feat(open-webui): HA deployment with CNPG, PDB, and session persistence

- Switch from SQLite/PVC to CNPG PostgreSQL (3 instances, low-resource) with a transaction-mode PgBouncer pooler (2 instances) - Raise open-webui replicas to 3 with priorityClassName: power - Add PodDisruptionBudget (minAvailable: 1) - Add Gateway API sessionPersistence (cookie) on the HTTPS HTTPRoute so WebSocket connections stick to the same backend pod - Add postgres-credentials VaultStaticSecret; DATABASE_URL must be added to kv/kubernetes/namespace/open-webui/default/open-webui-credentials
fix(open-webui): use traefik-internal gateway for chat hostname
2026-05-26 23:37:10 +10:00 · 2026-05-26 23:26:01 +10:00 · 2026-05-26 23:25:26 +10:00 · 2026-05-26 00:11:25 +10:00 · 2026-05-25 23:52:06 +10:00 · 2026-05-25 23:25:48 +10:00
77 changed files with 1839 additions and 183 deletions
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: artifactapi
  namespace: artifactapi
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: artifactapi.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: artifactapi.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: artifactapi-tls
        mode: Terminate
@@ -0,0 +1,49 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: artifactapi-http-redirect
  namespace: artifactapi
 spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: artifactapi
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: artifactapi
  namespace: artifactapi
 spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: artifactapi
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: artifactapi-api
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,32 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    nginx.ingress.kubernetes.io/proxy-body-size: 10g
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  name: artifactapi-ingress
  namespace: artifactapi
 spec:
  ingressClassName: nginx
  rules:
    - host: artifactapi.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: artifactapi-api
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - artifactapi.k8s.syd1.au.unkin.net
      secretName: artifactapi-tls
@@ -6,7 +6,8 @@ resources:
  - artifactapi-deployment.yaml
  - artifactapi-hpa.yaml
  - configmap.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - postgres-deployment.yaml
  - pvc.yaml
@@ -8,6 +8,7 @@ remotes:
      - "^emberstack/helm-charts"
      - "^openvoxproject/"
      - "^stakater/reloader"
      - "^stalwartlabs/stalwart"
      - "^voxpupuli/puppetboard"
      - "^woodpecker-ci/helm"
    cache:
@@ -30,10 +31,15 @@ remotes:
      - "^bitnami/"
      - "^curlimages/curl"
      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/vault-secrets-operator"
+      - "^hashicorp/consul"
      - "^hashicorp/vault"
      - "^jfrog/"
      - "^kanidm/"
      - "^rancher/"
      - "^rspamd/rspamd"
      - "^tozd/postfix"
      - "^traefik/"
      - "^valkey/valkey"
      - "^ubi9/ubi-minimal"
      - "^victoriametrics/"
      - "^woodpeckerci/"
@@ -5,6 +5,7 @@ remotes:
    description: "GitHub releases and files"
    mutable_patterns:
      - ".*/archive/refs/heads/.*.tar.gz$"
      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
    immutable_patterns:
      - ".*/archive/refs/tags/.*.tar.gz$"
      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
@@ -35,6 +36,7 @@ remotes:
      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
@@ -15,6 +15,13 @@ metadata:
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: rancher.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
@@ -24,6 +31,7 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - kind: Secret
+          - group: ""
            kind: Secret
            name: rancher-tls
        mode: Terminate
@@ -1,6 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: rancher-http-redirect
  namespace: cattle-system
 spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: rancher
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: rancher
  namespace: cattle-system
@@ -8,12 +32,17 @@ spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
-    - name: rancher
+    - group: gateway.networking.k8s.io
      kind: Gateway
      name: rancher
      sectionName: https
  rules:
    - backendRefs:
-        - name: rancher
+        - group: ""
          kind: Service
          name: rancher
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -0,0 +1,53 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: consul
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    cert-manager.io/alt-names: consul.service.consul
    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: consul.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      hostname: consul.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: consul-tls
    - name: consul-svc
      port: 443
      protocol: HTTPS
      hostname: consul.service.consul
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: consul-tls
@@ -0,0 +1,83 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: consul-http-redirect
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
 spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: consul
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: consul
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
 spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: consul
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: consul-ui
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: consul-svc
  namespace: consul
  labels:
    app.kubernetes.io/name: consul
    app.kubernetes.io/instance: consul
 spec:
  hostnames:
    - consul.service.consul
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: consul
      sectionName: consul-svc
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: consul-ui
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,8 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - gateway.yaml
  - httproute.yaml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: consul
@@ -0,0 +1,32 @@
 # kanidm
 Single-replica kanidm identity server deployment.
 ## Initial setup
 After the pod starts for the first time, generate the admin and idm_admin credentials:
 ```bash
 kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account admin
 kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account idm_admin
 ```
 ## Adding replication
 If replication is needed in the future:
 1. Scale the StatefulSet to 3 replicas and add `podAntiAffinity` to spread across nodes.
 2. Add a `[replication]` section to `configmap.yaml` per pod (origin is pod-specific:
   `repl://kanidm-N.kanidm-headless.kanidm.svc.cluster.local:8444`).
