Merge branch 'main' into fix-kanidm-replication-config

fix(kanidm): remove invalid automatic_refresh from replication config (#179 )
Reviewed-on: #179
2026-05-30 23:33:36 +10:00 · 2026-05-30 23:20:48 +10:00 · 2026-05-30 23:15:41 +10:00 · 2026-05-30 23:11:38 +10:00 · 2026-05-30 23:00:46 +10:00 · 2026-05-26 23:58:57 +10:00
70 changed files with 1592 additions and 183 deletions
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: artifactapi
  namespace: artifactapi
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: artifactapi.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: artifactapi.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: artifactapi-tls
        mode: Terminate
@@ -0,0 +1,49 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: artifactapi-http-redirect
  namespace: artifactapi
 spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: artifactapi
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: artifactapi
  namespace: artifactapi
 spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: artifactapi
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: artifactapi-api
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,32 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    nginx.ingress.kubernetes.io/proxy-body-size: 10g
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  name: artifactapi-ingress
  namespace: artifactapi
 spec:
  ingressClassName: nginx
  rules:
    - host: artifactapi.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: artifactapi-api
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - artifactapi.k8s.syd1.au.unkin.net
      secretName: artifactapi-tls
@@ -6,7 +6,8 @@ resources:
  - artifactapi-deployment.yaml
  - artifactapi-hpa.yaml
  - configmap.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - postgres-deployment.yaml
  - pvc.yaml
@@ -6,8 +6,10 @@ remotes:
    immutable_patterns:
      - "^cloudnative-pg/cloudnative-pg"
      - "^emberstack/helm-charts"
      - "^open-webui/open-webui"
      - "^openvoxproject/"
      - "^stakater/reloader"
      - "^stalwartlabs/stalwart"
      - "^voxpupuli/puppetboard"
      - "^woodpecker-ci/helm"
    cache:
@@ -30,10 +32,15 @@ remotes:
      - "^bitnami/"
      - "^curlimages/curl"
      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/vault-secrets-operator"
+      - "^hashicorp/consul"
      - "^hashicorp/vault"
      - "^jfrog/"
      - "^kanidm/"
      - "^rancher/"
      - "^rspamd/rspamd"
      - "^tozd/postfix"
      - "^traefik/"
      - "^valkey/valkey"
      - "^ubi9/ubi-minimal"
      - "^victoriametrics/"
      - "^woodpeckerci/"
@@ -5,6 +5,7 @@ remotes:
    description: "GitHub releases and files"
    mutable_patterns:
      - ".*/archive/refs/heads/.*.tar.gz$"
      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
    immutable_patterns:
      - ".*/archive/refs/tags/.*.tar.gz$"
      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
@@ -35,6 +36,7 @@ remotes:
      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
@@ -15,6 +15,13 @@ metadata:
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: rancher.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
@@ -24,6 +31,7 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - kind: Secret
+          - group: ""
            kind: Secret
            name: rancher-tls
        mode: Terminate
@@ -1,6 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: rancher-http-redirect
  namespace: cattle-system
 spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: rancher
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: rancher
  namespace: cattle-system
@@ -8,12 +32,17 @@ spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
-    - name: rancher
+    - group: gateway.networking.k8s.io
      kind: Gateway
      name: rancher
      sectionName: https
  rules:
    - backendRefs:
-        - name: rancher
+        - group: ""
          kind: Service
          name: rancher
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -0,0 +1,53 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: consul
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    cert-manager.io/alt-names: consul.service.consul
    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: consul.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      hostname: consul.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: consul-tls
    - name: consul-svc
      port: 443
      protocol: HTTPS
      hostname: consul.service.consul
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: consul-tls
@@ -0,0 +1,83 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: consul-http-redirect
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
 spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: consul
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: consul
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
 spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: consul
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: consul-ui
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: consul-svc
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
 spec:
  hostnames:
    - consul.service.consul
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: consul
      sectionName: consul-svc
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: consul-ui
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,8 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - gateway.yaml
  - httproute.yaml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: consul
@@ -0,0 +1,51 @@
 # kanidm
 Three-replica kanidm identity server with Vault-managed replication certificates.
