Pull bind CRDs from operator repo instead of vendoring

References the CRD bundle from the bind-operator repo by a stable raw URL
so the CRDs never drift from the operator, matching how other apps import
upstream manifests.

- replace the nine vendored crds/*.yaml with a single remote resource:
  git.unkin.net/unkin/bind-operator raw config/crd/install.yaml at v0.1.1
- bump the operator image to v0.1.1 so the running operator and its CRDs
  come from the same tag

.claude/commands/solve-issue.md

@@ -0,0 +1,273 @@
+---
+description: Pull master, read open issues, pick one, branch, implement, test, commit, PR, and comment.
+---
+
+# Solve a Gitea Issue
+
+## Current repo state
+
+```!
+git status --short
+echo "Current branch: $(git branch --show-current)"
+echo "Remote: $(git remote get-url origin 2>/dev/null || echo 'none')"
+```
+
+## Open issues (with full body)
+
+```!
+echo "Fetching open issues..."
+issue_ids=$(tea issues list --output simple 2>/dev/null | awk 'NF && $1 ~ /^[0-9]+$/ {print $1}')
+if [ -z "$issue_ids" ]; then
+  echo "No open issues found (or tea is not logged in)."
+else
+  for id in $issue_ids; do
+    echo ""
+    echo "══════════════════════════════════════"
+    tea issues view "$id" --fields index,title,body 2>/dev/null \
+      || tea issue "$id" 2>/dev/null \
+      || echo "  (could not read issue #$id)"
+    echo "══════════════════════════════════════"
+  done
+fi
+```
+
+---
+
+## Your task
+
+Follow these steps **in order**. Do not skip steps.
+
+### 1 — Choose an issue
+
+Present the issues above to the user as a numbered list (index, one-line title). Ask which one to work on. Wait for the answer before continuing.
+
+### 2 — Sync master
+
+```bash
+git checkout master
+git pull
+```
+
+Confirm you are on master and up to date.
+
+### 3 — Create a branch
+
+Name the branch `benvin/issue-<N>-<short-slug>` where `<short-slug>` is 2–4 kebab-case words from the issue title.
+
+```bash
+git checkout -b benvin/issue-<N>-<slug>
+```
+
+### 4 — Read the issue in full
+
+Re-read the full issue body shown above. If any part is ambiguous, state your interpretation before coding.
+
+**If you discover other problems while working:** do NOT solve them inline. Create a new Gitea issue with `tea issues create --title "..." --description "..."` and stay focused on the assigned issue.
+
+### 5 — Implement the solution
+
+Make the code changes needed to resolve the issue. Follow the conventions already in the repo:
+- `main.py` route handlers each contain a single function call; logic lives in submodules.
+- No comments unless the WHY is non-obvious.
+- No new files unless the issue or architecture requires it.
+- Security: no command injection, XSS, SQL injection, or secrets in code.
+- **For performance improvements:** implement at the most generic call site possible so the fix applies to all current and future implementations, not just the one being tested.
+
+### 6 — Update tests
+
+Add or update tests that cover the new behaviour. Tests live in `tests/`. Check existing test structure before writing new ones — mirror the style and fixture patterns already in use.
+
+### 7 — Update README
+
+If the feature introduces new config keys, endpoints, or user-facing behaviour, document it in `README.md`. Keep additions concise — follow the existing section style.
+
+### 8 — Run the full test suite
+
+```bash
+make test
+```
+
+All tests must pass. If any fail, fix them before proceeding. Do not skip or suppress failing tests.
+
+### 9 — Live Docker test (new package type only)
+
+**Skip this step if the issue does not add a new remote package type.**
+
+If the issue adds a new package type (e.g. `deb`, `conda`, `cargo`, `rubygems`, or any type not already in `remotes.yaml`), do the following before committing.
+
+#### 9a — Add a real test remote to remotes.yaml
+
+Append a valid, publicly accessible remote of the new type to `remotes.yaml`. Use a real upstream URL and patterns that cover both an immutable file (versioned artifact) and a mutable file (index/metadata). Add a comment explaining which URLs to use for manual testing.
+
+#### 9b — Start the stack
+
+```bash
+make docker-up
+```
+
+Wait until `curl -s http://localhost:8000/health` returns `{"status":"healthy"}`.
+
+#### 9c — Test a mutable file (first fetch — cache miss)
+
+Download the index or metadata file for the new remote. Confirm:
+- HTTP 200
+- `X-Artifact-Source: remote` header (or equivalent log line confirming a cache miss)
+- Content looks correct (not empty, not an error page)
+
+```bash