 3. Add the replication port (8444) back to the StatefulSet container ports and headless service.
 4. Restore `rbac.yaml` for the cert-publisher sidecar, or exchange certificates manually:
 ```bash
 # On each pod, get its replication certificate
 kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd renew-replication-certificate
 # Add each peer's certificate to the other pods' configs under:
 # [replication."repl://<peer-fqdn>:8444"]
 # type = "mutual-pull"
 # partner_cert = "<cert>"
 ```
@@ -0,0 +1,26 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: kanidm-tls
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  secretName: kanidm-tls
  issuerRef:
    kind: ClusterIssuer
    name: vault-issuer
  commonName: auth.unkin.net
  dnsNames:
    - auth.unkin.net
    - au.auth.unkin.net
    - kanidm.k8s.syd1.au.unkin.net
    - kanidm.kanidm.svc.cluster.local
    - kanidm-0.kanidm-headless.kanidm.svc.cluster.local
    - kanidm-1.kanidm-headless.kanidm.svc.cluster.local
    - kanidm-2.kanidm-headless.kanidm.svc.cluster.local
  privateKey:
    algorithm: RSA
    size: 4096
@@ -0,0 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
    traefik.io/instance: internal
  annotations:
    external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    - name: https-passthrough
      port: 443
      protocol: TLS
      tls:
        mode: Passthrough
      allowedRoutes:
        namespaces:
          from: Same
@@ -0,0 +1,29 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: kanidm-http-redirect
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  hostnames:
    - kanidm.k8s.syd1.au.unkin.net
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: kanidm
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,27 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - serviceaccount.yaml
  - certificate.yaml
  - service.yaml
  - statefulset.yaml
  - poddisruptionbudget.yaml
  - gateway.yaml
  - httproute.yaml
  - tlsroute.yaml
 configMapGenerator:
  - name: kanidm-config
    namespace: kanidm
    options:
      disableNameSuffixHash: true
      labels:
        app.kubernetes.io/name: kanidm
        app.kubernetes.io/instance: kanidm
    files:
      - server-0.toml=resources/server-0.toml
      - server-1.toml=resources/server-1.toml
      - server-2.toml=resources/server-2.toml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: kanidm
@@ -0,0 +1,15 @@
 ---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: kanidm
      app.kubernetes.io/instance: kanidm
@@ -0,0 +1,37 @@
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: kanidm-repl
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kanidm-repl-certs"]
    verbs: ["get", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: kanidm-repl
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 subjects:
  - kind: ServiceAccount
    name: kanidm
    namespace: kanidm
 roleRef:
  kind: Role
  name: kanidm-repl
  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,27 @@
 version = "2"
 domain = "auth.unkin.net"
 origin = "https://auth.unkin.net"
 bindaddress = "[::]:8443"
 db_path = "/data/kanidm.db"
 db_arc_size = 2048
 tls_chain = "/data/tls/tls.crt"
 tls_key = "/data/tls/tls.key"
 log_level = "info"
 [online_backup]
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
 [replication]
 origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
 [replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
 type = "mutual-pull"
 partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
 [replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
 type = "mutual-pull"
 partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"
@@ -0,0 +1,27 @@
 version = "2"
 domain = "auth.unkin.net"
 origin = "https://auth.unkin.net"
 bindaddress = "[::]:8443"
 db_path = "/data/kanidm.db"
 db_arc_size = 2048
 tls_chain = "/data/tls/tls.crt"
 tls_key = "/data/tls/tls.key"
 log_level = "info"
 [online_backup]
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
 [replication]
 origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
 [replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
 type = "mutual-pull"
 partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
 [replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
 type = "mutual-pull"
 partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"
@@ -0,0 +1,27 @@
 version = "2"
 domain = "auth.unkin.net"
 origin = "https://auth.unkin.net"
 bindaddress = "[::]:8443"
 db_path = "/data/kanidm.db"
 db_arc_size = 2048
 tls_chain = "/data/tls/tls.crt"
 tls_key = "/data/tls/tls.key"
 log_level = "info"
 [online_backup]
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
 [replication]
 origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
 [replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
 type = "mutual-pull"
 partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
 [replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
 type = "mutual-pull"
 partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
@@ -0,0 +1,43 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  type: ClusterIP
  ports:
    - name: https
      port: 8443
      targetPort: https
      protocol: TCP
  selector:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: kanidm-headless
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: https
      port: 8443
      targetPort: https
      protocol: TCP
    - name: replication
      port: 8444
      targetPort: replication
      protocol: TCP
  selector:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
@@ -0,0 +1,9 @@
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
@@ -0,0 +1,115 @@
 ---
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  serviceName: kanidm-headless
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: kanidm
      app.kubernetes.io/instance: kanidm
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kanidm
        app.kubernetes.io/instance: kanidm
    spec:
      serviceAccountName: kanidm
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: kanidm
                  app.kubernetes.io/instance: kanidm
              topologyKey: kubernetes.io/hostname
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        fsGroup: 1000
      initContainers:
        - name: config-init
          image: busybox:1.36
          command: ["/bin/sh", "-c"]
          args:
            - cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          volumeMounts:
            - name: config-template
              mountPath: /config-template
              readOnly: true
            - name: config
              mountPath: /config
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
      containers:
        - name: kanidm
          image: kanidm/server:1.10.3
          command: ["/sbin/kanidmd"]
          args: ["server", "-c", "/config/server.toml"]
          ports:
            - name: https
              containerPort: 8443
              protocol: TCP
            - name: replication
              containerPort: 8444
              protocol: TCP
          volumeMounts:
            - name: data
              mountPath: /data
            - name: config
              mountPath: /config
              readOnly: true
            - name: tls
              mountPath: /data/tls
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
          resources:
            requests:
              memory: 256Mi
              cpu: 100m
            limits:
              memory: 1Gi
              cpu: 500m
          readinessProbe:
            tcpSocket:
              port: 8443
            initialDelaySeconds: 15
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: 8443
            initialDelaySeconds: 30
            periodSeconds: 30
      volumes:
        - name: config-template
          configMap:
            name: kanidm-config
        - name: config
          emptyDir: {}
        - name: tls
          secret:
            secretName: kanidm-tls
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: [ReadWriteOnce]
        storageClassName: cephrbd-fast-delete
        resources:
          requests:
            storage: 10Gi
@@ -0,0 +1,26 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: TLSRoute
 metadata:
  name: kanidm
  namespace: kanidm
  labels:
    app.kubernetes.io/name: kanidm
    app.kubernetes.io/instance: kanidm
 spec:
  hostnames:
    - kanidm.k8s.syd1.au.unkin.net
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: kanidm
      sectionName: https-passthrough
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: kanidm
          port: 8443
          weight: 1
@@ -76,11 +76,11 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: 500m
+      cpu: "1"
-      memory: 512Mi
+      memory: 1Gi
    requests:
      cpu: 250m
-      memory: 256Mi
+      memory: 512Mi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
@@ -56,10 +56,10 @@ spec:
          resources:
            limits:
              cpu: "2"
-              memory: 6Gi
+              memory: 8Gi
            requests:
              cpu: 250m
-              memory: 2Gi
+              memory: 6Gi
          volumeMounts:
            - mountPath: /app/config.yaml
              name: config
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: litellm
  namespace: litellm
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: litellm.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: litellm.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: litellm-tls
        mode: Terminate
@@ -10,14 +10,14 @@ spec:
    kind: Deployment
    name: litellm
  minReplicas: 2
-  maxReplicas: 10
+  maxReplicas: 4
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
-          averageUtilization: 60
+          averageUtilization: 80
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0
@@ -25,7 +25,7 @@ spec:
      policies:
        - type: Percent
          value: 100
-          periodSeconds: 30
+          periodSeconds: 60
        - type: Pods
          value: 4
          periodSeconds: 30
@@ -34,7 +34,7 @@ spec:
      selectPolicy: Min
      policies:
        - type: Percent
-          value: 10
+          value: 30
          periodSeconds: 60
        - type: Pods
          value: 2
@@ -0,0 +1,49 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: litellm-http-redirect
  namespace: litellm
 spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: litellm
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: litellm
  namespace: litellm
 spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: litellm
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: litellm
          port: 4000
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: litellm
  namespace: litellm
 spec:
  rules:
    - host: litellm.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: litellm
                port:
                  number: 4000
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - litellm.k8s.syd1.au.unkin.net
      secretName: litellm-tls
@@ -7,7 +7,8 @@ resources:
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
@@ -0,0 +1,91 @@
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
  name: open-webui-postgres
  namespace: open-webui
 spec:
  affinity:
    podAntiAffinityType: preferred
  bootstrap:
    initdb:
      database: open-webui
      encoding: UTF8
      localeCType: C
      localeCollate: C
      owner: open-webui
      secret:
        name: postgres-credentials
  enablePDB: true
  enableSuperuserAccess: false
  failoverDelay: 0
  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
  instances: 3
  logLevel: info
  maxSyncReplicas: 0
  minSyncReplicas: 0
  monitoring:
    customQueriesConfigMap:
      - key: queries
        name: cnpg-default-monitoring
    disableDefaultQueries: false
    enablePodMonitor: false
  postgresql:
    parameters:
      archive_mode: "on"
      archive_timeout: 5min
      dynamic_shared_memory_type: posix
      effective_cache_size: 128MB
      full_page_writes: "on"
      log_destination: csvlog
      log_directory: /controller/log
      log_filename: postgres
      log_rotation_age: "0"
      log_rotation_size: "0"
      log_truncate_on_rotation: "false"
      logging_collector: "on"
      max_connections: "100"
      max_parallel_workers: "4"
      max_replication_slots: "16"
      max_worker_processes: "4"
      shared_buffers: 64MB
      shared_memory_type: mmap
      ssl_max_protocol_version: TLSv1.3
      ssl_min_protocol_version: TLSv1.3
      wal_keep_size: 128MB
      wal_level: logical
      wal_log_hints: "on"
      wal_receiver_timeout: 5s
      wal_sender_timeout: 5s
    syncReplicaElectionConstraint:
      enabled: false
  primaryUpdateMethod: restart
  primaryUpdateStrategy: unsupervised
  probes:
    liveness:
      isolationCheck:
        connectionTimeout: 1000