 ## Architecture
 - Per-pod `server-N.toml` in `resources/` — each has its own replication origin hardcoded
 - `config-init` busybox init container copies the right config and injects peer certs from the
  vault-synced `kanidm-repl-certs` Secret at pod startup
 - `reloader.stakater.com/auto: "true"` triggers a rolling restart when the ConfigMap or Secret changes
 - Vault path: `kv/kubernetes/namespace/kanidm/default/repl-certs`
  - Keys: `kanidm-0`, `kanidm-1`, `kanidm-2` — each holds that pod's replication certificate
 ## Initial setup
 After the first pod starts, generate the admin credentials:
 ```bash
 kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml admin
 kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml idm_admin
 ```
 ## Replication certificate rotation
 When certs need to be renewed, update vault and reloader will roll the StatefulSet:
 ```bash
 # Get new cert from a pod
 kubectl exec -it -n kanidm kanidm-N -- /sbin/kanidmd renew-replication-certificate -c /config/server.toml
 # Write updated cert to vault (reloader triggers restart automatically)
 vault kv patch kv/kubernetes/namespace/kanidm/default/repl-certs "kanidm-N=<cert>"
 ```
 ## Resolving domain UUID mismatch
 If pods initialized independently (each with a different domain UUID), replication will fail with
 `Consumer Domain UUID does not match`. Fix by resetting kanidm-1 and kanidm-2 to sync from
 kanidm-0 (the authoritative node):
 ```bash
 # Scale down to avoid split-brain during reset
 kubectl scale statefulset -n kanidm kanidm --replicas=1
 # Delete the stale PVCs for the replica pods
 kubectl delete pvc -n kanidm data-kanidm-1 data-kanidm-2
 # Scale back up — replicas start with empty DBs and automatic_refresh=true
 # will trigger a full sync from kanidm-0 once TLS peer certs are verified
 kubectl scale statefulset -n kanidm kanidm --replicas=3
 ```
@@ -0,0 +1,26 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: kanidm-tls
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  secretName: kanidm-tls
  issuerRef:
    kind: ClusterIssuer
    name: vault-issuer
  commonName: auth.unkin.net
  dnsNames:
    - auth.unkin.net
    - au.auth.unkin.net
    - kanidm.k8s.syd1.au.unkin.net
    - kanidm.kanidm.svc.cluster.local
    - kanidm-0.kanidm-headless.kanidm.svc.cluster.local
    - kanidm-1.kanidm-headless.kanidm.svc.cluster.local
    - kanidm-2.kanidm-headless.kanidm.svc.cluster.local
  privateKey:
    algorithm: RSA
    size: 4096
@@ -0,0 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
    traefik.io/instance: internal
  annotations:
    external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    - name: https-passthrough
      port: 443
      protocol: TLS
      tls:
        mode: Passthrough
      allowedRoutes:
        namespaces:
          from: Same
@@ -0,0 +1,29 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: kanidm-http-redirect
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  hostnames:
    - kanidm.k8s.syd1.au.unkin.net
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: kanidm
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,29 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - serviceaccount.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
  - certificate.yaml
  - service.yaml
  - statefulset.yaml
  - poddisruptionbudget.yaml
  - gateway.yaml
  - httproute.yaml
  - tlsroute.yaml
 configMapGenerator:
  - name: kanidm-config
    namespace: kanidm
    options:
      disableNameSuffixHash: true
      labels:
        app.kubernetes.io/name: kanidm
        app.kubernetes.io/instance: kanidm
    files:
      - server-0.toml=resources/server-0.toml
      - server-1.toml=resources/server-1.toml
      - server-2.toml=resources/server-2.toml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: kanidm
@@ -0,0 +1,15 @@
 ---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: kanidm
      app.kubernetes.io/instance: kanidm
@@ -0,0 +1,37 @@
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: kanidm-repl
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kanidm-repl-certs"]
    verbs: ["get", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: kanidm-repl
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 subjects:
  - kind: ServiceAccount
    name: kanidm
    namespace: kanidm
 roleRef:
  kind: Role
  name: kanidm-repl
  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,19 @@
 version = "2"
 domain = "auth.unkin.net"
 origin = "https://auth.unkin.net"
 bindaddress = "[::]:8443"
 db_path = "/data/kanidm.db"
 db_arc_size = 2048
 tls_chain = "/data/tls/tls.crt"
 tls_key = "/data/tls/tls.key"
 log_level = "info"
 [online_backup]
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
 [replication]
 origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
@@ -0,0 +1,19 @@
 version = "2"
 domain = "auth.unkin.net"
 origin = "https://auth.unkin.net"
 bindaddress = "[::]:8443"
 db_path = "/data/kanidm.db"
 db_arc_size = 2048
 tls_chain = "/data/tls/tls.crt"
 tls_key = "/data/tls/tls.key"
 log_level = "info"
 [online_backup]