+curl -sv "http://localhost:8000/api/v1/remote/<new-remote>/<mutable-path>" 2>&1 | grep -E "< HTTP|X-Artifact"
+```
+
+#### 9d — Test a mutable file (second fetch — cache hit)
+
+Repeat the exact same request. Confirm:
+- HTTP 200
+- `X-Artifact-Source: cache`
+
+```bash
+curl -sv "http://localhost:8000/api/v1/remote/<new-remote>/<mutable-path>" 2>&1 | grep -E "< HTTP|X-Artifact"
+```
+
+#### 9e — Test an immutable file (first fetch — cache miss)
+
+Download a versioned/immutable artifact. Confirm HTTP 200 and a cache-miss log line.
+
+```bash
+curl -sv "http://localhost:8000/api/v1/remote/<new-remote>/<immutable-path>" 2>&1 | grep -E "< HTTP|X-Artifact"
+```
+
+#### 9f — Test an immutable file (second fetch — cache hit)
+
+Repeat. Confirm `X-Artifact-Source: cache`.
+
+#### 9g — Check container logs
+
+```bash
+make docker-logs
+```
+
+Scan for:
+- `Cache MISS` on first fetches, `Cache HIT` on second fetches
+- `Cache ADD SUCCESS` with correct sizes
+- No unhandled exceptions or ERROR lines
+
+#### 9h — Exercise package-type tooling against the proxy
+
+Use the native tooling for this package type to verify end-to-end behaviour. Examples:
+
+| Package type | Command |
+|---|---|
+| `pypi` | `uv run --index-url http://localhost:8000/api/v1/remote/<remote>/simple <tool>` |
+| `npm` | `npm install --registry http://localhost:8000/api/v1/remote/<remote>/ <pkg>` |
+| `helm` | `helm repo add test http://localhost:8000/api/v1/remote/<remote> && helm search repo test && helm template test/<chart>` |
+| `alpine` | `apk fetch --repository http://localhost:8000/api/v1/remote/<remote>/<branch>/<arch> <pkg>` |
+| `rpm` | `dnf install --repofrompath ... <pkg>` or `repoquery` |
+| `generic` | `curl` / `wget` as appropriate |
+
+Confirm the tool resolves and downloads correctly through the proxy.
+
+#### 9i — Tear down
+
+```bash
+make docker-down
+```
+
+Fix any failures found during 9b–9h before moving on.
+
+### 9.5 — Performance issues: measure before/after and gate the PR
+
+**Skip this step if the issue is not a performance improvement.**
+
+For performance issues, a PR is only warranted if there is a measurable gain. Use the Docker stack to compare before and after.
+
+#### 9.5a — Baseline measurement (before)
+
+Start the stack with the **unmodified** code (temporarily revert your change):
+
+```bash
+make docker-up
+```
+
+Warm or clear the cache as appropriate, then measure the relevant metric — e.g. concurrent request latency during a slow operation, response time for a specific endpoint, or throughput. Record the numbers.
+
+#### 9.5b — Apply your change and rebuild
+
+```bash
+make docker-up   # rebuilds the image
+```
+
+Repeat exactly the same measurement. Record the numbers.
+
+#### 9.5c — Decide
+
+If the improvement is not clearly measurable, **do not open a PR**. Instead:
+1. Update the issue with your findings.
+2. Note any conditions under which the improvement would be observable.
+3. Skip steps 11–14.
+
+If the improvement is clear, proceed with the commit and PR. Include the before/after numbers in the PR description and the issue comment.
+
+#### 9.5d — Tear down
+
+```bash
+make docker-down
+```
+
+### 10 — Build the wheel (smoke check)
+
+```bash
+uv build --wheel
+```
+
+Confirm the build succeeds.
+
+### 11 — Stage and commit
+
+Stage only the files you changed. Do not use `git add -A` or `git add .` — list files explicitly. Run:
+
+```bash
+git add <file1> <file2> ...
+git commit
+```
+
+The commit message must:
+- Start with a conventional-commit prefix (`feat:`, `fix:`, `refactor:`, `chore:`, etc.)
+- Summarise the change in ≤ 72 characters on the first line
+- Optionally include a short body explaining *why* (not *what*)
+
+If the pre-commit hook auto-fixes files, re-stage the fixed files and commit again.
+
+### 12 — Push the branch
+
+```bash
+git push origin <branch-name>
+```
+
+### 13 — Open a pull request
+
+```bash
+tea pulls create \
+  --base master \
+  --head <branch-name> \
+  --title "<same as commit subject>" \
+  --description "Closes #<N>\n\n## Summary\n<bullet points>\n\n## Test plan\n<what was verified>"
+```
+
+### 14 — Comment on the issue
+
+```bash
+tea comment <N> "<resolution comment>"
+```
+
+The comment must cover:
+- **How it was resolved** — what changed and why
+- **Issues encountered** — any non-obvious problems hit during implementation
+- **Potential future improvements** — what could be done next
+
+### 15 — Return to master
+
+```bash
+git checkout master
+```
+
+Report the PR URL and a one-sentence summary to the user.

