },
+              "namespaces": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "schedule": {
+                "type": "string"
+              },
+              "timeZone": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "jwtTokensByRole": {
+          "additionalProperties": {
+            "properties": {
+              "items": {
+                "items": {
+                  "properties": {
+                    "exp": {
+                      "format": "int64",
+                      "type": "integer"
+                    },
+                    "iat": {
+                      "format": "int64",
+                      "type": "integer"
+                    },
+                    "id": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "iat"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              }
+            },
+            "type": "object"
+          },
+          "type": "object"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "metadata",
+    "spec"
+  ],
+  "type": "object"
+}

schemas/auditlog.cattle.io/auditpolicy_v1.json

@@ -0,0 +1,148 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "additionalRedactions": {
+          "items": {
+            "properties": {
+              "headers": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "paths": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "filters": {
+          "items": {
+            "properties": {
+              "action": {
+                "type": "string"
+              },
+              "requestURI": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "verbosity": {
+          "properties": {
+            "level": {
+              "type": "integer"
+            },
+            "request": {
+              "properties": {
+                "body": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "type": "boolean"
+                }
+              },
+              "type": "object"
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "type": "boolean"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "required": [
+            "level"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "enabled"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/autoscaling.k8s.elastic.co/elasticsearchautoscaler_v1alpha1.json

@@ -0,0 +1,352 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "elasticsearchRef": {
+          "properties": {
+            "name": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "policies": {
+          "items": {
+            "properties": {
+              "deciders": {
+                "additionalProperties": {
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "type": "object"
+                },
+                "type": "object"
+              },
+              "name": {
+                "type": "string"
+              },
+              "resources": {
+                "properties": {
+                  "cpu": {
+                    "properties": {
+                      "max": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      },
+                      "min": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      },
+                      "requestsToLimitsRatio": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      }
+                    },
+                    "required": [
+                      "max",
+                      "min"
+                    ],
+                    "type": "object"
+                  },
+                  "memory": {
+                    "properties": {
+                      "max": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      },
+                      "min": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      },
+                      "requestsToLimitsRatio": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      }
+                    },
+                    "required": [
+                      "max",
+                      "min"
+                    ],
+                    "type": "object"
+                  },
+                  "nodeCount": {
+                    "properties": {
+                      "max": {
+                        "format": "int32",
+                        "type": "integer"
+                      },
+                      "min": {
+                        "format": "int32",
+                        "type": "integer"
+                      }
+                    },
+                    "required": [
+                      "max",
+                      "min"
+                    ],
+                    "type": "object"
+                  },
+                  "storage": {
+                    "properties": {
+                      "max": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      },
+                      "min": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      },
+                      "requestsToLimitsRatio": {
+                        "anyOf": [
+                          {
+                            "type": "integer"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ],
+                        "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                        "x-kubernetes-int-or-string": true
+                      }
+                    },
+                    "required": [
+                      "max",
+                      "min"
+                    ],
+                    "type": "object"
+                  }
+                },
+                "required": [
+                  "nodeCount"
+                ],
+                "type": "object"
+              },
+              "roles": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "resources"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "pollingPeriod": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "elasticsearchRef",
+        "policies"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string"
+              },
+              "type": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "policies": {
+          "items": {
+            "properties": {
+              "lastModificationTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "nodeSets": {
+                "items": {
+                  "properties": {
+                    "name": {
+                      "type": "string"
+                    },
+                    "nodeCount": {
+                      "format": "int32",
+                      "type": "integer"
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "nodeCount"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "resources": {
+                "properties": {
+                  "limits": {
+                    "additionalProperties": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "type": "object"
+                  },
+                  "requests": {
+                    "additionalProperties": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "type": "object"
+                  }
+                },
+                "type": "object"
+              },
+              "state": {
+                "items": {
+                  "properties": {
+                    "messages": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    },
+                    "type": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "messages",
+                    "type"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/beat.k8s.elastic.co/beat_v1beta1.json