        enabled: true
        requestTimeout: 1000
  replicationSlots:
    highAvailability:
      enabled: true
      slotPrefix: _cnpg_
    synchronizeReplicas:
      enabled: true
    updateInterval: 30
  resources:
    limits:
      cpu: 500m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 256Mi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
  storage:
    resizeInUseVolumes: true
    size: 5Gi
    storageClass: cephrbd-fast-delete
  switchoverDelay: 3600
@@ -0,0 +1,33 @@
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Pooler
 metadata:
  name: open-webui-postgres-pooler
  namespace: open-webui
 spec:
  cluster:
    name: open-webui-postgres
  instances: 2
  pgbouncer:
    parameters:
      default_pool_size: "50"
      max_client_conn: "200"
    paused: false
    poolMode: transaction
  template:
    metadata:
      labels:
        app: pooler
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app
                    operator: In
                    values:
                      - pooler
              topologyKey: kubernetes.io/hostname
      containers: []
  type: rw
@@ -0,0 +1,61 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: open-webui
  namespace: open-webui
 spec:
  replicas: 3
  selector:
    matchLabels:
      app: open-webui
  template:
    metadata:
      annotations:
        reloader.stakater.com/auto: "true"
      labels:
        app: open-webui
    spec:
      priorityClassName: power
      containers:
        - name: open-webui
          image: ghcr.io/open-webui/open-webui:main
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            - name: OPENAI_API_BASE_URL
              value: https://litellm.k8s.syd1.au.unkin.net
            - name: WEBUI_URL
              value: https://chat.k8s.syd1.au.unkin.net
          envFrom:
            - secretRef:
                name: open-webui-credentials
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            limits:
              cpu: "2"
              memory: 4Gi
            requests:
              cpu: 250m
              memory: 512Mi
      restartPolicy: Always
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: chat.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: chat.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: open-webui
  namespace: open-webui
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: chat.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: chat.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: open-webui-tls
        mode: Terminate
@@ -0,0 +1,53 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: open-webui-http-redirect
  namespace: open-webui
 spec:
  hostnames:
    - chat.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: open-webui
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: open-webui
  namespace: open-webui
 spec:
  hostnames:
    - chat.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: open-webui
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: open-webui
          port: 8080
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
      sessionPersistence:
        type: Cookie
        cookieName: open-webui-backend
        absoluteTimeout: 24h0m0s
@@ -0,0 +1,15 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
  - pdb.yaml
  - service.yaml
  - gateway.yaml
  - httproute.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: open-webui
@@ -0,0 +1,11 @@
 ---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
  name: open-webui
  namespace: open-webui
 spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: open-webui
@@ -0,0 +1,17 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: open-webui
  namespace: open-webui
 spec:
  internalTrafficPolicy: Cluster
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: http
  selector:
    app: open-webui
  sessionAffinity: None
  type: ClusterIP
@@ -0,0 +1,18 @@
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
  name: default
  namespace: open-webui
 spec:
  allowedNamespaces:
    - open-webui
  kubernetes:
    audiences:
      - vault
    role: default
    serviceAccount: default
    tokenExpirationSeconds: 600
  method: kubernetes
  mount: k8s/au/syd1
  vaultConnectionRef: vso-system/default
@@ -0,0 +1,34 @@
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
  name: postgres-credentials
  namespace: open-webui
 spec:
  destination:
    create: true
    name: postgres-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/open-webui/default/postgres-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
  name: open-webui-credentials
  namespace: open-webui
 spec:
  destination:
    create: true
    name: open-webui-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/open-webui/default/open-webui-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
@@ -0,0 +1,37 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: paperclip
  namespace: paperclip
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: paperclip.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: paperclip.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: paperclip-tls
        mode: Terminate
@@ -0,0 +1,49 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: paperclip-http-redirect
  namespace: paperclip
 spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: paperclip
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: paperclip
  namespace: paperclip
 spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: paperclip
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: paperclip
          port: 3100
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: paperclip
  namespace: paperclip
 spec:
  rules:
    - host: paperclip.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: paperclip
                port:
                  number: 3100
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - paperclip.k8s.syd1.au.unkin.net
      secretName: paperclip-tls
@@ -6,7 +6,8 @@ resources:
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - services.yaml
  - vaultauth.yaml
@@ -0,0 +1,41 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetboard.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetboard.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: puppetboard-tls
        mode: Terminate
@@ -0,0 +1,34 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetdb.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: puppetdb-tls
