Merge branch 'main' into benvin/artifactapi-mail-images

feat(artifactapi): add valkey/valkey to dockerhub allowed patterns
Required for stalwart in-memory store (rate limiting, locks, OAuth codes).
2026-05-24 14:28:42 +10:00 · 2026-05-24 12:56:13 +10:00 · 2026-05-24 12:55:16 +10:00 · 2026-05-24 12:42:27 +10:00 · 2026-05-24 12:38:13 +10:00 · 2026-05-23 23:47:24 +10:00
58 changed files with 1233 additions and 206 deletions
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: artifactapi-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi-http-redirect
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: artifactapi-api
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,32 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/proxy-body-size: 10g
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-  name: artifactapi-ingress
-  namespace: artifactapi
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: artifactapi.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: artifactapi-api
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - artifactapi.k8s.syd1.au.unkin.net
-      secretName: artifactapi-tls
@@ -6,7 +6,8 @@ resources:
  - artifactapi-deployment.yaml
  - artifactapi-hpa.yaml
  - configmap.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - postgres-deployment.yaml
  - pvc.yaml
@@ -6,8 +6,10 @@ remotes:
    immutable_patterns:
      - "^cloudnative-pg/cloudnative-pg"
      - "^emberstack/helm-charts"
+      - "^kanidm/"
      - "^openvoxproject/"
      - "^stakater/reloader"
+      - "^stalwartlabs/stalwart"
      - "^voxpupuli/puppetboard"
      - "^woodpecker-ci/helm"
    cache:
@@ -19,7 +21,10 @@ remotes:
    package: "docker"
    description: "Docker Hub registry"
    immutable_patterns:
+      - "^library/almalinux"
      - "^library/busybox"
+      - "^library/debian"
+      - "^library/fedora"
      - "^library/nginx"
      - "^library/postgres"
      - "^library/redis"
@@ -27,10 +32,14 @@ remotes:
      - "^bitnami/"
      - "^curlimages/curl"
      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/vault-secrets-operator"
+      - "^hashicorp/consul"
+      - "^hashicorp/vault"
      - "^jfrog/"
      - "^rancher/"
+      - "^rspamd/rspamd"
+      - "^tozd/postfix"
      - "^traefik/"
+      - "^valkey/valkey"
      - "^ubi9/ubi-minimal"
      - "^victoriametrics/"
      - "^woodpeckerci/"
@@ -5,6 +5,7 @@ remotes:
    description: "GitHub releases and files"
    mutable_patterns:
      - ".*/archive/refs/heads/.*.tar.gz$"
+      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
    immutable_patterns:
      - ".*/archive/refs/tags/.*.tar.gz$"
      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
@@ -26,7 +27,9 @@ remotes:
      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
+      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
      - "lxc/incus/.*.tar.gz$"
      - "mikefarah/yq/.*/yq_linux_amd64$"
      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -54,6 +57,7 @@ remotes:
      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
+      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
    cache:
      immutable_ttl: 0
      mutable_ttl: 7200
@@ -130,3 +130,14 @@ remotes:
    cache:
      immutable_ttl: 0
      mutable_ttl: 3600
+
+  argo-helm:
+    base_url: "https://argoproj.github.io/argo-helm"
+    package: "helm"
+    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
@@ -15,3 +15,4 @@ virtuals:
      - stakater
      - traefik
      - victoriametrics
+      - argo-helm
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
+  name: rancher
+  namespace: cattle-system
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rancher-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher-http-redirect
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: rancher
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80
@@ -6,4 +6,5 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,53 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    cert-manager.io/alt-names: consul.service.consul
+    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
+    - name: consul-svc
+      port: 443
+      protocol: HTTPS
+      hostname: consul.service.consul
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
@@ -0,0 +1,71 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-http-redirect
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: consul
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: consul