@@ -0,0 +1,301 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "config": {
+          "type": "object",
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "configRef": {
+          "properties": {
+            "secretName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "daemonSet": {
+          "properties": {
+            "podTemplate": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "updateStrategy": {
+              "properties": {
+                "rollingUpdate": {
+                  "properties": {
+                    "maxSurge": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "maxUnavailable": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "deployment": {
+          "properties": {
+            "podTemplate": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "replicas": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "strategy": {
+              "properties": {
+                "rollingUpdate": {
+                  "properties": {
+                    "maxSurge": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    },
+                    "maxUnavailable": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ],
+                      "x-kubernetes-int-or-string": true
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": {
+                  "type": "string"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "elasticsearchRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "secretName": {
+              "type": "string"
+            },
+            "serviceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "image": {
+          "type": "string"
+        },
+        "kibanaRef": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "secretName": {
+              "type": "string"
+            },
+            "serviceName": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "monitoring": {
+          "properties": {
+            "logs": {
+              "properties": {
+                "elasticsearchRefs": {
+                  "items": {
+                    "properties": {
+                      "name": {
+                        "type": "string"
+                      },
+                      "namespace": {
+                        "type": "string"
+                      },
+                      "secretName": {
+                        "type": "string"
+                      },
+                      "serviceName": {
+                        "type": "string"
+                      }
+                    },
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "type": "object"
+            },
+            "metrics": {
+              "properties": {
+                "elasticsearchRefs": {
+                  "items": {
+                    "properties": {
+                      "name": {
+                        "type": "string"
+                      },
+                      "namespace": {
+                        "type": "string"
+                      },
+                      "secretName": {
+                        "type": "string"
+                      },
+                      "serviceName": {
+                        "type": "string"
+                      }
+                    },
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "revisionHistoryLimit": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "secureSettings": {
+          "items": {
+            "properties": {
+              "entries": {
+                "items": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "secretName": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "secretName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "serviceAccountName": {
+          "type": "string"
+        },
+        "type": {
+          "maxLength": 20,
+          "pattern": "[a-zA-Z0-9-]+",
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "version"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "availableNodes": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "elasticsearchAssociationStatus": {
+          "type": "string"
+        },
+        "expectedNodes": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "health": {
+          "type": "string"
+        },
+        "kibanaAssociationStatus": {
+          "type": "string"
+        },
+        "monitoringAssociationStatus": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/bind.unkin.net/bindacl_v1alpha1.json

@@ -0,0 +1,96 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterRef": {
+          "type": "string"
+        },
+        "entries": {
+          "items": {
+            "type": "string"
+          },
+          "minItems": 1,
+          "type": "array"
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "ready": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/bind.unkin.net/bindcatalogzone_v1alpha1.json

@@ -0,0 +1,106 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterRef": {
+          "type": "string"
+        },
+        "defaultPrimaries": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "transferKeyRef": {
+          "type": "string"
+        },
+        "zoneName": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "clusterRef",
+        "zoneName"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "memberCount": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "ready": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/bind.unkin.net/bindcluster_v1alpha1.json