        mode: Terminate
@@ -0,0 +1,59 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard-http-redirect
  namespace: puppet
 spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: puppetboard
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: puppetboard
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: puppetboard
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,30 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  hostnames:
    - puppetdb.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: puppetdb
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: puppetdb
          port: 8080
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,34 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  rules:
    - host: puppetboard.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: puppetboard
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - puppetboard.k8s.syd1.au.unkin.net
      secretName: puppetboard-tls
@@ -1,34 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  rules:
    - host: puppetdb.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: puppetdb
                port:
                  number: 8080
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - puppetdb.k8s.syd1.au.unkin.net
      secretName: puppetdb-tls
@@ -25,8 +25,10 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
+  - gateway_puppetboard.yaml
-  - ingress_puppetdb.yaml
+  - httproute_puppetboard.yaml
  - gateway_puppetdb.yaml
  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -9,7 +9,6 @@ metadata:
  name: puppetdb
  namespace: puppet
 spec:
  clusterIP: null
  ports:
  - name: pdb-http
    port: 8080
@@ -0,0 +1,52 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    cert-manager.io/alt-names: vault.service.consul,vault.query.consul
    external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: vault.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      hostname: vault.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: vault-tls
    - name: vault-direct
      port: 8200
      protocol: HTTPS
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: vault-tls
@@ -0,0 +1,84 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: vault-http-redirect
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
 spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: vault
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
 spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: vault
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: vault
          port: 8200
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: vault-consul
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: vault
 spec:
  hostnames:
    - vault.service.consul
    - vault.query.consul
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: vault
      sectionName: vault-direct
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: vault
          port: 8200
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,8 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - gateway.yaml
  - httproute.yaml
@@ -0,0 +1,5 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: vault
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "v1.19.2"
+    version: "v1.20.2"
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
@@ -1,6 +1,11 @@
 crds:
  enabled: true
 config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  kind: ControllerConfiguration
  enableGatewayAPI: true
 replicaCount: 2
 resources:
@@ -0,0 +1,16 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/consul
 helmCharts:
  - name: consul
    repo: https://helm.releases.hashicorp.com
    version: "1.9.7"
    releaseName: consul
    namespace: consul
    valuesFile: values.yaml
    apiVersions:
      - policy/v1/PodDisruptionBudget
@@ -0,0 +1,58 @@
 global:
  name: consul
  datacenter: au-syd1
  domain: consul
 server:
  image: hashicorp/consul:1.22.7
  replicas: 5
  bootstrapExpect: 5
  storage: 10Gi
  storageClass: cephrbd-fast-delete
  connect: true
  disruptionBudget:
    maxUnavailable: 1
  extraConfig: |
    {
      "disable_remote_exec": true,
      "disable_update_check": true,
      "performance": {
        "raft_multiplier": 10
      },
      "ports": {
        "dns": 8600,
        "grpc": 8502,
        "http": 8500,
        "https": -1
      },
      "primary_datacenter": "au-syd1"
    }
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 2Gi
      cpu: "1"
 client:
  enabled: false
 ui:
  enabled: true
  service:
    type: ClusterIP
 connectInject:
  enabled: false
 dns:
  enabled: true
  type: LoadBalancer
  annotations: |
    purelb.io/service-group: "common"
    purelb.io/addresses: 198.18.200.5
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: external-dns
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.19.0"
+    version: "1.21.1"
    releaseName: externaldns
    namespace: externaldns
    valuesFile: values.yaml
@@ -25,10 +25,7 @@ sources:
  - service
  - ingress
  - gateway-httproute
  - gateway-tlsroute
  - gateway-grpcroute
  - gateway-tcproute
  - gateway-udproute
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -0,0 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/kanidm
@@ -0,0 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/open-webui
@@ -94,5 +94,7 @@ ports:
    port: 80
  websecure:
    port: 443
  vault-direct:
    port: 8200
 enabled: true
@@ -0,0 +1,14 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/vault
 helmCharts:
  - name: vault
    repo: https://helm.releases.hashicorp.com
    version: "0.32.0"
    releaseName: vault
    namespace: vault
    valuesFile: values.yaml
@@ -0,0 +1,73 @@
 server:
  image:
    repository: hashicorp/vault
    tag: "2.0.1"
  ha:
    enabled: true
    replicas: 5
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui            = true
        disable_mlock = true
        listener "tcp" {
          address         = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_disable     = "true"
        }
        storage "raft" {
          path = "/vault/data"
          retry_join {
            leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
          }
        }
        service_registration "consul" {
          address = "consul-server.consul.svc.cluster.local:8500"
        }
  dataStorage:
    enabled: true
    size: 10Gi
    storageClass: cephrbd-fast-delete
    accessMode: ReadWriteOnce
  statefulSet:
    securityContext:
      container:
        capabilities:
          add:
            - IPC_LOCK
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 2Gi
      cpu: 1000m
 injector:
  enabled: false
 ui:
  enabled: true
  serviceType: ClusterIP
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: woodpecker
    repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.5.1"
+    version: "3.6.3"
    releaseName: woodpecker
    namespace: woodpecker
    valuesFile: values.yaml
@@ -11,6 +11,7 @@ spec:
      revision: HEAD
      directories:
      - path: apps/overlays/*/litellm
      - path: apps/overlays/*/open-webui
      - path: apps/overlays/*/paperclip
  template:
    metadata:
@@ -15,10 +15,12 @@ spec:
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
      - path: apps/overlays/*/cnpg-system
      - path: apps/overlays/*/consul
      - path: apps/overlays/*/elastic-system
      - path: apps/overlays/*/externaldns
      - path: apps/overlays/*/inteldeviceplugins-system
      - path: apps/overlays/*/jfrog
      - path: apps/overlays/*/kanidm
      - path: apps/overlays/*/node-feature-discovery
      - path: apps/overlays/*/puppet
      - path: apps/overlays/*/purelb
@@ -27,6 +29,7 @@ spec:
      - path: apps/overlays/*/reposync
      - path: apps/overlays/*/traefik-system
      - path: apps/overlays/*/vm-system
      - path: apps/overlays/*/vault
      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
  template:
@@ -41,6 +44,12 @@ spec:
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{path[3]}}'  # Use directory name as namespace
      ignoreDifferences:
      - group: ""
        kind: ConfigMap
        name: kanidm-repl-certs
        jsonPointers:
        - /data
      syncPolicy:
        automated:
          prune: true
@@ -11,6 +11,8 @@ spec:
  destinations:
    - namespace: 'litellm'
      server: https://kubernetes.default.svc
    - namespace: 'open-webui'
      server: https://kubernetes.default.svc
    - namespace: 'paperclip'
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
@@ -21,10 +21,14 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'certificates'
      server: https://kubernetes.default.svc
    - namespace: 'consul'
      server: https://kubernetes.default.svc
    - namespace: 'externaldns'
      server: https://kubernetes.default.svc
    - namespace: 'jfrog'
      server: https://kubernetes.default.svc
    - namespace: 'kanidm'
      server: https://kubernetes.default.svc
    - namespace: 'node-feature-discovery'
      server: https://kubernetes.default.svc
    - namespace: 'purelb'
@@ -33,6 +37,8 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'reposync'
      server: https://kubernetes.default.svc
    - namespace: 'vault'
      server: https://kubernetes.default.svc
    - namespace: 'woodpecker'
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
Author	SHA1	Message	Date
unkinben	3d85105afd	feat(open-webui): HA deployment with CNPG, PDB, and session persistence ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline failed Details - Switch from SQLite/PVC to CNPG PostgreSQL (3 instances, low-resource) with a transaction-mode PgBouncer pooler (2 instances) - Raise open-webui replicas to 3 with priorityClassName: power - Add PodDisruptionBudget (minAvailable: 1) - Add Gateway API sessionPersistence (cookie) on the HTTPS HTTPRoute so WebSocket connections stick to the same backend pod - Add postgres-credentials VaultStaticSecret; DATABASE_URL must be added to kv/kubernetes/namespace/open-webui/default/open-webui-credentials	2026-05-26 23:37:10 +10:00
unkinben	85a8cfe47d	fix(open-webui): use traefik-internal gateway for chat hostname ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-05-26 23:26:01 +10:00
unkinben	16dabbbf8d	fix(open-webui): use litellm external hostname as OPENAI_API_BASE_URL ci/woodpecker/pr/pre-commit Pipeline was canceled Details ci/woodpecker/pr/kubeconform Pipeline was canceled Details	2026-05-26 23:25:26 +10:00
unkinben	1bcb88d3dd	feat(open-webui): deploy Open WebUI with litellm backend ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Deploys Open WebUI (chat.k8s.syd1.au.unkin.net) into the open-webui namespace via the aitooling ArgoCD project. Uses SQLite with a 10Gi cephrbd PVC for persistence, routes model requests to the existing litellm deployment, and exposes the UI through the traefik-external gateway. Credentials (OPENAI_API_KEY, WEBUI_SECRET_KEY) are injected via VaultStaticSecret from kv/kubernetes/namespace/open-webui/default. Closes #155	2026-05-26 00:11:25 +10:00
unkinben	d358098fff	chore: update replication certs (#170 ) - add replication certs for kanidm-0, kanidm-1 and kanidm-2 Reviewed-on: #170	2026-05-25 23:52:06 +10:00
unkinben	201e601737	feat: update kanidm replicaiton (#169 ) - split to per-server configs - remove init containers that attempted to automate the replication config - add README.md Reviewed-on: #169	2026-05-25 23:25:48 +10:00
unkinben	d230d87ec9	feat(artifactapi): add conftest to GitHub generic remote cache (#168 ) ## Summary - Adds `open-policy-agent/conftest/./conftest_._Linux_x86_64.tar.gz$` to the `github` remote immutable patterns in artifactapi ## Why conftest v0.68.2 (https://github.com/open-policy-agent/conftest/releases/tag/v0.68.2) is now used for OPA policy checks in CI (see #167). Caching the release tarball in artifactapi reduces external dependency on GitHub during builds. Reviewed-on: #168	2026-05-25 22:44:57 +10:00
unkinben	6497dab25e	fix(puppet): remove explicit clusterIP: null from puppetdb Service (#166 ) ## Summary - Removes `clusterIP: null` from the `puppetdb` Service spec ## Why Setting `clusterIP: null` makes ArgoCD's desired state explicit about the field being null. Kubernetes assigns a real IP on creation and the field is immutable afterward. The null vs assigned-IP mismatch causes permanent OutOfSync on the puppetdb Service. Removing the field means ArgoCD no longer claims ownership of `clusterIP`, so the API server's value is authoritative. Reviewed-on: #166	2026-05-25 22:44:24 +10:00
unkinben	f403c6b05d	fix(kanidm): add explicit group/kind/weight to TLSRoute refs (#165 ) ## Summary - Adds `group: gateway.networking.k8s.io` and `kind: Gateway` to `parentRefs` - Adds `group: ""`, `kind: Service`, and `weight: 1` to `backendRefs` ## Why The Gateway API controller defaults these fields when creating/updating TLSRoute objects, so the live state always has them. ArgoCD diffs desired vs live by string comparison, causing the `kanidm` TLSRoute to show permanent OutOfSync. Same root cause as #162 (HTTPRoutes). Reviewed-on: #165	2026-05-25 22:43:52 +10:00