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: consul-ui
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-svc
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.service.consul
+  parentRefs:
+    - name: consul
+      sectionName: consul-svc
+  rules:
+    - backendRefs:
+        - name: consul-ui
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: consul
@@ -76,11 +76,11 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: 500m
-      memory: 512Mi
+      cpu: 1
+      memory: 1024Mi
    requests:
      cpu: 250m
-      memory: 256Mi
+      memory: 512Mi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
@@ -56,10 +56,10 @@ spec:
          resources:
            limits:
              cpu: "2"
-              memory: 6Gi
+              memory: 8Gi
            requests:
              cpu: 250m
-              memory: 2Gi
+              memory: 6Gi
          volumeMounts:
            - mountPath: /app/config.yaml
              name: config
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: litellm
+  namespace: litellm
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: litellm-tls
+        mode: Terminate
@@ -10,14 +10,14 @@ spec:
    kind: Deployment
    name: litellm
  minReplicas: 2
-  maxReplicas: 10
+  maxReplicas: 4
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
-          averageUtilization: 60
+          averageUtilization: 80
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0
@@ -25,7 +25,7 @@ spec:
      policies:
        - type: Percent
          value: 100
-          periodSeconds: 30
+          periodSeconds: 60
        - type: Pods
          value: 4
          periodSeconds: 30
@@ -34,7 +34,7 @@ spec:
      selectPolicy: Min
      policies:
        - type: Percent
-          value: 10
+          value: 30
          periodSeconds: 60
        - type: Pods
          value: 2
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm-http-redirect
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: litellm
+          port: 4000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: litellm
-  namespace: litellm
-spec:
-  rules:
-    - host: litellm.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: litellm
-                port:
-                  number: 4000
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - litellm.k8s.syd1.au.unkin.net
-      secretName: litellm-tls
@@ -7,7 +7,8 @@ resources:
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: paperclip
+  namespace: paperclip
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: paperclip-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip-http-redirect
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: paperclip
+          port: 3100
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: paperclip
-  namespace: paperclip
-spec:
-  rules:
-    - host: paperclip.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: paperclip
-                port:
-                  number: 3100
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - paperclip.k8s.syd1.au.unkin.net
-      secretName: paperclip-tls
@@ -6,7 +6,8 @@ resources:
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - services.yaml
  - vaultauth.yaml
@@ -0,0 +1,41 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: puppetboard-tls
+        mode: Terminate
@@ -0,0 +1,34 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetdb.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: puppetdb-tls
+        mode: Terminate
@@ -0,0 +1,52 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard-http-redirect
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetboard
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetdb.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetdb
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetdb
+          port: 8080
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetboard.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetboard
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetboard.k8s.syd1.au.unkin.net
-      secretName: puppetboard-tls
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetdb.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetdb
-                port:
-                  number: 8080
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetdb.k8s.syd1.au.unkin.net
-      secretName: puppetdb-tls
@@ -25,8 +25,10 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
-  - ingress_puppetdb.yaml
+  - gateway_puppetboard.yaml
+  - httproute_puppetboard.yaml