@@ -0,0 +1,898 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "affinity": {
+          "properties": {
+            "nodeAffinity": {
+              "properties": {
+                "preferredDuringSchedulingIgnoredDuringExecution": {
+                  "items": {
+                    "properties": {
+                      "preference": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchFields": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "weight": {
+                        "format": "int32",
+                        "type": "integer"
+                      }
+                    },
+                    "required": [
+                      "preference",
+                      "weight"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "x-kubernetes-list-type": "atomic"
+                },
+                "requiredDuringSchedulingIgnoredDuringExecution": {
+                  "properties": {
+                    "nodeSelectorTerms": {
+                      "items": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchFields": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "type": "array",
+                      "x-kubernetes-list-type": "atomic"
+                    }
+                  },
+                  "required": [
+                    "nodeSelectorTerms"
+                  ],
+                  "type": "object",
+                  "x-kubernetes-map-type": "atomic"
+                }
+              },
+              "type": "object"
+            },
+            "podAffinity": {
+              "properties": {
+                "preferredDuringSchedulingIgnoredDuringExecution": {
+                  "items": {
+                    "properties": {
+                      "podAffinityTerm": {
+                        "properties": {
+                          "labelSelector": {
+                            "properties": {
+                              "matchExpressions": {
+                                "items": {
+                                  "properties": {
+                                    "key": {
+                                      "type": "string"
+                                    },
+                                    "operator": {
+                                      "type": "string"
+                                    },
+                                    "values": {
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "type": "array",
+                                      "x-kubernetes-list-type": "atomic"
+                                    }
+                                  },
+                                  "required": [
+                                    "key",
+                                    "operator"
+                                  ],
+                                  "type": "object"
+                                },
+                                "type": "array",
+                                "x-kubernetes-list-type": "atomic"
+                              },
+                              "matchLabels": {
+                                "additionalProperties": {
+                                  "type": "string"
+                                },
+                                "type": "object"
+                              }
+                            },
+                            "type": "object",
+                            "x-kubernetes-map-type": "atomic"
+                          },
+                          "matchLabelKeys": {
+                            "items": {
+                              "type": "string"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "mismatchLabelKeys": {
+                            "items": {
+                              "type": "string"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "namespaceSelector": {
+                            "properties": {
+                              "matchExpressions": {
+                                "items": {
+                                  "properties": {
+                                    "key": {
+                                      "type": "string"
+                                    },
+                                    "operator": {
+                                      "type": "string"
+                                    },
+                                    "values": {
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "type": "array",
+                                      "x-kubernetes-list-type": "atomic"
+                                    }
+                                  },
+                                  "required": [
+                                    "key",
+                                    "operator"
+                                  ],
+                                  "type": "object"
+                                },
+                                "type": "array",
+                                "x-kubernetes-list-type": "atomic"
+                              },
+                              "matchLabels": {
+                                "additionalProperties": {
+                                  "type": "string"
+                                },
+                                "type": "object"
+                              }
+                            },
+                            "type": "object",
+                            "x-kubernetes-map-type": "atomic"
+                          },
+                          "namespaces": {
+                            "items": {
+                              "type": "string"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "topologyKey": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "topologyKey"
+                        ],
+                        "type": "object"
+                      },
+                      "weight": {
+                        "format": "int32",
+                        "type": "integer"
+                      }
+                    },
+                    "required": [
+                      "podAffinityTerm",
+                      "weight"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "x-kubernetes-list-type": "atomic"
+                },
+                "requiredDuringSchedulingIgnoredDuringExecution": {
+                  "items": {
+                    "properties": {
+                      "labelSelector": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchLabels": {
+                            "additionalProperties": {
+                              "type": "string"
+                            },
+                            "type": "object"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "matchLabelKeys": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "mismatchLabelKeys": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "namespaceSelector": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchLabels": {
+                            "additionalProperties": {
+                              "type": "string"
+                            },
+                            "type": "object"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "namespaces": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "topologyKey": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "topologyKey"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "x-kubernetes-list-type": "atomic"
+                }
+              },
+              "type": "object"
+            },
+            "podAntiAffinity": {
+              "properties": {
+                "preferredDuringSchedulingIgnoredDuringExecution": {
+                  "items": {
+                    "properties": {
+                      "podAffinityTerm": {
+                        "properties": {
+                          "labelSelector": {
+                            "properties": {
+                              "matchExpressions": {
+                                "items": {
+                                  "properties": {
+                                    "key": {
+                                      "type": "string"
+                                    },
+                                    "operator": {
+                                      "type": "string"
+                                    },
+                                    "values": {
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "type": "array",
+                                      "x-kubernetes-list-type": "atomic"
+                                    }
+                                  },
+                                  "required": [
+                                    "key",
+                                    "operator"