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
 [replication]
 origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
@@ -0,0 +1,19 @@
 version = "2"
 domain = "auth.unkin.net"
 origin = "https://auth.unkin.net"
 bindaddress = "[::]:8443"
 db_path = "/data/kanidm.db"
 db_arc_size = 2048
 tls_chain = "/data/tls/tls.crt"
 tls_key = "/data/tls/tls.key"
 log_level = "info"
 [online_backup]
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
 [replication]
 origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
@@ -0,0 +1,43 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  type: ClusterIP
  ports:
    - name: https
      port: 8443
      targetPort: https
      protocol: TCP
  selector:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: kanidm-headless
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: https
      port: 8443
      targetPort: https
      protocol: TCP
    - name: replication
      port: 8444
      targetPort: replication
      protocol: TCP
  selector:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
@@ -0,0 +1,9 @@
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
@@ -0,0 +1,133 @@
 ---
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: kanidm
  namespace: kanidm
  annotations:
    reloader.stakater.com/auto: "true"
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  serviceName: kanidm-headless
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: kanidm
      app.kubernetes.io/instance: kanidm
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kanidm
        app.kubernetes.io/instance: kanidm
    spec:
      serviceAccountName: kanidm
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: kanidm
                  app.kubernetes.io/instance: kanidm
              topologyKey: kubernetes.io/hostname
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        fsGroup: 1000
      initContainers:
        - name: config-init
          image: busybox:1.36
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -e
              cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
              for peer in kanidm-0 kanidm-1 kanidm-2; do
                [ "${peer}" = "${POD_NAME}" ] && continue
                cert_file="/repl-certs/${peer}"
                [ -s "${cert_file}" ] || continue
                fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
                printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
                  "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
              done
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          volumeMounts:
            - name: config-template
              mountPath: /config-template
              readOnly: true
            - name: config
              mountPath: /config
            - name: repl-certs
              mountPath: /repl-certs
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
      containers:
        - name: kanidm
          image: kanidm/server:1.10.3
          command: ["/sbin/kanidmd"]
          args: ["server", "-c", "/config/server.toml"]
          ports:
            - name: https
              containerPort: 8443
              protocol: TCP
            - name: replication
              containerPort: 8444
              protocol: TCP
          volumeMounts:
            - name: data
              mountPath: /data
            - name: config
              mountPath: /config
              readOnly: true
            - name: tls
              mountPath: /data/tls
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
          resources:
            requests:
              memory: 256Mi
              cpu: 100m
            limits:
              memory: 1Gi
              cpu: 500m
          readinessProbe:
            tcpSocket:
              port: 8443
            initialDelaySeconds: 15
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: 8443
            initialDelaySeconds: 30
            periodSeconds: 30
      volumes:
        - name: config-template
          configMap:
            name: kanidm-config
        - name: config
          emptyDir: {}
        - name: repl-certs
          secret:
            secretName: kanidm-repl-certs
        - name: tls
          secret:
            secretName: kanidm-tls
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: [ReadWriteOnce]
        storageClassName: cephrbd-fast-delete
        resources:
          requests:
            storage: 10Gi
@@ -0,0 +1,26 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: TLSRoute
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  hostnames:
    - kanidm.k8s.syd1.au.unkin.net
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: kanidm
      sectionName: https-passthrough
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: kanidm
          port: 8443
          weight: 1
@@ -0,0 +1,18 @@
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
  name: default
  namespace: kanidm
 spec:
  allowedNamespaces:
    - kanidm
  kubernetes:
    audiences:
      - vault
    role: default
    serviceAccount: default