+  - gateway_puppetdb.yaml
+  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: traefik-external
+spec:
+  controllerName: traefik.io/gateway-controller
@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: internal
+  name: traefik-internal
+spec:
+  controllerName: traefik.io/gateway-controller
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gatewayclass-internal.yaml
+  - gatewayclass-external.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik-system
@@ -0,0 +1,52 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: vault
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    cert-manager.io/alt-names: vault.service.consul,vault.query.consul
+    external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: vault.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: vault.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vault-tls
+    - name: vault-direct
+      port: 8200
+      protocol: HTTPS
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vault-tls
@@ -0,0 +1,72 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault-http-redirect
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+spec:
+  hostnames:
+    - vault.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: vault
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+spec:
+  hostnames:
+    - vault.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: vault
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: vault
+          port: 8200
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault-consul
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+spec:
+  hostnames:
+    - vault.service.consul
+    - vault.query.consul
+  parentRefs:
+    - name: vault
+      sectionName: vault-direct
+  rules:
+    - backendRefs:
+        - name: vault
+          port: 8200
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault
@@ -6,5 +6,6 @@ resources:
  - namespace.yaml
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
+  - serviceaccount_terraform_vault.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-vault
+  namespace: woodpecker
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "v1.19.2"
+    version: "v1.20.2"
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
@@ -1,6 +1,11 @@
 crds:
  enabled: true

+config:
+  apiVersion: controller.config.cert-manager.io/v1alpha1
+  kind: ControllerConfiguration
+  enableGatewayAPI: true
+
 replicaCount: 2

 resources:
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/consul
+
+helmCharts:
+  - name: consul
+    repo: https://helm.releases.hashicorp.com
+    version: "1.9.7"
+    releaseName: consul
+    namespace: consul
+    valuesFile: values.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
@@ -0,0 +1,58 @@
+global:
+  name: consul
+  datacenter: au-syd1
+  domain: consul
+
+server:
+  image: hashicorp/consul:1.22.7
+  replicas: 5
+  bootstrapExpect: 5
+  storage: 10Gi
+  storageClass: cephrbd-fast-delete
+
+  connect: true
+
+  disruptionBudget:
+    maxUnavailable: 1
+
+  extraConfig: |
+    {
+      "disable_remote_exec": true,
+      "disable_update_check": true,
+      "performance": {
+        "raft_multiplier": 10
+      },
+      "ports": {
+        "dns": 8600,
+        "grpc": 8502,
+        "http": 8500,
+        "https": -1
+      },
+      "primary_datacenter": "au-syd1"
+    }
+
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 2Gi
+      cpu: 1000m
+
+client:
+  enabled: false
+
+ui:
+  enabled: true
+  service:
+    type: ClusterIP
+
+connectInject:
+  enabled: false
+
+dns:
+  enabled: true
+  type: LoadBalancer
+  annotations: |
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.5
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: external-dns
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.19.0"
+    version: "1.21.1"
    releaseName: externaldns
    namespace: externaldns
    valuesFile: values.yaml
@@ -24,6 +24,8 @@ policy: "sync"
 sources:
  - service
  - ingress
+  - gateway-httproute
+  - gateway-grpcroute

 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -49,3 +51,5 @@ extraArgs:
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx
+
+logLevel: debug
@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/traefik-system
+
+helmCharts:
+  - name: traefik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "40.0.0"
+    releaseName: traefik-internal
+    namespace: traefik-system
+    valuesFile: values-internal.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