+                                  ],
+                                  "type": "object"
+                                },
+                                "type": "array",
+                                "x-kubernetes-list-type": "atomic"
+                              },
+                              "matchLabels": {
+                                "additionalProperties": {
+                                  "type": "string"
+                                },
+                                "type": "object"
+                              }
+                            },
+                            "type": "object",
+                            "x-kubernetes-map-type": "atomic"
+                          },
+                          "matchLabelKeys": {
+                            "items": {
+                              "type": "string"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "mismatchLabelKeys": {
+                            "items": {
+                              "type": "string"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "namespaceSelector": {
+                            "properties": {
+                              "matchExpressions": {
+                                "items": {
+                                  "properties": {
+                                    "key": {
+                                      "type": "string"
+                                    },
+                                    "operator": {
+                                      "type": "string"
+                                    },
+                                    "values": {
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "type": "array",
+                                      "x-kubernetes-list-type": "atomic"
+                                    }
+                                  },
+                                  "required": [
+                                    "key",
+                                    "operator"
+                                  ],
+                                  "type": "object"
+                                },
+                                "type": "array",
+                                "x-kubernetes-list-type": "atomic"
+                              },
+                              "matchLabels": {
+                                "additionalProperties": {
+                                  "type": "string"
+                                },
+                                "type": "object"
+                              }
+                            },
+                            "type": "object",
+                            "x-kubernetes-map-type": "atomic"
+                          },
+                          "namespaces": {
+                            "items": {
+                              "type": "string"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "topologyKey": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "topologyKey"
+                        ],
+                        "type": "object"
+                      },
+                      "weight": {
+                        "format": "int32",
+                        "type": "integer"
+                      }
+                    },
+                    "required": [
+                      "podAffinityTerm",
+                      "weight"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "x-kubernetes-list-type": "atomic"
+                },
+                "requiredDuringSchedulingIgnoredDuringExecution": {
+                  "items": {
+                    "properties": {
+                      "labelSelector": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchLabels": {
+                            "additionalProperties": {
+                              "type": "string"
+                            },
+                            "type": "object"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "matchLabelKeys": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "mismatchLabelKeys": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "namespaceSelector": {
+                        "properties": {
+                          "matchExpressions": {
+                            "items": {
+                              "properties": {
+                                "key": {
+                                  "type": "string"
+                                },
+                                "operator": {
+                                  "type": "string"
+                                },
+                                "values": {
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "type": "array",
+                                  "x-kubernetes-list-type": "atomic"
+                                }
+                              },
+                              "required": [
+                                "key",
+                                "operator"
+                              ],
+                              "type": "object"
+                            },
+                            "type": "array",
+                            "x-kubernetes-list-type": "atomic"
+                          },
+                          "matchLabels": {
+                            "additionalProperties": {
+                              "type": "string"
+                            },
+                            "type": "object"
+                          }
+                        },
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "namespaces": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      },
+                      "topologyKey": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "topologyKey"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "x-kubernetes-list-type": "atomic"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "allowNewZones": {
+          "default": true,
+          "type": "boolean"
+        },
+        "catalogZoneRef": {
+          "type": "string"
+        },
+        "extraOptions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "forwarders": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "image": {
+          "default": "internetsystemsconsortium/bind9:9.20",
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "type": "string"
+        },
+        "mode": {
+          "default": "authoritative",
+          "enum": [
+            "authoritative",
+            "resolver"
+          ],
+          "type": "string"
+        },
+        "nodeSelector": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "recursion": {
+          "type": "boolean"
+        },
+        "replicas": {
+          "default": 3,
+          "format": "int32",
+          "minimum": 1,
+          "type": "integer"
+        },
+        "resources": {
+          "properties": {
+            "claims": {
+              "items": {
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "request": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "name"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-map-keys": [
+                "name"
+              ],
+              "x-kubernetes-list-type": "map"
+            },
+            "limits": {
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "x-kubernetes-int-or-string": true
+              },
+              "type": "object"
+            },
+            "requests": {
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "x-kubernetes-int-or-string": true
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "service": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "ClusterIP",
+                "LoadBalancer",
+                "NodePort"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "storageClassName": {
+          "type": "string"
+        },
+        "storageSize": {
+          "default": "1Gi",
+          "type": "string"
+        },
+        "tolerations": {
+          "items": {
+            "properties": {
+              "effect": {
+                "type": "string"
+              },
+              "key": {
+                "type": "string"
+              },
+              "operator": {
+                "type": "string"
+              },
+              "tolerationSeconds": {
+                "format": "int64",
+                "type": "integer"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "mode"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "phase": {
+          "type": "string"
+        },
+        "primaryPod": {
+          "type": "string"
+        },
+        "primaryService": {
+          "type": "string"
+        },
+        "readyReplicas": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/bind.unkin.net/binddnssecpolicy_v1alpha1.json