    tokenExpirationSeconds: 600
  method: kubernetes
  mount: k8s/au/syd1
  vaultConnectionRef: vso-system/default
@@ -0,0 +1,20 @@
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
  name: repl-certs
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  vaultAuthRef: default
  mount: kv
  type: kv-v2
  path: kubernetes/namespace/kanidm/default/repl-certs
  refreshAfter: 5m
  destination:
    name: kanidm-repl-certs
    create: true
    overwrite: true
  hmacSecretData: true
@@ -76,11 +76,11 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: 500m
+      cpu: "1"
-      memory: 512Mi
+      memory: 1Gi
    requests:
      cpu: 250m
-      memory: 256Mi
+      memory: 512Mi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
@@ -56,10 +56,10 @@ spec:
          resources:
            limits:
              cpu: "2"
-              memory: 6Gi
+              memory: 8Gi
            requests:
              cpu: 250m
-              memory: 2Gi
+              memory: 6Gi
          volumeMounts:
            - mountPath: /app/config.yaml
              name: config
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: litellm
  namespace: litellm
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: litellm.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: litellm.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: litellm-tls
        mode: Terminate
@@ -10,14 +10,14 @@ spec:
    kind: Deployment
    name: litellm
  minReplicas: 2
-  maxReplicas: 10
+  maxReplicas: 4
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
-          averageUtilization: 60
+          averageUtilization: 80
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0
@@ -25,7 +25,7 @@ spec:
      policies:
        - type: Percent
          value: 100
-          periodSeconds: 30
+          periodSeconds: 60
        - type: Pods
          value: 4
          periodSeconds: 30
@@ -34,7 +34,7 @@ spec:
      selectPolicy: Min
      policies:
        - type: Percent
-          value: 10
+          value: 30
          periodSeconds: 60
        - type: Pods
          value: 2
@@ -0,0 +1,49 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: litellm-http-redirect
  namespace: litellm
 spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: litellm
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: litellm
  namespace: litellm
 spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: litellm
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: litellm
          port: 4000
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: litellm
  namespace: litellm
 spec:
  rules:
    - host: litellm.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: litellm
                port:
                  number: 4000
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - litellm.k8s.syd1.au.unkin.net
      secretName: litellm-tls
@@ -7,7 +7,8 @@ resources:
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: paperclip
  namespace: paperclip
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: paperclip.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: paperclip.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: paperclip-tls
        mode: Terminate
@@ -0,0 +1,49 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: paperclip-http-redirect
  namespace: paperclip
 spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: paperclip
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: paperclip
  namespace: paperclip
 spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: paperclip
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: paperclip
          port: 3100
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: paperclip
  namespace: paperclip
 spec:
  rules:
    - host: paperclip.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: paperclip
                port:
                  number: 3100
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - paperclip.k8s.syd1.au.unkin.net
      secretName: paperclip-tls
@@ -6,7 +6,8 @@ resources:
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - services.yaml
  - vaultauth.yaml
@@ -0,0 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - priorityclasses.yaml
@@ -0,0 +1,36 @@
 ---
 apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
  name: low
 value: 100
 preemptionPolicy: Never
 globalDefault: false
 description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
 ---
 apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
  name: power
 value: 100
 preemptionPolicy: Never
 globalDefault: false
 description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
 ---
 apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
  name: medium
 value: 10000
 preemptionPolicy: PreemptLowerPriority
 globalDefault: false
 description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
 ---
 apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
  name: high
 value: 100000
 preemptionPolicy: PreemptLowerPriority
 globalDefault: false
 description: "High-importance services. Will preempt medium- and low-priority pods if necessary."
