Pull bind CRDs from operator repo instead of vendoring

References the CRD bundle from the bind-operator repo by a stable raw URL
so the CRDs never drift from the operator, matching how other apps import
upstream manifests.

- replace the nine vendored crds/*.yaml with a single remote resource:
  git.unkin.net/unkin/bind-operator raw config/crd/install.yaml at v0.1.1
- bump the operator image to v0.1.1 so the running operator and its CRDs
  come from the same tag

.woodpecker/vector-test.yaml

@@ -1,29 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: vector-test
-    image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian
-    commands:
-      # Dummy creds + writable dirs so the full topologies build; the unit tests
-      # only exercise the transforms (sources are not started).
-      - export CLICKHOUSE_USER=ci CLICKHOUSE_PASSWORD=ci
-      - export NATS_PRODUCER_PASSWORD=ci NATS_CONSUMER_PASSWORD=ci
-      - mkdir -p /vector-data-dir /etc/vault-ca
-      - cp /etc/ssl/certs/ca-certificates.crt /etc/vault-ca/ca.crt
-      # Transform tier + VM ingest: unit-tested transforms.
-      - vector test apps/base/logging/vector/aggregator.yaml apps/base/logging/vector/aggregator-tests.yaml
-      - vector test apps/base/logging/vector/vm-ingest.yaml apps/base/logging/vector/vm-ingest-tests.yaml
-      # Agent + archiver have no transforms to unit-test; validate they build.
-      - vector validate --no-environment apps/base/logging/vector/agent.yaml
-      - vector validate --no-environment apps/base/logging/vector/archiver.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 250m
-          limits:
-            memory: 1Gi
-            cpu: 1

apps/base/age-api/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
   - httproute.yaml
   - namespace.yaml
   - service.yaml
-  - vpa.yaml
 
 configMapGenerator:
   - name: age-api-config

apps/base/age-api/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: age-api-vpa
-  namespace: age-api
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: age-api
-  updatePolicy:
-    updateMode: "Off"

apps/base/artifactapi/api-deployment.yaml

@@ -35,7 +35,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.7
+          image: git.unkin.net/unkin/artifactapi:v3.7.3
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/cnpg_backup.yaml

@@ -1,55 +0,0 @@
----
-# Ceph RGW (S3) backup target for the artifactapi CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
-# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
-# its own namespace, so backups are per-database rather than one shared bucket.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-artifactapi-backup
-  namespace: artifactapi
-spec:
-  displayName: "CNPG backup owner (artifactapi)"
-  # RGW users are global; keep the uid namespace-qualified so it never collides.
-  uid: cnpg-artifactapi-backup
-  maxBuckets: 5
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
-  # S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
-  secretName: cnpg-artifactapi-backup-s3
-  # Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
-  # in-flight restore can still reach the archive.
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-artifactapi
-  namespace: artifactapi
-spec:
-  bucketName: cnpg-artifactapi
-  # The owner user has full control of its own bucket (read + write), which is
-  # all the backup/restore identity needs — no extra BucketAccess grant.
-  ownerRef: cnpg-artifactapi-backup
-  versioning: false
-  tags:
-    app: artifactapi
-    purpose: cnpg-backup
-  # Never drop the backups if the CR is removed; retire buckets by hand.
-  retainOnDelete: true
----
-# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore; this schedules the periodic full backup that
-# WAL is layered on top of. Schedules are staggered across clusters so the 8
-# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-artifactapi-nightly
-  namespace: artifactapi
-spec:
-  schedule: "0 40 1 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres

apps/base/artifactapi/cnpg_cluster.yaml

@@ -7,35 +7,6 @@ metadata:
 spec:
   affinity:
     podAntiAffinityType: preferred
-  backup:
-    # 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
-    # against the object store on each successful base backup.
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-artifactapi
-      endpointURL: https://s3.ceph.unkin.net
-      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
-      # every namespace as the vault-ca-cert Secret).
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-artifactapi-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-artifactapi-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      # Path prefix within the bucket; keep stable across restores (see docs).
-      serverName: artifactapi
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
   bootstrap:
     initdb:
       database: artifacts
@@ -108,7 +79,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 50m
+      cpu: 250m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/artifactapi/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - api-hpa.yaml
   - configmap.yaml
   - cnpg_cluster.yaml
-  - cnpg_backup.yaml
   - cnpg_pooler.yaml
   - gateway.yaml
   - httproute.yaml
@@ -18,4 +17,3 @@ resources:
   - ui-hpa.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - vpa.yaml

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.7
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/artifactapi/vpa.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: api-vpa
-  namespace: artifactapi
-  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
-  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
-  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: api
-  updatePolicy:
-    updateMode: "Off"
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: redis-vpa
-  namespace: artifactapi
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: redis
-  updatePolicy:
-    updateMode: "Off"
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: ui-vpa
-  namespace: artifactapi
-  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
-  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
-  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: ui
-  updatePolicy:
-    updateMode: "Off"

apps/base/authentik/cnpg_backup.yaml

@@ -1,55 +0,0 @@
----
-# Ceph RGW (S3) backup target for the authentik CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
-# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
-# its own namespace, so backups are per-database rather than one shared bucket.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-authentik-backup
-  namespace: authentik
-spec:
-  displayName: "CNPG backup owner (authentik)"
-  # RGW users are global; keep the uid namespace-qualified so it never collides.
-  uid: cnpg-authentik-backup
-  maxBuckets: 5
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
-  # S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
-  secretName: cnpg-authentik-backup-s3
-  # Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
-  # in-flight restore can still reach the archive.
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-authentik
-  namespace: authentik
-spec:
-  bucketName: cnpg-authentik
-  # The owner user has full control of its own bucket (read + write), which is
-  # all the backup/restore identity needs — no extra BucketAccess grant.
-  ownerRef: cnpg-authentik-backup
-  versioning: false
-  tags:
-    app: authentik
-    purpose: cnpg-backup
-  # Never drop the backups if the CR is removed; retire buckets by hand.
-  retainOnDelete: true
----
-# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore; this schedules the periodic full backup that
-# WAL is layered on top of. Schedules are staggered across clusters so the 8
-# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-authentik-nightly
-  namespace: authentik
-spec:
-  schedule: "0 0 1 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres

apps/base/authentik/cnpg_cluster.yaml

@@ -7,35 +7,6 @@ metadata:
 spec:
   affinity:
     podAntiAffinityType: preferred
-  backup:
-    # 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
-    # against the object store on each successful base backup.
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-authentik
-      endpointURL: https://s3.ceph.unkin.net
-      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
-      # every namespace as the vault-ca-cert Secret).
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-authentik-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-authentik-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      # Path prefix within the bucket; keep stable across restores (see docs).
-      serverName: authentik
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
   bootstrap:
     initdb:
       database: authentik
@@ -106,12 +77,10 @@ spec:
   resources:
     limits:
       cpu: 500m
-      # 512Mi OOMKilled replicas under load (shared_buffers 128MB +
-      # max_connections 200 leave no headroom) — see incident 2026-07-28.
-      memory: 1Gi
-    requests:
-      cpu: 50m
       memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800

apps/base/authentik/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 
 resources:
   - cnpg_cluster.yaml
-  - cnpg_backup.yaml
   - cnpg_pooler.yaml
   - gateway.yaml
   - httproute.yaml
@@ -18,4 +17,3 @@ resources:
   - redis-service.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - vpa.yaml

apps/base/authentik/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: redis-vpa
-  namespace: authentik
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: redis
-  updatePolicy:
-    updateMode: "Off"

apps/base/bind-internal/authoritative/acls.yaml

@@ -1,29 +0,0 @@
----
-# Internal client networks allowed to query the authoritative servers,
-# mirrored from the puppet authoritative /etc/named/acls.conf
-# (acl-main.unkin.net). Named auth-acl-main because the resolver has its own,
-# differently-scoped acl-main.unkin.net in the same namespace.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: auth-acl-main
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  entries:
-    - 198.18.13.0/24
-    - 198.18.14.0/24
-    - 198.18.15.0/24
-    - 198.18.16.0/24
-    - 198.18.17.0/24
-    - 198.18.19.0/24
-    - 198.18.20.0/24
-    - 198.18.24.0/24
-    - 198.18.25.0/24
-    - 198.18.26.0/24
-    - 198.18.27.0/24
-    - 198.18.28.0/24
-    - 198.18.29.0/24
-    # Admin/management access (individual hosts, not whole subnets)
-    - 10.10.12.200/32   # benvin workstation (wireguard)
-    - 198.18.21.160/32  # benvin router

apps/base/bind-internal/authoritative/cluster.yaml

@@ -1,51 +0,0 @@
----
-# Authoritative masters (replaces the 3x Puppet authoritative servers).
-# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-authoritative
-  namespace: bind-internal
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 2Gi
-  # Restrict queries to internal networks (puppet acl-main.unkin.net).
-  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication. localhost is required so the
-  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
-  # without it every dynamic update is "denied due to allow-query".
-  extraOptions:
-    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.6
-      external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
-  primaryService:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.9
-      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
----
-# Catalog zone so new BindZones auto-provision onto the secondaries.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-authoritative-catalog
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: catalog.internal
-  transferKeyRef: transfer-key

apps/base/bind-internal/authoritative/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cluster.yaml
-  - tsigkey.yaml
-  - zones.yaml
-  - records.yaml
-  - acls.yaml

apps/base/bind-internal/authoritative/records.yaml

@@ -1,64 +0,0 @@
-# Individually-managed authoritative records for the unkin.net zone.
-# DNSRecords must live in the same namespace as their BindZone (the operator
-# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
-# these sit alongside the zone in bind-internal, not in the app namespace.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  # "internal" in the name distinguishes this from the external DNS that
-  # Authentik will manage its own records from later.
-  name: identity-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: identity
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the authentik Gateway serves the
-    # identity.unkin.net hostname there.
-    - 198.18.200.4
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: s3-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: s3
-  type: CNAME
-  ttl: 600
-  values:
-    # radosgw S3 endpoint. Points at the Consul service for now; the real
-    # target will be changed later.
-    - radosgw.service.consul.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: dashboard-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: dashboard
-  type: CNAME
-  ttl: 600
-  values:
-    # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
-    # cephrgw-operator) resolve dashboard.ceph.unkin.net.
-    - lb1.unkin.net.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: lb1-unkin-net
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: lb1
-  type: A
-  ttl: 600
-  values:
-    - 103.216.191.185

apps/base/bind-internal/authoritative/tsigkey.yaml

@@ -1,24 +0,0 @@
----
-# Zone-transfer / catalog key. The operator generates the material into a
-# Secret (transfer-key-tsig); nothing sensitive is committed to git.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: transfer-key
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  algorithm: hmac-sha256
----
-# Client-update key: puppet clients (profiles::dns::updater) nsupdate their own
-# records to the authoritative zones with this key. Operator generates the
-# material into Secret client-update-tsig; the same value must reach puppet
-# eyaml (or the planned Vault-sync bridge) for clients to authenticate.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: client-update
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  algorithm: hmac-sha256

apps/base/bind-internal/authoritative/zones.yaml

@@ -1,256 +0,0 @@
-# Authoritative zones migrated from puppet-prod
-# (profiles::dns::master::zones in hieradata/roles/infra/dns/master.yaml).
-# type primary, static (puppet dynamic:false); TTL 600 as in the puppet zone header.
-# Record data is populated by PuppetDB exported resources upstream, so it is
-# NOT in this repo — migrate it into these zones (AXFR from the current masters,
-# or DNSRecord CRs) as a follow-up. The zones start with SOA+NS only.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: main-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: main.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-# ceph.unkin.net: the ceph host (ausyd1nxvm2069/halb) publishes
-# dashboard.ceph.unkin.net via nsupdate; puppet targets a dedicated
-# `zone ceph.unkin.net.`, so it must exist here or the update gets NOTZONE.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: ceph-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: ceph.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 13-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 13.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 14-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 14.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 15-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 15.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 16-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 16.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 17-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 17.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 19-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 19.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 20-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 20.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 21-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 21.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 22-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 22.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 23-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 23.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 24-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 24.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 25-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 25.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 26-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 26.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 27-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 27.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 28-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 28.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 29-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 29.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update

apps/base/bind-internal/externaldns/cluster.yaml

@@ -1,42 +0,0 @@
----
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-externaldns
-  namespace: bind-internal
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.8
-      external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
-  primaryService:
-    type: ClusterIP
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
----
-# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
-# (external-dns writes to the primary; secondaries IXFR the result).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-externaldns-catalog
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: catalog.externaldns.internal
-  transferKeyRef: externaldns-key

apps/base/bind-internal/externaldns/tsigkey.yaml

@@ -1,21 +0,0 @@
----
-# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret
-# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
-# reflector hints onto that Secret so it is mirrored into the externaldns
-# namespace, where the external-dns controller reads it -- guaranteeing
-# external-dns presents exactly the key the primary's allow-update accepts.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: externaldns-key
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  algorithm: hmac-sha256
-  secretTemplate:
-    annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
-      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"

apps/base/bind-internal/externaldns/zones.yaml

@@ -1,34 +0,0 @@
-# k8s external-dns zones migrated from puppet-prod
-# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
-# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
-# records here via RFC2136 authenticated with externaldns-key.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: k8s-syd1-au-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: k8s.syd1.au.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 200-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: 200.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key

apps/base/bind-internal/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - authoritative
-  - resolvers
-  - externaldns
-  - tsig-api

apps/base/bind-internal/resolvers/acls.yaml

@@ -1,69 +0,0 @@
-# Internal client ACLs, mirrored from puppet /etc/named/acls.conf.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-main.unkin.net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 10.42.0.0/16   # k8s pod network (kube-proxy masquerades node-originated LB queries)
-    - 198.18.1.10/32
-    - 198.18.2.160/27
-    - 198.18.21.160/27
-    - 198.18.2.192/27
-    - 198.18.21.192/27
-    # Admin/management access
-    - 10.10.12.200/32   # benvin workstation (wireguard)
-    - 198.18.21.160/32  # benvin router (also within 198.18.21.160/27 above)
-    - 198.18.13.0/24
-    - 198.18.14.0/24
-    - 198.18.15.0/24
-    - 198.18.16.0/24
-    - 198.18.17.0/24
-    - 198.18.18.0/24
-    - 198.18.19.0/24
-    - 198.18.20.0/24
-    - 198.18.21.0/24
-    - 198.18.22.0/24
-    - 198.18.23.0/24
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-dmz
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.24.0/24
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-common
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.25.0/24
-    - 198.18.26.0/24
-    - 198.18.27.0/24
-    - 198.18.28.0/24
-    - 198.18.29.0/24
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-nomad-jobs
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.64.0/24
-    - 198.18.65.0/24
-    - 198.18.66.0/24
-    - 198.18.67.0/24
-    - 198.18.68.0/24
-    - 198.18.69.0/24

apps/base/bind-internal/resolvers/cluster.yaml

@@ -1,39 +0,0 @@
----
-# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
-# Three identical recursive servers; no zone replication.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-resolvers
-  namespace: bind-internal
-spec:
-  mode: resolver
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.7
-      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
-  forwarders:
-    - 8.8.8.8
-    - 1.1.1.1
-  # The internal split-horizon zones are served UNSIGNED by the in-cluster
-  # authoritative, but their public parents publish DS records (e.g. unkin.net
-  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
-  # sees "parent indicates secure" but gets an insecure answer and returns
-  # SERVFAIL (broken trust chain). Treat the forwarded internal domains as
-  # insecure so they are not validated. unkin.net covers all *.unkin.net
-  # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
-  extraOptions:
-    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
-  resources:
-    requests:
-      cpu: 20m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi

apps/base/bind-internal/resolvers/forward-zones.yaml

@@ -1,303 +0,0 @@
-# Conditional forward zones, from the puppet openforwarder view.
-# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14,
-#   k8s 198.18.200.8 (in-cluster bind-externaldns VIP).
-# k8s -> in-cluster bind-externaldns 198.18.200.8 for both the forward zone
-#   k8s.syd1.au.unkin.net and the reverse zone 200.18.198.in-addr.arpa, which
-#   external-dns now publishes to (see the external-dns migration PRs).
-# (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-main-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: main.unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-consul
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: consul
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.19.14
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-k8s-syd1-au-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: k8s.syd1.au.unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.8
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-200-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 200.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    # Reverse zone for the k8s LB range, published by external-dns to the
-    # in-cluster bind-externaldns alongside k8s.syd1.au.unkin.net.
-    - 198.18.200.8
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-13-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 13.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-14-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 14.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-15-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 15.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-16-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 16.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-17-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 17.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-19-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 19.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-20-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 20.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-21-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 21.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-22-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 22.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-23-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 23.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-24-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 24.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-25-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 25.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-26-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 26.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-27-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 27.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-28-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 28.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-29-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 29.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6

apps/base/bind-internal/resolvers/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cluster.yaml
-  - acls.yaml
-  - view.yaml
-  - forward-zones.yaml

apps/base/bind-internal/resolvers/view.yaml

@@ -1,23 +0,0 @@
----
-# openforwarder view, mirrored from puppet /etc/named/views.conf.
-# match-clients gates access to internal networks; recursion/query are 'any'
-# within the view since match-clients already restricts who reaches it.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindView
-metadata:
-  name: openforwarder
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  order: 100
-  matchClients:
-    - acl-main.unkin.net
-    - acl-nomad-jobs
-    - acl-common
-    - acl-dmz
-  recursion: true
-  allowQuery:
-    - any
-  extraOptions:
-    - "allow-recursion { any; }"
-    - "allow-query-cache { any; }"

apps/base/bind-internal/tsig-api/tsig-api.yaml

@@ -1,27 +0,0 @@
----
-# Companion TSIG API. The operator reconciles this into a Deployment, Service,
-# ConfigMap, master-token Secret and namespaced RBAC. vault-plugin-secrets-bind-tsig
-# calls it to create/rotate/delete TSIG keys, which it does by managing
-# BindTSIGKey resources in this namespace (the operator reconciles the material).
-#
-# The master access token Secret (bind-tsig-api-token) is generated by the
-# operator if absent; a VaultStaticSecret may later pre-seed/overwrite it so the
-# token is sourced from Vault rather than generated in-cluster.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGAPI
-metadata:
-  name: bind-tsig-api
-  namespace: bind-internal
-spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.3
-  replicas: 1
-  port: 8443
-  # targetNamespace defaults to this resource's namespace (bind-internal), where
-  # the authoritative cluster and its keys live.
-  resources:
-    requests:
-      cpu: 25m
-      memory: 64Mi
-    limits:
-      cpu: 250m
-      memory: 128Mi

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.6
+          image: git.unkin.net/unkin/bind-operator:v0.1.1
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/bind-system/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.6/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.1/config/crd/install.yaml
   - rbac.yaml
   - deployment.yaml
-  - vpa.yaml

apps/base/bind-system/rbac.yaml

@@ -23,15 +23,7 @@ rules:
     resources: ["pods/exec"]
     verbs: ["create", "get"]
   - apiGroups: ["apps"]
-    resources: ["statefulsets", "deployments"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  # The BindTSIGAPI reconciler deploys the companion API: a ServiceAccount plus
-  # a namespaced Role/RoleBinding granting it access to BindTSIGKey + Secrets.
-  - apiGroups: [""]
-    resources: ["serviceaccounts"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["roles", "rolebindings"]
+    resources: ["statefulsets"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: [""]
     resources: ["events"]

apps/base/bind-system/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: bind-operator-vpa
-  namespace: bind-system
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: bind-operator
-  updatePolicy:
-    updateMode: "Off"

apps/base/binddns-auth/cluster.yaml

@@ -0,0 +1,36 @@
+---
+# Authoritative masters (replaces the 3x Puppet authoritative servers).
+# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: auth
+  namespace: binddns-auth
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so new BindZones auto-provision onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: auth-catalog
+  namespace: binddns-auth
+spec:
+  clusterRef: auth
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key

apps/base/binddns-auth/kustomization.yaml

@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - cluster.yaml
+  - namespace.yaml
   - tsigkey.yaml
-  - zones.yaml
+  - cluster.yaml

apps/base/binddns-auth/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: pdbmux
+  name: binddns-auth

apps/base/binddns-auth/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Zone-transfer / catalog key. The operator generates the material into a
+# Secret (transfer-key-tsig); nothing sensitive is committed to git.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: transfer-key
+  namespace: binddns-auth
+spec:
+  algorithm: hmac-sha256

apps/base/binddns-externaldns/cluster.yaml

@@ -0,0 +1,26 @@
+---
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: externaldns
+  namespace: binddns-externaldns
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: dmz
+      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/binddns-externaldns/kustomization.yaml

@@ -4,3 +4,5 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - tsigkey.yaml
+  - cluster.yaml

apps/base/binddns-externaldns/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: encapi
+  name: binddns-externaldns

apps/base/binddns-externaldns/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
+# updates to the primary. The operator generates the material into a Secret.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: externaldns-key
+  namespace: binddns-externaldns
+spec:
+  algorithm: hmac-sha256

apps/base/binddns-resolver/cluster.yaml

@@ -0,0 +1,28 @@
+---
+# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
+# Three identical recursive servers; no zone replication.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: resolver
+  namespace: binddns-resolver
+spec:
+  mode: resolver
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
+  forwarders:
+    - 1.1.1.1
+    - 9.9.9.9
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi

apps/base/binddns-resolver/kustomization.yaml

@@ -4,3 +4,4 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - cluster.yaml

apps/base/binddns-resolver/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: bind-internal
+  name: binddns-resolver

apps/base/cephrgw-system/deployment.yaml

@@ -1,82 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cephrgw-operator
-  namespace: cephrgw-system
-  labels:
-    app.kubernetes.io/name: cephrgw-operator
-  annotations:
-    # Restart the operator when the credentials Secret rotates.
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: cephrgw-operator
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: cephrgw-operator
-    spec:
-      serviceAccountName: cephrgw-operator
-      securityContext:
-        runAsNonRoot: true
-      containers:
-        - name: operator
-          image: git.unkin.net/unkin/cephrgw-operator:v0.3.1
-          args:
-            - --metrics-bind-address=:8080
-            - --health-probe-bind-address=:8081
-            - --leader-elect
-          envFrom:
-            # Provides CEPH_RGW_ACCESS_KEY/SECRET_KEY and the endpoints
-            # (CEPH_RGW_ENDPOINT / CEPH_RGW_ADMIN_ENDPOINT), plus optional
-            # CEPH_RGW_REGION / CEPH_RGW_CA / CEPH_RGW_INSECURE. Rendered from
-            # Vault per docs/ceph-setup.md; not managed in GitOps.
-            - secretRef:
-                name: cephrgw-credentials
-          env:
-            # Trust the internal unkin.net (Vault PKI) CA so the operator can
-            # verify radosgw's TLS cert. vault-ca-cert is reflected into every
-            # namespace from the certificates namespace.
-            - name: CEPH_RGW_CA_FILE
-              value: /etc/vault-ca/ca.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /etc/vault-ca/ca.crt
-              subPath: ca.crt
-              readOnly: true
-          ports:
-            - containerPort: 8080
-              name: metrics
-            - containerPort: 8081
-              name: health
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8081
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8081
-            initialDelaySeconds: 15
-            periodSeconds: 20
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert

apps/base/cephrgw-system/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  # CRDs are pulled from the cephrgw-operator repo at the matching tag rather
-  # than vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/cephrgw-operator/raw/tag/v0.3.1/config/crd/install.yaml
-  - rbac.yaml
-  - deployment.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - vpa.yaml

apps/base/cephrgw-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cephrgw-system

apps/base/cephrgw-system/rbac.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cephrgw-operator
-  namespace: cephrgw-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: cephrgw-operator
-rules:
-  - apiGroups: ["ceph.unkin.net"]
-    resources: ["*"]
-    verbs: ["*"]
-  # The operator delivers RGW access/secret keys into Secrets.
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  # v0.3.1 startup check reads its own CRDs to warn if they are stale/missing.
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cephrgw-operator
-subjects:
-  - kind: ServiceAccount
-    name: cephrgw-operator
-    namespace: cephrgw-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cephrgw-operator

apps/base/cephrgw-system/vaultauth.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: cephrgw-system
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cephrgw-system
-  kubernetes:
-    # Shared "default" role: binds the namespace's default ServiceAccount and
-    # grants the templated kv/kubernetes/namespace/<ns>/<sa>/* read policy, so
-    # no per-app terraform-vault change is needed.
-    role: default
-    serviceAccount: default
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/cephrgw-system/vaultstaticsecret.yaml

@@ -1,30 +0,0 @@
----
-# Renders the radosgw credentials from Vault into the cephrgw-credentials
-# Secret the operator Deployment consumes via envFrom. The KV secret's keys
-# (CEPH_RGW_ACCESS_KEY/SECRET_KEY, CEPH_RGW_ENDPOINT, optional
-# CEPH_RGW_ADMIN_ENDPOINT/REGION/CA) are copied verbatim, so they land as the
-# matching env vars.
-#
-# The path sits under the templated default policy
-# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
-# role or policy. Seed the values with:
-#   vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
-#     CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net \
-#     CEPH_RGW_ADMIN_ENDPOINT=https://radosgw.service.consul:443 \
-#     CEPH_RGW_ACCESS_KEY=... CEPH_RGW_SECRET_KEY=...
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: cephrgw-credentials
-  namespace: cephrgw-system
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials
-  refreshAfter: 5m
-  hmacSecretData: true
-  destination:
-    name: cephrgw-credentials
-    create: true
-    overwrite: true

apps/base/cephrgw-system/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: cephrgw-operator-vpa
-  namespace: cephrgw-system
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: cephrgw-operator
-  updatePolicy:
-    updateMode: "Off"

apps/base/cert-manager/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
-  - vmservicescrape.yaml

apps/base/cert-manager/vmservicescrape.yaml

@@ -1,17 +0,0 @@
----
-# Scrape cert-manager webhook + cainjector metrics endpoints.
-# Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  endpoints:
-    - port: metrics
-      path: /metrics
-    - port: http-metrics
-      path: /metrics

apps/base/clickhouse-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: clickhouse-system
-  name: clickhouse-system

apps/base/consul/README.md

@@ -1,30 +0,0 @@
-# consul (k8s)
-
-Consul server cluster (DC `au-syd1`), deployed via the HashiCorp helm chart with
-ACLs enabled (`default_policy: deny`, parity with the VM cluster).
-
-## API access (ACL auth)
-
-The HTTP API and UI are served on port 8500 behind the gateway at
-`https://consul.k8s.syd1.au.unkin.net` (and `https://consul.service.consul`).
-With ACLs enabled, requests beyond the anonymous policy require a token:
-
-```bash
-# management (bootstrap) token — seeded from Vault, synced by VSO into the
-# consul-bootstrap-acl-token secret; same value as the VM cluster's
-# initial_management token:
-CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token)
-
-curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader
-
-# consul CLI:
-CONSUL_HTTP_ADDR=https://consul.k8s.syd1.au.unkin.net CONSUL_HTTP_TOKEN=$CONSUL_HTTP_TOKEN consul members
-```
-
-The UI at the same hostname exposes an ACL login (top right) — paste a token.
-Anonymous requests get the anonymous-token policy only (reads for DNS/service
-discovery; no writes, no ACL/token APIs).
-
-Prefer short-lived tokens minted by Vault's consul secrets engine over the
-management token for day-to-day use; the terraform-* CI roles already work this
-way.

apps/base/consul/httproute.yaml

@@ -46,8 +46,8 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: consul-http
-          port: 8500
+          name: consul-ui
+          port: 80
           weight: 1
       matches:
         - path:
@@ -74,8 +74,8 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: consul-http
-          port: 8500
+          name: consul-ui
+          port: 80
           weight: 1
       matches:
         - path:

apps/base/consul/kustomization.yaml

@@ -6,6 +6,3 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
-  - service.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/consul/service.yaml

@@ -1,25 +0,0 @@
----
-# ClusterIP service targeting the consul server pods' HTTP API (8500).
-# The HashiCorp chart only ships consul-ui (also 8500 via the server pods)
-# and the headless consul-server; this named service gives the Gateway a
-# stable API backend. Consul serves both the HTTP API and the UI (at /ui/)
-# on this same port, so routing the API hostname here preserves the UI too.
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-http
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  type: ClusterIP
-  selector:
-    app: consul
-    component: server
-    release: consul
-  ports:
-    - name: http
-      port: 8500
-      protocol: TCP
-      targetPort: 8500

apps/base/consul/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: consul
-spec:
-  allowedNamespaces:
-    - consul
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/consul/vaultstaticsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: bootstrap-acl-token
-  namespace: consul
-spec:
-  destination:
-    create: true
-    name: consul-bootstrap-acl-token
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/consul/default/bootstrap-acl-token
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/csi-cephfs/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - storageclass.yaml
-  - vmservicescrape.yaml

apps/base/csi-cephfs/vmservicescrape.yaml

@@ -1,15 +0,0 @@
----
-# Scrape the ceph-csi-cephfs nodeplugin + provisioner http-metrics endpoints.
-# Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: ceph-csi-cephfs
-  namespace: csi-cephfs
-spec:
-  selector:
-    matchLabels:
-      app: ceph-csi-cephfs
-  endpoints:
-    - port: http-metrics
-      path: /metrics

apps/base/csi-cephrbd/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - storageclass.yaml
-  - vmservicescrape.yaml

apps/base/csi-cephrbd/vmservicescrape.yaml

@@ -1,15 +0,0 @@
----
-# Scrape the ceph-csi-rbd nodeplugin + provisioner http-metrics endpoints.
-# Picked up by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMServiceScrape
-metadata:
-  name: ceph-csi-rbd
-  namespace: csi-cephrbd
-spec:
-  selector:
-    matchLabels:
-      app: ceph-csi-rbd
-  endpoints:
-    - port: http-metrics
-      path: /metrics

apps/base/encapi/cnpg_backup.yaml

@@ -1,55 +0,0 @@
----
-# Ceph RGW (S3) backup target for the encapi CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
-# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
-# its own namespace, so backups are per-database rather than one shared bucket.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-encapi-backup
-  namespace: encapi
-spec:
-  displayName: "CNPG backup owner (encapi)"
-  # RGW users are global; keep the uid namespace-qualified so it never collides.
-  uid: cnpg-encapi-backup
-  maxBuckets: 5
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
-  # S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
-  secretName: cnpg-encapi-backup-s3
-  # Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
-  # in-flight restore can still reach the archive.
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-encapi
-  namespace: encapi
-spec:
-  bucketName: cnpg-encapi
-  # The owner user has full control of its own bucket (read + write), which is
-  # all the backup/restore identity needs — no extra BucketAccess grant.
-  ownerRef: cnpg-encapi-backup
-  versioning: false
-  tags:
-    app: encapi
-    purpose: cnpg-backup
-  # Never drop the backups if the CR is removed; retire buckets by hand.
-  retainOnDelete: true
----
-# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore; this schedules the periodic full backup that
-# WAL is layered on top of. Schedules are staggered across clusters so the 8
-# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-encapi-nightly
-  namespace: encapi
-spec:
-  schedule: "0 40 2 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres

apps/base/encapi/cnpg_cluster.yaml

@@ -1,120 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: encapi
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    # 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
-    # against the object store on each successful base backup.
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-encapi
-      endpointURL: https://s3.ceph.unkin.net
-      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
-      # every namespace as the vault-ca-cert Secret).
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-encapi-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-encapi-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      # Path prefix within the bucket; keep stable across restores (see docs).
-      serverName: encapi
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      database: encapi
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: encapi
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/encapi/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: postgres-pooler
-  namespace: encapi
-spec:
-  cluster:
-    name: postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/encapi/configmap.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: encapi-env
-  namespace: encapi
-data:
-  LISTEN_ADDR: ":8000"
-  DBHOST: postgres-pooler
-  DBNAME: encapi
-  DBPORT: "5432"
-  DBUSER: encapi
-  DBSSL: require

apps/base/encapi/deployment.yaml

@@ -1,64 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: encapi
-  namespace: encapi
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: encapi
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: encapi
-    spec:
-      automountServiceAccountToken: true
-      containers:
-        - name: encapi
-          image: git.unkin.net/unkin/encapi:v0.1.1
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8000
-              name: http
-              protocol: TCP
-          envFrom:
-            # DBHOST/DBNAME/DBPORT/DBUSER/DBSSL/LISTEN_ADDR
-            - configMapRef:
-                name: encapi-env
-                optional: false
-            # DBPASS + ENCAPI_WRITE_TOKEN (seeded in Vault, see cutover notes)
-            - secretRef:
-                name: environment
-                optional: false
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      restartPolicy: Always

apps/base/encapi/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: encapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: encapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: encapi
-  namespace: encapi
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: encapi.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: encapi.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: encapi-tls
-        mode: Terminate

apps/base/encapi/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: encapi-http-redirect
-  namespace: encapi
-spec:
-  hostnames:
-    - encapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: encapi
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: encapi
-  namespace: encapi
-spec:
-  hostnames:
-    - encapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: encapi
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: encapi
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/encapi/kustomization.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - configmap.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - cnpg_cluster.yaml
-  - cnpg_backup.yaml
-  - cnpg_pooler.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - vpa.yaml

apps/base/encapi/service.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: encapi
-  namespace: encapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: encapi
-  sessionAffinity: None
-  type: ClusterIP

apps/base/encapi/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: encapi
-spec:
-  allowedNamespaces:
-    - encapi
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/encapi/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: encapi
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/encapi/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: environment
-  namespace: encapi
-spec:
-  destination:
-    create: true
-    name: environment
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/encapi/default/environment
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/encapi/vpa.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: autoscaling.k8s.io/v1
-kind: VerticalPodAutoscaler
-metadata:
-  name: encapi-vpa
-  namespace: encapi
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: encapi
-  updatePolicy:
-    updateMode: "Off"

apps/base/grafana-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: grafana-system
-  name: grafana-system

apps/base/grafana/cnpg_backup.yaml

@@ -1,55 +0,0 @@
----
-# Ceph RGW (S3) backup target for the grafana CNPG cluster, provisioned by the
-# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
-# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
-# its own namespace, so backups are per-database rather than one shared bucket.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-grafana-backup
-  namespace: grafana
-spec:
-  displayName: "CNPG backup owner (grafana)"
-  # RGW users are global; keep the uid namespace-qualified so it never collides.
-  uid: cnpg-grafana-backup
-  maxBuckets: 5
-  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
-  # S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
-  secretName: cnpg-grafana-backup-s3
-  # Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
-  # in-flight restore can still reach the archive.
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-grafana
-  namespace: grafana
-spec:
-  bucketName: cnpg-grafana
-  # The owner user has full control of its own bucket (read + write), which is
-  # all the backup/restore identity needs — no extra BucketAccess grant.
-  ownerRef: cnpg-grafana-backup
-  versioning: false
-  tags:
-    app: grafana
-    purpose: cnpg-backup
-  # Never drop the backups if the CR is removed; retire buckets by hand.
-  retainOnDelete: true
----
-# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
-# spec.backup.barmanObjectStore; this schedules the periodic full backup that
-# WAL is layered on top of. Schedules are staggered across clusters so the 8
-# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-grafana-nightly
-  namespace: grafana
-spec:
-  schedule: "0 20 3 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: postgres

apps/base/grafana/cnpg_cluster.yaml

@@ -1,87 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: grafana
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    # 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
-    # against the object store on each successful base backup.
-    retentionPolicy: 30d
-    barmanObjectStore:
-      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
-      destinationPath: s3://cnpg-grafana
-      endpointURL: https://s3.ceph.unkin.net
-      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
-      # every namespace as the vault-ca-cert Secret).
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-grafana-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-grafana-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      # Path prefix within the bucket; keep stable across restores (see docs).
-      serverName: grafana
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      database: grafana
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: grafana
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 2
-  logLevel: info
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      max_connections: "200"
-      shared_buffers: 128MB
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/grafana/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: postgres-pooler-rw
-  namespace: grafana
-spec:
-  cluster:
-    name: postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "50"
-      max_client_conn: "200"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler-rw
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler-rw
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/grafana/dashboards/bind9-exporter-dns.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: bind9-exporter-dns
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+1da1PbuBr+Kx5v5wx0A8QJ4ZKZ/QCBnu2Z0naBdmany8kotpKodSwfSaZkMzm/fd9Xsh2HXEhCYiDkC8SWLOm9PM+rq92zSRBwRRTjgbSrPdtnUtnVbz27ETFfvQ/sqlOwPaKI5JFwKWZR3RD+Z28W7Ih5cKslSJMExO4XbBqQhg/ZlIhowW4zL/3NXB7UuM8FPCBaDbJVLFglx4E/lUrBcrahtIB0sIaTQdOsf1knPhVKQqoiokWVaWyHwQ+nWCzYHaLc9knQtatN4kuK2Vog0bebwqDBst3gRHjYvtF7N3DXo9IVLMQqIfGUBd6xdfbxyrqi4pa51LrC5kjFXLkLDaEeU1kpm0y6xP+TEgH5hLrggWrbVWhbK6DqPSjIKZWLxwVUU9i+5txXLNTpPgt+SK11VA7UTO8UFQHxLUyxh2RhCiu0z5KGW1eJDVRSom2n8sXPR8KHi7ZSoazu7bWYakeNXZd39kLqEqkE34tNt5MqRO41fN7Y60AyFXuh4B2q2jSC26iVHXoXcgEpO14gd79LaHX/BgW5pR/5z9QGIQmobyRzue+TUFIvTRzrVYOKUq96k8nYR+0x7zPXztrW3gnVlfYL9p1WJdi/CJnwQec404CbxG9MaxasW9Am2tE+0dImtrjqgo46A6UL0EC/sHAlTUZ9r8aDJmvhcx5tkshXWmDX4KZndzgCylZtQWWb+560tfe6rENQXAfxEIYsaBlxeZgCXOMEHg0i37dRIgmF6/aB08H9j3sg3AAgEjyEEd/IO6ht0ATSkNyPFDogaCFMja3x3RKUBpByS/wIMmOdqJgkWYA3pIlHRQ3BKEBI21ogfksFWJtqA46Yfl+b/iBjeSex/ABSN6iJuzNQ8GfOAtSiZouMQnRjLowwAQ9QEA3Q4VvfI4B9sxvfJJHicJMLRgPDUAgvuPwbME+MXr3IpZ8y1RDfxQbZHUoC+yY2szRo1SqQMTJQ+doWvfhXtlK4FfpRiwVfqZCm3uPdyq5jL8W/AdVolze9el3xKqTRqqRASZ7sWzsWKHIL0V9vcK7qinVoPU7tsUAqErj0t///Zb8JoL3V3bd/2f1tC2oyaSrl/wBoAwQ2kidX74ir0CfQdLRFA+8dF+CqJpMgQYumvDEAoXE58AE0aRIW7CFsXlKJXKwdLXFpsNgGn/ni82AIn6UNPleKT1c752wIfXqAmtZGYixGic+I1N1FaRTeIEJmuhCy/YEGLexnOUVzTeVjexhTAJ667RjvbzJAbLVsfvxbEA+dz/T/xuDCKWlg4L8YGdBJ9mgAXU2WEQHbV05UjgWQ21aa6EZC6Dria3CAwW8WpL+BFAZ9MsURAcnVfc8GAfHSeAJe/GQearc8BFkkCo3XBISGrDKoJdhbv04IyRSI2KCgY4BgxlsmwSXE8lGLYKhqJb6WGScLPCoowqHpc4WupjX3KWsVuBkSl2ZdBDzL/THQDLhnSL0PIGhm4LAsnLLAFZRIugVPuFTKuhtGCSDr2g4TYFmwvvPGb3AH/gFIvzmlorzZth/CZmksNkfQ6IyCMRM5zCijQy9pyxgzO+z4CCMzz6p9/mJdQ5bsoKMHXkYQw7HvSBgeaOfXHlaPVQfsxG6ZF2HESsGu6RzKuiN3LBu6lKnCeK8pNXFXDbguuaPGTM1EXrSIz1unoHRNVYNnkUwG2drYuolZb3TZLHZk1kqQ1H+RjOTMyEhHmZ50ZRofOQdDhIQKOpHXZiQcZ1uEpQRrtdWVnikY4i1j+cVoy1k+bZk6noa1YmitlLS2ZNTZEtC12EI6mpmyEpLathpdawsRvG29taAzt23tWTgvQsSWy6NATSoWHwHKi0AhSICT+ivIgu2sk8xLib2ehVVZ/f7SyPF5cWDsrPfoTaPOBnvYMersor0APxrAzUGQ9gdOPMupdKDYX2q1k7Jugbmp7x0dF98VS8m9OJ9TqTmH9tqR69EM5Hr4Ysi1tF7kmkuXUJOfD57ujPKoJrgFOnkJmGags8LS2l+ZFAcWFaCSFeB09QI4S5fAGRKhtkYhZVw82ASRpQWRylxBxDmYIYocveYu+pPOLOTRR9ck1qEdLrr1C9q5RsXXG11FJ87zwfTg1r2n3sHk7wMP/WplnzmNmk1Q5lzP1Ijbpt70RxaZ2Pgi9XRhTgFvHqUtIAyUa2HB+QXAeSy6gEBxubNEw6XKM4u3LSCOKTYjzdkKY3tpVbE95ucJIV7r7AlD/FqM9Q6zU/tmJu14WpjeX87M/jMbxK0+/MbOg9RJ7qx3zKfWWbx1h2vaMQYr9p96uJdM/IP96s3sKlxCSW9wGw3Mdw3N9y8SQsBB8giHiUA8pMFqJfoU6qXpBwPiPMsXYzzluY+0yqUcVjFwmwRACwknM5b6yoSKtMF+KZ7slw9rg3vWhQ64maQXwN+l+fg7XpqdSuCVpyfwzcrsI2js1rhz0n+813FcNqUlgMqTqEWM7JxETIlkycwd882z4+tx3ebNovPsfeWhnbvOwTSuPX56rnU2XPuIXTB6b9r/Igos5EWhz1xYZB5ZVJ5KSKMbYSYz0VlaxVi+3V8u3Y4TEkwAeF2ZgLCQrWsYXsk+zVNCQQF76LGrk/IyrWLsbNL+whHlj8hQzItYbFlBSMnvQEapnOz7dXI6kfE+gMMtsLt69EzG65h0Ku1PC6RTtm8ZD33k0lAMntcZbXv9J14bGuZpFiNBEzZ7dLidY5MVtnuZm6zuQduamb9Lz3ixfHAkZAeBPncRr3qCPZ6gmU52hxuyW9tl8AlUJyiQnVQr7Xnz0F3yJtL7/HZppLA+6ZpeCM9tpj4WnPooTz0BdLQhsVdCYqCKEJRDV0pe5lDpJPJafEh9GTceuEtqvLxWzspvbF0+SsbW5ZzG1mBb7gN8XtHYeljjUxcEncpmlnotWFj7eErHOczl3jL6EygZTkuNn9jNaep6VHQfznzmI/iHk4vz/KeyRyXuMKlfw5CP1Bfvry5Ormu/zzC/vXLJAWoBrpl4+Yh+ffnlY+3k+vxs7N7KR3VEtGBW2iM51/jdDKLWLTRnDy3vT10+dkqbyLxGkXk589mzR+QVTWenTPWiprM3DDUvQx3NwlDlDUOtGUN1n9XAYdl7DKcLDm+GLOYq/jm8qrOYyxmqqYILqvKLTJdQWXdpp44zW2O6my7zWgek+BTxAxFpfxOR1mDP5T2C8iKh34mYvoCnEbk/qMohOvmr6EIbtjrtWmexXBvKWuvNbZXyVMoqbijrRVLWMFO5eOS6LoSEwuc/rfJ8hvX66Lh1eQmvkFevd6/xK9mJ9gAzORtmWqPhPQxvof9UB80zz3Sn8hzrfiU+jM+ecpQ/Kr+MXH3kMK+5jnHbWJZy2BDmEa7Oa6jjWLTX2aO80WpFnUEpFXQTCcGsQ1KQl49Q2V3ffElFZL5UoqM5XHr62A5epF8MQU4YuB5qnXZCH9QctIY+QJOSIiic+tRVmd008bvwP2ddOH5NffZmP3lVaBHdy/Ujj574A9L0SYP6979k0wGXYmmW+Es0QzlSekSX0SOq+2hKtebg7xa9M9vm5Q8WfhH+VTdwB5KMfExH7x9KZe8vHP8g4DF4V79hY3s2TfyHNyap4LtOGid7L1WCLqZuXNewRRTqV1lvZxA6sM8OpOx8JYLhTsYdPYyLtx3Nqj2DPUe73Vdd7R9xU2JXzF4axZm2FvA9s9faV+OQ+XRK/51LVZ2kdmTOBfWeEPAE5WPJM2p/b+vbf6s3v27DC5T21tkSnw1RjjVEaNLmN8SY91Bt7b7dhtj3oImwzllNpC2kS55uovISTIQxSccsEL0JzdV++nNHv/4SvoGhr+w4T8hgbkl/EyVudj0J9DpO6LDiFPFvWf/V7zHVJZnXaZaL+jeGzRL+cTw7Dt31gS2yD+isBzqrfqC0r/9iNDr0dIGenQjwN348BIaesINRmh2NcQ/AfPrrPA5Z+A2w1M+Gv3+FgScJh7g9k9If+uNfus/xD1uJBfNebQAA

apps/base/grafana/dashboards/frr-ospf-route-metrics.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: frr-ospf-route-metrics
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+1ZbW/bNhD+KwJRFC0gF7brZkGAfXDcZgiQpkFcbNiawqCkk82FJjWScuIK/u+7o14sN0lXB0nRJfliS5TIe+655046sWBcKe24E1pZtlcwKaxje58KFuVCukPF9nohS7jjVucmBrrFLTP8Z1PDU644C1kuEjzvdILfyqGg02GrkIHikcQ7nckhZDORNMci1mqkpTY4zUwj/qIbBv1eD3/evAmD3ktcU/E5GRmu0QXPg6EE4yxerSAk3M4izU3CVp/JYCJc22QqbMzln8DN2HHj3mvlZmyvGxL0bPZRa+lE5gekUOfo/qfPIcu4Amk9BakAmYy0SsWU/E4g5bl0nqY5zzKhptUcNzNgZ1om5TVNnjIeWS1zBwjXOsjKJePK66kBUHhlwWWON3dX4fqagWR9ZbeLrqFvegHGIIXe4opcEMmJ9vbQp9chu2B7g5BdeneWfkVGYcHo6ayJrjfxvsRXGqjIqMaUVjT0d26dSJfVYAzKgcFhbQQe+miQf7nTOJiBoRtGM66mMGqtbx1XCcUmJI/yGD60cHAZkydMcpTb57CkGkdY7Tkep1xaQDeQ2YuTtpXqEvIOl66yVqHZPhLEdpv9ryLT88q6QOaP+FLnrtQWDmUynwr1Oxhb0tHrv+q96hIEbqbgSiPtxGHPWmco1suMzKXGTNC0hNhpM8mzojn59Yxpm6VnLBSKuIwBR57Vx2ds5YlNDyn3hpgAaFk4Ej/7MD45CEb1OgGK3+WtrMEFnHf5/6nvwYa+d7bSNzfAr+i7ks49qftYu+NcyrsU+f2q0eC6MHFYduUkFVHBU4HCE9ligFJcmJRUiH+30OXhyWIQnNLyNhAqODjcfzCi3N0Q5S9PovxRoty5A1HuPFBRlpXydSXKwZMo70+U91MlH1h5rJX45kmJP0KJd1kat1NipZpGdhmX4Bx0YiTXipiawxjDqed0D78Udl+bBMwY+WwopOGR7zwg+QuM3rzQiipxzcrhIx6BLGNFpyeSxzDHNdZhiLgZSjFV5WjXD/whEjc74PSujEOv8I0yMfxi7JaeBGwNiexUSPkh47FwKORe2UMmJL7Nzom63ANTOiZhCipZa6LuN6vzhfiylhKGA1tbEp1tbiDLh0RApmUtcRrj1IvRgQfO9vooJS2UG4sv4JOLul54i428EVFeTmy69mqBWr00j9StYOFbPIvt7yYKjHd8jmWF1piizjIvk7AOrfd71S43FXFN8HWaMqoWP1l52vXlqd9t9cw7VX3qb9SnOozrGoHwE2Ezyetq5D+aUEKv9RZpR/ouaT6qlqgSv1FC4fVC6l7zXVFhkSrpidDGNTzfbdWg9nKiQEzxI4qxxXfWipKPA23mnIAVhUjR7dV/tKPHtZkgWgZe1TRrXVacmAOmgMBoPaLikpX591V5+amqS+8OqkvFz6MuLr1BVV1eP6bqQi9vE2n5ROXzCEzx3WXlI73LBEfjYVAUtMjX9SW8JQxwF9qcbw3nuJx3E6D9WwPiNjJboxmO909vgjK6PTf2FnE6HiOMG6C83RYKocCCC0Zhmx/rnMrT90N5V80kOC0U764+jAjviJa3Tw+gpwfQQ3wA7Vx9APX71QNo95E8gGyMXxFgkuTGy2tiAbcdE1ts8WrbbMZ84/X24PS0vdnijQZvK6PX1xfaZjQgNV+nD65NkiGPu5SPNp7BnDc8DHrEgJcXGcQbqJDhH7XnpF8CBPOMMqlUc7ORG+fG+KAVPhFjmScwxI8bteVqp3WDxX9yMEsqD5jr4Gbgt48aiL3WBmwzyQu2MVXWLYwzEC9BTfNaxozS6htxvBloa60apqTKOCk/z7y42tmEjf2X17tRrnO9B1XlbyGvR27rADZY22DH278Nm7Kf1JWJ+BxMGWc6/0I5halq9IX1zX1bsf45+Lz8uhO8B6ylsW228hFGh2B0TP3xZ1ELsb/6F7MoRVUzIAAA

apps/base/grafana/dashboards/gitea.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: gitea
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+2abW/bNhDHv4pBDMMGOIWlxG5qYC+yDimCpknQtOuLNjAo6SwzoUiNpJK4gb/77qgH20G2dbCgtIBe2BAlinf83+9OpKAHxpXSjjuhlWXTByaFdWz6+YH99NOC28VbWLIp09E1xG4ajl6O2ZBFhZDuRLFpMGQJd9zqwsSA3fb2Bm8Mn3PFB3t72BEUjyRecKaAIVuIpDkWsVavtdQG7zJpxH8ZDQdhEODfeDwcBL/izYpnNObR2r3Bz4MjCcZZvOqWOV1N0MVIc5Ow1dUKvQEbG5FTb7z4TivhtBm8EQ74wIK5BUNeJcJt+pUqcCcJzmY/eBVi0/B88UFr6UTOpqMhKqJuUJrPV0OWcwXSenm4FNz6KZBsaDvidDTn0sLQ+3UKKnULHHdUtmHz8oZqCbhwOR4nPD64vonRwbmQ0otLByhoIkBhTMbkm0gutI8TDjwZsjs2PRyye+8nBmq08jInoC7BiA2DAue3jyNKSEEldD+/TZurcWGMN1G1M36/PhaqObYLfdc0HIZFNq1bLovG3sqLRs1SYWrciYTEQD9VIeWFFsq90wSEb+Osdd4wSPKc1qrjYDmgUsrxFBp7uSxSof4EY8tYT168fLGPo+Q0MElW4M1h1V7rgNNMwABhN5fa4Q3WC3WOaKC2UMXZ5jyGzfhZx+ObtQ4O8hwSdHHtkOMmBVeyAfc5WciNjsHamQGLQys3yyDTZjmLlg7sw7WOfvvCUmLzC1uhJ+goIkqaMlZH6libjLvyjIE5YcqOkHW0t8BhF1omlctOZHBsdMampGfZfg9pKWnd4XIh5m7dw1ESsPeVe4PSPUqumv4HDDk3kNSBtNo4H0Mf7lmVhEIl4lYkBbqOwUL1FepXAlXeVvXzmYXD3/N74eMcFfGN16x0KCt5IEeb/C+vlOCVg9WkeTKW/B5Kzee1UtjXUGAlj0DWA0id/s4t+KzydFcWCe7HJlbDVke78l6WE8aika7TybdO4bYeeEWWv7O6cvgNdSXs68qz1JU4L2YW8Ema2JlX7amaghY2IvBcNeb1xcdBldd9cemLS1Vcgsk3VJf9vro8S3XROajZPHliodLwS8k0K135z1pTt4557GjZH3RZfs5xLoPjPy778vOs5effK8h2nTjwdWKysbmZrMqKEG5lXUzVrMpJL5+vRSCT840+XMakJM7UujPtzih3r2i7OOeFdL5PxvNcqLQmaQO9hzp4PLJaFo4sUC6VsYmrXWzCzc1eVNov/SjnfYUzZ3o7UR+XHQ9PXVe0oiGuC+vEfFmdpDri967aUFnl1QaXF04Tlv9UVp7Ibp/GMx5TildZ+79WBE+k4JMZd1ZkEZiBng+O1raqXMEy4dguPEy2eAgOeyB2BcJAri29LBHdQPF+215bYAThdqU46MnYlYwCn++dIPGxMtQaC4dbLIx7FHZFQVhbdFMeTmpLu8NwsLGCCEb1IyP4fmlYgpS4wPohVhGlOp0sImpTbRFx8IiIUU/E7kT4nUQnQJzWltri4XCbh7CvEC3woE3KlfjKO6sT548MtkVHtbBcl4tJj8fueOAv6wSLD5Wh1nCYbONw2NOwOw1zTZ52wsNxY6otIsJHK8ywX0+0gEReRFLge9RlJ1RceGtvS2st7zwO6gfHy++Xi7wwufwhdqIYlW5eSlxWhlredTQ0HPQ07E7DHUQLrW86AeLT2lbLO4+GiVc9E2280JbAbVcvsxtbbe83aij6p0YLTMQ6y0C5Tph4vbbV9qajZmK/Z2J3JjIhwTqtuqkU7zattb31qLkIxz0YLSwquIsX3VDxqTG1hcSVH5pkxlNBRqJit4w3kwhD0nkpoVLXT6cJEGS5RBVUuvFVP31W4j9BwVNz7ySKebcXLPyHMWWLVX1y2ngZ6ll5MauF8KTsj8hh79aY/gL/vz/yxzReSH9BwmqbXylqUxYZ3Hj7QNVC+M/zsV0QvEyd/RWc3I3ffPWQGEFf6ttHU7itFRiv/gYQwxSUwDAAAA==

apps/base/grafana/dashboards/nzbget.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: nzbget
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+1X227bRhD9FWIfCqegDcmNAtdAH2wHLgzErgEZDVpbMJbkiNx4uUvsDq0blG/vzHJFybHbpg3aIkBfJHEvczlz5gy1EtIYixKVNV4cr4RWHsXx7UpkrdJ4YcTxMBWFROlt63LgI7ho6FuUTk6lkSIVrSroeX8/+bFbSvb3xToVYGSm6SS6FlJRqaL/rXJrzqy2jq65MpN7gzQ5HA7pYzRKk+ErsmlkzU5OttEl3yQnGhx62o0hFNJXmZWuEOsJOywU7rqcKp9L/QtIN0bp8NIarMTxIOXQm+rGWo2qCQlqZR4o/dtJKhppQPsAwYtpN87WgBW0vs+8ADxcjEaFzF9/eMg59akCXZxZM1UlXy1gKluNAeC8y3slalsEe1IDIuznWnqvwu289WhrPiPnyp9aV4AbV3YmjqdSe0qMl8/AIDgofgVnn26wg8vOOMIcRbf8TmagaSk+XmuZQ002aEm2aGk5k+5Eq9J0q4Ow8F4VWJ3LHDnmwcEb4oKTszEuGGWGDQRnq/VPjcwVLjbwFoqMxCCMDaeYAOeuy0tDCabow8ZNKeLzo1rG34SGMp6qftVqrko8wI4vOP/G6sCOGIx0otsMcYfSNlYZHKslRTJKBRMC3hLHncra7mJf2WiAXHoC+5rveQ4fHoHNemLG0yg8yvxBmVDi0tm2YcLSyXonb7KGlQOyqAsfcetrb6dTsd7Q5VKZSznvjdeyach2ZOXWxs51mXmrW2RwPULTkTbyiwICMLTzKHVLhw1Fvk6328Sc7ebRIPRPaxTT4ZQs0ZOltB3VrDNbS8wrCMQNnM8WV9yhdKyJ2iFuqFN1clMREmXVtMhGqFsaqp6KVsLVLoTe+YrSn0Nx9kncMcewxyBtLofeOOBadWju2GE5IDfDQTocTDpaRpEgA5OQYkkZXdsAIh09SgU11eHrVMwDcZm+zLgiMKfPbMtXwk/qnHMR1K54ZQMvOVqQIWgVPqmM5L9QvtFysWnFoEyEyE7jOVVW3J/Mt3fRBUvXeqcl+mp7YkOw4K3Dnl58VLoS8Esli6LlCG9IMd6TPPY8ZFHt9STnL1qbN1wq5STCnllm5P7ewMzfU6cSa+6RmXCfLRD8qlv64eOdOPj2TqxvR/WE9X1KuF0CyjG1XF713pTJdVvAVdzldPqhYajfGLaNBgTAzq0jalIwq+hpvSbrTpqyHwMOphdFbM3Wwyk17VZ8mFh/H7SXwYGaiuy2CHZo+bbe+xzEAkKv7ozYzMwemj/M/1n3/Q4KpzQriTMKg4J3oSRv3yXjBqBIskVy7ewj+XXbMYuqBoqTm/jL4PoqxyIvj+0USZ83U/H/MfmfjMl/fSR+MgU/a4AcxQFy+CcD5NmACG/eT+dDZpEZ/xUNCP7X0GlHVL2odVwsWdzntjX4T6j/SY7qERLSFgN5h/pfmgLPJfFFiy8I4iSYZirSxjAUi16UavkzOB8a57vvuQI9a8NwwNgO8d8WE4tthpeh0PtUvNn+m4pd2u5JxDONosBZKePzkqtMwDs7851oP8mjLyjA4GFp1AezHJSDnIm+CZC6fwbwEP4jsRKufwNsYW6gFQ4AAA==

apps/base/grafana/dashboards/puppet-report.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDashboard
-metadata:
-  name: puppet-report
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  resyncPeriod: 5m
-  allowCrossNamespaceImport: false
-  gzipJson: H4sIAAycS2oC/+2be2/bNhDAv4rAbUACOJ0k27FjYAOaFzagj60J9sfaIqAlWiYiiyopOU4977Pvjg9J9pLGbtM2bVy0qsXn8e7440lnzwnNMlHQgotMkcGcpFwVZPD67aJFYqYiyXOsIgNyzArKUxZ7PBsJOdE9PDoUZeH9UeY5KzzJciELb8IKySNFWoTFvKDDlJFBIUvWIknGit9jMuj5fouMecyORFZIkSrXIOXZpcLZW0SykWRqTAYjmiqokuIKa+YkEmlKc8WqmtVZxownY1gDCbp+PgMxcpqx1Ham0Zid8wkDsckgK9O0hQMKeUijy0SKMourcXX5XzQt2XIRjkRkMqQ7Xb/lBb2w5XW6Lc9/ctDbhdl0TdjuQVV4AFU+VvUP6ips3O2Yf9Bpl8BqY1pQJUoZwVyEsndpnvFeycJphxE0RMQnFJdgJF5dMZNSyEpIYx0YB02Q0DJhaNcJndm1BP19UP+EZ/YebtRYXLnBijHqXaTxMzrUarPDVuXPqbxk0lUsGgqH+TjoL4D/soLJKU2dxFy9YFc3WHlC85xnyfl1znS/xr0xWEYnqJIpiuoVwivYrIBppnYpi1bVRNIsuaFJuNDTzI5Bw38IkAvGDdD/UDBd8FzE2D8SWcaigsXE1J3jMFb8XKhixGdmifbmFHz3jL/Hrj3/JywHl63a6M+NJl3dRMv4HLxXr20kxQSqcAqo02IPyIufn+KNcBUovgIPhpXoD/IS1KctOuJpeoQOiYtHz2oH4HNBHy79A3StoI9ON8JRnBGxb6OP6RKiGx+0sbFxBGfYgsqEFUZYNsuxUwF7Z2d3L9c7/sLs+PkYNPLLG/Ij/v+GtFg25VJkE5bp0sbtG7L4GZTve796ewExDKhkcz5zSqMCBYT1pixhWXzqHJpoLCBBCCpJFSyHZh0fdVS5p8Kd3wcLB/2+j6rkBe4UgrveUzyLmJdS5WiFDcAqqFiQr3Z27ZAEmicpU4BH51ANk/a1SXVpZVIBApFfVq1pXbE2qC54Yfw2KqWeGl35Y/Fk9tUSnXaQO/B3HSTdwLE7mbQmgzKRsVsw5N9MoVXc3IkhnH9hyNN9bOTpfmfksba8ATxLxLlgU9gyahPwtNBYUHoOwU4KHHIIups68zl2XSygsQltbpFmfTq1giaXUCBPjLwTN8rjgs9HxEMPkj29LXu+CntW/Cfw70RPs4f/pOt/NH4sUk7huaiUDBizSSD0YABkxSfbqOcbJc/+ljzbqOfDUc9ZGUVMqYeEHSsSqOu7IA/dqViy/tugGlffJnn6W/I8DvKAD2jPrGIe+xj1bUY8r9xq7pE8/jbi+XLcCcIteB4HeKIxrmejmGdxM2JuAYmdYH2SNDhyVPX9gvELnSbGYqDHcyOITdxYqZ7h222bkntlXnJr5qydN2v7/8ub0ZRTdWS5M7cLR2X90Ds5DPePofWpzg5i0UnYOe6EUPQScoPwYktdZ6j3H46OnsLQUP4KVSQL29rvdUMc4AyYGJd2jJ5/fHiiSy85rESXdftBxz+CMn34YEk/POwe92F5ZEhllUX8JKBxdOXA5icR0S+n0GIpT4EAClaBow8w1A2oKsmeqvPmHGiziuf2HHBah6FPJnlx3Sz4m0nh7gEsVV/AaJ0QRWudacFMw2YST4HVjyF9W/mG0Zjtqt2pJiruWLW0f694XIw1qxsgXaWZhUrOQNFZQZNaQzm2kjTmpdLIzS0UneSgKSYZbvZRKnCrKCY5U07Tdj6DpH3cjHAqViuDnQn+8EwTyp0VN+SpRH6502st73VMXs03jVi8YJc0TxuyaQRzA1dWqYLLReFODa7DCTH3Z2M+qk4It7+PS2mS7zspLViVydrVTBdpwXN9ACuMctLSZO+totQY0lx1aIFeog2kHeLCQoxnMZ/yuITFLiqyJZLmY5hhRmdcI2BinMBYDs8zTScjadMTna+9rhwfv1pwTWf29F3KVqcYA7hRUpEcUuUO7Zkr1ntgdR4EXD3S2CT27GhosA+NpUO3xlBvcbBHCDzk2sFnwJptUHPNwWwLNgM2txvXI9ttD2af8iR2P1TzP4w1R7FbsFY9lHnDaw9DqFLdF+H8B0K4ZS59bcq9rXUPO96DL1htGCeG3W81TrQruwdu2nDQ/3RuNjC5DjhtcIimNR/vHZvVk7SjZvD1qGk9y6XLyTI7F/cMVR0n6hdd/74h8B3FEU8AQfD4yEBT/9zHq6+PAG71/Po54FvHlAK07mG7TWhbO9knhpM48VqoNQ68DSUfIhNtLNl5DEz0HxITqzOpIWB4Nyo3erB+VOHndwHDBxd13vrmcumlpfIq7Zv3nYC4Cf0LUgFa6UHbafxICgWfuKw9+VoPF8ObbLQbTbSWzOiY8SjYJIcnC3hZ2/jFA26n1CYpbEbGYWi+uIuL5ovMCL4sSsuYPW2+ELeq+g12Bp7jJXhRVWkzC2NTJ3L7Owx03Xclk0A80//CWHtnafu1POy3Sxq/lgjwc8JsjqB6/AEd6KWpP82g1vdBM8sFxiHNzObs+qwqOamxcJtm2FKTjRXU6P7Z9IQbT7vpoE64iKu99rjKsuhHK90m59ElYn3uRLlw2NM+2sXQJfDx2tbXAF8FdvES6Gvb159x6BAvQUws5S5q3TQ76Kb7uqnuEHb0FVNQvVgPGBO3gPeYxBuQIf7WBoS8ZWNCeYnnOxnRg3CfDv29kIX7e53OMNijbT/YO6Dwxw97/XY4wmxGtWUX/wF8UK+AbjQAAA==

apps/base/grafana/gateway.yaml

@@ -1,39 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: grafana
-  namespace: grafana
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: grafana
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: grafana.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: grafana.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: grafana.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: grafana.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: grafana-tls

apps/base/grafana/grafana.yaml

@@ -1,63 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: Grafana
-metadata:
-  name: grafana
-  namespace: grafana
-  labels:
-    dashboards: "grafana"
-spec:
-  deployment:
-    spec:
-      template:
-        spec:
-          containers:
-            - name: grafana
-              env:
-                # DB password + OAuth client secret injected from the
-                # Vault-synced secrets (GF_ env overrides grafana.ini).
-                - name: GF_DATABASE_PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: postgres-credentials
-                      key: password
-                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
-                  valueFrom:
-                    secretKeyRef:
-                      name: oauth-credentials
-                      key: client_secret
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 256Mi
-                limits:
-                  cpu: "1"
-                  memory: 1Gi
-  config:
-    server:
-      root_url: "https://grafana.k8s.syd1.au.unkin.net"
-    database:
-      type: "postgres"
-      host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
-      name: "grafana"
-      user: "grafana"
-      ssl_mode: "require"
-    auth:
-      disable_login_form: "false"
-      oauth_auto_login: "false"
-    "auth.generic_oauth":
-      enabled: "true"
-      name: "Authentik"
-      allow_sign_up: "true"
-      use_pkce: "true"
-      client_id: "grafana"
-      # ak_groups = hierarchical group claim from terraform-authentik (carries
-      # permission groups inherited via role groups).
-      scopes: "openid email profile ak_groups"
-      auth_url: "https://identity.unkin.net/application/o/authorize/"
-      token_url: "https://identity.unkin.net/application/o/token/"
-      api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
-      # to akR-global-admin members (and direct members) via terraform-authentik.
-      role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
-      role_attribute_strict: "false"

apps/base/grafana/grafanadatasource.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: grafana.integreatly.org/v1beta1
-kind: GrafanaDatasource
-metadata:
-  name: victoriametrics
-  namespace: grafana
-spec:
-  instanceSelector:
-    matchLabels:
-      dashboards: "grafana"
-  # uid matches the previous default datasource so the imported dashboards
-  # (which hardcode this uid or use the default) resolve without edits.
-  datasource:
-    name: "VictoriaMetrics"
-    type: "prometheus"
-    uid: "det2y55dac4jkc"
-    access: "proxy"
-    url: "http://vmselect-main.observability.svc.cluster.local:8481/select/0/prometheus"
-    isDefault: true
-    jsonData:
-      timeInterval: "15s"
-      httpMethod: "POST"

apps/base/grafana/httproute.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana-http-redirect
-  namespace: grafana
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: grafana
-spec:
-  hostnames:
-    - grafana.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: grafana
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: grafana
-  labels:
-    app.kubernetes.io/name: grafana
-    app.kubernetes.io/instance: grafana
-spec:
-  hostnames:
-    - grafana.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: grafana
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: grafana-service
-          port: 3000
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/grafana/kustomization.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cnpg_cluster.yaml
-  - cnpg_backup.yaml
-  - cnpg_pooler.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - grafana.yaml
-  - grafanadatasource.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - dashboards/bind9-exporter-dns.yaml
-  - dashboards/ceph-cluster.yaml
-  - dashboards/frr-ospf-route-metrics.yaml
-  - dashboards/gitea.yaml
-  - dashboards/haproxy.yaml
-  - dashboards/media-dashboard.yaml
-  - dashboards/node-exporter-full.yaml
-  - dashboards/nzbget.yaml
-  - dashboards/postgresql-database.yaml
-  - dashboards/puppet-report.yaml
-  - dashboards/victorialogs-cluster.yaml
-  - dashboards/victoriametrics-cluster.yaml
-  - dashboards/victoriametrics-vmagent.yaml
-  - dashboards/cloudnativepg.yaml

apps/base/grafana/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: grafana
-  name: grafana