+  - name: traefik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "40.0.0"
+    releaseName: traefik-external
+    namespace: traefik-system
+    valuesFile: values-external.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
@@ -0,0 +1,98 @@
+image:
+  tag: v3.7.0
+
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+gateway:
+  enabled: false
+
+gatewayClass:
+  enabled: false
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+providers:
+  kubernetesCRD:
+    enabled: false
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: true
+    experimentalChannel: false
+    namespaces: []
+    nativeLBByDefault: false
+    labelSelector: "traefik.io/instance=external"
+
+logs:
+  access:
+    enabled: true
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+  notAppendXForwardedFor: false
+
+service:
+  enabled: true
+  single: true
+  annotations:
+    purelb.io/service-group: "dmz"
+    purelb.io/addresses: 198.18.199.0
+  annotationsTCP: {}
+  annotationsUDP: {}
+  labels: {}
+  spec:
+    type: LoadBalancer
+    loadBalancerIP: "198.18.199.0"
+  additionalServices: {}
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 5
+  metrics: []
+  behavior: {}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: "{{ template \"traefik.fullname\" . }}"
+
+persistence:
+  enabled: false
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
+        topologyKey: kubernetes.io/hostname
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
+enabled: true
@@ -0,0 +1,100 @@
+image:
+  tag: v3.7.0
+
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+gateway:
+  enabled: false
+
+gatewayClass:
+  enabled: false
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+providers:
+  kubernetesCRD:
+    enabled: false
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: true
+    experimentalChannel: false
+    namespaces: []
+    nativeLBByDefault: false
+    labelSelector: "traefik.io/instance=internal"
+
+logs:
+  access:
+    enabled: true
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+  notAppendXForwardedFor: false
+
+service:
+  enabled: true
+  single: true
+  annotations:
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.4
+  annotationsTCP: {}
+  annotationsUDP: {}
+  labels: {}
+  spec:
+    type: LoadBalancer
+    loadBalancerIP: "198.18.200.4"
+  additionalServices: {}
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 5
+  metrics: []
+  behavior: {}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: "{{ template \"traefik.fullname\" . }}"
+
+persistence:
+  enabled: false
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
+        topologyKey: kubernetes.io/hostname
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+  vault-direct:
+    port: 8200
+
+enabled: true
@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/vault
+
+helmCharts:
+  - name: vault
+    repo: https://helm.releases.hashicorp.com
+    version: "0.32.0"
+    releaseName: vault
+    namespace: vault
+    valuesFile: values.yaml
@@ -0,0 +1,73 @@
+server:
+  image:
+    repository: hashicorp/vault
+    tag: "2.0.1"
+
+  ha:
+    enabled: true
+    replicas: 5
+
+    raft:
+      enabled: true
+      setNodeId: true
+      config: |
+        ui            = true
+        disable_mlock = true
+
+        listener "tcp" {
+          address         = "[::]:8200"
+          cluster_address = "[::]:8201"
+          tls_disable     = "true"
+        }
+
+        storage "raft" {
+          path = "/vault/data"
+
+          retry_join {
+            leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
+          }
+        }
+
+        service_registration "consul" {
+          address = "consul-server.consul.svc.cluster.local:8500"
+        }
+
+  dataStorage:
+    enabled: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+    accessMode: ReadWriteOnce
+
+  statefulSet:
+    securityContext:
+      container:
+        capabilities:
+          add:
+            - IPC_LOCK
+
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 2Gi
+      cpu: 1000m
+
+injector:
+  enabled: false
+
+ui:
+  enabled: true
+  serviceType: ClusterIP
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: woodpecker
    repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.5.1"
+    version: "3.6.3"
    releaseName: woodpecker
    namespace: woodpecker
    valuesFile: values.yaml
@@ -15,6 +15,7 @@ spec:
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
      - path: apps/overlays/*/cnpg-system