.pre-commit-config.yaml

@@ -7,6 +7,7 @@ repos:
       - id: check-json
       - id: check-added-large-files
         args: ['--maxkb=500']
+        exclude: '^schemas/'
       - id: check-merge-conflict
       - id: check-shebang-scripts-are-executable
       - id: check-symlinks
@@ -19,6 +20,7 @@ repos:
       - id: end-of-file-fixer
       - id: forbid-new-submodules
       - id: pretty-format-json
+        args: ['--autofix']
       - id: trailing-whitespace
 
   # YAML linting

.woodpecker/kubeconform.yaml

@@ -3,7 +3,16 @@ when:
 
 steps:
   - name: kubeconform
-    image: git.unkin.net/unkin/almalinux9-base:latest
+    image: git.unkin.net/unkin/almalinux9-kubetest:20260606
     commands:
-      - dnf install make kustomize kubeconform helm -y
       - make kubeconform
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -3,7 +3,16 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-base:latest
+    image: git.unkin.net/unkin/almalinux9-base:20260606
     commands:
-      - dnf install uv make -y
       - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 250m
+          limits:
+            memory: 1Gi
+            cpu: 1

AGENTS.md

@@ -0,0 +1,261 @@
+# AGENTS.md
+
+## Project Overview
+
+This is an **ArgoCD GitOps repository** that manages Kubernetes applications for the `au-syd1` cluster using a Kustomize + Helm pattern. Applications are deployed via ArgoCD ApplicationSets that watch directory patterns in this repo.
+
+The migration pattern for this repo is: **Terragrunt/Terraform → ArgoCD** (see `migration.md` for full guide).
+
+---
+
+## Essential Commands
+
+```bash
+# Build and render manifests for a path (outputs to manifests/<path>/)
+make build apps/overlays/au-syd1/<app-name>
+make build clusters/au-syd1/bootstrap
+
+# Validate all apps and clusters with kubeconform
+make kubeconform
+
+# Clean generated manifests
+make clean
+
+# Quick build + inspect without persisting output
+kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+
+# Check all resource kinds produced by an overlay
+kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
+
+# Run pre-commit checks against all files
+uvx pre-commit run --all-files
+```
+
+---
+
+## Directory Structure
+
+```
+argocd-apps/
+├── argocd/
+│   ├── applicationsets/     # ArgoCD ApplicationSet definitions (platform.yaml, storage.yaml)
+│   └── projects/            # ArgoCD AppProject definitions (platform.yaml, storage.yaml)
+├── apps/
+│   ├── base/                # Base Kustomize resources per app (no cluster-specific config)
+│   │   └── <app-name>/
+│   │       ├── kustomization.yaml
+│   │       ├── namespace.yaml
+│   │       ├── vaultauth.yaml        # (if Vault-managed secrets)
+│   │       └── vaultstaticsecret.yaml
+│   └── overlays/
+│       └── au-syd1/         # Cluster-specific overlays
+│           └── <app-name>/
+│               ├── kustomization.yaml  # references base + helmCharts
+│               └── values.yaml         # Helm values for this cluster
+├── clusters/
+│   └── au-syd1/
+│       ├── apps/            # Entry point: references apps/base (ArgoCD app-of-apps)
+│       └── bootstrap/       # ArgoCD install + initial Application manifest
+├── ci/
+│   ├── validate-apps.sh     # kubeconform over apps/overlays/*/kustomization.yaml
+│   ├── validate-clusters.sh # kubeconform over clusters/*/kustomization.yaml
+│   └── validate-no-secrets.sh # pre-commit hook: blocks plain Kubernetes Secrets
+└── sources/                 # Reference sources (Terraform configs, upstream charts, etc.)
+    └── terraform-k8s/       # Original Terraform configs — reference when migrating
+```
+
+---
+
+## Adding a New Application
+
+Follow these 10 steps (detailed in `migration.md`):
+
+### 1. Create base resources
+```
+apps/base/<app-name>/
+├── kustomization.yaml
+├── namespace.yaml
+├── vaultauth.yaml          # if needed
+└── vaultstaticsecret.yaml  # if needed
+```
+
+### 2. Create cluster overlay
+```
+apps/overlays/au-syd1/<app-name>/
+├── kustomization.yaml
+└── values.yaml
+```
+
+**Overlay kustomization.yaml pattern:**
+```yaml
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/<app-name>
+
+helmCharts:
+  - name: <chart-name>
+    repo: <helm-repo-url>
+    version: "<version>"
+    releaseName: <release-name>
+    namespace: <namespace>
+    valuesFile: values.yaml
+```
+
+### 3. Register in ApplicationSet
+Add a directory entry to `argocd/applicationsets/platform.yaml` (or `storage.yaml` for `csi-*` apps):
+```yaml
+- path: apps/overlays/*/<app-name>
+```
+
+### 4. Update AppProject
+In `argocd/projects/platform.yaml` (or `storage.yaml`):
+- Add the Helm repo URL to `sourceRepos`
+- Add the namespace to `destinations`
+- Add any required cluster-scoped resource types to `clusterResourceWhitelist`
+
+### 5. Validate
+```bash
+kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+make kubeconform
+```
+
+---
+
+## Secret Management
+
+**Plain Kubernetes `Secret` objects are blocked** by the pre-commit hook. Use Vault Operator CRDs instead:
+
+### VaultAuth template
+```yaml
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: <namespace>
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - <namespace>
+  kubernetes:
+    role: <role>
+    serviceAccount: <service-account>
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600
+```
+
+### VaultStaticSecret template
+```yaml
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: <secret-name>
+  namespace: <namespace>
+spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: kubernetes/namespace/<namespace>/default/<secret-name>
+  refreshAfter: 5m
+  destination:
+    name: <k8s-secret-name>
+    create: true
+    overwrite: true
+  hmacSecretData: true
+```
+
+---
+
+## YAML Conventions
+
+- **2-space indentation** (enforced by yamllint)
+- All files must end with a newline (`end-of-file-fixer`)
+- No trailing whitespace
+- YAML linting uses relaxed rules with `line-length: disable` (long base64/URLs are fine)
+- yamllint ignores `chart` directories (vendored Helm charts)
+- `---` document separator at top of every YAML file
+- Multiple documents in one file are allowed (e.g., `vaultstaticsecret.yaml` often contains multiple secrets)
+
+---
+
+## Kubernetes Labels Pattern
+
+Use standard `app.kubernetes.io/*` labels consistently:
+```yaml
+labels:
+  app.kubernetes.io/component: <component>
+  app.kubernetes.io/instance: <release-name>
+  app.kubernetes.io/name: <app-name>
+  app.kubernetes.io/version: <version>
+```
+
+---
+
+## Resource Naming Conventions
+
+Files in `apps/base/<app-name>/` follow the pattern:
+```
+<kind>_<name>.yaml
+```
+Examples:
+- `deployment_puppetserver-master.yaml`
+- `cronjob_g10k-code.yaml`
+- `configmap_puppetboard-config.yaml`
+- `horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml`
+- `service_puppet-headless.yaml`
+
+---
+
+## Helm Chart Vendoring
+
+Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
+
+Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
+
+---
+
+## Project Boundaries
+
+| Project    | ApplicationSet            | App pattern              |
+|------------|---------------------------|--------------------------|
+| `platform` | `argocd/applicationsets/platform.yaml` | Named apps (cert-manager, puppet, woodpecker, etc.) |
+| `storage`  | `argocd/applicationsets/storage.yaml`  | `csi-*` apps             |
+
+The `clusters/au-syd1/apps/` entry-point is deployed as a standalone ArgoCD `Application` (not an ApplicationSet) called `au-syd1-apps`.
+
+---
+
+## CI / Pre-commit Hooks
+
+Runs on every PR via Woodpecker CI (`.woodpecker/`):
+
+| Check | Tool | Trigger |
+|---|---|---|
+| YAML lint + general file checks | `pre-commit` (yamllint + pre-commit-hooks) | PR |
+| No plain Secrets | `ci/validate-no-secrets.sh` | PR (staged files) |
+| Kubernetes manifest validation | `kubeconform` via `make kubeconform` | PR |
+
+kubeconform skips: `CustomResourceDefinition`, `GpuDevicePlugin` (for apps validation).
+
+---
+
+## Git Workflow
+
+- Branch naming: `benvin/<app-name>` (user prefix)
+- **Never `git add .`** — add only relevant files explicitly
+- If pre-commit modifies files, `git add -u` then `git commit --amend --no-edit`
+- Use `git push --force-with-lease` after amending
+
+---
+
+## Security Policies
+
+- `reloader.stakater.com/auto: "true"` annotation triggers rolling restarts on ConfigMap/Secret changes
+- Security contexts follow least-privilege: `drop: [all]` then add only required capabilities
+- `fsGroup: 999` on pod security context for Puppet workloads
+- `runAsUser: 0` is used only for init containers that need to set file permissions, then regular containers run as non-root

