feat: update gems for puppet

- add deep_merge, ipaddr, and hiera-eyaml gems
- pin intel-device-plugins to 0.35.0

apps/base/artifact-keeper/cnpg_cluster.yaml

@@ -1,94 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: artifact-keeper-postgres
-  namespace: artifact-keeper
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: artifact_registry
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: registry
-      secret:
-        name: postgres-credentials
-      postInitSQL:
-        - CREATE DATABASE dependency_track OWNER registry;
-        - GRANT ALL PRIVILEGES ON DATABASE dependency_track TO registry;
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: "1"
-      memory: 1Gi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 20Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/artifact-keeper/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: artifact-keeper-postgres-pooler
-  namespace: artifact-keeper
-spec:
-  cluster:
-    name: artifact-keeper-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: artifact-keeper-pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - artifact-keeper-pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/artifact-keeper/configmap_app-config.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: config
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-data:
-  BIND_ADDRESS: "0.0.0.0:8080"
-  LOG_LEVEL: "info,artifact_keeper=debug"
-  STORAGE_BACKEND: "s3"
-  MEILISEARCH_URL: "http://meilisearch:7700"
-  TRIVY_URL: "http://trivy:8090"
-  DEPENDENCY_TRACK_URL: "http://dtrack:8080"
-  DEPENDENCY_TRACK_ENABLED: "true"
-  SCAN_WORKSPACE_PATH: "/scan-workspace"
-  PLUGINS_DIR: "/data/plugins"

apps/base/artifact-keeper/configmap_s3-env.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: s3-env
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-data:
-  S3_ENDPOINT: "https://radosgw.service.consul"
-  S3_BUCKET: "artifact-keeper"
-  S3_REGION: "ap-southeast-2"
-  S3_PATH_STYLE: "true"

apps/base/artifact-keeper/deployment_backend.yaml

@@ -1,171 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: backend
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: artifact-keeper
-      app.kubernetes.io/instance: ak
-      app.kubernetes.io/component: backend
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: artifact-keeper
-        app.kubernetes.io/instance: ak
-        app.kubernetes.io/component: backend
-    spec:
-      serviceAccountName: backend
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchExpressions:
-                    - key: app.kubernetes.io/component
-                      operator: In
-                      values:
-                        - backend
-                topologyKey: kubernetes.io/hostname
-      initContainers:
-        - name: wait-for-postgres
-          image: postgres:16-alpine
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 16Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              echo "Waiting for PostgreSQL..."
-              until pg_isready -h artifact-keeper-postgres-pooler -p 5432 -U registry; do
-                sleep 3
-              done
-              echo "PostgreSQL is ready"
-        - name: wait-for-meilisearch
-          image: alpine:3.20
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 16Mi
-              ephemeral-storage: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-              ephemeral-storage: 64Mi
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              echo "Waiting for Meilisearch..."
-              until wget -qO- http://meilisearch:7700/health >/dev/null 2>&1; do
-                sleep 3
-              done
-              echo "Meilisearch is ready"
-      containers:
-        - name: backend
-          image: "ghcr.io/artifact-keeper/artifact-keeper-backend:dev"
-          imagePullPolicy: Always
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              if [ -f /shared/dtrack-api-key ] && [ -s /shared/dtrack-api-key ]; then
-                export DEPENDENCY_TRACK_API_KEY="$(cat /shared/dtrack-api-key)"
-              fi
-              exec /usr/local/bin/artifact-keeper
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-            - name: grpc
-              containerPort: 9090
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: config
-            - configMapRef:
-                name: s3-env
-            - secretRef:
-                name: s3-credentials
-            - secretRef:
-                name: app-secrets
-          resources:
-            limits:
-              cpu: "2"
-              memory: 2Gi
-            requests:
-              cpu: 250m
-              memory: 256Mi
-          livenessProbe:
-            httpGet:
-              path: /livez
-              port: http
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 5
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-            - name: storage
-              mountPath: /data/storage
-              subPath: storage
-            - name: storage
-              mountPath: /data/backups
-              subPath: backups
-            - name: storage
-              mountPath: /data/plugins
-              subPath: plugins
-            - name: scan-workspace
-              mountPath: /scan-workspace
-            - name: shared-config
-              mountPath: /shared
-              readOnly: true
-      volumes:
-        - name: tmp
-          emptyDir:
-            sizeLimit: 256Mi
-        - name: storage
-          persistentVolumeClaim:
-            claimName: storage
-        - name: scan-workspace
-          persistentVolumeClaim:
-            claimName: scan-workspace
-        - name: shared-config
-          persistentVolumeClaim:
-            claimName: shared-config

apps/base/artifact-keeper/deployment_dtrack.yaml

@@ -1,111 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dtrack
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: dependency-track
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: artifact-keeper
-      app.kubernetes.io/instance: ak
-      app.kubernetes.io/component: dependency-track
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: artifact-keeper
-        app.kubernetes.io/instance: ak
-        app.kubernetes.io/component: dependency-track
-    spec:
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
-      initContainers:
-        - name: wait-for-postgres
-          image: postgres:16-alpine
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 16Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              echo "Waiting for PostgreSQL..."
-              until pg_isready -h artifact-keeper-postgres-pooler -p 5432 -U registry; do
-                sleep 3
-              done
-              echo "PostgreSQL is ready"
-      containers:
-        - name: dtrack-api
-          image: "dependencytrack/apiserver:4.11.4"
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: ALPINE_DATABASE_MODE
-              value: "external"
-            - name: ALPINE_DATABASE_URL
-              value: "jdbc:postgresql://artifact-keeper-postgres-pooler:5432/dependency_track"
-            - name: ALPINE_DATABASE_DRIVER
-              value: "org.postgresql.Driver"
-            - name: ALPINE_DATABASE_USERNAME
-              value: "registry"
-            - name: ALPINE_DATABASE_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-credentials
-                  key: password
-            - name: ALPINE_DATA_DIRECTORY
-              value: "/data"
-            - name: ALPINE_ENFORCE_AUTHENTICATION
-              value: "true"
-            - name: ALPINE_CORS_ENABLED
-              value: "true"
-            - name: ALPINE_CORS_ALLOW_ORIGIN
-              value: "*"
-            - name: JAVA_OPTIONS
-              value: "-Xmx4g"
-          resources:
-            limits:
-              cpu: "2"
-              memory: 6Gi
-            requests:
-              cpu: 250m
-              memory: 4Gi
-          volumeMounts:
-            - name: dtrack-data
-              mountPath: /data
-            - name: tmp
-              mountPath: /tmp
-      volumes:
-        - name: tmp
-          emptyDir:
-            sizeLimit: 256Mi
-        - name: dtrack-data
-          persistentVolumeClaim:
-            claimName: dtrack

