chore: migrate non oci helm repos to virtual/helm

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -19,10 +19,7 @@ remotes:
     package: "docker"
     description: "Docker Hub registry"
     immutable_patterns:
-      - "^library/almalinux"
       - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
       - "^library/nginx"
       - "^library/postgres"
       - "^library/redis"
@@ -33,7 +30,6 @@ remotes:
       - "^hashicorp/vault-secrets-operator"
       - "^jfrog/"
       - "^rancher/"
-      - "^traefik/"
       - "^ubi9/ubi-minimal"
       - "^victoriametrics/"
       - "^woodpeckerci/"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -26,9 +26,6 @@ remotes:
       - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
       - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
       - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
-      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
       - "lxc/incus/.*.tar.gz$"
       - "mikefarah/yq/.*/yq_linux_amd64$"
       - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -56,7 +53,6 @@ remotes:
       - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
       - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
       - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
     cache:
       immutable_ttl: 0
       mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-helm.yaml

@@ -109,17 +109,6 @@ remotes:
       immutable_ttl: 0
       mutable_ttl: 3600
 
-  traefik:
-    base_url: "https://traefik.github.io/charts"
-    package: "helm"
-    description: "Traefik Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
   victoriametrics:
     base_url: "https://victoriametrics.github.io/helm-charts/"
     package: "helm"
@@ -130,14 +119,3 @@ remotes:
     cache:
       immutable_ttl: 0
       mutable_ttl: 3600
-
-  argo-helm:
-    base_url: "https://argoproj.github.io/argo-helm"
-    package: "helm"
-    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600

apps/base/artifactapi/resources/conf.d/virtual-helm.yaml

@@ -13,6 +13,4 @@ virtuals:
       - purelb
       - rancher-stable
       - stakater
-      - traefik
       - victoriametrics
-      - argo-helm

apps/base/cattle-system/gateway.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
-  name: rancher
-  namespace: cattle-system
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: rancher-tls
-        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: rancher
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/cattle-system/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - rancher.k8s.syd1.au.unkin.net
+      secretName: rancher-tls
+  rules:
+    - host: rancher.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml

apps/base/traefik-system/gatewayclass-external.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: traefik-external
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/gatewayclass-internal.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: internal
-  name: traefik-internal
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gatewayclass-internal.yaml
-  - gatewayclass-external.yaml

apps/base/traefik-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik-system

apps/base/woodpecker/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - namespace.yaml
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
-  - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_vault.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-vault
-  namespace: woodpecker

apps/overlays/au-syd1/externaldns/values.yaml

@@ -24,11 +24,6 @@ policy: "sync"
 sources:
   - service
   - ingress
-  - gateway-httproute
-  - gateway-tlsroute
-  - gateway-grpcroute
-  - gateway-tcproute
-  - gateway-udproute
 
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -54,5 +49,3 @@ extraArgs:
   - --rfc2136-tsig-axfr
   - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
   - --ingress-class=nginx
-
-logLevel: debug

apps/overlays/au-syd1/traefik-system/kustomization.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/traefik-system
-
-helmCharts:
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-internal
-    namespace: traefik-system
-    valuesFile: values-internal.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-external
-    namespace: traefik-system
-    valuesFile: values-external.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/traefik-system/values-external.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=external"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "dmz"
-    purelb.io/addresses: 198.18.199.0
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.199.0"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=internal"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.4
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.200.4"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

argocd/applicationsets/platform.yaml

@@ -25,7 +25,6 @@ spec:
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker

argocd/projects/platform.yaml

@@ -60,10 +60,6 @@ spec:
       kind: Certificate
     - group: 'cert-manager.io'
       kind: Issuer
-    - group: 'gateway.networking.k8s.io'
-      kind: GatewayClass
-    - group: 'networking.k8s.io'
-      kind: IngressClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'

clusters/au-syd1/bootstrap/kustomization.yaml

@@ -3,8 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
   - au-syd1-apps.yaml
   - argocd-self-app.yaml