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build clean
+.PHONY: build clean schemas
 
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap
@@ -6,6 +6,10 @@ build:
 	@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
 	@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
 
+# Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
+schemas:
+	@ci/generate-schemas.sh schemas
+
 # kubeconform
 kubeconform:
 	@ci/validate-apps.sh && \

apps/base/age-api/deployment.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: age-api
+  namespace: age-api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: age-api
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: age-api
+    spec:
+      containers:
+        - name: age-api
+          image: git.unkin.net/unkin/age-api:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: CONFIG_PATH
+              value: /etc/age-api/config.yaml
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          volumeMounts:
+            - mountPath: /etc/age-api/config.yaml
+              name: config
+              subPath: config.yaml
+      restartPolicy: Always
+      volumes:
+        - name: config
+          configMap:
+            name: age-api-config

apps/base/age-api/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: age-api.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: age-api.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: age-api
+  namespace: age-api
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: age-api.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: age-api.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: age-api-tls
+        mode: Terminate

apps/base/age-api/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: age-api-http-redirect
+  namespace: age-api
+spec:
+  hostnames:
+    - age-api.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: age-api
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: age-api
+  namespace: age-api
+spec:
+  hostnames:
+    - age-api.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: age-api
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: age-api
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/age-api/kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - service.yaml
+
+configMapGenerator:
+  - name: age-api-config
+    files:
+      - config.yaml=resources/config.yaml
+    options:
+      disableNameSuffixHash: true

apps/base/age-api/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: age-api

apps/base/age-api/resources/config.yaml

@@ -0,0 +1,7 @@
+people:
+  - name: jaidi
+    birthtime: 1773135720
+  - name: ben
+    birthtime: 559663200
+  - name: sudaporn
+    birthtime: 686757600

apps/base/age-api/service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: age-api
+  namespace: age-api
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: age-api
+  sessionAffinity: None
+  type: ClusterIP

apps/base/artifactapi/api-deployment.yaml

@@ -2,37 +2,56 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: artifactapi-deployment
+  name: api
   namespace: artifactapi
   annotations:
     reloader.stakater.com/auto: "true"
 spec:
-  replicas: 2
   selector:
     matchLabels:
-      app: artifactapi
+      app: api
   strategy:
     rollingUpdate:
       maxUnavailable: 1
     type: RollingUpdate
   template:
+    metadata:
+      labels:
+        app: api
     spec:
       automountServiceAccountToken: true
+      initContainers:
+        - name: combine-certs
+          image: alpine:3
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
       containers:
-        - name: artifactapi
-          image: git.unkin.net/unkin/almalinux9-artifactapi:latest
-          imagePullPolicy: Always
+        - name: api
+          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
               name: http
               protocol: TCP
           envFrom:
             - configMapRef:
-                name: artifactapi-env
+                name: api-env
                 optional: false
             - secretRef:
                 name: environment
                 optional: false
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
           livenessProbe:
             failureThreshold: 3
             httpGet:
@@ -60,14 +79,13 @@ spec:
             requests:
               cpu: 100m
               memory: 256Mi
-          volumeMounts:
-            - mountPath: /app/remotes.yaml
-              mountPropagation: None
-              name: remotes-config
-              subPath: remotes.yaml
-      restartPolicy: Always
       volumes:
-        - configMap:
-            name: remotes-config
-            optional: false
-          name: remotes-config
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always

apps/base/artifactapi/api-hpa.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: api-hpa
+  namespace: artifactapi
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: api
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 60
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 30
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 10
+          periodSeconds: 60
+        - type: Pods
+          value: 2
+          periodSeconds: 60

apps/base/artifactapi/cnpg_cluster.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: artifactapi
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: artifacts
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: artifacts
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/artifactapi/cnpg_pooler.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: postgres-pooler
+  namespace: artifactapi
+spec:
+  cluster:
+    name: postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw

apps/base/artifactapi/configmap.yaml

@@ -2,26 +2,15 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: artifactapi-env
+  name: api-env
   namespace: artifactapi
 data:
-  CONFIG_PATH: /app/remotes.yaml
-  DBHOST: postgres-service
+  DBHOST: postgres-pooler
   DBNAME: artifacts
   DBPORT: "5432"
   DBUSER: artifacts
-  MINIO_BUCKET: artifactapi
+  MINIO_BUCKET: artifactapi-prod-k8s-syd1-au
   MINIO_ENDPOINT: radosgw.service.consul
   MINIO_SECURE: "true"
-  REDIS_URL: redis://redis-service:6379
-  REQUESTS_CA_BUNDLE: /etc/pki/tls/certs/ca-bundle.crt
-  SSL_CERT_FILE: /etc/pki/tls/certs/ca-bundle.crt
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: postgres-env
-  namespace: artifactapi
-data:
-  POSTGRES_DB: artifacts
-  POSTGRES_USER: artifacts
+  REDIS_URL: redis://redis:6379
+  SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt

apps/base/artifactapi/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: artifactapi-tls
+        mode: Terminate

apps/base/artifactapi/httproute.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-redirect
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: api-route
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: ui
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /ui
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: artifactapi
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/artifactapi/ingress.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/proxy-body-size: 10g
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-  name: artifactapi-ingress
-  namespace: artifactapi
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: artifactapi.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: artifactapi-api
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - artifactapi.k8s.syd1.au.unkin.net
-      secretName: artifactapi-tls

apps/base/artifactapi/kustomization.yaml

@@ -3,18 +3,17 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - artifactapi_deployment.yaml
+  - api-deployment.yaml
+  - api-hpa.yaml
   - configmap.yaml
-  - ingress.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - gateway.yaml
+  - httproute.yaml
   - namespace.yaml
-  - postgres-deployment.yaml
-  - pvc.yaml
   - redis-deployment.yaml
   - services.yaml
+  - ui-deployment.yaml
+  - ui-hpa.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: remotes-config
-    files:
-      - resources/remotes.yaml

apps/base/artifactapi/pvc.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: artifactapi-postgres-pgdata
-  namespace: artifactapi
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: artifactapi-redis-data
-  namespace: artifactapi
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/artifactapi/redis-deployment.yaml

