chore: migrate to artifactapi helm virtual repo

- replace all helm repos with artifactapi/virtual/helm
- update projects with accepted repos
- set resource requests/limits for woodpecker jobs

apps/base/artifactapi/artifactapi-deployment.yaml

@@ -19,7 +19,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: artifactapi
-          image: git.unkin.net/unkin/artifactapi:v2.7.2
+          image: git.unkin.net/unkin/artifactapi:v2.7.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -19,10 +19,7 @@ remotes:
     package: "docker"
     description: "Docker Hub registry"
     immutable_patterns:
-      - "^library/almalinux"
       - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
       - "^library/nginx"
       - "^library/postgres"
       - "^library/redis"
@@ -33,7 +30,6 @@ remotes:
       - "^hashicorp/vault-secrets-operator"
       - "^jfrog/"
       - "^rancher/"
-      - "^traefik/"
       - "^ubi9/ubi-minimal"
       - "^victoriametrics/"
       - "^woodpeckerci/"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -26,9 +26,6 @@ remotes:
       - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
       - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
       - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
-      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
       - "lxc/incus/.*.tar.gz$"
       - "mikefarah/yq/.*/yq_linux_amd64$"
       - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -56,7 +53,6 @@ remotes:
       - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
       - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
       - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
     cache:
       immutable_ttl: 0
       mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-helm.yaml

@@ -109,17 +109,6 @@ remotes:
       immutable_ttl: 0
       mutable_ttl: 3600
 
-  traefik:
-    base_url: "https://traefik.github.io/charts"
-    package: "helm"
-    description: "Traefik Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
   victoriametrics:
     base_url: "https://victoriametrics.github.io/helm-charts/"
     package: "helm"
@@ -130,14 +119,3 @@ remotes:
     cache:
       immutable_ttl: 0
       mutable_ttl: 3600
-
-  argo-helm:
-    base_url: "https://argoproj.github.io/argo-helm"
-    package: "helm"
-    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600

apps/base/artifactapi/resources/conf.d/virtual-helm.yaml

@@ -13,6 +13,4 @@ virtuals:
       - purelb
       - rancher-stable
       - stakater
-      - traefik
       - victoriametrics
-      - argo-helm

apps/base/cattle-system/gateway.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
-  name: rancher
-  namespace: cattle-system
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: rancher-tls
-        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: rancher
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/cattle-system/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - rancher.k8s.syd1.au.unkin.net
+      secretName: rancher-tls
+  rules:
+    - host: rancher.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml

apps/base/inteldeviceplugins-system/kustomization.yaml

@@ -7,12 +7,12 @@ resources:
 
 helmCharts:
   - name: intel-device-plugins-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://intel.github.io/helm-charts/
     version: "0.35.0"
     releaseName: intel-device-plugins-operator
     namespace: inteldeviceplugins-system
   - name: intel-device-plugins-gpu
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://intel.github.io/helm-charts/
     version: "0.34.1"
     releaseName: intel-gpu-plugin
     namespace: inteldeviceplugins-system

apps/base/litellm/deployment.yaml

@@ -10,8 +10,6 @@ spec:
       app: litellm
   template:
     metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
       labels:
         app: litellm
     spec:
@@ -33,8 +31,6 @@ spec:
           envFrom:
             - secretRef:
                 name: litellm-credentials
-            - configMapRef:
-                name: litellm-env
           livenessProbe:
             httpGet:
               path: /health/liveliness
@@ -55,11 +51,11 @@ spec:
             timeoutSeconds: 5
           resources:
             limits:
-              cpu: "2"
+              cpu: "1"
-              memory: 6Gi
+              memory: 2Gi
             requests:
               cpu: 250m
-              memory: 2Gi
+              memory: 512Mi
           volumeMounts:
             - mountPath: /app/config.yaml
               name: config

apps/base/litellm/kustomization.yaml

@@ -21,8 +21,3 @@ configMapGenerator:
       - config.yaml=resources/config.yaml
     options:
       disableNameSuffixHash: true
-  - name: litellm-env
-    literals:
-      - STORE_MODEL_IN_DB=True
-    options:
-      disableNameSuffixHash: true

apps/base/paperclip/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: paperclip-postgres
-  namespace: paperclip
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: paperclip
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: paperclip
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/paperclip/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: paperclip-pooler-rw
-  namespace: paperclip
-spec:
-  cluster:
-    name: paperclip-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/paperclip/deployment.yaml

@@ -1,108 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  selector:
-    matchLabels:
-      app: paperclip
-  template:
-    metadata:
-      labels:
-        app: paperclip
-    spec:
-      containers:
-        - name: paperclip
-          image: ghcr.io/paperclipai/paperclip:latest
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 3100
-              name: http
-              protocol: TCP
-          env:
-            - name: PORT
-              value: "3100"
-            - name: PAPERCLIP_BIND
-              value: custom
-            - name: PAPERCLIP_BIND_HOST
-              value: 0.0.0.0
-            - name: PAPERCLIP_API_URL
-              value: https://paperclip.k8s.syd1.au.unkin.net
-            - name: BETTER_AUTH_BASE_URL
-              value: https://paperclip.k8s.syd1.au.unkin.net
-            - name: PAPERCLIP_ALLOWED_HOSTNAMES
-              value: paperclip.k8s.syd1.au.unkin.net,localhost
-            - name: PAPERCLIP_HOME
-              value: /paperclip
-            - name: PAPERCLIP_INSTANCE_ID
-              value: default
-            - name: PAPERCLIP_DEPLOYMENT_MODE
-              value: authenticated
-            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
-              value: private
-            - name: SERVE_UI
-              value: "true"
-            - name: HEARTBEAT_SCHEDULER_ENABLED
-              value: "true"
-            - name: PAPERCLIP_MIGRATION_AUTO_APPLY
-              value: "true"
-            - name: PAPERCLIP_STORAGE_PROVIDER
-              value: s3
-            - name: PAPERCLIP_STORAGE_S3_BUCKET
-              value: paperclip
-            - name: PAPERCLIP_STORAGE_S3_REGION
-              value: us-east-1
-            - name: PAPERCLIP_STORAGE_S3_ENDPOINT
-              value: https://radosgw.service.consul
-            - name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
-              value: "true"
-            - name: NODE_EXTRA_CA_CERTS
-              value: /etc/ssl/paperclip/ca.crt
-          envFrom:
-            - secretRef:
-                name: paperclip-credentials
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /etc/ssl/paperclip
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /api/health
-              port: 3100
-              httpHeaders:
-                - name: Host
-                  value: localhost
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /api/health
-              port: 3100
-              httpHeaders:
-                - name: Host
-                  value: localhost
-            failureThreshold: 3
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "1"
-              memory: 2Gi
-            requests:
-              cpu: 250m
-              memory: 512Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-      restartPolicy: Always

apps/base/paperclip/ingress.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: paperclip
-  namespace: paperclip
-spec:
-  rules:
-    - host: paperclip.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: paperclip
-                port:
-                  number: 3100
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - paperclip.k8s.syd1.au.unkin.net
-      secretName: paperclip-tls

apps/base/paperclip/kustomization.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - deployment.yaml
-  - ingress.yaml
-  - namespace.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/paperclip/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: paperclip

apps/base/paperclip/services.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 3100
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: paperclip
-  sessionAffinity: None
-  type: ClusterIP

apps/base/paperclip/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: paperclip
-spec:
-  allowedNamespaces:
-    - paperclip
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/paperclip/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: paperclip
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/paperclip/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: paperclip-credentials
-  namespace: paperclip
-spec:
-  destination:
-    create: true
-    name: paperclip-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/paperclip/default/paperclip-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/traefik-system/gatewayclass-external.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: traefik-external
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/gatewayclass-internal.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: internal
-  name: traefik-internal
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gatewayclass-internal.yaml
-  - gatewayclass-external.yaml

apps/base/traefik-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik-system

apps/base/woodpecker/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - namespace.yaml
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
-  - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_vault.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-vault
-  namespace: woodpecker

apps/overlays/au-syd1/csi-cephfs/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: ceph-csi-cephfs
-    repo: https://ceph.github.io/csi-charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
     version: "3.15.0"
     releaseName: ceph-csi-cephfs
     namespace: csi-cephfs

apps/overlays/au-syd1/csi-cephrbd/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: ceph-csi-rbd
-    repo: https://ceph.github.io/csi-charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
     version: "3.15.1"
     releaseName: ceph-csi-rbd
     namespace: csi-cephrbd

apps/overlays/au-syd1/externaldns/values.yaml

@@ -24,7 +24,6 @@ policy: "sync"
 sources:
   - service
   - ingress
-  - gateway-httproute
 
 # Environment variables for TSIG secret and algorithm from Vault
 env:

apps/overlays/au-syd1/paperclip/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/paperclip

apps/overlays/au-syd1/traefik-system/kustomization.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/traefik-system
-
-helmCharts:
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-internal
-    namespace: traefik-system
-    valuesFile: values-internal.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-external
-    namespace: traefik-system
-    valuesFile: values-external.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/traefik-system/values-external.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=external"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "dmz"
-    purelb.io/addresses: 198.18.199.0
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.199.0"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=internal"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.4
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.200.4"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

apps/overlays/au-syd1/vm-system/kustomization.yaml

@@ -9,7 +9,7 @@ resources:
 
 helmCharts:
   - name: victoria-metrics-operator
-    repo: https://victoriametrics.github.io/helm-charts/
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
     version: "0.57.1"
     releaseName: victoria-metrics-operator
     namespace: vm-system

apps/overlays/au-syd1/vso-system/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 helmCharts:
   - name: vault-secrets-operator
     repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.3.0"
+    version: "1.2.0"
     releaseName: vault-secrets-operator
     namespace: vso-system
     valuesFile: values.yaml

argocd/applicationsets/aitooling.yaml

@@ -11,7 +11,6 @@ spec:
       revision: HEAD
       directories:
       - path: apps/overlays/*/litellm
-      - path: apps/overlays/*/paperclip
   template:
     metadata:
       name: 'aitooling-{{path[3]}}'

argocd/applicationsets/platform.yaml

@@ -25,7 +25,6 @@ spec:
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker

argocd/projects/aitooling.yaml

@@ -11,8 +11,6 @@ spec:
   destinations:
     - namespace: 'litellm'
       server: https://kubernetes.default.svc
-    - namespace: 'paperclip'
-      server: https://kubernetes.default.svc
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace

argocd/projects/observability.yaml

@@ -8,6 +8,7 @@ spec:
   description: Observability stack (metrics, monitoring)
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
+    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
   destinations:
     - namespace: 'observability'
       server: https://kubernetes.default.svc

argocd/projects/platform.yaml

@@ -9,8 +9,8 @@ spec:
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
     - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    - https://purelb.github.io/purelb/charts
     - oci://gcr.io/k8s-staging-nfd/charts
+    - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
   destinations:
     - namespace: '*-system'
@@ -60,10 +60,6 @@ spec:
       kind: Certificate
     - group: 'cert-manager.io'
       kind: Issuer
-    - group: 'gateway.networking.k8s.io'
-      kind: GatewayClass
-    - group: 'networking.k8s.io'
-      kind: IngressClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'

argocd/projects/storage.yaml

@@ -8,7 +8,7 @@ spec:
   description: Storage infrastructure and CSI drivers
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
-    - https://ceph.github.io/csi-charts
+    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
   destinations:
     - namespace: 'csi-*'
       server: https://kubernetes.default.svc

clusters/au-syd1/bootstrap/argocd-repo-server-vault-ca-patch.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: argocd-repo-server
-  namespace: argocd
-spec:
-  template:
-    spec:
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-      containers:
-        - name: argocd-repo-server
-          env:
-            - name: SSL_CERT_DIR
-              value: /etc/ssl/certs:/custom-certs
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-certs
-              readOnly: true

clusters/au-syd1/bootstrap/argocd-self-app.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://git.unkin.net/unkin/argocd-apps
-    targetRevision: HEAD
-    path: clusters/au-syd1/bootstrap
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
-  syncPolicy:
-    automated:
-      prune: false
-      selfHeal: true
-    syncOptions:
-      - ServerSideApply=true

clusters/au-syd1/bootstrap/argocd-tls-certs-patch.yaml

@@ -1,50 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-tls-certs-cm
-  namespace: argocd
-data:
-  artifactapi.k8s.syd1.au.unkin.net: |
-    -----BEGIN CERTIFICATE-----
-    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
-    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
-    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
-    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
-    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
-    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
-    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
-    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
-    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
-    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
-    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
-    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
-    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
-    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
-    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
-    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
-    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
-    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
-    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
-    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
-    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
-    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
-    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
-    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
-    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
-    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
-    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
-    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
-    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
-    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
-    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
-    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
-    4gqd
-    -----END CERTIFICATE-----

clusters/au-syd1/bootstrap/kustomization.yaml

@@ -3,21 +3,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
   - au-syd1-apps.yaml
-  - argocd-self-app.yaml
 
 patches:
   - path: argocd-cm-patch.yaml
     target:
       kind: ConfigMap
       name: argocd-cm
-  - path: argocd-tls-certs-patch.yaml
-    target:
-      kind: ConfigMap
-      name: argocd-tls-certs-cm
-  - path: argocd-repo-server-vault-ca-patch.yaml
-    target:
-      kind: Deployment
-      name: argocd-repo-server