apps/base/artifact-keeper/deployment_meilisearch.yaml

@@ -1,154 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: meilisearch
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: meilisearch
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: artifact-keeper
-      app.kubernetes.io/instance: ak
-      app.kubernetes.io/component: meilisearch
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: artifact-keeper
-        app.kubernetes.io/instance: ak
-        app.kubernetes.io/component: meilisearch
-    spec:
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
-      initContainers:
-        - name: fix-ownership
-          image: busybox:1.37
-          securityContext:
-            runAsNonRoot: false
-            runAsUser: 0
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - CHOWN
-                - FOWNER
-          resources:
-            requests:
-              cpu: 10m
-              memory: 16Mi
-              ephemeral-storage: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-              ephemeral-storage: 64Mi
-          command: ["sh", "-c", "chown -R 1000:1000 /meili_data"]
-          volumeMounts:
-            - name: meilisearch-data
-              mountPath: /meili_data
-        - name: version-guard
-          image: busybox:1.37
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 16Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          command: ["sh", "-c"]
-          args:
-            - |
-              EXPECTED="v1.12"
-              VERSION_FILE="/meili_data/data.ms/VERSION"
-              if [ ! -f "$VERSION_FILE" ]; then
-                echo "No existing database, fresh start"
-                exit 0
-              fi
-              CURRENT=$(cat "$VERSION_FILE" 2>/dev/null || echo "unknown")
-              echo "Current DB version: $CURRENT, expected image: $EXPECTED"
-              if echo "$CURRENT" | grep -qv "$(echo $EXPECTED | sed 's/^v//')"; then
-                echo "Version mismatch — wiping data.ms for clean re-index"
-                rm -rf /meili_data/data.ms
-                echo "Done. Backend will re-index automatically."
-              else
-                echo "Versions match, keeping existing data"
-              fi
-          volumeMounts:
-            - name: meilisearch-data
-              mountPath: /meili_data
-      containers:
-        - name: meilisearch
-          image: "getmeili/meilisearch:v1.12"
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            readOnlyRootFilesystem: false
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          ports:
-            - name: http
-              containerPort: 7700
-              protocol: TCP
-          env:
-            - name: MEILI_MASTER_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: app-secrets
-                  key: MEILISEARCH_API_KEY
-            - name: MEILI_ENV
-              value: "production"
-            - name: MEILI_MAX_INDEXING_THREADS
-              value: "4"
-          resources:
-            limits:
-              cpu: "1"
-              memory: 8Gi
-            requests:
-              cpu: 250m
-              memory: 512Mi
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 7700
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 5
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 7700
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 5
-          volumeMounts:
-            - name: meilisearch-data
-              mountPath: /meili_data
-            - name: tmp
-              mountPath: /tmp
-      volumes:
-        - name: tmp
-          emptyDir:
-            sizeLimit: 256Mi
-        - name: meilisearch-data
-          persistentVolumeClaim:
-            claimName: meilisearch

apps/base/artifact-keeper/deployment_trivy.yaml

@@ -1,87 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: trivy
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: trivy
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: artifact-keeper
-      app.kubernetes.io/instance: ak
-      app.kubernetes.io/component: trivy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: artifact-keeper
-        app.kubernetes.io/instance: ak
-        app.kubernetes.io/component: trivy
-    spec:
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 10000
-        fsGroup: 10000
-      containers:
-        - name: trivy
-          image: "aquasec/trivy:0.62.1"
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          command: ["trivy"]
-          args: ["server", "--listen", "0.0.0.0:8090", "--cache-dir", "/home/trivy/.cache"]
-          ports:
-            - name: http
-              containerPort: 8090
-              protocol: TCP
-          resources:
-            limits:
-              cpu: "1"
-              memory: 2Gi
-            requests:
-              cpu: 250m
-              memory: 256Mi
-          readinessProbe:
-            tcpSocket:
-              port: 8090
-            initialDelaySeconds: 15
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 5
-          livenessProbe:
-            tcpSocket:
-              port: 8090
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          volumeMounts:
-            - name: trivy-cache
-              mountPath: /home/trivy/.cache
-            - name: tmp
-              mountPath: /tmp
-            - name: scan-workspace
-              mountPath: /scan-workspace
-              readOnly: true
-      volumes:
-        - name: tmp
-          emptyDir:
-            sizeLimit: 256Mi
-        - name: trivy-cache
-          persistentVolumeClaim:
-            claimName: trivy-cache
-        - name: scan-workspace
-          persistentVolumeClaim:
-            claimName: scan-workspace

apps/base/artifact-keeper/deployment_web.yaml

@@ -1,98 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: web
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: artifact-keeper
-      app.kubernetes.io/instance: ak
-      app.kubernetes.io/component: web
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: artifact-keeper
-        app.kubernetes.io/instance: ak
-        app.kubernetes.io/component: web
-    spec:
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchExpressions:
-                    - key: app.kubernetes.io/component
-                      operator: In
-                      values:
-                        - web
-                topologyKey: kubernetes.io/hostname
-      containers:
-        - name: web
-          image: "ghcr.io/artifact-keeper/artifact-keeper-web:dev"
-          imagePullPolicy: Always
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          ports:
-            - name: http
-              containerPort: 3000
-              protocol: TCP
-          env:
-            - name: NEXT_PUBLIC_API_URL
-              value: ""
-            - name: BACKEND_URL
-              value: "http://backend:8080"
-            - name: NODE_ENV
-              value: "production"
-          resources:
-            limits:
-              cpu: "1"
-              memory: 1Gi
-            requests:
-              cpu: 250m
-              memory: 256Mi
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 5
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 20
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 5
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-            - name: nextjs-cache
-              mountPath: /app/.next/cache
-      volumes:
-        - name: tmp
-          emptyDir:
-            sizeLimit: 256Mi
-        - name: nextjs-cache
-          emptyDir:
-            sizeLimit: 1Gi

apps/base/artifact-keeper/ingress.yaml

@@ -1,286 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: artifact-keeper
-  namespace: artifact-keeper
-  annotations:
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: 10g
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifacts.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifacts.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: artifacts.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /api
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /health
-            pathType: Exact
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /ready
-            pathType: Exact
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /v2
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /maven
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /npm
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /pypi
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /nuget
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /cargo
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /gems
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /go
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /helm
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /debian
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /rpm
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /alpine
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /composer
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /conan
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /conda
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /swift
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /terraform
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /cocoapods
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /hex
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /pub
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /lfs
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /ivy
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /chef
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /puppet
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /ansible
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /cran
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /huggingface
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /jetbrains
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /vscode
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /proto
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /incus
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /ext
-            pathType: Prefix
-            backend:
-              service:
-                name: backend
-                port:
-                  number: 8080
-          - path: /dtrack
-            pathType: Prefix
-            backend:
-              service:
-                name: dtrack
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: web
-                port:
-                  number: 3000
-  tls:
-    - hosts:
-        - artifacts.k8s.syd1.au.unkin.net
-      secretName: artifacts-tls