unkinben	ac8b8212bd	fix(consul): normalize cpu limit to canonical string form (#164 ) ## Summary - Changes `server.resources.limits.cpu` from `1000m` to `"1"` in consul Helm values ## Why `1000m` (1000 milliCPU) is equivalent to `1` CPU, but Kubernetes normalizes the value to `"1"` when storing. ArgoCD diffs desired vs live by string comparison, so the mismatch causes a permanent OutOfSync on the `consul-server` StatefulSet. Same root cause as #163. Reviewed-on: #164	2026-05-25 22:43:35 +10:00
unkinben	dd282f59fb	fix(litellm): normalize postgres cluster resource values (#163 ) ## Summary - Changes `limits.memory` from `1024Mi` to `1Gi` (same value, canonical form) - Changes `limits.cpu` from `1` (integer) to `"1"` (string, canonical form) ## Why Kubernetes normalizes resource quantities on write — `1024Mi` becomes `1Gi` and integer `1` becomes string `"1"`. ArgoCD diffs by string comparison, so these equivalent values cause a permanent OutOfSync on the `litellm-postgres` Cluster. Reviewed-on: #163	2026-05-24 23:30:10 +10:00
unkinben	1890dd4bda	fix(gateways): add explicit group/kind/weight to all HTTPRoute refs (#162 ) ## Summary - Adds `group: gateway.networking.k8s.io` and `kind: Gateway` to all `parentRefs` entries - Adds `group: ""`, `kind: Service`, and `weight: 1` to all `backendRefs` entries - Affects 9 HTTPRoute files across artifactapi, cattle-system, consul, kanidm, litellm, paperclip, puppet, and vault ## Why ArgoCD diffs the desired manifest against the live Kubernetes object. The Gateway API controller defaults these fields when creating/updating objects, so the live state always has them — causing persistent OutOfSync for every HTTPRoute. Same root cause as #153 (certificateRefs). ## Test plan - [ ] All affected ArgoCD applications show Synced after merge Reviewed-on: #162	2026-05-24 20:32:37 +10:00
unkinben	6815b66010	fix(kanidm): use dockerhub image instead of ghcr.io (#161 ) ## Summary - Changes both `config-init` init container and `kanidm` container images from `ghcr.io/kanidm/server:1.10.3` to `kanidm/server:1.10.3` ## Why `kanidm/server` is published on Docker Hub, not ghcr.io. RKE2 rewrites dockerhub pulls through the artifactapi mirror automatically. ## Test plan - [ ] Pods roll successfully after ArgoCD sync - [ ] Verify kanidm cluster replication still healthy Reviewed-on: #161	2026-05-24 20:27:21 +10:00
unkinben	7cbec33588	fix(artifactapi): move kanidm to dockerhub remote (#160 ) ## Summary - Removes `^kanidm/` from the `ghcr` remote immutable_patterns - Adds `^kanidm/` to the `dockerhub` remote immutable_patterns ## Why `kanidm/server` is published on Docker Hub, not ghcr.io. Pulling via the `ghcr` cache was failing with 403 on anonymous token fetch → 502 Bad Gateway. ## Test plan - [ ] `docker pull artifactapi.k8s.syd1.au.unkin.net/dockerhub/kanidm/server:1.10.3` succeeds after artifactapi redeploys Reviewed-on: #160	2026-05-24 20:24:33 +10:00
unkinben	3756208ccd	benvin/kanidm (#159 ) Reviewed-on: #159	2026-05-24 19:55:22 +10:00
unkinben	6ce92e8ead	benvin/artifactapi-mail-images (#158 ) Reviewed-on: #158	2026-05-24 14:44:38 +10:00
unkinben	af79d86db6	feat(artifactapi): cache stalwart webadmin zip (#157 ) ## Summary - Adds \`stalwartlabs/webadmin/releases/latest/download/webadmin.zip\` to \`mutable_patterns\` in the \`github\` generic remote so the stalwart webadmin UI can be fetched through artifactapi rather than directly from GitHub. ## Notes - Uses \`mutable_patterns\` (not \`immutable\`) because \`releases/latest\` resolves to whichever release is current and changes over time. - Access URL: \`https://artifactapi.k8s.syd1.au.unkin.net/generic/github/stalwartlabs/webadmin/releases/latest/download/webadmin.zip\` Reviewed-on: #157	2026-05-24 12:55:16 +10:00
unkinben	5f4c9225bb	feat(artifactapi): add mail stack images to docker registry cache (#156 ) - ghcr: stalwartlabs/stalwart (Stalwart mail server) - dockerhub: rspamd/rspamd (spam filter), tozd/postfix (MTA gateway) Reviewed-on: #156	2026-05-24 12:42:27 +10:00
unkinben	cbc2c1cb9f	fix(gateways): add explicit group: "" to all certificateRefs entries (#153 ) The Gateway API admission server defaults certificateRefs[].group to "" when it is omitted. ArgoCD diffed the desired state (no group field) against the live state (group: "") and flagged every gateway as out of sync. Fix: explicitly set group: "" in all certificateRefs entries so the rendered manifest matches the API server's canonical form exactly. Affected: artifactapi, cattle-system, consul, litellm, paperclip, puppet (puppetboard + puppetdb), vault. Reviewed-on: #153	2026-05-23 23:47:24 +10:00
unkinben	c6f9893804	fix(argocd): add vault and consul to platform project destinations (#152 ) Vault and consul namespaces were missing from the platform AppProject allowed destinations, causing ArgoCD sync failures with: destination server 'https://kubernetes.default.svc' and namespace 'vault' do not match any of the allowed destinations in project 'platform' Reviewed-on: #152	2026-05-23 23:27:24 +10:00
unkinben	e43fb742ad	feat(artifactapi): add kanidm to ghcr docker immutable patterns (#151 ) Prerequisite for kanidm deployment (PR benvin/kanidm). Reviewed-on: #151	2026-05-23 23:09:38 +10:00
unkinben	11ac2ae91e	feat(consul): deploy HashiCorp Consul 1.22.7 via Helm chart (5-replica cluster) (#149 ) ## Summary - Deploys HashiCorp Consul 1.22.7 using Helm chart 1.9.7 with 5 server replicas - Configuration modelled on production consul: \`datacenter=au-syd1\`, \`connect=true\`, \`raft_multiplier=10\`, HTTP on 8500, GRPC on 8502, HTTPS disabled - 5-replica server cluster with \`bootstrapExpect=5\` - 10Gi cephrbd-fast-delete PVC per server pod - Gateway API: HTTPS gateway + HTTPRoute (443→consul-consul-ui:80→8500) at \`consul.k8s.syd1.au.unkin.net\` - PodDisruptionBudget patched from \`policy/v1beta1\` to \`policy/v1\` (k8s 1.25+ compatibility) - ArgoCD platform ApplicationSet updated to include consul overlay path - Clients disabled (server-only deployment) - ConnectInject disabled (can be enabled later for service mesh) ## Requires - PR #147 (artifactapi: add hashicorp/consul to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-consul\`: all 5 server pods 1/1 Running, cluster formed - [ ] After merge: ArgoCD syncs consul namespace - [ ] Verify \`consul.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #149	2026-05-23 22:40:49 +10:00