@@ -0,0 +1,41 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetboard.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetboard.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: puppetboard-tls
        mode: Terminate
@@ -0,0 +1,34 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetdb.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: puppetdb-tls
        mode: Terminate
@@ -0,0 +1,59 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard-http-redirect
  namespace: puppet
 spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: puppetboard
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: puppetboard
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: puppetboard
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  hostnames:
    - puppetdb.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: puppetdb
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: puppetdb
          port: 8080
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,34 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  rules:
    - host: puppetboard.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: puppetboard
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - puppetboard.k8s.syd1.au.unkin.net
      secretName: puppetboard-tls
@@ -1,34 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  rules:
    - host: puppetdb.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: puppetdb
                port:
                  number: 8080
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - puppetdb.k8s.syd1.au.unkin.net
      secretName: puppetdb-tls
@@ -25,8 +25,10 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
+  - gateway_puppetboard.yaml
-  - ingress_puppetdb.yaml
+  - httproute_puppetboard.yaml
  - gateway_puppetdb.yaml
  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -9,7 +9,6 @@ metadata:
  name: puppetdb
  namespace: puppet
 spec:
  clusterIP: null
  ports:
  - name: pdb-http
    port: 8080
@@ -0,0 +1,52 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    cert-manager.io/alt-names: vault.service.consul,vault.query.consul
    external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: vault.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      hostname: vault.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: vault-tls
    - name: vault-direct
      port: 8200
      protocol: HTTPS
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: vault-tls
@@ -0,0 +1,84 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: vault-http-redirect
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
 spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: vault
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
 spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: vault
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: vault
          port: 8200
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: vault-consul
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
 spec:
  hostnames:
    - vault.service.consul
    - vault.query.consul
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: vault
      sectionName: vault-direct
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: vault
          port: 8200
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,9 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - gateway.yaml
  - httproute.yaml
  - role_k8s-service-registration.yaml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: vault
@@ -0,0 +1,24 @@
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: vault-k8s-service-registration
  namespace: vault
 rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "update", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: vault-k8s-service-registration
  namespace: vault
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vault-k8s-service-registration
 subjects:
  - kind: ServiceAccount
    name: vault
    namespace: vault
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "v1.19.2"
+    version: "v1.20.2"
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
@@ -1,6 +1,11 @@
 crds:
  enabled: true
 config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  kind: ControllerConfiguration
  enableGatewayAPI: true
 replicaCount: 2
 resources:
@@ -0,0 +1,16 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/consul
 helmCharts:
  - name: consul
    repo: https://helm.releases.hashicorp.com
    version: "1.9.7"
    releaseName: consul
    namespace: consul
    valuesFile: values.yaml
    apiVersions:
      - policy/v1/PodDisruptionBudget
@@ -0,0 +1,58 @@
 global:
  name: consul
  datacenter: au-syd1
  domain: consul
 server:
  image: hashicorp/consul:1.22.7
  replicas: 5
  bootstrapExpect: 5
  storage: 10Gi
  storageClass: cephrbd-fast-delete
  connect: true
  disruptionBudget:
    maxUnavailable: 1
  extraConfig: |
    {
      "disable_remote_exec": true,
      "disable_update_check": true,
      "performance": {
        "raft_multiplier": 10
      },
      "ports": {
        "dns": 8600,
        "grpc": 8502,
        "http": 8500,
        "https": -1