+      - path: apps/overlays/*/consul
      - path: apps/overlays/*/elastic-system
      - path: apps/overlays/*/externaldns
      - path: apps/overlays/*/inteldeviceplugins-system
@@ -25,7 +26,9 @@ spec:
      - path: apps/overlays/*/reflector-system
      - path: apps/overlays/*/reloader-system
      - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/traefik-system
      - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vault
      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
  template:
@@ -21,6 +21,8 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'certificates'
      server: https://kubernetes.default.svc
+    - namespace: 'consul'
+      server: https://kubernetes.default.svc
    - namespace: 'externaldns'
      server: https://kubernetes.default.svc
    - namespace: 'jfrog'
@@ -33,6 +35,8 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'reposync'
      server: https://kubernetes.default.svc
+    - namespace: 'vault'
+      server: https://kubernetes.default.svc
    - namespace: 'woodpecker'
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
@@ -60,6 +64,10 @@ spec:
      kind: Certificate
    - group: 'cert-manager.io'
      kind: Issuer
+    - group: 'gateway.networking.k8s.io'
+      kind: GatewayClass
+    - group: 'networking.k8s.io'
+      kind: IngressClass
  namespaceResourceWhitelist:
    - group: '*'
      kind: '*'
Author	SHA1	Message	Date
unkinben	5e204dba5f	Merge branch 'main' into benvin/artifactapi-mail-images ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-05-24 14:28:42 +10:00
unkinben	7fc2bdd746	feat(artifactapi): add valkey/valkey to dockerhub allowed patterns ci/woodpecker/pr/kubeconform Pipeline was canceled Details ci/woodpecker/pr/pre-commit Pipeline was canceled Details Required for stalwart in-memory store (rate limiting, locks, OAuth codes).	2026-05-24 12:56:13 +10:00
unkinben	af79d86db6	feat(artifactapi): cache stalwart webadmin zip (#157 ) ## Summary - Adds \`stalwartlabs/webadmin/releases/latest/download/webadmin.zip\` to \`mutable_patterns\` in the \`github\` generic remote so the stalwart webadmin UI can be fetched through artifactapi rather than directly from GitHub. ## Notes - Uses \`mutable_patterns\` (not \`immutable\`) because \`releases/latest\` resolves to whichever release is current and changes over time. - Access URL: \`https://artifactapi.k8s.syd1.au.unkin.net/generic/github/stalwartlabs/webadmin/releases/latest/download/webadmin.zip\` Reviewed-on: #157	2026-05-24 12:55:16 +10:00
unkinben	5f4c9225bb	feat(artifactapi): add mail stack images to docker registry cache (#156 ) - ghcr: stalwartlabs/stalwart (Stalwart mail server) - dockerhub: rspamd/rspamd (spam filter), tozd/postfix (MTA gateway) Reviewed-on: #156	2026-05-24 12:42:27 +10:00
unkinben	8ad76b0314	feat(artifactapi): add mail stack images to docker registry cache ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details - ghcr: stalwartlabs/stalwart (Stalwart mail server) - dockerhub: rspamd/rspamd (spam filter), tozd/postfix (MTA gateway)	2026-05-24 12:38:13 +10:00
unkinben	cbc2c1cb9f	fix(gateways): add explicit group: "" to all certificateRefs entries (#153 ) The Gateway API admission server defaults certificateRefs[].group to "" when it is omitted. ArgoCD diffed the desired state (no group field) against the live state (group: "") and flagged every gateway as out of sync. Fix: explicitly set group: "" in all certificateRefs entries so the rendered manifest matches the API server's canonical form exactly. Affected: artifactapi, cattle-system, consul, litellm, paperclip, puppet (puppetboard + puppetdb), vault. Reviewed-on: #153	2026-05-23 23:47:24 +10:00
unkinben	c6f9893804	fix(argocd): add vault and consul to platform project destinations (#152 ) Vault and consul namespaces were missing from the platform AppProject allowed destinations, causing ArgoCD sync failures with: destination server 'https://kubernetes.default.svc' and namespace 'vault' do not match any of the allowed destinations in project 'platform' Reviewed-on: #152	2026-05-23 23:27:24 +10:00
unkinben	e43fb742ad	feat(artifactapi): add kanidm to ghcr docker immutable patterns (#151 ) Prerequisite for kanidm deployment (PR benvin/kanidm). Reviewed-on: #151	2026-05-23 23:09:38 +10:00
unkinben	11ac2ae91e	feat(consul): deploy HashiCorp Consul 1.22.7 via Helm chart (5-replica cluster) (#149 ) ## Summary - Deploys HashiCorp Consul 1.22.7 using Helm chart 1.9.7 with 5 server replicas - Configuration modelled on production consul: \`datacenter=au-syd1\`, \`connect=true\`, \`raft_multiplier=10\`, HTTP on 8500, GRPC on 8502, HTTPS disabled - 5-replica server cluster with \`bootstrapExpect=5\` - 10Gi cephrbd-fast-delete PVC per server pod - Gateway API: HTTPS gateway + HTTPRoute (443→consul-consul-ui:80→8500) at \`consul.k8s.syd1.au.unkin.net\` - PodDisruptionBudget patched from \`policy/v1beta1\` to \`policy/v1\` (k8s 1.25+ compatibility) - ArgoCD platform ApplicationSet updated to include consul overlay path - Clients disabled (server-only deployment) - ConnectInject disabled (can be enabled later for service mesh) ## Requires - PR #147 (artifactapi: add hashicorp/consul to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-consul\`: all 5 server pods 1/1 Running, cluster formed - [ ] After merge: ArgoCD syncs consul namespace - [ ] Verify \`consul.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #149	2026-05-23 22:40:49 +10:00
unkinben	d2be521878	feat(vault): deploy HashiCorp Vault 2.0.1 via Helm chart (5-replica HA raft) (#148 ) ## Summary - Deploys HashiCorp Vault 2.0.1 using Helm chart 0.32.0 in HA raft mode (5 replicas) - Configuration modelled on production vault: \`disable_mlock=true\`, headless-DNS retry_join for all 5 pods - IPC_LOCK capability added via \`server.statefulSet.securityContext.container\` - 10Gi cephrbd-fast-delete PVC per pod via \`dataStorage\` - Gateway API: HTTPS gateway + HTTPRoute (443→vault service port 8200) at \`vault.k8s.syd1.au.unkin.net\` - ArgoCD platform ApplicationSet updated to include vault overlay path - Injector disabled (no agent sidecar injection needed) ## Requires - PR #147 (artifactapi: add hashicorp/vault to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-vault\`: all 5 pods Running, raft cluster forming - [ ] After merge: ArgoCD syncs vault namespace - [ ] Operator runs \`vault operator init\` to initialize, then unseals all 5 nodes - [ ] Verify \`vault.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #148	2026-05-23 22:39:41 +10:00
unkinben	bcd4c1a722	feat(cert-manager): upgrade to v1.20.2 and enable Gateway API support (#150 ) ## Summary - Upgrades cert-manager from v1.19.2 to v1.20.2 - Enables `enableGatewayAPI: true` via the `ControllerConfiguration` config block ## Why cert-manager's Gateway API integration was not enabled. Without it, `cert-manager.io/*` annotations on Gateway resources are ignored and no certificates are issued. This is required for the consul and vault PRs (#148, #149) to have their TLS certs automatically provisioned from their Gateway annotations. In v1.20.2, `ExperimentalGatewayAPISupport` is BETA and defaults to true — enabling `enableGatewayAPI` in the controller config activates the gateway-shim controller. ## Test plan - [ ] cert-manager rolls out cleanly (v1.20.2 pods become Ready) - [ ] After rollout, existing Gateway-annotated services (artifactapi, puppet, litellm) retain valid certs - [ ] New Gateway resources with `cert-manager.io/cluster-issuer` annotations trigger Certificate creation Reviewed-on: #150	2026-05-23 22:38:39 +10:00
unkinben	6d9530b1ee	feat(artifactapi): add hashicorp/consul and hashicorp/vault to docker immutable patterns (#147 ) ## Summary - Adds \`^hashicorp/consul\` and \`^hashicorp/vault\` to the dockerhub immutable_patterns in artifactapi's remote-docker.yaml - Replaces the more specific \`^hashicorp/vault-secrets-operator\` pattern since \`^hashicorp/vault\` subsumes it - Required for the benvin/vault and benvin/consul branches (vault:2.0.1 and consul:1.22.7) ## Test plan - [ ] Verify artifactapi accepts requests for hashicorp/vault and hashicorp/consul images after merge Reviewed-on: #147	2026-05-23 18:21:25 +10:00
unkinben	dcea768c15	feat(woodpecker): upgrade to v3.14.1 (chart 3.6.3) (#146 ) Reviewed-on: #146	2026-05-23 18:00:55 +10:00
unkinben	e05f9bfd83	feat: increase litellm resources (#144 ) finding litellm performance has dropped, crashed in multiple cases, and then it had scaled to the maximum level using the majority of memory in cluster. - reduce the rate at which litellm autoscales - increase the requests/limits to match usage Reviewed-on: #144	2026-05-23 17:59:43 +10:00
unkinben	445d8b6e7e	feat: add HTTP→HTTPS redirect to Gateway API services (#145 ) Add port 80 HTTP listener and redirect HTTPRoute to artifactapi, cattle-system (rancher), litellm, paperclip, and puppetboard — restoring the redirect behaviour that existed on the previous nginx/traefik Ingress resources. Reviewed-on: #145	2026-05-23 17:34:07 +10:00