apps/base/artifact-keeper/job_dtrack-init.yaml

@@ -1,70 +0,0 @@
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: dtrack-init
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: dependency-track
-spec:
-  backoffLimit: 3
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: artifact-keeper
-        app.kubernetes.io/instance: ak
-        app.kubernetes.io/component: dependency-track
-    spec:
-      restartPolicy: OnFailure
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
-      containers:
-        - name: dtrack-init
-          image: alpine:3.20
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-              ephemeral-storage: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-              ephemeral-storage: 128Mi
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              apk add --no-cache curl jq >/dev/null 2>&1
-              /bin/sh /scripts/init-dtrack.sh
-          env:
-            - name: DEPENDENCY_TRACK_URL
-              value: "http://dtrack:8080"
-            - name: DEPENDENCY_TRACK_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: app-secrets
-                  key: DEPENDENCY_TRACK_ADMIN_PASSWORD
-          volumeMounts:
-            - name: init-script
-              mountPath: /scripts
-              readOnly: true
-            - name: shared-config
-              mountPath: /shared
-      volumes:
-        - name: init-script
-          configMap:
-            name: dtrack-init
-            defaultMode: 0755
-        - name: shared-config
-          persistentVolumeClaim:
-            claimName: shared-config

apps/base/artifact-keeper/kustomization.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount_backend.yaml
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - configmap_app-config.yaml
-  - configmap_s3-env.yaml
-  - persistentvolumeclaims.yaml
-  - service_backend.yaml
-  - service_dtrack.yaml
-  - service_meilisearch.yaml
-  - service_trivy.yaml
-  - service_web.yaml
-  - deployment_backend.yaml
-  - deployment_dtrack.yaml
-  - deployment_meilisearch.yaml
-  - deployment_trivy.yaml
-  - deployment_web.yaml
-  - job_dtrack-init.yaml
-  - ingress.yaml
-
-configMapGenerator:
-  - name: dtrack-init
-    files:
-      - resources/init-dtrack.sh
-    options:
-      disableNameSuffixHash: true

apps/base/artifact-keeper/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper

apps/base/artifact-keeper/persistentvolumeclaims.yaml

@@ -1,78 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: storage
-  namespace: artifact-keeper
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: cephfs-raid5-delete
-  resources:
-    requests:
-      storage: 10Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: scan-workspace
-  namespace: artifact-keeper
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: cephfs-raid5-delete
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: shared-config
-  namespace: artifact-keeper
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: cephfs-raid5-delete
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: dtrack
-  namespace: artifact-keeper
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: cephrbd-fast-delete
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: meilisearch
-  namespace: artifact-keeper
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: cephrbd-fast-delete
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: trivy-cache
-  namespace: artifact-keeper
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: cephrbd-fast-delete
-  resources:
-    requests:
-      storage: 5Gi

apps/base/artifact-keeper/resources/init-dtrack.sh

@@ -1,43 +0,0 @@
-#!/bin/sh
-set -e
-DT_URL="${DEPENDENCY_TRACK_URL:-http://ak-artifact-keeper-dtrack:8080}"
-DT_ADMIN_USER="admin"
-DT_DEFAULT_PASS="admin"
-DT_NEW_PASS="${DEPENDENCY_TRACK_ADMIN_PASSWORD}"
-API_KEY_FILE="/shared/dtrack-api-key"
-
-echo "[dtrack-init] Waiting for Dependency-Track at $DT_URL ..."
-for i in $(seq 1 60); do
-  if curl -sf "$DT_URL/api/version" > /dev/null 2>&1; then break; fi
-  if [ "$i" -eq 60 ]; then echo "[dtrack-init] ERROR: timeout"; exit 1; fi
-  sleep 5
-done
-
-if [ -f "$API_KEY_FILE" ] && [ -s "$API_KEY_FILE" ]; then
-  echo "[dtrack-init] API key already provisioned -- skipping"
-  exit 0
-fi
-
-TOKEN=$(curl -sf -X POST "$DT_URL/api/v1/user/login" \
-  -H "Content-Type: application/x-www-form-urlencoded" \
-  -d "username=${DT_ADMIN_USER}&password=${DT_NEW_PASS}" 2>/dev/null || true)
-
-if [ -z "$TOKEN" ] || echo "$TOKEN" | grep -qi "FORCE_PASSWORD_CHANGE"; then
-  curl -sf -o /dev/null -X POST "$DT_URL/api/v1/user/forceChangePassword" \
-    -H "Content-Type: application/x-www-form-urlencoded" \
-    -d "username=${DT_ADMIN_USER}&password=${DT_DEFAULT_PASS}&newPassword=${DT_NEW_PASS}&confirmPassword=${DT_NEW_PASS}"
-  TOKEN=$(curl -sf -X POST "$DT_URL/api/v1/user/login" \
-    -H "Content-Type: application/x-www-form-urlencoded" \
-    -d "username=${DT_ADMIN_USER}&password=${DT_NEW_PASS}" 2>/dev/null || true)
-fi
-
-if [ -z "$TOKEN" ]; then echo "[dtrack-init] ERROR: auth failed"; exit 1; fi
-
-API_KEY=$(curl -sf "$DT_URL/api/v1/team" \
-  -H "Authorization: Bearer $TOKEN" | \
-  jq -r '.[] | select(.name == "Automation") | .apiKeys[0].key // empty')
-
-if [ -z "$API_KEY" ]; then echo "[dtrack-init] ERROR: no API key"; exit 1; fi
-
-echo "$API_KEY" > "$API_KEY_FILE"
-echo "[dtrack-init] Done"

apps/base/artifact-keeper/service_backend.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: backend
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-      protocol: TCP
-    - name: grpc
-      port: 9090
-      targetPort: grpc
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/component: backend

apps/base/artifact-keeper/service_dtrack.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: dtrack
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: dependency-track
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/component: dependency-track

apps/base/artifact-keeper/service_meilisearch.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: meilisearch
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: meilisearch
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 7700
-      targetPort: http
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/component: meilisearch

apps/base/artifact-keeper/service_trivy.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: trivy
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: trivy
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 8090
-      targetPort: http
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/component: trivy

apps/base/artifact-keeper/service_web.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: web
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: web
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 3000
-      targetPort: http
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/component: web

apps/base/artifact-keeper/serviceaccount_backend.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: backend
-  namespace: artifact-keeper
-  labels:
-    app.kubernetes.io/name: artifact-keeper
-    app.kubernetes.io/instance: ak
-    app.kubernetes.io/part-of: artifact-keeper
-    app.kubernetes.io/component: backend

apps/base/artifact-keeper/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: artifact-keeper
-spec:
-  allowedNamespaces:
-    - artifact-keeper
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/artifact-keeper/vaultstaticsecret.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: artifact-keeper
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/artifact-keeper/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: app-secrets
-  namespace: artifact-keeper
-spec:
-  destination:
-    create: true
-    name: app-secrets
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/artifact-keeper/default/app-secrets
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: s3-credentials
-  namespace: artifact-keeper
-spec:
-  destination:
-    create: true
-    name: s3-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/artifact-keeper/default/s3-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/artifactapi/resources/remotes.yaml