@@ -0,0 +1,160 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "algorithm": {
+          "default": "ecdsap256sha256",
+          "type": "string"
+        },
+        "clusterRef": {
+          "type": "string"
+        },
+        "csk": {
+          "properties": {
+            "algorithm": {
+              "type": "string"
+            },
+            "keySize": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "lifetime": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "extraOptions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "ksk": {
+          "properties": {
+            "algorithm": {
+              "type": "string"
+            },
+            "keySize": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "lifetime": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "maxZoneTTL": {
+          "type": "string"
+        },
+        "nsec3": {
+          "type": "boolean"
+        },
+        "policyName": {
+          "type": "string"
+        },
+        "signaturesValidity": {
+          "type": "string"
+        },
+        "zsk": {
+          "properties": {
+            "algorithm": {
+              "type": "string"
+            },
+            "keySize": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "lifetime": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "clusterRef"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "ready": {
+          "type": "boolean"
+        },
+        "zoneCount": {
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/bind.unkin.net/bindpolicy_v1alpha1.json

@@ -0,0 +1,154 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "clusterRef": {
+          "type": "string"
+        },
+        "order": {
+          "default": 100,
+          "format": "int32",
+          "type": "integer"
+        },
+        "primaries": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "rules": {
+          "items": {
+            "properties": {
+              "action": {
+                "default": "nxdomain",
+                "enum": [
+                  "nxdomain",
+                  "nodata",
+                  "passthru",
+                  "drop",
+                  "tcp-only",
+                  "cname"
+                ],
+                "type": "string"
+              },
+              "match": {
+                "type": "string"
+              },
+              "target": {
+                "type": "string"
+              },
+              "trigger": {
+                "default": "qname",
+                "enum": [
+                  "qname",
+                  "client-ip",
+                  "ip",
+                  "nsdname",
+                  "nsip"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "match"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "transferKeyRef": {
+          "type": "string"
+        },
+        "viewRef": {
+          "type": "string"
+        },
+        "zoneName": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "clusterRef",
+        "zoneName"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "ready": {
+          "type": "boolean"
+        },
+        "ruleCount": {
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/bind.unkin.net/bindtsigkey_v1alpha1.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "algorithm": {
+          "default": "hmac-sha256",
+          "enum": [
+            "hmac-sha256",
+            "hmac-sha512",
+            "hmac-sha384",
+            "hmac-sha224",
+            "hmac-sha1",
+            "hmac-md5"
+          ],
+          "type": "string"
+        },
+        "clusterRef": {
+          "type": "string"
+        },
+        "importExisting": {
+          "type": "boolean"
+        },
+        "keyName": {
+          "type": "string"
+        },
+        "secretName": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "keyName": {
+          "type": "string"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "ready": {
+          "type": "boolean"
+        },
+        "secretName": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}