@@ -2,23 +2,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    deployment.kubernetes.io/revision: "1"
-  name: redis-deployment
+  name: redis
   namespace: artifactapi
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: redis
-  strategy:
-    type: Recreate
   template:
+    metadata:
+      labels:
+        app: redis
     spec:
       containers:
         - name: redis
           image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
           command:
             - redis-server
             - --save
@@ -28,6 +26,13 @@ spec:
             - containerPort: 6379
               name: redis
               protocol: TCP
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
           livenessProbe:
             exec:
               command:
@@ -48,19 +53,4 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              mountPropagation: None
-              name: data
       restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: artifactapi-redis-data

apps/base/artifactapi/resources/remotes.yaml

@@ -1,262 +0,0 @@
-remotes:
-  github:
-    base_url: "https://github.com"
-    type: "remote"
-    package: "generic"
-    description: "GitHub releases and files"
-    include_patterns:
-      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
-      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
-      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
-      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
-      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
-      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
-      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
-      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
-      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
-      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
-      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-      - "lxc/incus/.*.tar.gz$"
-      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
-      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
-      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
-      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
-      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
-      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
-      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
-      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  gitea-dl:
-    base_url: "https://dl.gitea.com"
-    type: "remote"
-    package: "generic"
-    description: "Gitea download site"
-    include_patterns:
-      - "act_runner/.*/act_runner-.*-linux-amd64$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  hashicorp-releases:
-    base_url: "https://releases.hashicorp.com"
-    type: "remote"
-    package: "generic"
-    description: "HashiCorp product releases"
-    include_patterns:
-      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
-      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
-      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
-      - "vault/.*vault_.*_linux_amd64\\.zip$"
-      - "vault/.*vault_.*_windows_amd64\\.zip$"
-      - "vault/.*vault_.*_darwin_amd64\\.zip$"
-      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
-      - "consul/.*/consul_.*_linux_amd64\\.zip$"
-      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
-      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
-      - "packer/.*/packer_.*_linux_amd64\\.zip$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  alpine:
-    base_url: "https://dl-cdn.alpinelinux.org"
-    type: "remote"
-    package: "alpine"
-    description: "Alpine Linux APK package repository"
-    include_patterns:
-      - ".*/x86_64/.*\\.apk$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  almalinux:
-    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
-    type: "remote"
-    package: "rpm"
-    description: "AlmaLinux RPM package repository"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-reef:
-    base_url: "https://download.ceph.com/rpm-reef/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Reef 18"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-squid:
-    base_url: "https://download.ceph.com/rpm-squid/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Squid 19"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-tentacle:
-    base_url: "https://download.ceph.com/rpm-tentacle/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Tentacle 20"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  epel:
-    base_url: "https://gsl-syd.mm.fcix.net/epel"
-    type: "remote"
-    package: "rpm"
-    description: "EPEL (Extra Packages for Enterprise Linux)"
-    include_patterns:
-      - ".*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - "RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  fedora:
-    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
-    type: "remote"
-    package: "rpm"
-    description: "Fedora Linux RPM package repository"
-    include_patterns:
-      - "releases/.*/Everything/x86_64/.*\\.rpm$"
-      - "updates/.*/Everything/x86_64/.*\\.rpm$"
-      - "development/.*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  frr:
-    base_url: "https://rpm.frrouting.org/repo"
-    type: "remote"
-    package: "rpm"
-    description: "FRR RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  mariadb:
-    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
-    type: "remote"
-    package: "rpm"
-    description: "MariaDB RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  openvox:
-    base_url: "https://yum.voxpupuli.org"
-    type: "remote"
-    package: "rpm"
-    description: "OpenVox RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  postgresql:
-    base_url: "https://download.postgresql.org/pub/repos/yum"
-    type: "remote"
-    package: "rpm"
-    description: "PostgreSQL RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-      - ".*/PGDG-RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  rke2:
-    base_url: "https://rpm.rancher.io"
-    type: "remote"
-    package: "rpm"
-    description: "RKE2 RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "public.key$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  zfs:
-    base_url: "http://download.zfsonlinux.org"
-    type: "remote"
-    package: "rpm"
-    description: "ZFS RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-
-  local-generic:
-    type: "local"
-    package: "generic"
-    description: "Local generic file repository"
-    cache:
-      file_ttl: 0
-      index_ttl: 0

apps/base/artifactapi/services.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: artifactapi-api
+  name: artifactapi
   namespace: artifactapi
 spec:
   internalTrafficPolicy: Cluster
@@ -12,31 +12,31 @@ spec:
       protocol: TCP
       targetPort: http
   selector:
-    app: artifactapi
+    app: api
   sessionAffinity: None
   type: ClusterIP
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: postgres-service
+  name: ui
   namespace: artifactapi
 spec:
   internalTrafficPolicy: Cluster
   ports:
-    - name: postgres
-      port: 5432
+    - name: http
+      port: 80
       protocol: TCP
-      targetPort: postgres
+      targetPort: http
   selector:
-    app: postgres
+    app: ui
   sessionAffinity: None
   type: ClusterIP
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: redis-service
+  name: redis
   namespace: artifactapi
 spec:
   internalTrafficPolicy: Cluster

apps/base/artifactapi/ui-deployment.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ui
+  namespace: artifactapi
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  selector:
+    matchLabels:
+      app: ui
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: ui
+    spec:
+      automountServiceAccountToken: true
+      containers:
+        - name: ui
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+              name: http
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /ui
+              port: http
+              scheme: HTTP
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /ui
+              port: http
+              scheme: HTTP
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+      restartPolicy: Always

apps/base/artifactapi/ui-hpa.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: ui-hpa
+  namespace: artifactapi
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: ui
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 60
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 30
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 10
+          periodSeconds: 60
+        - type: Pods
+          value: 2
+          periodSeconds: 60