@@ -63,7 +63,6 @@ remotes:
     description: "Gitea download site"
     include_patterns:
       - "act_runner/.*/act_runner-.*-linux-amd64$"
-      - "tea/.*/tea-.*-linux-amd64$"
     cache:
       file_ttl: 0
       index_ttl: 0

apps/base/elastic-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: elastic-system
-  name: elastic-system

apps/base/jfrog/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jfrog

apps/base/observability/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml

apps/base/observability/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: observability
-  name: observability

apps/base/puppet/cronjob_g10k-code.yaml

@@ -26,6 +26,38 @@ spec:
         spec:
           hostname: g10k-code
           imagePullSecrets: null
+          initContainers:
+            - name: fetch-config
+              image: alpine/git:latest
+              imagePullPolicy: IfNotPresent
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  cpu: 100m
+                  memory: 128Mi
+              args:
+                - |
+                  set -e
+                  echo "Cloning r10k config repository..."
+                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
+                  cp /tmp/config/r10k.yaml /shared/r10k.yaml
+                  echo "r10k.yaml fetched successfully"
+              command:
+                - /bin/sh
+                - -c
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - all
+                runAsGroup: 999
+                runAsNonRoot: true
+                runAsUser: 999
+              volumeMounts:
+                - mountPath: /shared
+                  name: shared-config
           containers:
             - name: g10k-code
               image: git.unkin.net/unkin/almalinux9-g10k:20260308
@@ -37,16 +69,11 @@ spec:
                 limits:
                   cpu: 200m
                   memory: 256Mi
-              command:
-                - /bin/sh
-                - -c
               args:
-                - |
-                  set -e
-                  echo "Cloning r10k config repository..."
-                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/r10k-config
-                  echo "Running g10k..."
-                  /usr/bin/g10k -config /tmp/r10k-config/r10k.yaml
+                - -config
+                - /shared/r10k.yaml
+              command:
+                - /usr/bin/g10k
               envFrom: null
               env: []
               securityContext:
@@ -60,6 +87,8 @@ spec:
               volumeMounts:
                 - mountPath: /etc/puppetlabs/code/
                   name: puppet-code-volume
+                - mountPath: /shared
+                  name: shared-config
           restartPolicy: OnFailure
           securityContext:
             fsGroup: 999
@@ -67,3 +96,6 @@ spec:
             - name: puppet-code-volume
               persistentVolumeClaim:
                 claimName: puppetserver-code-shared
+            - name: shared-config
+              persistentVolumeClaim:
+                claimName: puppetserver-shared-config

apps/base/puppet/cronjob_generate-types.yaml

@@ -41,14 +41,16 @@ spec:
                     echo "Generating types for $env"
                     puppet generate types --environment "$env"
                   done
-              env: []
+              env:
+                - name: PUPPETSERVER_JAVA_ARGS
+                  value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
               resources:
                 limits:
                   cpu: 300m
-                  memory: 1Gi
+                  memory: 256Mi
                 requests:
                   cpu: 200m
-                  memory: 512Mi
+                  memory: 128Mi
               securityContext:
                 runAsUser: 0
                 runAsNonRoot: false

apps/base/puppet/persistentvolumeclaims.yaml

@@ -73,6 +73,24 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: r10k-shared-config
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-shared-config
+  namespace: puppet
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   labels:
     app.kubernetes.io/component: puppetboard

apps/base/purelb/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - lbnodeagents.yaml
-  - servicegroups.yaml

apps/base/purelb/lbnodeagents.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: purelb.io/v1
-kind: LBNodeAgent
-metadata:
-  labels:
-    app.kubernetes.io/component: lbnodeagent
-    app.kubernetes.io/name: purelb
-  name: common
-  namespace: purelb
-spec:
-  local:
-    extlbint: kube-lb0
-    localint: default
-    sendgarp: false
----
-apiVersion: purelb.io/v1
-kind: LBNodeAgent
-metadata:
-  labels:
-    app.kubernetes.io/component: lbnodeagent
-    app.kubernetes.io/name: purelb
-  name: dmz
-  namespace: purelb
-spec:
-  local:
-    extlbint: kube-lb0
-    localint: default
-    sendgarp: false

apps/base/purelb/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: purelb
-  name: purelb

apps/base/purelb/servicegroups.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: purelb.io/v1
-kind: ServiceGroup
-metadata:
-  labels:
-    app.kubernetes.io/component: servicegroup
-    app.kubernetes.io/name: purelb
-  name: common
-  namespace: purelb
-spec:
-  local:
-    v4pools:
-      - aggregation: /32
-        pool: 198.18.200.0/24
-        subnet: 198.18.200.0/24
----
-apiVersion: purelb.io/v1
-kind: ServiceGroup
-metadata:
-  labels:
-    app.kubernetes.io/component: servicegroup
-    app.kubernetes.io/name: purelb
-  name: dmz
-  namespace: purelb
-spec:
-  local:
-    v4pools:
-      - aggregation: /32
-        pool: 198.18.199.0/24
-        subnet: 198.18.199.0/24

apps/base/reposync/configmap_dnf-conf.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync
-    app.kubernetes.io/name: reposync
-  name: dnf-conf
-  namespace: reposync
-data:
-  dnf.conf: |
-    [main]
-    gpgcheck=1
-    installonly_limit=3
-    clean_requirements_on_remove=True
-    best=True
-    skip_if_unavailable=False
-    max_parallel_downloads=6

apps/base/reposync/configmap_openvox-repo.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-openvox7
-    app.kubernetes.io/name: reposync
-  name: openvox7-openvox-repo
-  namespace: reposync
-data:
-  openvox.repo: |
-    [openvox]
-    name=openvox repository
-    baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/9/x86_64/
-    gpgkey=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub
-    enabled=1
-    gpgcheck=1

apps/base/reposync/cronjob_reposync-almalinux9-appstream.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-almalinux9-appstream
-    app.kubernetes.io/name: reposync
-  name: reposync-almalinux9-appstream
-  namespace: reposync
-spec:
-  schedule: "10 2 * * *"
-  timeZone: "Australia/Sydney"
-  concurrencyPolicy: Forbid
-  suspend: false
-  successfulJobsHistoryLimit: 10
-  failedJobsHistoryLimit: 5
-  jobTemplate:
-    spec:
-      completions: 1
-      parallelism: 1
-      backoffLimit: 3
-      ttlSecondsAfterFinished: 3600
-      template:
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: reposync
-              image: git.unkin.net/unkin/almalinux9-base:latest
-              imagePullPolicy: Always
-              command: ["/bin/bash", "-c"]
-              args:
-                - |
-                  set -euo pipefail
-                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
-
-                  # Install reposync
-                  dnf install -y dnf-plugins-core
-
-                  # Sync repository
-                  dnf reposync \
-                    --repoid=$REPO_TYPE \
-                    --destdir=/data \
-                    --download-metadata \
-                    --newest-only \
-                    --delete
-
-                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
-              env:
-                - name: REPO_TYPE
-                  value: "appstream"
-              resources:
-                requests:
-                  cpu: 500m
-                  memory: 1Gi
-                limits:
-                  cpu: 2000m
-                  memory: 4Gi
-              volumeMounts:
-                - name: repodata
-                  mountPath: /data
-                  readOnly: false
-                - name: dnf-conf
-                  mountPath: /etc/dnf/dnf.conf
-                  subPath: dnf.conf
-                  readOnly: true
-          volumes:
-            - name: repodata
-              persistentVolumeClaim:
-                claimName: reposync-almalinux9-appstream-repodata
-            - name: dnf-conf
-              configMap:
-                name: dnf-conf

