Fix validate-except syntax: trailing semicolon after last entry

named requires every entry in the list to be semicolon-terminated,
including the last one before the closing brace; without it named fails
config parse (missing ';' before '}') and crash-loops.

apps/base/artifactapi/cnpg_cluster.yaml

@@ -79,7 +79,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/authentik/cnpg_cluster.yaml

@@ -79,7 +79,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/bind-internal/authoritative/cluster.yaml

@@ -31,7 +31,7 @@ spec:
       external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
   resources:
     requests:
-      cpu: 100m
+      cpu: 20m
       memory: 128Mi
     limits:
       cpu: "1"

apps/base/bind-internal/authoritative/tsigkey.yaml

@@ -9,3 +9,16 @@ metadata:
 spec:
   clusterRef: bind-authoritative
   algorithm: hmac-sha256
+---
+# Client-update key: puppet clients (profiles::dns::updater) nsupdate their own
+# records to the authoritative zones with this key. Operator generates the
+# material into Secret client-update-tsig; the same value must reach puppet
+# eyaml (or the planned Vault-sync bridge) for clients to authenticate.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: client-update
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  algorithm: hmac-sha256

apps/base/bind-internal/authoritative/zones.yaml

@@ -15,6 +15,8 @@ spec:
   zoneName: unkin.net
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -26,6 +28,8 @@ spec:
   zoneName: main.unkin.net
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -37,6 +41,8 @@ spec:
   zoneName: 13.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -48,6 +54,8 @@ spec:
   zoneName: 14.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -59,6 +67,8 @@ spec:
   zoneName: 15.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -70,6 +80,8 @@ spec:
   zoneName: 16.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -81,6 +93,8 @@ spec:
   zoneName: 17.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -92,6 +106,8 @@ spec:
   zoneName: 19.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -103,6 +119,8 @@ spec:
   zoneName: 20.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -114,6 +132,8 @@ spec:
   zoneName: 21.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -125,6 +145,8 @@ spec:
   zoneName: 22.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -136,6 +158,8 @@ spec:
   zoneName: 23.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -147,6 +171,8 @@ spec:
   zoneName: 24.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -158,6 +184,8 @@ spec:
   zoneName: 25.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -169,6 +197,8 @@ spec:
   zoneName: 26.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -180,6 +210,8 @@ spec:
   zoneName: 27.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -191,6 +223,8 @@ spec:
   zoneName: 28.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -202,3 +236,5 @@ spec:
   zoneName: 29.18.198.in-addr.arpa
   type: primary
   defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: client-update

apps/base/bind-internal/externaldns/cluster.yaml

@@ -23,7 +23,7 @@ spec:
     type: ClusterIP
   resources:
     requests:
-      cpu: 100m
+      cpu: 20m
       memory: 128Mi
     limits:
       cpu: "1"

apps/base/bind-internal/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - authoritative
   - resolvers
   - externaldns
+  - tsig-api

apps/base/bind-internal/resolvers/cluster.yaml

@@ -21,9 +21,18 @@ spec:
   forwarders:
     - 8.8.8.8
     - 1.1.1.1
+  # The internal split-horizon zones are served UNSIGNED by the in-cluster
+  # authoritative, but their public parents publish DS records (e.g. unkin.net
+  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
+  # sees "parent indicates secure" but gets an insecure answer and returns
+  # SERVFAIL (broken trust chain). Treat the forwarded internal domains as
+  # insecure so they are not validated. unkin.net covers all *.unkin.net
+  # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
+  extraOptions:
+    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
   resources:
     requests:
-      cpu: 100m
+      cpu: 20m
       memory: 128Mi
     limits:
       cpu: "1"

apps/base/bind-internal/tsig-api/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/paperclip
+  - tsig-api.yaml

apps/base/bind-internal/tsig-api/tsig-api.yaml

@@ -0,0 +1,27 @@
+---
+# Companion TSIG API. The operator reconciles this into a Deployment, Service,
+# ConfigMap, master-token Secret and namespaced RBAC. vault-plugin-secrets-bind-tsig
+# calls it to create/rotate/delete TSIG keys, which it does by managing
+# BindTSIGKey resources in this namespace (the operator reconciles the material).
+#
+# The master access token Secret (bind-tsig-api-token) is generated by the
+# operator if absent; a VaultStaticSecret may later pre-seed/overwrite it so the
+# token is sourced from Vault rather than generated in-cluster.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGAPI
+metadata:
+  name: bind-tsig-api
+  namespace: bind-internal
+spec:
+  image: git.unkin.net/unkin/bind-tsig-api:v0.2.1
+  replicas: 1
+  port: 8443
+  # targetNamespace defaults to this resource's namespace (bind-internal), where
+  # the authoritative cluster and its keys live.
+  resources:
+    requests:
+      cpu: 25m
+      memory: 64Mi
+    limits:
+      cpu: 250m
+      memory: 128Mi

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.1.5
+          image: git.unkin.net/unkin/bind-operator:v0.2.1
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/bind-system/kustomization.yaml

@@ -6,6 +6,6 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.5/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.1/config/crd/install.yaml
   - rbac.yaml
   - deployment.yaml

apps/base/bind-system/rbac.yaml

@@ -23,7 +23,15 @@ rules:
     resources: ["pods/exec"]
     verbs: ["create", "get"]
   - apiGroups: ["apps"]
-    resources: ["statefulsets"]
+    resources: ["statefulsets", "deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # The BindTSIGAPI reconciler deploys the companion API: a ServiceAccount plus
+  # a namespaced Role/RoleBinding granting it access to BindTSIGKey + Secrets.
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["roles", "rolebindings"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: [""]
     resources: ["events"]

apps/base/cert-manager/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
+  - vmservicescrape.yaml

apps/base/cert-manager/vmservicescrape.yaml

@@ -0,0 +1,17 @@
+---
+# Scrape cert-manager webhook + cainjector metrics endpoints.
+# Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cert-manager
+  endpoints:
+    - port: metrics
+      path: /metrics
+    - port: http-metrics
+      path: /metrics

apps/base/csi-cephfs/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - storageclass.yaml
+  - vmservicescrape.yaml

apps/base/csi-cephfs/vmservicescrape.yaml

@@ -0,0 +1,15 @@
+---
+# Scrape the ceph-csi-cephfs nodeplugin + provisioner http-metrics endpoints.
+# Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: ceph-csi-cephfs
+  namespace: csi-cephfs
+spec:
+  selector:
+    matchLabels:
+      app: ceph-csi-cephfs
+  endpoints:
+    - port: http-metrics
+      path: /metrics

apps/base/csi-cephrbd/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - storageclass.yaml
+  - vmservicescrape.yaml

apps/base/csi-cephrbd/vmservicescrape.yaml

@@ -0,0 +1,15 @@
+---
+# Scrape the ceph-csi-rbd nodeplugin + provisioner http-metrics endpoints.
+# Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: ceph-csi-rbd
+  namespace: csi-cephrbd
+spec:
+  selector:
+    matchLabels:
+      app: ceph-csi-rbd
+  endpoints:
+    - port: http-metrics
+      path: /metrics

apps/base/encapi/cnpg_cluster.yaml

@@ -79,7 +79,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/grafana/cnpg_cluster.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: grafana
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: grafana
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: grafana
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 2
+  logLevel: info
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: 128MB
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/grafana/cnpg_pooler.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: postgres-pooler-rw
+  namespace: grafana
+spec:
+  cluster:
+    name: postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "50"
+      max_client_conn: "200"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler-rw
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler-rw
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw

apps/base/grafana/dashboards/bind9-exporter-dns.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: bind9-exporter-dns
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  resyncPeriod: 5m
+  allowCrossNamespaceImport: false
+  gzipJson: H4sIAAycS2oC/+1da1PbuBr+Kx5v5wx0A8QJ4ZKZ/QCBnu2Z0naBdmany8kotpKodSwfSaZkMzm/fd9Xsh2HXEhCYiDkC8SWLOm9PM+rq92zSRBwRRTjgbSrPdtnUtnVbz27ETFfvQ/sqlOwPaKI5JFwKWZR3RD+Z28W7Ih5cKslSJMExO4XbBqQhg/ZlIhowW4zL/3NXB7UuM8FPCBaDbJVLFglx4E/lUrBcrahtIB0sIaTQdOsf1knPhVKQqoiokWVaWyHwQ+nWCzYHaLc9knQtatN4kuK2Vog0bebwqDBst3gRHjYvtF7N3DXo9IVLMQqIfGUBd6xdfbxyrqi4pa51LrC5kjFXLkLDaEeU1kpm0y6xP+TEgH5hLrggWrbVWhbK6DqPSjIKZWLxwVUU9i+5txXLNTpPgt+SK11VA7UTO8UFQHxLUyxh2RhCiu0z5KGW1eJDVRSom2n8sXPR8KHi7ZSoazu7bWYakeNXZd39kLqEqkE34tNt5MqRO41fN7Y60AyFXuh4B2q2jSC26iVHXoXcgEpO14gd79LaHX/BgW5pR/5z9QGIQmobyRzue+TUFIvTRzrVYOKUq96k8nYR+0x7zPXztrW3gnVlfYL9p1WJdi/CJnwQec404CbxG9MaxasW9Am2tE+0dImtrjqgo46A6UL0EC/sHAlTUZ9r8aDJmvhcx5tkshXWmDX4KZndzgCylZtQWWb+560tfe6rENQXAfxEIYsaBlxeZgCXOMEHg0i37dRIgmF6/aB08H9j3sg3AAgEjyEEd/IO6ht0ATSkNyPFDogaCFMja3x3RKUBpByS/wIMmOdqJgkWYA3pIlHRQ3BKEBI21ogfksFWJtqA46Yfl+b/iBjeSex/ABSN6iJuzNQ8GfOAtSiZouMQnRjLowwAQ9QEA3Q4VvfI4B9sxvfJJHicJMLRgPDUAgvuPwbME+MXr3IpZ8y1RDfxQbZHUoC+yY2szRo1SqQMTJQ+doWvfhXtlK4FfpRiwVfqZCm3uPdyq5jL8W/AdVolze9el3xKqTRqqRASZ7sWzsWKHIL0V9vcK7qinVoPU7tsUAqErj0t///Zb8JoL3V3bd/2f1tC2oyaSrl/wBoAwQ2kidX74ir0CfQdLRFA+8dF+CqJpMgQYumvDEAoXE58AE0aRIW7CFsXlKJXKwdLXFpsNgGn/ni82AIn6UNPleKT1c752wIfXqAmtZGYixGic+I1N1FaRTeIEJmuhCy/YEGLexnOUVzTeVjexhTAJ667RjvbzJAbLVsfvxbEA+dz/T/xuDCKWlg4L8YGdBJ9mgAXU2WEQHbV05UjgWQ21aa6EZC6Dria3CAwW8WpL+BFAZ9MsURAcnVfc8GAfHSeAJe/GQearc8BFkkCo3XBISGrDKoJdhbv04IyRSI2KCgY4BgxlsmwSXE8lGLYKhqJb6WGScLPCoowqHpc4WupjX3KWsVuBkSl2ZdBDzL/THQDLhnSL0PIGhm4LAsnLLAFZRIugVPuFTKuhtGCSDr2g4TYFmwvvPGb3AH/gFIvzmlorzZth/CZmksNkfQ6IyCMRM5zCijQy9pyxgzO+z4CCMzz6p9/mJdQ5bsoKMHXkYQw7HvSBgeaOfXHlaPVQfsxG6ZF2HESsGu6RzKuiN3LBu6lKnCeK8pNXFXDbguuaPGTM1EXrSIz1unoHRNVYNnkUwG2drYuolZb3TZLHZk1kqQ1H+RjOTMyEhHmZ50ZRofOQdDhIQKOpHXZiQcZ1uEpQRrtdWVnikY4i1j+cVoy1k+bZk6noa1YmitlLS2ZNTZEtC12EI6mpmyEpLathpdawsRvG29taAzt23tWTgvQsSWy6NATSoWHwHKi0AhSICT+ivIgu2sk8xLib2ehVVZ/f7SyPF5cWDsrPfoTaPOBnvYMersor0APxrAzUGQ9gdOPMupdKDYX2q1k7Jugbmp7x0dF98VS8m9OJ9TqTmH9tqR69EM5Hr4Ysi1tF7kmkuXUJOfD57ujPKoJrgFOnkJmGags8LS2l+ZFAcWFaCSFeB09QI4S5fAGRKhtkYhZVw82ASRpQWRylxBxDmYIYocveYu+pPOLOTRR9ck1qEdLrr1C9q5RsXXG11FJ87zwfTg1r2n3sHk7wMP/WplnzmNmk1Q5lzP1Ijbpt70RxaZ2Pgi9XRhTgFvHqUtIAyUa2HB+QXAeSy6gEBxubNEw6XKM4u3LSCOKTYjzdkKY3tpVbE95ucJIV7r7AlD/FqM9Q6zU/tmJu14WpjeX87M/jMbxK0+/MbOg9RJ7qx3zKfWWbx1h2vaMQYr9p96uJdM/IP96s3sKlxCSW9wGw3Mdw3N9y8SQsBB8giHiUA8pMFqJfoU6qXpBwPiPMsXYzzluY+0yqUcVjFwmwRACwknM5b6yoSKtMF+KZ7slw9rg3vWhQ64maQXwN+l+fg7XpqdSuCVpyfwzcrsI2js1rhz0n+813FcNqUlgMqTqEWM7JxETIlkycwd882z4+tx3ebNovPsfeWhnbvOwTSuPX56rnU2XPuIXTB6b9r/Igos5EWhz1xYZB5ZVJ5KSKMbYSYz0VlaxVi+3V8u3Y4TEkwAeF2ZgLCQrWsYXsk+zVNCQQF76LGrk/IyrWLsbNL+whHlj8hQzItYbFlBSMnvQEapnOz7dXI6kfE+gMMtsLt69EzG65h0Ku1PC6RTtm8ZD33k0lAMntcZbXv9J14bGuZpFiNBEzZ7dLidY5MVtnuZm6zuQduamb9Lz3ixfHAkZAeBPncRr3qCPZ6gmU52hxuyW9tl8AlUJyiQnVQr7Xnz0F3yJtL7/HZppLA+6ZpeCM9tpj4WnPooTz0BdLQhsVdCYqCKEJRDV0pe5lDpJPJafEh9GTceuEtqvLxWzspvbF0+SsbW5ZzG1mBb7gN8XtHYeljjUxcEncpmlnotWFj7eErHOczl3jL6EygZTkuNn9jNaep6VHQfznzmI/iHk4vz/KeyRyXuMKlfw5CP1Bfvry5Ormu/zzC/vXLJAWoBrpl4+Yh+ffnlY+3k+vxs7N7KR3VEtGBW2iM51/jdDKLWLTRnDy3vT10+dkqbyLxGkXk589mzR+QVTWenTPWiprM3DDUvQx3NwlDlDUOtGUN1n9XAYdl7DKcLDm+GLOYq/jm8qrOYyxmqqYILqvKLTJdQWXdpp44zW2O6my7zWgek+BTxAxFpfxOR1mDP5T2C8iKh34mYvoCnEbk/qMohOvmr6EIbtjrtWmexXBvKWuvNbZXyVMoqbijrRVLWMFO5eOS6LoSEwuc/rfJ8hvX66Lh1eQmvkFevd6/xK9mJ9gAzORtmWqPhPQxvof9UB80zz3Sn8hzrfiU+jM+ecpQ/Kr+MXH3kMK+5jnHbWJZy2BDmEa7Oa6jjWLTX2aO80WpFnUEpFXQTCcGsQ1KQl49Q2V3ffElFZL5UoqM5XHr62A5epF8MQU4YuB5qnXZCH9QctIY+QJOSIiic+tRVmd008bvwP2ddOH5NffZmP3lVaBHdy/Ujj574A9L0SYP6979k0wGXYmmW+Es0QzlSekSX0SOq+2hKtebg7xa9M9vm5Q8WfhH+VTdwB5KMfExH7x9KZe8vHP8g4DF4V79hY3s2TfyHNyap4LtOGid7L1WCLqZuXNewRRTqV1lvZxA6sM8OpOx8JYLhTsYdPYyLtx3Nqj2DPUe73Vdd7R9xU2JXzF4axZm2FvA9s9faV+OQ+XRK/51LVZ2kdmTOBfWeEPAE5WPJM2p/b+vbf6s3v27DC5T21tkSnw1RjjVEaNLmN8SY91Bt7b7dhtj3oImwzllNpC2kS55uovISTIQxSccsEL0JzdV++nNHv/4SvoGhr+w4T8hgbkl/EyVudj0J9DpO6LDiFPFvWf/V7zHVJZnXaZaL+jeGzRL+cTw7Dt31gS2yD+isBzqrfqC0r/9iNDr0dIGenQjwN348BIaesINRmh2NcQ/AfPrrPA5Z+A2w1M+Gv3+FgScJh7g9k9If+uNfus/xD1uJBfNebQAA