apps/base/artifactapi/vaultauth.yaml

@@ -3,14 +3,14 @@ apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
   name: default
-  namespace: woodpecker
+  namespace: artifactapi
 spec:
   allowedNamespaces:
-    - woodpecker
+    - artifactapi
   kubernetes:
     audiences:
       - vault
-    role: woodpecker
+    role: default
     serviceAccount: default
     tokenExpirationSeconds: 600
   method: kubernetes

apps/base/artifactapi/vaultstaticsecret.yaml

@@ -1,6 +1,23 @@
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: artifactapi
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifactapi/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: environment
   namespace: artifactapi
@@ -8,27 +25,10 @@ spec:
   destination:
     create: true
     name: environment
-    overwrite: false
-  hmacSecretData: true
-  mount: kv
-  path: service/artifactapi/environment
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-password
-  namespace: artifactapi
-spec:
-  destination:
-    create: true
-    name: postgres-password
     overwrite: true
   hmacSecretData: true
   mount: kv
-  path: service/artifactapi/postgres-password
+  path: kubernetes/namespace/artifactapi/default/environment
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default

apps/base/authentik/cnpg_cluster.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: authentik
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: authentik
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: authentik
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/authentik/cnpg_pooler.yaml

@@ -0,0 +1,66 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: postgres-pooler-rw
+  namespace: authentik
+spec:
+  cluster:
+    name: postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler-rw
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler-rw
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: postgres-pooler-ro
+  namespace: authentik
+spec:
+  cluster:
+    name: postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler-ro
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler-ro
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: ro

apps/base/authentik/gateway.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: identity.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: authentik
+  namespace: authentik
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: authentik-tls
+        mode: Terminate
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: http-internal
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: https-internal
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: authentik-tls
+        mode: Terminate

apps/base/authentik/httproute.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-http-redirect
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: http
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: http-internal
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: https
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: https-internal
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/authentik/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - ldap-gateway.yaml
+  - ldap-httproute.yaml
+  - ldap-service.yaml
+  - ldap-tlsroute.yaml
+  - namespace.yaml
+  - redis-deployment.yaml
+  - redis-pvc.yaml
+  - redis-service.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml

apps/base/authentik/ldap-gateway.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: ldap.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.k8s.syd1.au.unkin.net
+      name: ldaps-internal
+      port: 636
+      protocol: TLS
+      tls:
+        mode: Passthrough
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.main.unkin.net
+      name: ldaps-main
+      port: 636
+      protocol: TLS
+      tls:
+        mode: Passthrough
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.k8s.syd1.au.unkin.net
+      name: http-dns
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: ldap.main.unkin.net
+      name: http-dns-main
+      port: 80
+      protocol: HTTP

apps/base/authentik/ldap-httproute.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-ldap-dns
+  namespace: authentik
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: ldap.k8s.syd1.au.unkin.net,ldap.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  hostnames:
+    - ldap.k8s.syd1.au.unkin.net
+    - ldap.main.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: http-dns
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: http-dns-main
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/authentik/ldap-service.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: ldaps
+      port: 6636
+      protocol: TCP
+      targetPort: 6636
+  selector:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/component: ldap
+  sessionAffinity: None
+  type: ClusterIP

apps/base/authentik/ldap-tlsroute.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TLSRoute
+metadata:
+  name: authentik-ldaps
+  namespace: authentik
+spec:
+  hostnames:
+    - ldap.k8s.syd1.au.unkin.net
+    - ldap.main.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: ldaps-internal
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-ldap
+      sectionName: ldaps-main
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-ldap
+          port: 6636
+          weight: 1

apps/base/authentik/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

apps/base/authentik/redis-deployment.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: authentik
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          imagePullPolicy: IfNotPresent
+          args:
+            - --save
+            - "20"
+            - "1"
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - mountPath: /data
+              name: redis-data
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: redis-data

apps/base/authentik/redis-pvc.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data
+  namespace: authentik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-delete

apps/base/authentik/redis-service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: authentik
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: redis
+      port: 6379
+      protocol: TCP
+      targetPort: redis
+  selector:
+    app: redis
+  sessionAffinity: None
+  type: ClusterIP

apps/base/authentik/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: authentik
+spec:
+  allowedNamespaces:
+    - authentik
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/authentik/vaultstaticsecret.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: authentik-credentials
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: authentik-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/authentik-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: s3-credentials
+  namespace: authentik
+spec:
+  destination:
+    create: true
+    name: s3-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/authentik/default/s3-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/bind-system/deployment.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bind-operator
+  namespace: bind-system
+  labels:
+    app.kubernetes.io/name: bind-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: bind-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: bind-operator
+    spec:
+      serviceAccountName: bind-operator
+      securityContext:
+        runAsNonRoot: true
+      containers:
+        - name: operator
+          image: git.unkin.net/unkin/bind-operator:v0.1.1
+          args:
+            - --metrics-bind-address=:8080
+            - --health-probe-bind-address=:8081
+            - --leader-elect
+          ports:
+            - containerPort: 8080
+              name: metrics
+            - containerPort: 8081
+              name: health
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/base/bind-system/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  # CRDs are pulled from the bind-operator repo at the matching tag rather than
+  # vendored here, so they never drift from the operator.
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.1/config/crd/install.yaml
+  - rbac.yaml
+  - deployment.yaml

apps/base/bind-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bind-system

apps/base/bind-system/rbac.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bind-operator
+  namespace: bind-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bind-operator
+rules:
+  - apiGroups: ["bind.unkin.net"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["services", "configmaps", "secrets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create", "get"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: bind-operator
+subjects:
+  - kind: ServiceAccount
+    name: bind-operator
+    namespace: bind-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: bind-operator

apps/base/binddns-auth/cluster.yaml

@@ -0,0 +1,36 @@
+---
+# Authoritative masters (replaces the 3x Puppet authoritative servers).
+# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: auth
+  namespace: binddns-auth
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so new BindZones auto-provision onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: auth-catalog
+  namespace: binddns-auth
+spec:
+  clusterRef: auth
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key