apps/base/reposync/cronjob_reposync-almalinux9-baseos.yaml

@@ -1,75 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-almalinux9-baseos
-    app.kubernetes.io/name: reposync
-  name: reposync-almalinux9-baseos
-  namespace: reposync
-spec:
-  schedule: "0 2 * * *"
-  timeZone: "Australia/Sydney"
-  concurrencyPolicy: Forbid
-  suspend: false
-  successfulJobsHistoryLimit: 10
-  failedJobsHistoryLimit: 5
-  jobTemplate:
-    spec:
-      completions: 1
-      parallelism: 1
-      backoffLimit: 3
-      ttlSecondsAfterFinished: 3600
-      template:
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: reposync
-              image: git.unkin.net/unkin/almalinux9-base:latest
-              imagePullPolicy: Always
-              command: ["/bin/bash", "-c"]
-              args:
-                - |
-                  set -euo pipefail
-                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
-
-                  # Install reposync
-                  dnf install -y dnf-plugins-core
-
-                  # Create repo directory
-                  mkdir -p /data/almalinux/$REPO_TYPE
-
-                  # Sync repository
-                  dnf reposync \
-                    --repoid=$REPO_TYPE \
-                    --destdir=/data/almalinux/$REPO_TYPE \
-                    --download-metadata \
-                    --newest-only \
-                    --delete
-
-                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
-              env:
-                - name: REPO_TYPE
-                  value: "baseos"
-              resources:
-                requests:
-                  cpu: 500m
-                  memory: 1Gi
-                limits:
-                  cpu: 2000m
-                  memory: 4Gi
-              volumeMounts:
-                - name: repodata
-                  mountPath: /data
-                  readOnly: false
-                - name: dnf-conf
-                  mountPath: /etc/dnf/dnf.conf
-                  subPath: dnf.conf
-                  readOnly: true
-          volumes:
-            - name: repodata
-              persistentVolumeClaim:
-                claimName: reposync-almalinux9-baseos-repodata
-            - name: dnf-conf
-              configMap:
-                name: dnf-conf

apps/base/reposync/cronjob_reposync-epel9.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-epel9
-    app.kubernetes.io/name: reposync
-  name: reposync-epel9
-  namespace: reposync
-spec:
-  schedule: "20 2 * * *"
-  timeZone: "Australia/Sydney"
-  concurrencyPolicy: Forbid
-  suspend: false
-  successfulJobsHistoryLimit: 10
-  failedJobsHistoryLimit: 5
-  jobTemplate:
-    spec:
-      completions: 1
-      parallelism: 1
-      backoffLimit: 3
-      ttlSecondsAfterFinished: 3600
-      template:
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: reposync
-              image: git.unkin.net/unkin/almalinux9-base:latest
-              imagePullPolicy: Always
-              command: ["/bin/bash", "-c"]
-              args:
-                - |
-                  set -euo pipefail
-                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
-
-                  # Install reposync
-                  dnf install -y dnf-plugins-core
-
-                  # Sync repository
-                  dnf reposync \
-                    --repoid=$REPO_TYPE \
-                    --destdir=/data \
-                    --download-metadata \
-                    --newest-only \
-                    --delete
-
-                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
-              env:
-                - name: REPO_TYPE
-                  value: "epel"
-              resources:
-                requests:
-                  cpu: 500m
-                  memory: 1Gi
-                limits:
-                  cpu: 2000m
-                  memory: 4Gi
-              volumeMounts:
-                - name: repodata
-                  mountPath: /data
-                  readOnly: false
-                - name: dnf-conf
-                  mountPath: /etc/dnf/dnf.conf
-                  subPath: dnf.conf
-                  readOnly: true
-          volumes:
-            - name: repodata
-              persistentVolumeClaim:
-                claimName: reposync-epel9-repodata
-            - name: dnf-conf
-              configMap:
-                name: dnf-conf

apps/base/reposync/cronjob_reposync-openvox7.yaml

@@ -1,78 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-openvox7
-    app.kubernetes.io/name: reposync
-  name: reposync-openvox7
-  namespace: reposync
-spec:
-  schedule: "30 2 * * *"
-  timeZone: "Australia/Sydney"
-  concurrencyPolicy: Forbid
-  suspend: false
-  successfulJobsHistoryLimit: 10
-  failedJobsHistoryLimit: 5
-  jobTemplate:
-    spec:
-      completions: 1
-      parallelism: 1
-      backoffLimit: 3
-      ttlSecondsAfterFinished: 3600
-      template:
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: reposync
-              image: git.unkin.net/unkin/almalinux9-base:latest
-              imagePullPolicy: Always
-              command: ["/bin/bash", "-c"]
-              args:
-                - |
-                  set -euo pipefail
-                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
-
-                  # Install reposync
-                  dnf install -y dnf-plugins-core
-
-                  # Sync repository
-                  dnf reposync \
-                    --repoid=$REPO_TYPE \
-                    --destdir=/data \
-                    --download-metadata \
-                    --delete
-
-                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
-              env:
-                - name: REPO_TYPE
-                  value: "openvox"
-              resources:
-                requests:
-                  cpu: 500m
-                  memory: 1Gi
-                limits:
-                  cpu: 2000m
-                  memory: 4Gi
-              volumeMounts:
-                - name: repodata
-                  mountPath: /data
-                  readOnly: false
-                - name: dnf-conf
-                  mountPath: /etc/dnf/dnf.conf
-                  subPath: dnf.conf
-                  readOnly: true
-                - name: openvox-repo
-                  mountPath: /etc/yum.repos.d/openvox.repo
-                  subPath: openvox.repo
-                  readOnly: true
-          volumes:
-            - name: repodata
-              persistentVolumeClaim:
-                claimName: reposync-openvox7-repodata
-            - name: dnf-conf
-              configMap:
-                name: dnf-conf
-            - name: openvox-repo
-              configMap:
-                name: openvox7-openvox-repo

apps/base/reposync/kustomization.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - configmap_dnf-conf.yaml
-  - configmap_openvox-repo.yaml
-  - persistentvolumeclaims.yaml
-  - cronjob_reposync-almalinux9-baseos.yaml
-  - cronjob_reposync-almalinux9-appstream.yaml
-  - cronjob_reposync-epel9.yaml
-  - cronjob_reposync-openvox7.yaml

apps/base/reposync/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: reposync
-  name: reposync

apps/base/reposync/persistentvolumeclaims.yaml

@@ -1,64 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-almalinux9-baseos
-    app.kubernetes.io/name: reposync
-  name: reposync-almalinux9-baseos-repodata
-  namespace: reposync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: cephrbd-fast-delete
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-almalinux9-appstream
-    app.kubernetes.io/name: reposync
-  name: reposync-almalinux9-appstream-repodata
-  namespace: reposync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 20Gi
-  storageClassName: cephrbd-fast-delete
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-epel9
-    app.kubernetes.io/name: reposync
-  name: reposync-epel9-repodata
-  namespace: reposync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 30Gi
-  storageClassName: cephrbd-fast-delete
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app.kubernetes.io/component: reposync-openvox7
-    app.kubernetes.io/name: reposync
-  name: reposync-openvox7-repodata
-  namespace: reposync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: cephrbd-fast-delete

apps/base/vm-system/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml

apps/base/vm-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: vm-system
-  name: vm-system

apps/base/vso-system/clusterrole_vault-service-account-admin.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: vault-service-account-admin
-    app.kubernetes.io/part-of: vault-secrets-system
-  name: vso-system-vault-service-account-admin
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]

apps/base/vso-system/clusterrolebindings.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: rbac
-    app.kubernetes.io/part-of: vault-secrets-operator
-  name: vso-system-vault-secrets-operator-auth-delegator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-  - kind: ServiceAccount
-    name: vault-secrets-operator-controller-manager
-    namespace: vso-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/name: vso-system-vault-admin-binding
-    app.kubernetes.io/part-of: vault-secrets-system
-  name: vso-system-vault-admin-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: vso-system-vault-service-account-admin
-subjects:
-  - kind: ServiceAccount
-    name: vso-system-vault-admin
-    namespace: vso-system

apps/base/vso-system/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount_vault-admin.yaml
-  - clusterrole_vault-service-account-admin.yaml
-  - clusterrolebindings.yaml

apps/base/vso-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: vso-system
-  name: vso-system

apps/base/vso-system/serviceaccount_vault-admin.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/name: vault-admin
-    app.kubernetes.io/part-of: vault-secrets-system
-  name: vso-system-vault-admin
-  namespace: vso-system

apps/overlays/au-syd1/artifact-keeper/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/artifact-keeper

apps/overlays/au-syd1/elastic-system/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: elastic-system
-
-resources:
-  - ../../../base/elastic-system
-
-helmCharts:
-  - name: eck-operator
-    repo: https://helm.elastic.co
-    version: "3.2.0"
-    releaseName: elastic-operator
-    namespace: elastic-system
-    valuesFile: values.yaml

apps/overlays/au-syd1/elastic-system/values.yaml

@@ -1,11 +0,0 @@
-replicaCount: 2
-resources:
-  limits:
-    cpu: 1
-    memory: 1Gi
-  requests:
-    cpu: 10m
-    memory: 150Mi
-podDisruptionBudget:
-  enabled: true
-  minAvailable: 1

apps/overlays/au-syd1/jfrog/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/jfrog
+
+helmCharts:
+  - name: artifactory-jcr
+    repo: https://charts.jfrog.io
+    version: "107.133.10"
+    releaseName: artifactory-jcr
+    namespace: jfrog
+    valuesFile: values.yaml

apps/overlays/au-syd1/jfrog/values.yaml

@@ -0,0 +1,63 @@
+---
+artifactory:
+  ## Artifactory
+  ## See full list of supported Artifactory options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
+  artifactory:
+    ## Default tag is from the artifactory sub-chart in the requirements.yaml
+    image:
+      registry: releases-docker.jfrog.io
+      repository: jfrog/artifactory-jcr
+    resources: {}
+    #  requests:
+    #    memory: "1Gi"
+    #    cpu: "500m"
+    #  limits:
+    #    memory: "4Gi"
+    #    cpu: "1"
+    ## The following Java options are passed to the java process running Artifactory.
+    ## You should set them according to the resources set above.
+    ## IMPORTANT: Make sure resources.limits.memory is at least 1G more than Xmx.
+    javaOpts: {}
+    # xms: "1g"
+    # xmx: "3g"
+    # other: ""
+  installer:
+    platform: jcr-helm
+  ## Nginx
+  ## See full list of supported Nginx options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
+  nginx:
+    enabled: true
+    tlsSecretName: ""
+    service:
+      type: LoadBalancer
+  ## Ingress
+  ## See full list of supported Ingress options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
+  ingress:
+    enabled: false
+    tls:
+  ## PostgreSQL
+  ## See list of supported postgresql options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
+  ## Configuration values for the PostgreSQL dependency sub-chart
+  ## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md
+  postgresql:
+    enabled: true
+  ## This key is required for upgrades to protect old PostgreSQL chart's breaking changes.
+  databaseUpgradeReady: "yes"
+  ## If NOT using the PostgreSQL in this chart (artifactory.postgresql.enabled=false),
+  ## specify custom database details here or leave empty and Artifactory will use embedded derby.
+  ## See full list of database options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
+  # database:
+  jfconnect:
+    enabled: false
+  rtfs:
+    enabled: false
+  onemodel:
+    enabled: false
+  evidence:
+    enabled: false
+  apptrust:
+    enabled: false
+  unifiedpolicy:
+    enabled: false
+  platformfederation:
+    enabled: false

apps/overlays/au-syd1/observability/kustomization.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: observability
-
-resources:
-  - ../../../base/observability
-
-helmCharts:
-  - name: victoria-metrics-cluster
-    repo: https://victoriametrics.github.io/helm-charts/
-    version: "0.33.0"
-    releaseName: victoria-metrics-cluster
-    namespace: observability
-    valuesFile: values-vmcluster.yaml
-  - name: victoria-metrics-agent
-    repo: https://victoriametrics.github.io/helm-charts/
-    version: "0.30.0"
-    releaseName: victoria-metrics-agent
-    namespace: observability
-    valuesFile: values-vmagent.yaml

apps/overlays/au-syd1/observability/values-vmagent.yaml

@@ -1,102 +0,0 @@
-image:
-  repository: victoriametrics/vmagent
-  pullPolicy: IfNotPresent
-global:
-  scrape_interval: 15s
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-podAnnotations:
-  prometheus.io/scrape: "true"
-  prometheus.io/port: "8481"
-replicaCount: 3
-extraArgs:
-  envflag.enable: true
-  envflag.prefix: VM_
-  loggerFormat: json
-  httpListenAddr: :8429
-service:
-  enabled: true
-ingress:
-  enabled: true
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: vmagent.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: vmagent.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-  hosts:
-    - name: vmagent.k8s.syd1.au.unkin.net
-      path:
-        - /
-      port: http
-  tls:
-    - hosts:
-        - vmagent.k8s.syd1.au.unkin.net
-      secretName: vmagent-tls
-  ingressClassName: nginx
-remoteWrite:
-  - url: http://victoria-metrics-cluster-vminsert.observability.svc.cluster.local:8480/insert/0/prometheus/
-scrape_configs:
-  - job_name: vmagent
-    static_configs:
-      - targets: ["localhost:8429"]
-  - job_name: "kubernetes-apiservers"
-    kubernetes_sd_configs:
-      - role: endpoints
-    scheme: https
-    tls_config:
-      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      insecure_skip_verify: true
-    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-    relabel_configs:
-      - source_labels:
-          - __meta_kubernetes_namespace
-          - __meta_kubernetes_service_name
-          - __meta_kubernetes_endpoint_port_name
-        action: keep
-        regex: default;kubernetes;https
-  - job_name: "kubernetes-nodes"
-    scheme: https
-    tls_config:
-      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      insecure_skip_verify: true
-    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-    kubernetes_sd_configs:
-      - role: node
-    relabel_configs:
-      - action: labelmap
-        regex: __meta_kubernetes_node_label_(.+)
-  - job_name: "kubernetes-nodes-cadvisor"
-    scheme: https
-    tls_config:
-      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      insecure_skip_verify: true
-    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-    kubernetes_sd_configs:
-      - role: node
-    metrics_path: /metrics/cadvisor
-    relabel_configs:
-      - action: labelmap
-        regex: __meta_kubernetes_node_label_(.+)
-      - source_labels: [__metrics_path__]
-        target_label: metrics_path
-    metric_relabel_configs:
-      - action: replace
-        source_labels: [pod]
-        regex: '(.+)'
-        target_label: pod_name
-        replacement: '${1}'
-      - action: replace
-        source_labels: [container]
-        regex: '(.+)'
-        target_label: container_name
-        replacement: '${1}'
-      - action: replace
-        target_label: name
-        replacement: k8s_stub
-      - action: replace
-        source_labels: [id]
-        regex: '^/system\.slice/(.+)\.service$'
-        target_label: systemd_service_name
-        replacement: '${1}'

apps/overlays/au-syd1/observability/values-vmcluster.yaml

@@ -1,185 +0,0 @@
-vmselect:
-  enabled: true
-  image:
-    repository: victoriametrics/vmselect
-    pullPolicy: IfNotPresent
-    variant: cluster
-  extraArgs:
-    envflag.enable: true
-    envflag.prefix: VM_
-    loggerFormat: json
-    httpListenAddr: :8481
-    dedup.minScrapeInterval: 15s
-    replicationFactor: 2
-  resources:
-    limits:
-      cpu: 500m
-      memory: 1024Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-  horizontalPodAutoscaler:
-    enabled: true
-    maxReplicas: 10
-    minReplicas: 2
-    metrics:
-      - type: Resource
-        resource:
-          name: cpu
-          target:
-            type: Utilization
-            averageUtilization: 60
-    behavior:
-      scaleUp:
-        stabilizationWindowSeconds: 0
-        selectPolicy: Max
-        policies:
-          - type: Percent
-            value: 100
-            periodSeconds: 30
-          - type: Pods
-            value: 4
-            periodSeconds: 30
-      scaleDown:
-        stabilizationWindowSeconds: 300
-        selectPolicy: Min
-        policies:
-          - type: Percent
-            value: 10
-            periodSeconds: 60
-          - type: Pods
-            value: 2
-            periodSeconds: 60
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8481"
-  podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
-  replicaCount: 2
-  ingress:
-    enabled: true
-    annotations:
-      cert-manager.io/cluster-issuer: vault-issuer
-      cert-manager.io/common-name: vmselect.k8s.syd1.au.unkin.net
-      cert-manager.io/private-key-size: "4096"
-      external-dns.alpha.kubernetes.io/hostname: vmselect.k8s.syd1.au.unkin.net
-      external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    hosts:
-      - name: vmselect.k8s.syd1.au.unkin.net
-        path:
-          - /
-        port: http
-    tls:
-      - hosts:
-          - vmselect.k8s.syd1.au.unkin.net
-        secretName: vmselect-tls
-    ingressClassName: nginx
-
-vminsert:
-  enabled: true
-  image:
-    repository: victoriametrics/vminsert
-    variant: cluster
-    pullPolicy: IfNotPresent
-  extraArgs:
-    envflag.enable: true
-    envflag.prefix: VM_
-    loggerFormat: json
-    httpListenAddr: :8480
-    replicationFactor: 2
-  resources:
-    limits:
-      cpu: 500m
-      memory: 1024Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-  horizontalPodAutoscaler:
-    enabled: true
-    maxReplicas: 10
-    minReplicas: 2
-    metrics:
-      - type: Resource
-        resource:
-          name: cpu
-          target:
-            type: Utilization
-            averageUtilization: 60
-    behavior:
-      scaleUp:
-        stabilizationWindowSeconds: 0
-        selectPolicy: Max
-        policies:
-          - type: Percent
-            value: 100
-            periodSeconds: 30
-          - type: Pods
-            value: 4
-            periodSeconds: 30
-      scaleDown:
-        stabilizationWindowSeconds: 300
-        selectPolicy: Min
-        policies:
-          - type: Percent
-            value: 10
-            periodSeconds: 60
-          - type: Pods
-            value: 2
-            periodSeconds: 60
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8480"
-  podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
-  replicaCount: 2
-  ingress:
-    enabled: true
-    annotations:
-      cert-manager.io/cluster-issuer: vault-issuer
-      cert-manager.io/common-name: vminsert.k8s.syd1.au.unkin.net
-      cert-manager.io/private-key-size: "4096"
-      external-dns.alpha.kubernetes.io/hostname: vminsert.k8s.syd1.au.unkin.net
-      external-dns.alpha.kubernetes.io/target: 198.18.200.0
-      nginx.ingress.kubernetes.io/proxy-body-size: "100m"
-    hosts:
-      - name: vminsert.k8s.syd1.au.unkin.net
-        path:
-          - /
-        port: http
-    tls:
-      - hosts:
-          - vminsert.k8s.syd1.au.unkin.net
-        secretName: vminsert-tls
-    ingressClassName: nginx
-
-vmstorage:
-  enabled: true
-  image:
-    repository: victoriametrics/vmstorage
-    variant: cluster
-    pullPolicy: IfNotPresent
-  retentionPeriod: 180d
-  extraArgs:
-    envflag.enable: true
-    envflag.prefix: VM_
-    loggerFormat: json
-    httpListenAddr: :8482
-    dedup.minScrapeInterval: 15s
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8482"
-  podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
-  persistentVolume:
-    enabled: true
-    name: vmstorage-volume
-    accessModes:
-      - ReadWriteOnce
-    storageClassName: cephrbd-fast-delete
-    mountPath: /storage
-    size: 200Gi
-  replicaCount: 3
-  podManagementPolicy: OrderedReady

apps/overlays/au-syd1/purelb/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: purelb
-
-resources:
-  - ../../../base/purelb
-
-helmCharts:
-  - name: purelb
-    repo: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
-    version: "v0.13.0"
-    releaseName: purelb
-    namespace: purelb
-    valuesFile: values.yaml

apps/overlays/au-syd1/purelb/values.yaml

@@ -1,56 +0,0 @@
-image:
-  repository: registry.gitlab.com/purelb/purelb
-  tag: v0.13.0
-  pullPolicy: Always
-
-allocator:
-  securityContext:
-    runAsNonRoot: true
-    runAsUser: 65534
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - all
-    readOnlyRootFilesystem: true
-  tolerations: []
-
-lbnodeagent:
-  extlbint: kube-lb0
-  localint: default
-  sendgarp: false
-  tolerations: []
-  containerSecurityContext:
-    capabilities:
-      add:
-        - NET_ADMIN
-        - NET_RAW
-      drop:
-        - ALL
-    readOnlyRootFilesystem: false
-    runAsGroup: 0
-    runAsUser: 0
-
-defaultAnnouncer: PureLB
-
-serviceGroup:
-  create: false
-  name: default
-
-Prometheus:
-  allocator:
-    Metrics:
-      enabled: false
-    serviceMonitor:
-      enabled: false
-    prometheusRules:
-      enabled: false
-  lbnodeagent:
-    Metrics:
-      enabled: false
-    serviceMonitor:
-      enabled: false
-    prometheusRules:
-      enabled: false
-
-memberlistSecretKey: 8sb7ikA5qHwQQqxc