apps/base/grafana/dashboards/frr-ospf-route-metrics.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: frr-ospf-route-metrics
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  resyncPeriod: 5m
+  allowCrossNamespaceImport: false
+  gzipJson: H4sIAAycS2oC/+1ZbW/bNhD+KwJRFC0gF7brZkGAfXDcZgiQpkFcbNiawqCkk82FJjWScuIK/u+7o14sN0lXB0nRJfliS5TIe+655046sWBcKe24E1pZtlcwKaxje58KFuVCukPF9nohS7jjVucmBrrFLTP8Z1PDU644C1kuEjzvdILfyqGg02GrkIHikcQ7nckhZDORNMci1mqkpTY4zUwj/qIbBv1eD3/evAmD3ktcU/E5GRmu0QXPg6EE4yxerSAk3M4izU3CVp/JYCJc22QqbMzln8DN2HHj3mvlZmyvGxL0bPZRa+lE5gekUOfo/qfPIcu4Amk9BakAmYy0SsWU/E4g5bl0nqY5zzKhptUcNzNgZ1om5TVNnjIeWS1zBwjXOsjKJePK66kBUHhlwWWON3dX4fqagWR9ZbeLrqFvegHGIIXe4opcEMmJ9vbQp9chu2B7g5BdeneWfkVGYcHo6ayJrjfxvsRXGqjIqMaUVjT0d26dSJfVYAzKgcFhbQQe+miQf7nTOJiBoRtGM66mMGqtbx1XCcUmJI/yGD60cHAZkydMcpTb57CkGkdY7Tkep1xaQDeQ2YuTtpXqEvIOl66yVqHZPhLEdpv9ryLT88q6QOaP+FLnrtQWDmUynwr1Oxhb0tHrv+q96hIEbqbgSiPtxGHPWmco1suMzKXGTNC0hNhpM8mzojn59Yxpm6VnLBSKuIwBR57Vx2ds5YlNDyn3hpgAaFk4Ej/7MD45CEb1OgGK3+WtrMEFnHf5/6nvwYa+d7bSNzfAr+i7ks49qftYu+NcyrsU+f2q0eC6MHFYduUkFVHBU4HCE9ligFJcmJRUiH+30OXhyWIQnNLyNhAqODjcfzCi3N0Q5S9PovxRoty5A1HuPFBRlpXydSXKwZMo70+U91MlH1h5rJX45kmJP0KJd1kat1NipZpGdhmX4Bx0YiTXipiawxjDqed0D78Udl+bBMwY+WwopOGR7zwg+QuM3rzQiipxzcrhIx6BLGNFpyeSxzDHNdZhiLgZSjFV5WjXD/whEjc74PSujEOv8I0yMfxi7JaeBGwNiexUSPkh47FwKORe2UMmJL7Nzom63ANTOiZhCipZa6LuN6vzhfiylhKGA1tbEp1tbiDLh0RApmUtcRrj1IvRgQfO9vooJS2UG4sv4JOLul54i428EVFeTmy69mqBWr00j9StYOFbPIvt7yYKjHd8jmWF1piizjIvk7AOrfd71S43FXFN8HWaMqoWP1l52vXlqd9t9cw7VX3qb9SnOozrGoHwE2Ezyetq5D+aUEKv9RZpR/ouaT6qlqgSv1FC4fVC6l7zXVFhkSrpidDGNTzfbdWg9nKiQEzxI4qxxXfWipKPA23mnIAVhUjR7dV/tKPHtZkgWgZe1TRrXVacmAOmgMBoPaLikpX591V5+amqS+8OqkvFz6MuLr1BVV1eP6bqQi9vE2n5ROXzCEzx3WXlI73LBEfjYVAUtMjX9SW8JQxwF9qcbw3nuJx3E6D9WwPiNjJboxmO909vgjK6PTf2FnE6HiOMG6C83RYKocCCC0Zhmx/rnMrT90N5V80kOC0U764+jAjviJa3Tw+gpwfQQ3wA7Vx9APX71QNo95E8gGyMXxFgkuTGy2tiAbcdE1ts8WrbbMZ84/X24PS0vdnijQZvK6PX1xfaZjQgNV+nD65NkiGPu5SPNp7BnDc8DHrEgJcXGcQbqJDhH7XnpF8CBPOMMqlUc7ORG+fG+KAVPhFjmScwxI8bteVqp3WDxX9yMEsqD5jr4Gbgt48aiL3WBmwzyQu2MVXWLYwzEC9BTfNaxozS6htxvBloa60apqTKOCk/z7y42tmEjf2X17tRrnO9B1XlbyGvR27rADZY22DH278Nm7Kf1JWJ+BxMGWc6/0I5halq9IX1zX1bsf45+Lz8uhO8B6ylsW228hFGh2B0TP3xZ1ELsb/6F7MoRVUzIAAA

apps/base/grafana/dashboards/gitea.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: gitea
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  resyncPeriod: 5m
+  allowCrossNamespaceImport: false
+  gzipJson: H4sIAAycS2oC/+2abW/bNhDHv4pBDMMGOIWlxG5qYC+yDimCpknQtOuLNjAo6SwzoUiNpJK4gb/77qgH20G2dbCgtIBe2BAlinf83+9OpKAHxpXSjjuhlWXTByaFdWz6+YH99NOC28VbWLIp09E1xG4ajl6O2ZBFhZDuRLFpMGQJd9zqwsSA3fb2Bm8Mn3PFB3t72BEUjyRecKaAIVuIpDkWsVavtdQG7zJpxH8ZDQdhEODfeDwcBL/izYpnNObR2r3Bz4MjCcZZvOqWOV1N0MVIc5Ow1dUKvQEbG5FTb7z4TivhtBm8EQ74wIK5BUNeJcJt+pUqcCcJzmY/eBVi0/B88UFr6UTOpqMhKqJuUJrPV0OWcwXSenm4FNz6KZBsaDvidDTn0sLQ+3UKKnULHHdUtmHz8oZqCbhwOR4nPD64vonRwbmQ0otLByhoIkBhTMbkm0gutI8TDjwZsjs2PRyye+8nBmq08jInoC7BiA2DAue3jyNKSEEldD+/TZurcWGMN1G1M36/PhaqObYLfdc0HIZFNq1bLovG3sqLRs1SYWrciYTEQD9VIeWFFsq90wSEb+Osdd4wSPKc1qrjYDmgUsrxFBp7uSxSof4EY8tYT168fLGPo+Q0MElW4M1h1V7rgNNMwABhN5fa4Q3WC3WOaKC2UMXZ5jyGzfhZx+ObtQ4O8hwSdHHtkOMmBVeyAfc5WciNjsHamQGLQys3yyDTZjmLlg7sw7WOfvvCUmLzC1uhJ+goIkqaMlZH6libjLvyjIE5YcqOkHW0t8BhF1omlctOZHBsdMampGfZfg9pKWnd4XIh5m7dw1ESsPeVe4PSPUqumv4HDDk3kNSBtNo4H0Mf7lmVhEIl4lYkBbqOwUL1FepXAlXeVvXzmYXD3/N74eMcFfGN16x0KCt5IEeb/C+vlOCVg9WkeTKW/B5Kzee1UtjXUGAlj0DWA0id/s4t+KzydFcWCe7HJlbDVke78l6WE8aika7TybdO4bYeeEWWv7O6cvgNdSXs68qz1JU4L2YW8Ema2JlX7amaghY2IvBcNeb1xcdBldd9cemLS1Vcgsk3VJf9vro8S3XROajZPHliodLwS8k0K135z1pTt4557GjZH3RZfs5xLoPjPy778vOs5effK8h2nTjwdWKysbmZrMqKEG5lXUzVrMpJL5+vRSCT840+XMakJM7UujPtzih3r2i7OOeFdL5PxvNcqLQmaQO9hzp4PLJaFo4sUC6VsYmrXWzCzc1eVNov/SjnfYUzZ3o7UR+XHQ9PXVe0oiGuC+vEfFmdpDri967aUFnl1QaXF04Tlv9UVp7Ibp/GMx5TildZ+79WBE+k4JMZd1ZkEZiBng+O1raqXMEy4dguPEy2eAgOeyB2BcJAri29LBHdQPF+215bYAThdqU46MnYlYwCn++dIPGxMtQaC4dbLIx7FHZFQVhbdFMeTmpLu8NwsLGCCEb1IyP4fmlYgpS4wPohVhGlOp0sImpTbRFx8IiIUU/E7kT4nUQnQJzWltri4XCbh7CvEC3woE3KlfjKO6sT548MtkVHtbBcl4tJj8fueOAv6wSLD5Wh1nCYbONw2NOwOw1zTZ52wsNxY6otIsJHK8ywX0+0gEReRFLge9RlJ1RceGtvS2st7zwO6gfHy++Xi7wwufwhdqIYlW5eSlxWhlredTQ0HPQ07E7DHUQLrW86AeLT2lbLO4+GiVc9E2280JbAbVcvsxtbbe83aij6p0YLTMQ6y0C5Tph4vbbV9qajZmK/Z2J3JjIhwTqtuqkU7zattb31qLkIxz0YLSwquIsX3VDxqTG1hcSVH5pkxlNBRqJit4w3kwhD0nkpoVLXT6cJEGS5RBVUuvFVP31W4j9BwVNz7ySKebcXLPyHMWWLVX1y2ngZ6ll5MauF8KTsj8hh79aY/gL/vz/yxzReSH9BwmqbXylqUxYZ3Hj7QNVC+M/zsV0QvEyd/RWc3I3ffPWQGEFf6ttHU7itFRiv/gYQwxSUwDAAAA==