apps/base/binddns-auth/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - tsigkey.yaml
+  - cluster.yaml

apps/base/binddns-auth/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: binddns-auth

apps/base/binddns-auth/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Zone-transfer / catalog key. The operator generates the material into a
+# Secret (transfer-key-tsig); nothing sensitive is committed to git.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: transfer-key
+  namespace: binddns-auth
+spec:
+  algorithm: hmac-sha256

apps/base/binddns-externaldns/cluster.yaml

@@ -0,0 +1,26 @@
+---
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: externaldns
+  namespace: binddns-externaldns
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: dmz
+      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/binddns-externaldns/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - tsigkey.yaml
+  - cluster.yaml

apps/base/binddns-externaldns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: binddns-externaldns

apps/base/binddns-externaldns/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
+# updates to the primary. The operator generates the material into a Secret.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: externaldns-key
+  namespace: binddns-externaldns
+spec:
+  algorithm: hmac-sha256

apps/base/binddns-resolver/cluster.yaml

@@ -0,0 +1,28 @@
+---
+# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
+# Three identical recursive servers; no zone replication.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: resolver
+  namespace: binddns-resolver
+spec:
+  mode: resolver
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
+  forwarders:
+    - 1.1.1.1
+    - 9.9.9.9
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/binddns-resolver/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - cluster.yaml

apps/base/binddns-resolver/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: binddns-resolver

apps/base/cattle-system/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
+  name: rancher
+  namespace: cattle-system
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rancher-tls
+        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher-http-redirect
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: rancher
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: rancher
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: rancher
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/cattle-system/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/cattle-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cattle-system

apps/base/cattle-system/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - cattle-system
+  kubernetes:
+    role: rancher
+    serviceAccount: rancher
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/cattle-system/vaultstaticsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: rancher-bootstrap-secret
+  namespace: cattle-system
+spec:
+  vaultAuthRef: rancher
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/rancher/bootstrap-password
+  refreshAfter: 5m
+  destination:
+    name: rancher-bootstrap-secret
+    create: true

apps/base/cert-manager/clusterrole.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager-vault-token-creator
+  labels:
+    app.kubernetes.io/name: "cert-manager-config"
+    app.kubernetes.io/instance: "cert-manager-config"
+rules:
+- apiGroups: [""]
+  resources: ["serviceaccounts/token"]
+  verbs: ["create"]

apps/base/cert-manager/clusterrolebinding.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-vault-token-creator
+  labels:
+    app.kubernetes.io/name: "cert-manager-config"
+    app.kubernetes.io/instance: "cert-manager-config"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager-vault-token-creator
+subjects:
+- kind: ServiceAccount
+  name: cert-manager
+  namespace: cert-manager

apps/base/cert-manager/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - clusterrole.yaml
+  - clusterrolebinding.yaml

apps/base/cert-manager/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager

apps/base/cert-manager/serviceaccount.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault-issuer
+  namespace: cert-manager
+  labels:
+    app.kubernetes.io/name: "cert-manager-config"
+    app.kubernetes.io/instance: "cert-manager-config"
+    app.kubernetes.io/component: "vault-issuer"
+automountServiceAccountToken: true

apps/base/certificates/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vault-ca-cert.yaml

apps/base/certificates/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: certificates

apps/base/certificates/vault-ca-cert.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vault-ca-cert
+  namespace: certificates
+  labels:
+    app.kubernetes.io/name: vault-ca-cert
+    app.kubernetes.io/part-of: vault-secrets-operator
+  annotations:
+    description: "Vault CA certificate replicated to all namespaces"
+    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ""
+type: Opaque
+stringData:
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
+    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
+    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
+    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
+    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
+    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
+    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
+    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
+    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
+    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
+    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
+    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
+    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
+    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
+    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
+    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
+    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
+    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
+    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
+    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
+    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
+    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
+    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
+    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
+    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
+    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
+    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
+    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
+    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
+    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
+    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
+    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
+    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
+    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
+    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
+    4gqd
+    -----END CERTIFICATE-----

apps/base/cnpg-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cnpg-system

apps/base/consul/gateway.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    cert-manager.io/alt-names: consul.service.consul
+    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
+    - name: consul-svc
+      port: 443
+      protocol: HTTPS
+      hostname: consul.service.consul
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls

apps/base/consul/httproute.yaml

@@ -0,0 +1,83 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-http-redirect
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: consul
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: consul
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: consul-ui
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-svc
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.service.consul
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: consul
+      sectionName: consul-svc
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: consul-ui
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/consul/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/consul/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: consul

apps/base/csi-cephfs/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - storageclass.yaml

apps/base/csi-cephfs/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: csi-cephfs

apps/base/csi-cephfs/storageclass.yaml

@@ -0,0 +1,83 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cephfs-raid6-delete
+provisioner: cephfs.csi.ceph.com
+reclaimPolicy: Delete
+allowVolumeExpansion: true
+parameters:
+  clusterID: "cephfs_csi_ssd_ec_6_2"
+  fsName: "cephfs"
+  subVolumeGroup: csi_ssd_ec_6_2
+  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cephfs-raid6-retain
+provisioner: cephfs.csi.ceph.com
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+parameters:
+  clusterID: "cephfs_csi_ssd_ec_6_2"
+  fsName: "cephfs"
+  subVolumeGroup: csi_ssd_ec_6_2
+  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cephfs-raid5-delete
+provisioner: cephfs.csi.ceph.com
+reclaimPolicy: Delete
+allowVolumeExpansion: true
+parameters:
+  clusterID: "cephfs_csi_ssd_ec_4_1"
+  fsName: "cephfs"
+  subVolumeGroup: csi_ssd_ec_4_1
+  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cephfs-raid5-retain
+provisioner: cephfs.csi.ceph.com
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+parameters:
+  clusterID: "cephfs_csi_ssd_ec_4_1"
+  fsName: "cephfs"
+  subVolumeGroup: csi_ssd_ec_4_1
+  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
+  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
+  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"