unkinben	d2be521878	feat(vault): deploy HashiCorp Vault 2.0.1 via Helm chart (5-replica HA raft) (#148 ) ## Summary - Deploys HashiCorp Vault 2.0.1 using Helm chart 0.32.0 in HA raft mode (5 replicas) - Configuration modelled on production vault: \`disable_mlock=true\`, headless-DNS retry_join for all 5 pods - IPC_LOCK capability added via \`server.statefulSet.securityContext.container\` - 10Gi cephrbd-fast-delete PVC per pod via \`dataStorage\` - Gateway API: HTTPS gateway + HTTPRoute (443→vault service port 8200) at \`vault.k8s.syd1.au.unkin.net\` - ArgoCD platform ApplicationSet updated to include vault overlay path - Injector disabled (no agent sidecar injection needed) ## Requires - PR #147 (artifactapi: add hashicorp/vault to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-vault\`: all 5 pods Running, raft cluster forming - [ ] After merge: ArgoCD syncs vault namespace - [ ] Operator runs \`vault operator init\` to initialize, then unseals all 5 nodes - [ ] Verify \`vault.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #148	2026-05-23 22:39:41 +10:00
unkinben	bcd4c1a722	feat(cert-manager): upgrade to v1.20.2 and enable Gateway API support (#150 ) ## Summary - Upgrades cert-manager from v1.19.2 to v1.20.2 - Enables `enableGatewayAPI: true` via the `ControllerConfiguration` config block ## Why cert-manager's Gateway API integration was not enabled. Without it, `cert-manager.io/*` annotations on Gateway resources are ignored and no certificates are issued. This is required for the consul and vault PRs (#148, #149) to have their TLS certs automatically provisioned from their Gateway annotations. In v1.20.2, `ExperimentalGatewayAPISupport` is BETA and defaults to true — enabling `enableGatewayAPI` in the controller config activates the gateway-shim controller. ## Test plan - [ ] cert-manager rolls out cleanly (v1.20.2 pods become Ready) - [ ] After rollout, existing Gateway-annotated services (artifactapi, puppet, litellm) retain valid certs - [ ] New Gateway resources with `cert-manager.io/cluster-issuer` annotations trigger Certificate creation Reviewed-on: #150	2026-05-23 22:38:39 +10:00
unkinben	6d9530b1ee	feat(artifactapi): add hashicorp/consul and hashicorp/vault to docker immutable patterns (#147 ) ## Summary - Adds \`^hashicorp/consul\` and \`^hashicorp/vault\` to the dockerhub immutable_patterns in artifactapi's remote-docker.yaml - Replaces the more specific \`^hashicorp/vault-secrets-operator\` pattern since \`^hashicorp/vault\` subsumes it - Required for the benvin/vault and benvin/consul branches (vault:2.0.1 and consul:1.22.7) ## Test plan - [ ] Verify artifactapi accepts requests for hashicorp/vault and hashicorp/consul images after merge Reviewed-on: #147	2026-05-23 18:21:25 +10:00
unkinben	dcea768c15	feat(woodpecker): upgrade to v3.14.1 (chart 3.6.3) (#146 ) Reviewed-on: #146	2026-05-23 18:00:55 +10:00
unkinben	e05f9bfd83	feat: increase litellm resources (#144 ) finding litellm performance has dropped, crashed in multiple cases, and then it had scaled to the maximum level using the majority of memory in cluster. - reduce the rate at which litellm autoscales - increase the requests/limits to match usage Reviewed-on: #144	2026-05-23 17:59:43 +10:00
unkinben	445d8b6e7e	feat: add HTTP→HTTPS redirect to Gateway API services (#145 ) Add port 80 HTTP listener and redirect HTTPRoute to artifactapi, cattle-system (rancher), litellm, paperclip, and puppetboard — restoring the redirect behaviour that existed on the previous nginx/traefik Ingress resources. Reviewed-on: #145	2026-05-23 17:34:07 +10:00
unkinben	c2637da068	feat(artifactapi): migrate Ingress to Gateway API (#129 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Notes The original Ingress had nginx-specific annotations (`proxy-body-size: 10g`, `proxy-read-timeout: 600`) which are not portable to Gateway API. These can be re-introduced via a Traefik `Middleware` CRD if needed. ## Test plan - [ ] ArgoCD syncs the app cleanly - [ ] cert-manager issues the `artifactapi-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://artifactapi.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #129	2026-05-23 16:06:33 +10:00
unkinben	90ddd932fe	feat(puppet): migrate puppetdb Ingress to Gateway API (#131 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetboard.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetdb-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetdb.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #131	2026-05-23 16:05:26 +10:00
unkinben	2c6d88aa6b	feat(puppet): migrate puppetboard Ingress to Gateway API (#130 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetdb.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetboard-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #130	2026-05-23 01:31:28 +10:00
unkinben	58368948d9	feat(paperclip): migrate Ingress to Gateway API (#133 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the paperclip app cleanly - [ ] cert-manager issues the `paperclip-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #133	2026-05-23 01:31:03 +10:00
unkinben	4f5c3f7ea0	feat(litellm): migrate Ingress to Gateway API (#134 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the litellm app cleanly - [ ] cert-manager issues the `litellm-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://litellm.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #134	2026-05-23 01:29:54 +10:00
unkinben	fd87cb96b5	feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs (#143 ) ## Changes - Upgrade external-dns chart from 1.19.0 → 1.21.1 (app v0.19.0 → v0.21.0) - Remove `gateway-tcproute` source — `TCPRoute` CRD is not installed, causing crash-loop - Add `gateway-tlsroute` source — `TLSRoute` CRD is installed (Gateway API 1.5.1) ## Why The pod was crash-looping every minute with `failed to list *v1alpha2.TCPRoute: the server could not find the requested resource` because the TCPRoute CRD doesn't exist in this cluster. TLSRoute was previously removed but its CRD does exist. Reviewed-on: #143	2026-05-23 01:28:20 +10:00
unkinben	d619f9195e	benvin/externaldns_compatability (#142 ) Reviewed-on: #142	2026-05-23 01:17:20 +10:00