apps/base/grafana/dashboards/nzbget.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: nzbget
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  resyncPeriod: 5m
+  allowCrossNamespaceImport: false
+  gzipJson: H4sIAAycS2oC/+1X227bRhD9FWIfCqegDcmNAtdAH2wHLgzErgEZDVpbMJbkiNx4uUvsDq0blG/vzHJFybHbpg3aIkBfJHEvczlz5gy1EtIYixKVNV4cr4RWHsXx7UpkrdJ4YcTxMBWFROlt63LgI7ho6FuUTk6lkSIVrSroeX8/+bFbSvb3xToVYGSm6SS6FlJRqaL/rXJrzqy2jq65MpN7gzQ5HA7pYzRKk+ErsmlkzU5OttEl3yQnGhx62o0hFNJXmZWuEOsJOywU7rqcKp9L/QtIN0bp8NIarMTxIOXQm+rGWo2qCQlqZR4o/dtJKhppQPsAwYtpN87WgBW0vs+8ADxcjEaFzF9/eMg59akCXZxZM1UlXy1gKluNAeC8y3slalsEe1IDIuznWnqvwu289WhrPiPnyp9aV4AbV3YmjqdSe0qMl8/AIDgofgVnn26wg8vOOMIcRbf8TmagaSk+XmuZQ002aEm2aGk5k+5Eq9J0q4Ow8F4VWJ3LHDnmwcEb4oKTszEuGGWGDQRnq/VPjcwVLjbwFoqMxCCMDaeYAOeuy0tDCabow8ZNKeLzo1rG34SGMp6qftVqrko8wI4vOP/G6sCOGIx0otsMcYfSNlYZHKslRTJKBRMC3hLHncra7mJf2WiAXHoC+5rveQ4fHoHNemLG0yg8yvxBmVDi0tm2YcLSyXonb7KGlQOyqAsfcetrb6dTsd7Q5VKZSznvjdeyach2ZOXWxs51mXmrW2RwPULTkTbyiwICMLTzKHVLhw1Fvk6328Sc7ebRIPRPaxTT4ZQs0ZOltB3VrDNbS8wrCMQNnM8WV9yhdKyJ2iFuqFN1clMREmXVtMhGqFsaqp6KVsLVLoTe+YrSn0Nx9kncMcewxyBtLofeOOBadWju2GE5IDfDQTocTDpaRpEgA5OQYkkZXdsAIh09SgU11eHrVMwDcZm+zLgiMKfPbMtXwk/qnHMR1K54ZQMvOVqQIWgVPqmM5L9QvtFysWnFoEyEyE7jOVVW3J/Mt3fRBUvXeqcl+mp7YkOw4K3Dnl58VLoS8Esli6LlCG9IMd6TPPY8ZFHt9STnL1qbN1wq5STCnllm5P7ewMzfU6cSa+6RmXCfLRD8qlv64eOdOPj2TqxvR/WE9X1KuF0CyjG1XF713pTJdVvAVdzldPqhYajfGLaNBgTAzq0jalIwq+hpvSbrTpqyHwMOphdFbM3Wwyk17VZ8mFh/H7SXwYGaiuy2CHZo+bbe+xzEAkKv7ozYzMwemj/M/1n3/Q4KpzQriTMKg4J3oSRv3yXjBqBIskVy7ewj+XXbMYuqBoqTm/jL4PoqxyIvj+0USZ83U/H/MfmfjMl/fSR+MgU/a4AcxQFy+CcD5NmACG/eT+dDZpEZ/xUNCP7X0GlHVL2odVwsWdzntjX4T6j/SY7qERLSFgN5h/pfmgLPJfFFiy8I4iSYZirSxjAUi16UavkzOB8a57vvuQI9a8NwwNgO8d8WE4tthpeh0PtUvNn+m4pd2u5JxDONosBZKePzkqtMwDs7851oP8mjLyjA4GFp1AezHJSDnIm+CZC6fwbwEP4jsRKufwNsYW6gFQ4AAA==

apps/base/grafana/dashboards/puppet-report.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: puppet-report
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  resyncPeriod: 5m
+  allowCrossNamespaceImport: false
+  gzipJson: H4sIAAycS2oC/+2be2/bNhDAv4rAbUACOJ0k27FjYAOaFzagj60J9sfaIqAlWiYiiyopOU4977Pvjg9J9pLGbtM2bVy0qsXn8e7440lnzwnNMlHQgotMkcGcpFwVZPD67aJFYqYiyXOsIgNyzArKUxZ7PBsJOdE9PDoUZeH9UeY5KzzJciELb8IKySNFWoTFvKDDlJFBIUvWIknGit9jMuj5fouMecyORFZIkSrXIOXZpcLZW0SykWRqTAYjmiqokuIKa+YkEmlKc8WqmtVZxownY1gDCbp+PgMxcpqx1Ham0Zid8wkDsckgK9O0hQMKeUijy0SKMourcXX5XzQt2XIRjkRkMqQ7Xb/lBb2w5XW6Lc9/ctDbhdl0TdjuQVV4AFU+VvUP6ips3O2Yf9Bpl8BqY1pQJUoZwVyEsndpnvFeycJphxE0RMQnFJdgJF5dMZNSyEpIYx0YB02Q0DJhaNcJndm1BP19UP+EZ/YebtRYXLnBijHqXaTxMzrUarPDVuXPqbxk0lUsGgqH+TjoL4D/soLJKU2dxFy9YFc3WHlC85xnyfl1znS/xr0xWEYnqJIpiuoVwivYrIBppnYpi1bVRNIsuaFJuNDTzI5Bw38IkAvGDdD/UDBd8FzE2D8SWcaigsXE1J3jMFb8XKhixGdmifbmFHz3jL/Hrj3/JywHl63a6M+NJl3dRMv4HLxXr20kxQSqcAqo02IPyIufn+KNcBUovgIPhpXoD/IS1KctOuJpeoQOiYtHz2oH4HNBHy79A3StoI9ON8JRnBGxb6OP6RKiGx+0sbFxBGfYgsqEFUZYNsuxUwF7Z2d3L9c7/sLs+PkYNPLLG/Ij/v+GtFg25VJkE5bp0sbtG7L4GZTve796ewExDKhkcz5zSqMCBYT1pixhWXzqHJpoLCBBCCpJFSyHZh0fdVS5p8Kd3wcLB/2+j6rkBe4UgrveUzyLmJdS5WiFDcAqqFiQr3Z27ZAEmicpU4BH51ANk/a1SXVpZVIBApFfVq1pXbE2qC54Yfw2KqWeGl35Y/Fk9tUSnXaQO/B3HSTdwLE7mbQmgzKRsVsw5N9MoVXc3IkhnH9hyNN9bOTpfmfksba8ATxLxLlgU9gyahPwtNBYUHoOwU4KHHIIups68zl2XSygsQltbpFmfTq1giaXUCBPjLwTN8rjgs9HxEMPkj29LXu+CntW/Cfw70RPs4f/pOt/NH4sUk7huaiUDBizSSD0YABkxSfbqOcbJc/+ljzbqOfDUc9ZGUVMqYeEHSsSqOu7IA/dqViy/tugGlffJnn6W/I8DvKAD2jPrGIe+xj1bUY8r9xq7pE8/jbi+XLcCcIteB4HeKIxrmejmGdxM2JuAYmdYH2SNDhyVPX9gvELnSbGYqDHcyOITdxYqZ7h222bkntlXnJr5qydN2v7/8ub0ZRTdWS5M7cLR2X90Ds5DPePofWpzg5i0UnYOe6EUPQScoPwYktdZ6j3H46OnsLQUP4KVSQL29rvdUMc4AyYGJd2jJ5/fHiiSy85rESXdftBxz+CMn34YEk/POwe92F5ZEhllUX8JKBxdOXA5icR0S+n0GIpT4EAClaBow8w1A2oKsmeqvPmHGiziuf2HHBah6FPJnlx3Sz4m0nh7gEsVV/AaJ0QRWudacFMw2YST4HVjyF9W/mG0Zjtqt2pJiruWLW0f694XIw1qxsgXaWZhUrOQNFZQZNaQzm2kjTmpdLIzS0UneSgKSYZbvZRKnCrKCY5U07Tdj6DpH3cjHAqViuDnQn+8EwTyp0VN+SpRH6502st73VMXs03jVi8YJc0TxuyaQRzA1dWqYLLReFODa7DCTH3Z2M+qk4It7+PS2mS7zspLViVydrVTBdpwXN9ACuMctLSZO+totQY0lx1aIFeog2kHeLCQoxnMZ/yuITFLiqyJZLmY5hhRmdcI2BinMBYDs8zTScjadMTna+9rhwfv1pwTWf29F3KVqcYA7hRUpEcUuUO7Zkr1ntgdR4EXD3S2CT27GhosA+NpUO3xlBvcbBHCDzk2sFnwJptUHPNwWwLNgM2txvXI9ttD2af8iR2P1TzP4w1R7FbsFY9lHnDaw9DqFLdF+H8B0K4ZS59bcq9rXUPO96DL1htGCeG3W81TrQruwdu2nDQ/3RuNjC5DjhtcIimNR/vHZvVk7SjZvD1qGk9y6XLyTI7F/cMVR0n6hdd/74h8B3FEU8AQfD4yEBT/9zHq6+PAG71/Po54FvHlAK07mG7TWhbO9knhpM48VqoNQ68DSUfIhNtLNl5DEz0HxITqzOpIWB4Nyo3erB+VOHndwHDBxd13vrmcumlpfIq7Zv3nYC4Cf0LUgFa6UHbafxICgWfuKw9+VoPF8ObbLQbTbSWzOiY8SjYJIcnC3hZ2/jFA26n1CYpbEbGYWi+uIuL5ovMCL4sSsuYPW2+ELeq+g12Bp7jJXhRVWkzC2NTJ3L7Owx03Xclk0A80//CWHtnafu1POy3Sxq/lgjwc8JsjqB6/AEd6KWpP82g1vdBM8sFxiHNzObs+qwqOamxcJtm2FKTjRXU6P7Z9IQbT7vpoE64iKu99rjKsuhHK90m59ElYn3uRLlw2NM+2sXQJfDx2tbXAF8FdvES6Gvb159x6BAvQUws5S5q3TQ76Kb7uqnuEHb0FVNQvVgPGBO3gPeYxBuQIf7WBoS8ZWNCeYnnOxnRg3CfDv29kIX7e53OMNijbT/YO6Dwxw97/XY4wmxGtWUX/wF8UK+AbjQAAA==

apps/base/grafana/gateway.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: grafana
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: grafana
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: grafana.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: grafana.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: grafana.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: grafana.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: grafana-tls

apps/base/grafana/grafana.yaml

@@ -0,0 +1,60 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: Grafana
+metadata:
+  name: grafana
+  namespace: grafana
+  labels:
+    dashboards: "grafana"
+spec:
+  deployment:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: grafana
+              env:
+                # DB password + OAuth client secret injected from the
+                # Vault-synced secrets (GF_ env overrides grafana.ini).
+                - name: GF_DATABASE_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: postgres-credentials
+                      key: password
+                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      name: oauth-credentials
+                      key: client_secret
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  cpu: "1"
+                  memory: 1Gi
+  config:
+    server:
+      root_url: "https://grafana.k8s.syd1.au.unkin.net"
+    database:
+      type: "postgres"
+      host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
+      name: "grafana"
+      user: "grafana"
+      ssl_mode: "require"
+    auth:
+      disable_login_form: "false"
+      oauth_auto_login: "false"
+    "auth.generic_oauth":
+      enabled: "true"
+      name: "Authentik"
+      allow_sign_up: "true"
+      use_pkce: "true"
+      client_id: "grafana"
+      scopes: "openid email profile"
+      auth_url: "https://identity.unkin.net/application/o/authorize/"
+      token_url: "https://identity.unkin.net/application/o/token/"
+      api_url: "https://identity.unkin.net/application/o/userinfo/"
+      # Authentik groups -> Grafana roles (adjust group name as needed).
+      role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
+      role_attribute_strict: "false"

apps/base/grafana/grafanadatasource.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: victoriametrics
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  # uid matches the previous default datasource so the imported dashboards
+  # (which hardcode this uid or use the default) resolve without edits.
+  datasource:
+    name: "VictoriaMetrics"
+    type: "prometheus"
+    uid: "det2y55dac4jkc"
+    access: "proxy"
+    url: "http://vmselect-main.observability.svc.cluster.local:8481/select/0/prometheus"
+    isDefault: true
+    jsonData:
+      timeInterval: "15s"
+      httpMethod: "POST"

apps/base/grafana/httproute.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana-http-redirect
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: grafana
+spec:
+  hostnames:
+    - grafana.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: grafana
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: grafana
+spec:
+  hostnames:
+    - grafana.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: grafana
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: grafana-service
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/grafana/kustomization.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - grafana.yaml
+  - grafanadatasource.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - dashboards/bind9-exporter-dns.yaml
+  - dashboards/ceph-cluster.yaml
+  - dashboards/frr-ospf-route-metrics.yaml
+  - dashboards/gitea.yaml
+  - dashboards/haproxy.yaml
+  - dashboards/media-dashboard.yaml
+  - dashboards/node-exporter-full.yaml
+  - dashboards/nzbget.yaml
+  - dashboards/postgresql-database.yaml
+  - dashboards/puppet-report.yaml
+  - dashboards/victorialogs-cluster.yaml
+  - dashboards/victoriametrics-cluster.yaml
+  - dashboards/victoriametrics-vmagent.yaml
+  - dashboards/cloudnativepg.yaml

apps/base/grafana/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: grafana
+  name: grafana

apps/base/grafana/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: grafana
+spec:
+  allowedNamespaces:
+    - grafana
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/grafana/vaultstaticsecret.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: grafana
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/grafana/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: grafana
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/grafana/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/litellm/cnpg_cluster.yaml

@@ -79,7 +79,7 @@ spec:
       cpu: "1"
       memory: 1Gi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 512Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/observability/gateway.yaml

@@ -0,0 +1,117 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: vmselect
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vmselect
+    app.kubernetes.io/instance: victoria-metrics
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vmselect.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: vmselect.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: vmselect.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: vmselect.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vmselect-tls
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: vminsert
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vminsert
+    app.kubernetes.io/instance: victoria-metrics
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vminsert.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: vminsert.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: vminsert.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: vminsert.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vminsert-tls
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: vmagent
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vmagent
+    app.kubernetes.io/instance: victoria-metrics
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vmagent.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: vmagent.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: vmagent.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: vmagent.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vmagent-tls

apps/base/observability/httproute.yaml

@@ -0,0 +1,165 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vmselect-http-redirect
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vmselect
+    app.kubernetes.io/instance: victoria-metrics
+spec:
+  hostnames:
+    - vmselect.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vmselect
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vmselect
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vmselect
+    app.kubernetes.io/instance: victoria-metrics
+spec:
+  hostnames:
+    - vmselect.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vmselect
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: vmselect-main
+          port: 8481
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vminsert-http-redirect
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vminsert
+    app.kubernetes.io/instance: victoria-metrics
+spec:
+  hostnames:
+    - vminsert.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vminsert
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vminsert
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vminsert
+    app.kubernetes.io/instance: victoria-metrics
+spec:
+  hostnames:
+    - vminsert.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vminsert
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: vminsert-main
+          port: 8480
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vmagent-http-redirect
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vmagent
+    app.kubernetes.io/instance: victoria-metrics
+spec:
+  hostnames:
+    - vmagent.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vmagent
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vmagent
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: vmagent
+    app.kubernetes.io/instance: victoria-metrics
+spec:
+  hostnames:
+    - vmagent.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vmagent
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: vmagent-main
+          port: 8429
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/observability/kustomization.yaml

@@ -4,3 +4,8 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - vmcluster.yaml
+  - vmagent.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - vmpodscrape-cnpg.yaml

apps/base/observability/vmagent.yaml

@@ -0,0 +1,126 @@
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAgent
+metadata:
+  name: main
+  namespace: observability
+spec:
+  replicaCount: 2
+  scrapeInterval: 15s
+  # Also consume VMServiceScrape / VMPodScrape / VMNodeScrape from every namespace
+  # (the operator auto-converts Prometheus ServiceMonitors -> VMServiceScrape).
+  selectAllByDefault: true
+  extraArgs:
+    loggerFormat: json
+  remoteWrite:
+    - url: http://vminsert-main.observability.svc.cluster.local:8480/insert/0/prometheus/
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "1"
+      memory: 2Gi
+  # Reflected Vault intermediate CA (unkin.net) for verifying puppet Consul + metrics targets.
+  volumes:
+    - name: vault-ca
+      secret:
+        secretName: vault-ca-cert
+  volumeMounts:
+    - name: vault-ca
+      mountPath: /etc/vmagent-tls
+      readOnly: true
+  inlineScrapeConfig: |
+    - job_name: vmagent
+      static_configs:
+        - targets: ["localhost:8429"]
+    - job_name: "kubernetes-apiservers"
+      kubernetes_sd_configs:
+        - role: endpoints
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      relabel_configs:
+        - source_labels:
+            - __meta_kubernetes_namespace
+            - __meta_kubernetes_service_name
+            - __meta_kubernetes_endpoint_port_name
+          action: keep
+          regex: default;kubernetes;https
+    - job_name: "kubernetes-nodes"
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      kubernetes_sd_configs:
+        - role: node
+      relabel_configs:
+        - action: labelmap
+          regex: __meta_kubernetes_node_label_(.+)
+    - job_name: "kubernetes-nodes-cadvisor"
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      kubernetes_sd_configs:
+        - role: node
+      metrics_path: /metrics/cadvisor
+      relabel_configs:
+        - action: labelmap
+          regex: __meta_kubernetes_node_label_(.+)
+        - source_labels: [__metrics_path__]
+          target_label: metrics_path
+      metric_relabel_configs:
+        - action: replace
+          source_labels: [pod]
+          regex: '(.+)'
+          target_label: pod_name
+          replacement: '${1}'
+        - action: replace
+          source_labels: [container]
+          regex: '(.+)'
+          target_label: container_name
+          replacement: '${1}'
+        - action: replace
+          target_label: name
+          replacement: k8s_stub
+        - action: replace
+          source_labels: [id]
+          regex: '^/system\.slice/(.+)\.service$'
+          target_label: systemd_service_name
+          replacement: '${1}'
+    # puppet-prod Consul service discovery (same targets as the puppet vmagent).
+    # consul.service.consul resolves to the puppet Consul from in-cluster pods.
+    - job_name: consul
+      consul_sd_configs:
+        - server: consul.service.consul:443
+          scheme: https
+          # Set datacenter explicitly so VM does not call /v1/agent/self
+          # (which needs agent:read that the anonymous token lacks); catalog
+          # and health reads work anonymously.
+          datacenter: au-syd1
+          tls_config:
+            ca_file: /etc/vmagent-tls/ca.crt
+      relabel_configs:
+        - source_labels: [__meta_consul_tagpresent_metrics]
+          regex: "true"
+          action: keep
+        - source_labels: [__meta_consul_node, __meta_consul_service_port]
+          separator: ":"
+          target_label: __address__
+          replacement: "${1}:${2}"
+          action: replace
+        - source_labels: [__meta_consul_tag_metrics_scheme]
+          target_label: __scheme__
+          action: replace
+        - target_label: __metrics_path__
+          replacement: /metrics
+        - source_labels: [__meta_consul_tag_metrics_job]
+          target_label: job
+          action: replace
+      tls_config:
+        ca_file: /etc/vmagent-tls/ca.crt

apps/base/observability/vmcluster.yaml

@@ -0,0 +1,115 @@
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMCluster
+metadata:
+  name: main
+  namespace: observability
+spec:
+  retentionPeriod: "180d"
+  replicationFactor: 2
+  vmstorage:
+    replicaCount: 2
+    extraArgs:
+      dedup.minScrapeInterval: 15s
+      loggerFormat: json
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: cephrbd-fast-delete
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 200Gi
+    resources:
+      requests:
+        cpu: 250m
+        memory: 2Gi
+      limits:
+        cpu: "2"
+        memory: 8Gi
+  vmselect:
+    replicaCount: 2
+    extraArgs:
+      dedup.minScrapeInterval: 15s
+      loggerFormat: json
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+      limits:
+        cpu: 500m
+        memory: 1024Mi
+    hpa:
+      minReplicas: 2
+      maxReplicas: 10
+      metrics:
+        - type: Resource
+          resource:
+            name: cpu
+            target:
+              type: Utilization
+              averageUtilization: 60
+      behavior:
+        scaleUp:
+          stabilizationWindowSeconds: 0
+          selectPolicy: Max
+          policies:
+            - type: Percent
+              value: 100
+              periodSeconds: 30
+            - type: Pods
+              value: 4
+              periodSeconds: 30
+        scaleDown:
+          stabilizationWindowSeconds: 300
+          selectPolicy: Min
+          policies:
+            - type: Percent
+              value: 10
+              periodSeconds: 60
+            - type: Pods
+              value: 2
+              periodSeconds: 60
+  vminsert:
+    replicaCount: 2
+    extraArgs:
+      loggerFormat: json
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+      limits:
+        cpu: 500m
+        memory: 1024Mi
+    hpa:
+      minReplicas: 2
+      maxReplicas: 10
+      metrics:
+        - type: Resource
+          resource:
+            name: cpu
+            target:
+              type: Utilization
+              averageUtilization: 60
+      behavior:
+        scaleUp:
+          stabilizationWindowSeconds: 0
+          selectPolicy: Max
+          policies:
+            - type: Percent
+              value: 100
+              periodSeconds: 30
+            - type: Pods
+              value: 4
+              periodSeconds: 30
+        scaleDown:
+          stabilizationWindowSeconds: 300
+          selectPolicy: Min
+          policies:
+            - type: Percent
+              value: 10
+              periodSeconds: 60
+            - type: Pods
+              value: 2
+              periodSeconds: 60

apps/base/observability/vmpodscrape-cnpg.yaml

@@ -0,0 +1,17 @@
+---
+# Scrape metrics (:9187) from every CloudNativePG postgres instance pod in any
+# namespace. Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: cnpg-clusters
+  namespace: observability
+spec:
+  namespaceSelector:
+    any: true
+  selector:
+    matchLabels:
+      cnpg.io/podRole: instance
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/paperclip/cnpg_cluster.yaml

@@ -79,7 +79,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/puppet/cnpg_cluster.yaml

@@ -100,7 +100,7 @@ spec:
       cpu: 500m
       memory: 512Mi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600

apps/base/puppet/cronjob_generate-types.yaml

@@ -47,7 +47,7 @@ spec:
                   cpu: 300m
                   memory: 1Gi
                 requests:
-                  cpu: 200m
+                  cpu: 50m
                   memory: 512Mi
               securityContext:
                 runAsUser: 0

apps/base/puppet/deployment_puppetboard.yaml

@@ -148,7 +148,7 @@ spec:
           resources:
             requests:
               memory: 350Mi
-              cpu: 100m
+              cpu: 50m
             limits:
               memory: 1024Mi
               cpu: 500m

apps/base/puppet/deployment_puppetdb.yaml

@@ -38,8 +38,8 @@ spec:
               cpu: 1
               memory: 1536Mi
             requests:
-              cpu: 250m
-              memory: 512Mi
+              cpu: 50m
+              memory: 768Mi
           ports:
             - containerPort: 8080
               name: pdb-http

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -34,7 +34,7 @@ spec:
             cpu: 2
             memory: 3072Mi
           requests:
-            cpu: 500m
+            cpu: 200m
             memory: 1024Mi
         ports:
         - containerPort: 8140

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -38,7 +38,7 @@ spec:
               cpu: 2
               memory: 3500Mi
             requests:
-              cpu: 250m
+              cpu: 100m
               memory: 1024Mi
           ports:
             - containerPort: 8140

apps/overlays/au-syd1/authentik/values.yaml

@@ -83,7 +83,7 @@ server:
       cpu: "2"
       memory: 2Gi
     requests:
-      cpu: 250m
+      cpu: 50m
       memory: 512Mi
 
 worker:
@@ -95,7 +95,7 @@ worker:
       cpu: "2"
       memory: 2Gi
     requests:
-      cpu: 250m
+      cpu: 100m
       memory: 512Mi
 
 postgresql:

apps/overlays/au-syd1/grafana/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: grafana
+
+resources:
+  - ../../../base/grafana

apps/overlays/au-syd1/observability/kustomization.yaml

@@ -6,17 +6,3 @@ namespace: observability
 
 resources:
   - ../../../base/observability
-
-helmCharts:
-  - name: victoria-metrics-cluster
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "0.33.0"
-    releaseName: victoria-metrics-cluster
-    namespace: observability
-    valuesFile: values-vmcluster.yaml
-  - name: victoria-metrics-agent
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "0.30.0"
-    releaseName: victoria-metrics-agent
-    namespace: observability
-    valuesFile: values-vmagent.yaml

apps/overlays/au-syd1/observability/values-vmagent.yaml

@@ -1,102 +0,0 @@
-image:
-  repository: victoriametrics/vmagent
-  pullPolicy: IfNotPresent
-global:
-  scrape_interval: 15s
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-podAnnotations:
-  prometheus.io/scrape: "true"
-  prometheus.io/port: "8481"
-replicaCount: 3
-extraArgs:
-  envflag.enable: true
-  envflag.prefix: VM_
-  loggerFormat: json
-  httpListenAddr: :8429
-service:
-  enabled: true
-ingress:
-  enabled: true
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: vmagent.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: vmagent.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-  hosts:
-    - name: vmagent.k8s.syd1.au.unkin.net
-      path:
-        - /
-      port: http
-  tls:
-    - hosts:
-        - vmagent.k8s.syd1.au.unkin.net
-      secretName: vmagent-tls
-  ingressClassName: nginx
-remoteWrite:
-  - url: http://victoria-metrics-cluster-vminsert.observability.svc.cluster.local:8480/insert/0/prometheus/
-scrape_configs:
-  - job_name: vmagent
-    static_configs:
-      - targets: ["localhost:8429"]
-  - job_name: "kubernetes-apiservers"
-    kubernetes_sd_configs:
-      - role: endpoints
-    scheme: https
-    tls_config:
-      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      insecure_skip_verify: true
-    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-    relabel_configs:
-      - source_labels:
-          - __meta_kubernetes_namespace
-          - __meta_kubernetes_service_name
-          - __meta_kubernetes_endpoint_port_name
-        action: keep
-        regex: default;kubernetes;https
-  - job_name: "kubernetes-nodes"
-    scheme: https
-    tls_config:
-      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      insecure_skip_verify: true
-    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-    kubernetes_sd_configs:
-      - role: node
-    relabel_configs:
-      - action: labelmap
-        regex: __meta_kubernetes_node_label_(.+)
-  - job_name: "kubernetes-nodes-cadvisor"
-    scheme: https
-    tls_config:
-      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      insecure_skip_verify: true
-    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-    kubernetes_sd_configs:
-      - role: node
-    metrics_path: /metrics/cadvisor
-    relabel_configs:
-      - action: labelmap
-        regex: __meta_kubernetes_node_label_(.+)
-      - source_labels: [__metrics_path__]
-        target_label: metrics_path
-    metric_relabel_configs:
-      - action: replace
-        source_labels: [pod]
-        regex: '(.+)'
-        target_label: pod_name
-        replacement: '${1}'
-      - action: replace
-        source_labels: [container]
-        regex: '(.+)'
-        target_label: container_name
-        replacement: '${1}'
-      - action: replace
-        target_label: name
-        replacement: k8s_stub
-      - action: replace
-        source_labels: [id]
-        regex: '^/system\.slice/(.+)\.service$'
-        target_label: systemd_service_name
-        replacement: '${1}'

apps/overlays/au-syd1/observability/values-vmcluster.yaml

@@ -1,185 +0,0 @@
-vmselect:
-  enabled: true
-  image:
-    repository: victoriametrics/vmselect
-    pullPolicy: IfNotPresent
-    variant: cluster
-  extraArgs:
-    envflag.enable: true
-    envflag.prefix: VM_
-    loggerFormat: json
-    httpListenAddr: :8481
-    dedup.minScrapeInterval: 15s
-    replicationFactor: 2
-  resources:
-    limits:
-      cpu: 500m
-      memory: 1024Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-  horizontalPodAutoscaler:
-    enabled: true
-    maxReplicas: 10
-    minReplicas: 2
-    metrics:
-      - type: Resource
-        resource:
-          name: cpu
-          target:
-            type: Utilization
-            averageUtilization: 60
-    behavior:
-      scaleUp:
-        stabilizationWindowSeconds: 0
-        selectPolicy: Max
-        policies:
-          - type: Percent
-            value: 100
-            periodSeconds: 30
-          - type: Pods
-            value: 4
-            periodSeconds: 30
-      scaleDown:
-        stabilizationWindowSeconds: 300
-        selectPolicy: Min
-        policies:
-          - type: Percent
-            value: 10
-            periodSeconds: 60
-          - type: Pods
-            value: 2
-            periodSeconds: 60
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8481"
-  podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
-  replicaCount: 2
-  ingress:
-    enabled: true
-    annotations:
-      cert-manager.io/cluster-issuer: vault-issuer
-      cert-manager.io/common-name: vmselect.k8s.syd1.au.unkin.net
-      cert-manager.io/private-key-size: "4096"
-      external-dns.alpha.kubernetes.io/hostname: vmselect.k8s.syd1.au.unkin.net
-      external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    hosts:
-      - name: vmselect.k8s.syd1.au.unkin.net
-        path:
-          - /
-        port: http
-    tls:
-      - hosts:
-          - vmselect.k8s.syd1.au.unkin.net
-        secretName: vmselect-tls
-    ingressClassName: nginx
-
-vminsert:
-  enabled: true
-  image:
-    repository: victoriametrics/vminsert
-    variant: cluster
-    pullPolicy: IfNotPresent
-  extraArgs:
-    envflag.enable: true
-    envflag.prefix: VM_
-    loggerFormat: json
-    httpListenAddr: :8480
-    replicationFactor: 2
-  resources:
-    limits:
-      cpu: 500m
-      memory: 1024Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-  horizontalPodAutoscaler:
-    enabled: true
-    maxReplicas: 10
-    minReplicas: 2
-    metrics:
-      - type: Resource
-        resource:
-          name: cpu
-          target:
-            type: Utilization
-            averageUtilization: 60
-    behavior:
-      scaleUp:
-        stabilizationWindowSeconds: 0
-        selectPolicy: Max
-        policies:
-          - type: Percent
-            value: 100
-            periodSeconds: 30
-          - type: Pods
-            value: 4
-            periodSeconds: 30
-      scaleDown:
-        stabilizationWindowSeconds: 300
-        selectPolicy: Min
-        policies:
-          - type: Percent
-            value: 10
-            periodSeconds: 60
-          - type: Pods
-            value: 2
-            periodSeconds: 60
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8480"
-  podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
-  replicaCount: 2
-  ingress:
-    enabled: true
-    annotations:
-      cert-manager.io/cluster-issuer: vault-issuer
-      cert-manager.io/common-name: vminsert.k8s.syd1.au.unkin.net
-      cert-manager.io/private-key-size: "4096"
-      external-dns.alpha.kubernetes.io/hostname: vminsert.k8s.syd1.au.unkin.net
-      external-dns.alpha.kubernetes.io/target: 198.18.200.0
-      nginx.ingress.kubernetes.io/proxy-body-size: "100m"
-    hosts:
-      - name: vminsert.k8s.syd1.au.unkin.net
-        path:
-          - /
-        port: http
-    tls:
-      - hosts:
-          - vminsert.k8s.syd1.au.unkin.net
-        secretName: vminsert-tls
-    ingressClassName: nginx
-
-vmstorage:
-  enabled: true
-  image:
-    repository: victoriametrics/vmstorage
-    variant: cluster
-    pullPolicy: IfNotPresent
-  retentionPeriod: 180d
-  extraArgs:
-    envflag.enable: true
-    envflag.prefix: VM_
-    loggerFormat: json
-    httpListenAddr: :8482
-    dedup.minScrapeInterval: 15s
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8482"
-  podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
-  persistentVolume:
-    enabled: true
-    name: vmstorage-volume
-    accessModes:
-      - ReadWriteOnce
-    storageClassName: cephrbd-fast-delete
-    mountPath: /storage
-    size: 200Gi
-  replicaCount: 3
-  podManagementPolicy: OrderedReady

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -15,7 +15,7 @@ agent:
     reloader.stakater.com/auto: "true"
   resources:
     requests:
-      cpu: 100m
+      cpu: 50m
     limits:
       memory: 128Mi
 

argocd/applicationsets/observability.yaml

@@ -11,6 +11,7 @@ spec:
       revision: HEAD
       directories:
       - path: apps/overlays/*/observability
+      - path: apps/overlays/*/grafana
   template:
     metadata:
       name: 'observability-{{path[3]}}'

argocd/projects/observability.yaml

@@ -11,6 +11,8 @@ spec:
   destinations:
     - namespace: 'observability'
       server: https://kubernetes.default.svc
+    - namespace: 'grafana'
+      server: https://kubernetes.default.svc
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace

schemas/bind.unkin.net/bindtsigapi_v1alpha1.json

@@ -0,0 +1,207 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "env": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "image": {
+          "default": "git.unkin.net/unkin/bind-tsig-api:latest",
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "type": "string"
+        },
+        "port": {
+          "default": 8443,
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "default": 1,
+          "format": "int32",
+          "type": "integer"
+        },
+        "resources": {
+          "properties": {
+            "claims": {
+              "items": {
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "request": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "name"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-map-keys": [
+                "name"
+              ],
+              "x-kubernetes-list-type": "map"
+            },
+            "limits": {
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "x-kubernetes-int-or-string": true
+              },
+              "type": "object"
+            },
+            "requests": {
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+                "x-kubernetes-int-or-string": true
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "service": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "ClusterIP",
+                "LoadBalancer",
+                "NodePort"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "targetNamespace": {
+          "type": "string"
+        },
+        "tokenSecretName": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "type"
+          ],
+          "x-kubernetes-list-type": "map"
+        },
+        "endpoint": {
+          "type": "string"
+        },
+        "observedGeneration": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "phase": {
+          "type": "string"
+        },
+        "readyReplicas": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "tokenSecret": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanaalertrulegroup_v1beta1.json