unkinben	c2637da068	feat(artifactapi): migrate Ingress to Gateway API (#129 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Notes The original Ingress had nginx-specific annotations (`proxy-body-size: 10g`, `proxy-read-timeout: 600`) which are not portable to Gateway API. These can be re-introduced via a Traefik `Middleware` CRD if needed. ## Test plan - [ ] ArgoCD syncs the app cleanly - [ ] cert-manager issues the `artifactapi-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://artifactapi.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #129	2026-05-23 16:06:33 +10:00
unkinben	90ddd932fe	feat(puppet): migrate puppetdb Ingress to Gateway API (#131 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetboard.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetdb-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetdb.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #131	2026-05-23 16:05:26 +10:00
unkinben	2c6d88aa6b	feat(puppet): migrate puppetboard Ingress to Gateway API (#130 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetdb.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetboard-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #130	2026-05-23 01:31:28 +10:00
unkinben	58368948d9	feat(paperclip): migrate Ingress to Gateway API (#133 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the paperclip app cleanly - [ ] cert-manager issues the `paperclip-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #133	2026-05-23 01:31:03 +10:00
unkinben	4f5c3f7ea0	feat(litellm): migrate Ingress to Gateway API (#134 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the litellm app cleanly - [ ] cert-manager issues the `litellm-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://litellm.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #134	2026-05-23 01:29:54 +10:00
unkinben	fd87cb96b5	feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs (#143 ) ## Changes - Upgrade external-dns chart from 1.19.0 → 1.21.1 (app v0.19.0 → v0.21.0) - Remove `gateway-tcproute` source — `TCPRoute` CRD is not installed, causing crash-loop - Add `gateway-tlsroute` source — `TLSRoute` CRD is installed (Gateway API 1.5.1) ## Why The pod was crash-looping every minute with `failed to list *v1alpha2.TCPRoute: the server could not find the requested resource` because the TCPRoute CRD doesn't exist in this cluster. TLSRoute was previously removed but its CRD does exist. Reviewed-on: #143	2026-05-23 01:28:20 +10:00
unkinben	d619f9195e	benvin/externaldns_compatability (#142 ) Reviewed-on: #142	2026-05-23 01:17:20 +10:00
unkinben	1944dbbfcd	temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout (#140 ) Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found. Reviewed-on: #140	2026-05-23 01:07:45 +10:00
unkinben	0940cc20f8	fix(traefik): listen on port 443 directly for Gateway API compatibility (#138 ) ## Problem Gateway listeners with `port: 443` were rejected with `PortUnavailable: Cannot find entryPoint for Gateway: no matching entryPoint for port 443 and protocol "HTTPS"`. Traefik matches Gateway listener ports against its internal entryPoint ports (pod-level), not the Service's `exposedPort`. The `websecure` entryPoint was configured on port `8443`, so port `443` listeners had no match. ## Fix - `ports.websecure.port: 443` — Traefik now binds directly on 443 - `securityContext.capabilities.add: [NET_BIND_SERVICE]` — allows a non-root process to bind to privileged ports (<1024) The Service `exposedPort` stays at `443`, so external connectivity is unchanged. All existing Gateway listeners (`port: 443`) are correct as-is. Applies to both internal and external Traefik instances. ## Test plan - [ ] Traefik pods restart cleanly - [ ] `kubectl get gateway -A` shows listeners as `Programmed: True` - [ ] `https://rancher.k8s.syd1.au.unkin.net` (already merged) is reachable Reviewed-on: #138	2026-05-23 00:44:13 +10:00
unkinben	20ce2b1b92	feat(cattle-system): migrate rancher Ingress to Gateway API (#132 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the cattle-system app cleanly - [ ] cert-manager issues the `rancher-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://rancher.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #132	2026-05-23 00:24:57 +10:00
unkinben	64dc5a0242	fix(traefik): add instance labels to GatewayClasses (#137 ) ## Problem GatewayClasses were `Unknown` even after controllerName was fixed. The `kubernetesGateway` `labelSelector` applies to all watched resources, including GatewayClasses themselves. Since neither GatewayClass had a `traefik.io/instance` label, both Traefik instances filtered them out and never accepted them. ## Fix - `gatewayclass-internal.yaml`: add `traefik.io/instance: internal` - `gatewayclass-external.yaml`: add `traefik.io/instance: external` ## Test plan - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #137	2026-05-23 00:23:18 +10:00
unkinben	57c14d32c0	fix(traefik): remove invalid controllerName flag causing CrashLoopBackOff (#136 ) ## URGENT — Traefik pods are CrashLoopBackOff The merged PR #135 added `--providers.kubernetesgateway.controllerName` as an `additionalArguments` entry. Traefik v3.7.0 does not support this flag and fails immediately on startup. Old replica sets are still running (one pod each) but new pods cannot come up. ## Fix - Remove `additionalArguments` from both `values-internal.yaml` and `values-external.yaml` - Revert GatewayClass `controllerName` back to `traefik.io/gateway-controller` (the hardcoded Traefik default — no override mechanism exists in v3.7.0) ## After merge GatewayClasses will remain `Unknown` until a separate solution for internal/external separation is implemented (the `labelSelector` approach needs further investigation). Reviewed-on: #136	2026-05-22 23:58:56 +10:00
unkinben	2df359c4a9	fix(traefik): set controllerName on GatewayClasses and Traefik providers (#135 ) ## Problem Both GatewayClasses (`traefik-internal`, `traefik-external`) were stuck as `Unknown`. Neither Traefik deployment had `controllerName` set in `kubernetesGateway`, so both defaulted to `traefik.io/gateway-controller` — which matched neither GatewayClass. ## Fix - `gatewayclass-internal.yaml`: `controllerName: traefik.io/gateway-controller-internal` - `gatewayclass-external.yaml`: `controllerName: traefik.io/gateway-controller-external` - `values-internal.yaml`: added `controllerName: traefik.io/gateway-controller-internal` - `values-external.yaml`: added `controllerName: traefik.io/gateway-controller-external` ## Test plan - [ ] ArgoCD syncs traefik-system cleanly - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #135	2026-05-22 23:44:06 +10:00
unkinben	f53a2dc4f8	fix: terraform_vault must be RFC1123 compliant (#128 ) Reviewed-on: #128	2026-05-21 23:19:20 +10:00
unkinben	c5dd3cc5cb	feat: add terraform_vault role (#127 ) this adds a service account that can be used to run the terraform_vault workflows with, so that we can access the jwt to generate a token Reviewed-on: #127	2026-05-21 23:13:48 +10:00
unkinben	462b2b3f4f	feat(externaldns): add Gateway API sources for httproute, tlsroute, grpcroute, tcproute, udproute (#126 ) Reviewed-on: #126	2026-05-18 00:11:33 +10:00
unkinben	73c9b3f603	fix(traefik): replace invalid controllername flag with labelSelector for v3 (#125 ) Remove --providers.kubernetesgateway.controllername which does not exist in Traefik v3, update GatewayClass controllerName to the standard v3 value, and use labelSelector on each instance's kubernetesGateway provider to differentiate internal vs external traffic. Reviewed-on: #125	2026-05-18 00:03:12 +10:00
unkinben	9a01a9ef19	fix: enable gateway/ingress class on platform project (#124 ) - add missing classes to platform required to deploy traefik system Reviewed-on: #124	2026-05-17 23:56:12 +10:00
unkinben	53553ddcfd	feat: deploy internal/external traefik routers (#119 ) deploy traefik for internal and external applications. port forwarding from the external routers will only occur to the IP of the traefik-external service. - traefik-internal and traefik-external added - each is a different deployment Reviewed-on: #119	2026-05-17 23:44:50 +10:00
unkinben	5d3ff3a0f4	feat(artifactapi): allow kubeconform and kustomize from GitHub (#123 ) Adds immutable patterns for yannh/kubeconform and kubernetes-sigs/kustomize to fix 403 Forbidden errors when downloading their Linux amd64 releases. Reviewed-on: #123	2026-05-17 12:19:27 +10:00
unkinben	c3002dc3c1	feat(artifactapi): allow kubecolor releases from GitHub (#122 ) Reviewed-on: #122	2026-05-11 23:39:48 +10:00
unkinben	27db33536a	feat(artifactapi): allow almalinux, debian, and fedora from Docker Hub (#121 ) Reviewed-on: #121	2026-05-10 22:56:39 +10:00
unkinben	8a7068a1c4	feat(artifactapi): add argo-helm as a remote and virtual helm member (#120 ) Reviewed-on: #120	2026-05-10 22:53:43 +10:00