      },
      "primary_datacenter": "au-syd1"
    }
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 2Gi
      cpu: "1"
 client:
  enabled: false
 ui:
  enabled: true
  service:
    type: ClusterIP
 connectInject:
  enabled: false
 dns:
  enabled: true
  type: LoadBalancer
  annotations: |
    purelb.io/service-group: "common"
    purelb.io/addresses: 198.18.200.5
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: external-dns
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.19.0"
+    version: "1.21.1"
    releaseName: externaldns
    namespace: externaldns
    valuesFile: values.yaml
@@ -25,10 +25,7 @@ sources:
  - service
  - ingress
  - gateway-httproute
  - gateway-tlsroute
  - gateway-grpcroute
  - gateway-tcproute
  - gateway-udproute
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -0,0 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/kanidm
@@ -0,0 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/priority-classes
@@ -94,5 +94,7 @@ ports:
    port: 80
  websecure:
    port: 443
  vault-direct:
    port: 8200
 enabled: true
@@ -0,0 +1,14 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/vault
 helmCharts:
  - name: vault
    repo: https://helm.releases.hashicorp.com
    version: "0.32.0"
    releaseName: vault
    namespace: vault
    valuesFile: values.yaml
@@ -0,0 +1,79 @@
 server:
  image:
    repository: hashicorp/vault
    tag: "2.0.1"
  ha:
    enabled: true
    replicas: 5
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui            = true
        disable_mlock = true
        listener "tcp" {
          address         = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_disable     = "true"
        }
        storage "raft" {
          path = "/vault/data"
          retry_join {
            leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
          }
        }
        service_registration "kubernetes" {}
  dataStorage:
    enabled: true
    size: 10Gi
    storageClass: cephrbd-fast-delete
    accessMode: ReadWriteOnce
  extraEnv:
    - name: VAULT_K8S_NAMESPACE
      value: vault
    - name: VAULT_K8S_POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
  statefulSet:
    securityContext:
      container:
        capabilities:
          add:
            - IPC_LOCK
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 2Gi
      cpu: 1000m
 injector:
  enabled: false
 ui:
  enabled: true
  serviceType: ClusterIP
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: woodpecker
    repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.5.1"
+    version: "3.6.3"
    releaseName: woodpecker
    namespace: woodpecker
    valuesFile: values.yaml
@@ -2,6 +2,7 @@ agent:
  replicaCount: 3
  env:
    WOODPECKER_MAX_WORKFLOWS: "8"
    WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
    WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
    WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
@@ -15,11 +15,14 @@ spec:
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
      - path: apps/overlays/*/cnpg-system
      - path: apps/overlays/*/consul
      - path: apps/overlays/*/elastic-system
      - path: apps/overlays/*/externaldns
      - path: apps/overlays/*/inteldeviceplugins-system
      - path: apps/overlays/*/jfrog
      - path: apps/overlays/*/kanidm
      - path: apps/overlays/*/node-feature-discovery
      - path: apps/overlays/*/priority-classes
      - path: apps/overlays/*/puppet
      - path: apps/overlays/*/purelb
      - path: apps/overlays/*/reflector-system
@@ -27,6 +30,7 @@ spec:
      - path: apps/overlays/*/reposync
      - path: apps/overlays/*/traefik-system
      - path: apps/overlays/*/vm-system
      - path: apps/overlays/*/vault
      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
  template:
@@ -41,6 +45,12 @@ spec:
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{path[3]}}'  # Use directory name as namespace
      ignoreDifferences:
      - group: ""
        kind: ConfigMap
        name: kanidm-repl-certs
        jsonPointers:
        - /data
      syncPolicy:
        automated:
          prune: true
@@ -21,18 +21,26 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'certificates'
      server: https://kubernetes.default.svc
    - namespace: 'consul'
      server: https://kubernetes.default.svc
    - namespace: 'externaldns'
      server: https://kubernetes.default.svc
    - namespace: 'jfrog'
      server: https://kubernetes.default.svc
    - namespace: 'kanidm'
      server: https://kubernetes.default.svc
    - namespace: 'node-feature-discovery'
      server: https://kubernetes.default.svc
    - namespace: 'priority-classes'
      server: https://kubernetes.default.svc
    - namespace: 'purelb'
      server: https://kubernetes.default.svc
    - namespace: 'puppet'
      server: https://kubernetes.default.svc
    - namespace: 'reposync'
      server: https://kubernetes.default.svc
    - namespace: 'vault'
      server: https://kubernetes.default.svc
    - namespace: 'woodpecker'
      server: https://kubernetes.default.svc
  clusterResourceWhitelist: