chore: migrate reloader/reflector to virtual/helm

2026-05-05 21:27:59 +10:00
30 changed files with 49 additions and 365 deletions
@@ -19,10 +19,7 @@ remotes:
    package: "docker"
    description: "Docker Hub registry"
    immutable_patterns:
-      - "^library/almalinux"
      - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
      - "^library/nginx"
      - "^library/postgres"
      - "^library/redis"
@@ -33,7 +30,6 @@ remotes:
      - "^hashicorp/vault-secrets-operator"
      - "^jfrog/"
      - "^rancher/"
-      - "^traefik/"
      - "^ubi9/ubi-minimal"
      - "^victoriametrics/"
      - "^woodpeckerci/"
@@ -26,9 +26,6 @@ remotes:
      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
-      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
      - "lxc/incus/.*.tar.gz$"
      - "mikefarah/yq/.*/yq_linux_amd64$"
      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -56,7 +53,6 @@ remotes:
      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
    cache:
      immutable_ttl: 0
      mutable_ttl: 7200
@@ -109,17 +109,6 @@ remotes:
      immutable_ttl: 0
      mutable_ttl: 3600

-  traefik:
-    base_url: "https://traefik.github.io/charts"
-    package: "helm"
-    description: "Traefik Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
  victoriametrics:
    base_url: "https://victoriametrics.github.io/helm-charts/"
    package: "helm"
@@ -130,14 +119,3 @@ remotes:
    cache:
      immutable_ttl: 0
      mutable_ttl: 3600
-
-  argo-helm:
-    base_url: "https://argoproj.github.io/argo-helm"
-    package: "helm"
-    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
@@ -13,6 +13,4 @@ virtuals:
      - purelb
      - rancher-stable
      - stakater
-      - traefik
      - victoriametrics
-      - argo-helm
@@ -1,29 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
-  name: rancher
-  namespace: cattle-system
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: rancher-tls
-        mode: Terminate
@@ -1,20 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: rancher
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - rancher.k8s.syd1.au.unkin.net
+      secretName: rancher-tls
+  rules:
+    - host: rancher.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80
@@ -6,5 +6,4 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - gateway.yaml
-  - httproute.yaml
+  - ingress.yaml
@@ -7,12 +7,12 @@ resources:

 helmCharts:
  - name: intel-device-plugins-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://intel.github.io/helm-charts/
    version: "0.35.0"
    releaseName: intel-device-plugins-operator
    namespace: inteldeviceplugins-system
  - name: intel-device-plugins-gpu
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://intel.github.io/helm-charts/
    version: "0.34.1"
    releaseName: intel-gpu-plugin
    namespace: inteldeviceplugins-system
@@ -1,9 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: traefik-external
-spec:
-  controllerName: traefik.io/gateway-controller
@@ -1,9 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: internal
-  name: traefik-internal
-spec:
-  controllerName: traefik.io/gateway-controller
@@ -1,8 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gatewayclass-internal.yaml
-  - gatewayclass-external.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik-system
@@ -6,6 +6,5 @@ resources:
  - namespace.yaml
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
-  - serviceaccount_terraform_vault.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
@@ -1,6 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-vault
-  namespace: woodpecker
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: rancher
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://releases.rancher.com/server-charts/stable
    version: "2.13.1"
    releaseName: rancher
    namespace: cattle-system
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: cert-manager
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://charts.jetstack.io
    version: "v1.19.2"
    releaseName: cert-manager
    namespace: cert-manager
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: cloudnative-pg
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://cloudnative-pg.github.io/charts
    version: "0.27.0"
    releaseName: cloudnative-pg-operator
    namespace: cnpg-system
@@ -9,7 +9,7 @@ resources:

 helmCharts:
  - name: eck-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://helm.elastic.co
    version: "3.2.0"
    releaseName: elastic-operator
    namespace: elastic-system
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: external-dns
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://kubernetes-sigs.github.io/external-dns/
    version: "1.19.0"
    releaseName: externaldns
    namespace: externaldns
@@ -24,11 +24,6 @@ policy: "sync"
 sources:
  - service
  - ingress
-  - gateway-httproute
-  - gateway-tlsroute
-  - gateway-grpcroute
-  - gateway-tcproute
-  - gateway-udproute

 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -54,5 +49,3 @@ extraArgs:
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx
-
-logLevel: debug
@@ -9,13 +9,13 @@ resources:

 helmCharts:
  - name: victoria-metrics-cluster
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://victoriametrics.github.io/helm-charts/
    version: "0.33.0"
    releaseName: victoria-metrics-cluster
    namespace: observability
    valuesFile: values-vmcluster.yaml
  - name: victoria-metrics-agent
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://victoriametrics.github.io/helm-charts/
    version: "0.30.0"
    releaseName: victoria-metrics-agent
    namespace: observability
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: reflector
-    repo: oci://ghcr.io/emberstack/helm-charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "10.0.1"
    releaseName: reflector
    namespace: reflector-system
@@ -1,24 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/traefik-system
-
-helmCharts:
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-internal
-    namespace: traefik-system
-    valuesFile: values-internal.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-external
-    namespace: traefik-system
-    valuesFile: values-external.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget
@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=external"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "dmz"
-    purelb.io/addresses: 198.18.199.0
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.199.0"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true
@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=internal"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.4
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.200.4"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true
@@ -25,7 +25,6 @@ spec:
      - path: apps/overlays/*/reflector-system
      - path: apps/overlays/*/reloader-system
      - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/traefik-system
      - path: apps/overlays/*/vm-system
      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
@@ -8,6 +8,7 @@ spec:
  description: Observability stack (metrics, monitoring)
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
+    - https://victoriametrics.github.io/helm-charts/
  destinations:
    - namespace: 'observability'
      server: https://kubernetes.default.svc
@@ -9,7 +9,14 @@ spec:
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    - https://charts.jetstack.io
+    - https://cloudnative-pg.github.io/charts
+    - https://helm.elastic.co
    - https://purelb.github.io/purelb/charts
+    - https://intel.github.io/helm-charts/
+    - https://kubernetes-sigs.github.io/external-dns/
+    - https://releases.rancher.com/server-charts/stable
+    - https://victoriametrics.github.io/helm-charts/
    - oci://gcr.io/k8s-staging-nfd/charts
    - oci://ghcr.io/woodpecker-ci/helm/woodpecker
  destinations:
@@ -60,10 +67,6 @@ spec:
      kind: Certificate
    - group: 'cert-manager.io'
      kind: Issuer
-    - group: 'gateway.networking.k8s.io'
-      kind: GatewayClass
-    - group: 'networking.k8s.io'
-      kind: IngressClass
  namespaceResourceWhitelist:
    - group: '*'
      kind: '*'
@@ -3,8 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
  - au-syd1-apps.yaml
  - argocd-self-app.yaml