apps/overlays/au-syd1/reposync/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: reposync
-
-resources:
-  - ../../../base/reposync

apps/overlays/au-syd1/vm-system/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: vm-system
-
-resources:
-  - ../../../base/vm-system
-
-helmCharts:
-  - name: victoria-metrics-operator
-    repo: https://victoriametrics.github.io/helm-charts/
-    version: "0.57.1"
-    releaseName: victoria-metrics-operator
-    namespace: vm-system
-    valuesFile: values.yaml

apps/overlays/au-syd1/vm-system/values.yaml

@@ -1,9 +0,0 @@
-logLevel: "info"
-replicaCount: 2
-resources:
-  limits:
-    cpu: 500m
-    memory: 512Mi
-  requests:
-    cpu: 50m
-    memory: 128Mi

apps/overlays/au-syd1/vso-system/kustomization.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: vso-system
-
-resources:
-  - ../../../base/vso-system
-
-helmCharts:
-  - name: vault-secrets-operator
-    repo: https://helm.releases.hashicorp.com
-    version: "1.2.0"
-    releaseName: vault-secrets-operator
-    namespace: vso-system
-    valuesFile: values.yaml
-
-patches:
-  - path: patch_vaultauth-remove-namespace.yaml
-    target:
-      group: secrets.hashicorp.com
-      version: v1beta1
-      kind: VaultAuth
-      name: default

apps/overlays/au-syd1/vso-system/patch_vaultauth-remove-namespace.yaml

@@ -1,2 +0,0 @@
-- op: remove
-  path: /spec/namespace

apps/overlays/au-syd1/vso-system/values.yaml

@@ -1,28 +0,0 @@
-defaultVaultConnection:
-  enabled: true
-  address: "https://vault.service.consul:8200"
-  skipTLSVerify: false
-  caCertSecret: "vault-ca-cert"
-
-defaultAuthMethod:
-  enabled: true
-  method: "kubernetes"
-  mount: "k8s/au/syd1"
-  namespace: ""
-  kubernetes:
-    role: "default"
-    serviceAccount: "vault-secrets-operator-controller-manager"
-    tokenAudiences: ["vault"]
-
-controller:
-  replicas: 3
-  resources:
-    limits:
-      cpu: 500m
-      memory: 256Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-
-globalVaultAuth:
-  enabled: true

argocd/applicationsets/kustomization.yaml

@@ -3,6 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/applicationsets/observability.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: observability-apps
-  namespace: argocd
-spec:
-  generators:
-  - git:
-      repoURL: https://git.unkin.net/unkin/argocd-apps
-      revision: HEAD
-      directories:
-      - path: apps/overlays/*/observability
-  template:
-    metadata:
-      name: 'observability-{{path[3]}}'
-    spec:
-      project: observability
-      source:
-        repoURL: https://git.unkin.net/unkin/argocd-apps
-        targetRevision: HEAD
-        path: '{{path}}'
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: '{{path[3]}}'
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - ServerSideApply=true

argocd/applicationsets/platform.yaml

@@ -12,21 +12,16 @@ spec:
       directories:
       - path: apps/overlays/*/artifactapi
       - path: apps/overlays/*/cattle-system
-      - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/certificates
+      - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/cnpg-system
-      - path: apps/overlays/*/elastic-system
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
-      - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/puppet
-      - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
-      - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/vm-system
-      - path: apps/overlays/*/vso-system
+      - path: apps/overlays/*/jfrog
+      - path: apps/overlays/*/puppet
       - path: apps/overlays/*/woodpecker
   template:
     metadata:

argocd/projects/kustomization.yaml

@@ -3,6 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/projects/observability.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: observability
-  namespace: argocd
-spec:
-  description: Observability stack (metrics, monitoring)
-  sourceRepos:
-    - https://git.unkin.net/unkin/argocd-apps
-    - https://victoriametrics.github.io/helm-charts/
-  destinations:
-    - namespace: 'observability'
-      server: https://kubernetes.default.svc
-  clusterResourceWhitelist:
-    - group: ''
-      kind: Namespace
-    - group: 'rbac.authorization.k8s.io'
-      kind: ClusterRole
-    - group: 'rbac.authorization.k8s.io'
-      kind: ClusterRoleBinding
-  namespaceResourceWhitelist:
-    - group: '*'
-      kind: '*'

argocd/projects/platform.yaml

@@ -8,18 +8,14 @@ spec:
   description: Platform infrastructure and core services
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
-    - https://charts.jetstack.io
-    - https://cloudnative-pg.github.io/charts
-    - https://helm.elastic.co
-    - https://helm.releases.hashicorp.com
-    - https://purelb.github.io/purelb/charts
-    - https://intel.github.io/helm-charts/
-    - https://kubernetes-sigs.github.io/external-dns/
-    - https://releases.rancher.com/server-charts/stable
-    - https://victoriametrics.github.io/helm-charts/
-    - oci://gcr.io/k8s-staging-nfd/charts
     - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
+    - https://releases.rancher.com/server-charts/stable
+    - https://charts.jetstack.io
+    - https://kubernetes-sigs.github.io/external-dns/
+    - https://cloudnative-pg.github.io/charts
+    - oci://gcr.io/k8s-staging-nfd/charts
+    - https://intel.github.io/helm-charts/
   destinations:
     - namespace: '*-system'
       server: https://kubernetes.default.svc
@@ -35,12 +31,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
-    - namespace: 'purelb'
-      server: https://kubernetes.default.svc
     - namespace: 'puppet'
       server: https://kubernetes.default.svc
-    - namespace: 'reposync'
-      server: https://kubernetes.default.svc
     - namespace: 'woodpecker'
       server: https://kubernetes.default.svc
   clusterResourceWhitelist:
@@ -58,8 +50,6 @@ spec:
       kind: ValidatingWebhookConfiguration
     - group: 'scheduling.k8s.io'
       kind: PriorityClass
-    - group: 'purelb.io'
-      kind: '*'
     - group: 'nfd.k8s-sigs.io'
       kind: NodeFeatureRule
     - group: 'deviceplugin.intel.com'

ci/validate-apps.sh

@@ -18,6 +18,6 @@ while IFS= read -r -d "" k; do
         -summary \
         -output pretty \
         -verbose \
-        -skip CustomResourceDefinition,GpuDevicePlugin,LBNodeAgent,ServiceGroup \
+        -skip CustomResourceDefinition,GpuDevicePlugin \
         "${schema_args[@]}"
 done < <(find apps/overlays -name kustomization.yaml -print0)