apps/base/csi-cephfs/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: ceph-csi-cephfs
+  namespace: csi-cephfs
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - csi-cephfs
+  kubernetes:
+    role: ceph-csi
+    serviceAccount: ceph-csi-cephfs-csi-cephfs-provisioner
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/csi-cephfs/vaultstaticsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: csi-cephfs-secret
+  namespace: csi-cephfs
+spec:
+  vaultAuthRef: ceph-csi-cephfs
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/csi/ceph-cephfs-secret
+  refreshAfter: 5m
+  destination:
+    name: csi-cephfs-secret
+    create: true

apps/base/csi-cephrbd/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - storageclass.yaml

apps/base/csi-cephrbd/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: csi-cephrbd

apps/base/csi-cephrbd/storageclass.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cephrbd-fast-delete
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: rbd.csi.ceph.com
+reclaimPolicy: Delete
+allowVolumeExpansion: true
+parameters:
+  clusterID: "de96a98f-3d23-465a-a899-86d3d67edab8"
+  pool: "kubernetes"
+  imageFeatures: "layering"
+  csi.storage.k8s.io/provisioner-secret-name: "csi-rbd-secret"
+  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephrbd"
+  csi.storage.k8s.io/controller-expand-secret-name: "csi-rbd-secret"
+  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephrbd"
+  csi.storage.k8s.io/node-stage-secret-name: "csi-rbd-secret"
+  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephrbd"
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cephrbd-fast-retain
+provisioner: rbd.csi.ceph.com
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+parameters:
+  clusterID: "de96a98f-3d23-465a-a899-86d3d67edab8"
+  pool: "kubernetes"
+  imageFeatures: "layering"
+  csi.storage.k8s.io/provisioner-secret-name: "csi-rbd-secret"
+  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephrbd"
+  csi.storage.k8s.io/controller-expand-secret-name: "csi-rbd-secret"
+  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephrbd"
+  csi.storage.k8s.io/node-stage-secret-name: "csi-rbd-secret"
+  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephrbd"

apps/base/csi-cephrbd/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: ceph-csi-rbd
+  namespace: csi-cephrbd
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - csi-cephrbd
+  kubernetes:
+    role: ceph-csi
+    serviceAccount: ceph-csi-rbd-csi-rbd-provisioner
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/csi-cephrbd/vaultstaticsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: csi-rbd-secret
+  namespace: csi-cephrbd
+spec:
+  vaultAuthRef: ceph-csi-rbd
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/csi/ceph-rbd-secret
+  refreshAfter: 5m
+  destination:
+    name: csi-rbd-secret
+    create: true

apps/base/elastic-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/elastic-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: elastic-system
+  name: elastic-system

apps/base/externaldns/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml

apps/base/externaldns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: externaldns

apps/base/externaldns/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: externaldns
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - externaldns
+  kubernetes:
+    role: externaldns
+    serviceAccount: externaldns
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/externaldns/vaultstaticsecret.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: externaldns-tsig
+  namespace: externaldns
+spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/externaldns/tsig
+  refreshAfter: 5m
+  destination:
+    name: externaldns-tsig
+    create: true
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: externaldns

apps/base/inteldeviceplugins-system/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+
+helmCharts:
+  - name: intel-device-plugins-operator
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.35.0"
+    releaseName: intel-device-plugins-operator
+    namespace: inteldeviceplugins-system
+  - name: intel-device-plugins-gpu
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.34.1"
+    releaseName: intel-gpu-plugin
+    namespace: inteldeviceplugins-system
+    valuesFile: values-gpu-plugin.yaml

apps/base/inteldeviceplugins-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: inteldeviceplugins-system

apps/base/inteldeviceplugins-system/values-gpu-plugin.yaml

@@ -0,0 +1,13 @@
+---
+name: intel-gpu-device-plugin
+sharedDevNum: 4
+logLevel: 2
+enableMonitoring: true
+allocationPolicy: "none"
+image:
+  hub: intel
+  tag: ""  # Use latest from chart
+nodeSelector:
+  intel.feature.node.kubernetes.io/gpu: 'true'
+nodeFeatureRule: true
+tolerations: []

apps/base/kanidm/README.md

@@ -0,0 +1,51 @@
+# kanidm
+
+Three-replica kanidm identity server with Vault-managed replication certificates.
+
+## Architecture
+
+- Per-pod `server-N.toml` in `resources/` — each has its own replication origin hardcoded
+- `config-init` busybox init container copies the right config and injects peer certs from the
+  vault-synced `kanidm-repl-certs` Secret at pod startup
+- `reloader.stakater.com/auto: "true"` triggers a rolling restart when the ConfigMap or Secret changes
+- Vault path: `kv/kubernetes/namespace/kanidm/default/repl-certs`
+  - Keys: `kanidm-0`, `kanidm-1`, `kanidm-2` — each holds that pod's replication certificate
+
+## Initial setup
+
+After the first pod starts, generate the admin credentials:
+
+```bash
+kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml admin
+kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml idm_admin
+```
+
+## Replication certificate rotation
+
+When certs need to be renewed, update vault and reloader will roll the StatefulSet:
+
+```bash
+# Get new cert from a pod
+kubectl exec -it -n kanidm kanidm-N -- /sbin/kanidmd renew-replication-certificate -c /config/server.toml
+
+# Write updated cert to vault (reloader triggers restart automatically)
+vault kv patch kv/kubernetes/namespace/kanidm/default/repl-certs "kanidm-N=<cert>"
+```
+
+## Resolving domain UUID mismatch
+
+If pods initialized independently (each with a different domain UUID), replication will fail with
+`Consumer Domain UUID does not match`. Fix by resetting kanidm-1 and kanidm-2 to sync from
+kanidm-0 (the authoritative node):
+
+```bash
+# Scale down to avoid split-brain during reset
+kubectl scale statefulset -n kanidm kanidm --replicas=1
+
+# Delete the stale PVCs for the replica pods
+kubectl delete pvc -n kanidm data-kanidm-1 data-kanidm-2
+
+# Scale back up — replicas start with empty DBs and automatic_refresh=true
+# will trigger a full sync from kanidm-0 once TLS peer certs are verified
+kubectl scale statefulset -n kanidm kanidm --replicas=3
+```