@@ -0,0 +1,371 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "editable": {
+          "type": "boolean",
+          "x-kubernetes-validations": [
+            {
+              "message": "Value is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "folderRef": {
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "Value is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "folderUID": {
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "Value is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "interval": {
+          "format": "duration",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "rules": {
+          "items": {
+            "properties": {
+              "annotations": {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "type": "object"
+              },
+              "condition": {
+                "type": "string"
+              },
+              "dashboardUid": {
+                "type": "string"
+              },
+              "data": {
+                "items": {
+                  "properties": {
+                    "datasourceUid": {
+                      "type": "string"
+                    },
+                    "model": {
+                      "x-kubernetes-preserve-unknown-fields": true
+                    },
+                    "queryType": {
+                      "type": "string"
+                    },
+                    "refId": {
+                      "type": "string"
+                    },
+                    "relativeTimeRange": {
+                      "properties": {
+                        "from": {
+                          "format": "int64",
+                          "type": "integer"
+                        },
+                        "to": {
+                          "format": "int64",
+                          "type": "integer"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "execErrState": {
+                "enum": [
+                  "OK",
+                  "Alerting",
+                  "Error",
+                  "KeepLast"
+                ],
+                "type": "string"
+              },
+              "for": {
+                "default": "0s",
+                "pattern": "^([0-9]+(\\.[0-9]+)?(s|m|h|d|w))+$",
+                "type": "string"
+              },
+              "isPaused": {
+                "type": "boolean"
+              },
+              "keepFiringFor": {
+                "format": "duration",
+                "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+                "type": "string"
+              },
+              "labels": {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "type": "object"
+              },
+              "missingSeriesEvalsToResolve": {
+                "format": "int64",
+                "type": "integer"
+              },
+              "noDataState": {
+                "enum": [
+                  "Alerting",
+                  "NoData",
+                  "OK",
+                  "KeepLast"
+                ],
+                "type": "string"
+              },
+              "notificationSettings": {
+                "properties": {
+                  "active_time_intervals": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  "group_by": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  "group_interval": {
+                    "type": "string"
+                  },
+                  "group_wait": {
+                    "type": "string"
+                  },
+                  "mute_time_intervals": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  "receiver": {
+                    "minLength": 1,
+                    "type": "string"
+                  },
+                  "repeat_interval": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "receiver"
+                ],
+                "type": "object"
+              },
+              "panelId": {
+                "type": "integer"
+              },
+              "record": {
+                "properties": {
+                  "from": {
+                    "type": "string"
+                  },
+                  "metric": {
+                    "type": "string"
+                  },
+                  "targetDatasourceUid": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "from",
+                  "metric"
+                ],
+                "type": "object"
+              },
+              "title": {
+                "example": "Always firing",
+                "maxLength": 190,
+                "minLength": 1,
+                "type": "string"
+              },
+              "uid": {
+                "maxLength": 40,
+                "pattern": "^[a-zA-Z0-9-_]+$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "condition",
+              "data",
+              "execErrState",
+              "for",
+              "noDataState",
+              "title",
+              "uid"
+            ],
+            "type": "object"
+          },
+          "minItems": 1,
+          "type": "array"
+        },
+        "suspend": {
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "instanceSelector",
+        "interval",
+        "rules"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "Only one of FolderUID or FolderRef can be set and one must be defined",
+          "rule": "(has(self.folderUID) && !(has(self.folderRef))) || (has(self.folderRef) && !(has(self.folderUID)))"
+        },
+        {
+          "message": "spec.editable is immutable",
+          "rule": "((!has(oldSelf.editable) && !has(self.editable)) || (has(oldSelf.editable) && has(self.editable)))"
+        },
+        {
+          "message": "spec.folderUID is immutable",
+          "rule": "((!has(oldSelf.folderUID) && !has(self.folderUID)) || (has(oldSelf.folderUID) && has(self.folderUID)))"
+        },
+        {
+          "message": "spec.folderRef is immutable",
+          "rule": "((!has(oldSelf.folderRef) && !has(self.folderRef)) || (has(oldSelf.folderRef) && has(self.folderRef)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanacontactpoint_v1beta1.json

@@ -0,0 +1,348 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "disableResolveMessage": {
+          "type": "boolean"
+        },
+        "editable": {
+          "type": "boolean",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.editable is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "name": {
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.name is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "receivers": {
+          "items": {
+            "properties": {
+              "disableResolveMessage": {
+                "type": "boolean"
+              },
+              "settings": {
+                "x-kubernetes-preserve-unknown-fields": true
+              },
+              "type": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "uid": {
+                "maxLength": 40,
+                "pattern": "^[a-zA-Z0-9-_]+$",
+                "type": "string"
+              },
+              "valuesFrom": {
+                "items": {
+                  "properties": {
+                    "targetPath": {
+                      "type": "string"
+                    },
+                    "valueFrom": {
+                      "properties": {
+                        "configMapKeyRef": {
+                          "properties": {
+                            "key": {
+                              "type": "string"
+                            },
+                            "name": {
+                              "default": "",
+                              "type": "string"
+                            },
+                            "optional": {
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "key"
+                          ],
+                          "type": "object",
+                          "x-kubernetes-map-type": "atomic"
+                        },
+                        "secretKeyRef": {
+                          "properties": {
+                            "key": {
+                              "type": "string"
+                            },
+                            "name": {
+                              "default": "",
+                              "type": "string"
+                            },
+                            "optional": {
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "key"
+                          ],
+                          "type": "object",
+                          "x-kubernetes-map-type": "atomic"
+                        }
+                      },
+                      "type": "object",
+                      "x-kubernetes-validations": [
+                        {
+                          "message": "Either configMapKeyRef or secretKeyRef must be set",
+                          "rule": "(has(self.configMapKeyRef) && !has(self.secretKeyRef)) || (!has(self.configMapKeyRef) && has(self.secretKeyRef))"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "targetPath",
+                    "valueFrom"
+                  ],
+                  "type": "object"
+                },
+                "maxItems": 99,
+                "type": "array"
+              }
+            },
+            "required": [
+              "settings",
+              "type"
+            ],
+            "type": "object"
+          },
+          "maxItems": 99,
+          "type": "array"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "settings": {
+          "x-kubernetes-preserve-unknown-fields": true
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "type": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "uid": {
+          "maxLength": 40,
+          "pattern": "^[a-zA-Z0-9-_]+$",
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.uid is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "valuesFrom": {
+          "items": {
+            "properties": {
+              "targetPath": {
+                "type": "string"
+              },
+              "valueFrom": {
+                "properties": {
+                  "configMapKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  },
+                  "secretKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  }
+                },
+                "type": "object",
+                "x-kubernetes-validations": [
+                  {
+                    "message": "Either configMapKeyRef or secretKeyRef must be set",
+                    "rule": "(has(self.configMapKeyRef) && !has(self.secretKeyRef)) || (!has(self.configMapKeyRef) && has(self.secretKeyRef))"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "targetPath",
+              "valueFrom"
+            ],
+            "type": "object"
+          },
+          "maxItems": 99,
+          "type": "array"
+        }
+      },
+      "required": [
+        "instanceSelector"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "spec.name is immutable",
+          "rule": "((!has(oldSelf.name) && !has(self.name)) || (has(oldSelf.name) && has(self.name)))"
+        },
+        {
+          "message": "spec.editable is immutable",
+          "rule": "((!has(oldSelf.editable) && !has(self.editable)) || (has(oldSelf.editable) && has(self.editable)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanadashboard_v1beta1.json

@@ -0,0 +1,492 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "configMapRef": {
+          "properties": {
+            "key": {
+              "type": "string"
+            },
+            "name": {
+              "default": "",
+              "type": "string"
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "key"
+          ],
+          "type": "object",
+          "x-kubernetes-map-type": "atomic"
+        },
+        "contentCacheDuration": {
+          "type": "string"
+        },
+        "datasources": {
+          "items": {
+            "properties": {
+              "datasourceName": {
+                "type": "string"
+              },
+              "inputName": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "datasourceName",
+              "inputName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "envFrom": {
+          "items": {
+            "properties": {
+              "configMapKeyRef": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "default": "",
+                    "type": "string"
+                  },
+                  "optional": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "key"
+                ],
+                "type": "object",
+                "x-kubernetes-map-type": "atomic"
+              },
+              "secretKeyRef": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "default": "",
+                    "type": "string"
+                  },
+                  "optional": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "key"
+                ],
+                "type": "object",
+                "x-kubernetes-map-type": "atomic"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "envs": {
+          "items": {
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              },
+              "valueFrom": {
+                "properties": {
+                  "configMapKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  },
+                  "secretKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  }
+                },
+                "type": "object"
+              }
+            },
+            "required": [
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "folder": {
+          "type": "string"
+        },
+        "folderRef": {
+          "type": "string"
+        },
+        "folderUID": {
+          "type": "string"
+        },
+        "grafanaCom": {
+          "properties": {
+            "id": {
+              "type": "integer"
+            },
+            "revision": {
+              "type": "integer"
+            }
+          },
+          "required": [
+            "id"
+          ],
+          "type": "object"
+        },
+        "gzipJson": {
+          "format": "byte",
+          "type": "string"
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "json": {
+          "type": "string"
+        },
+        "jsonnet": {
+          "type": "string"
+        },
+        "jsonnetLib": {
+          "properties": {
+            "fileName": {
+              "type": "string"
+            },
+            "gzipJsonnetProject": {
+              "format": "byte",
+              "type": "string"
+            },
+            "jPath": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "fileName",
+            "gzipJsonnetProject"
+          ],
+          "type": "object"
+        },
+        "oci": {
+          "properties": {
+            "insecurePlainHTTP": {
+              "type": "boolean"
+            },
+            "path": {
+              "maxLength": 512,
+              "minLength": 1,
+              "type": "string"
+            },
+            "pullSecretRef": {
+              "properties": {
+                "name": {
+                  "default": "",
+                  "type": "string"
+                }
+              },
+              "type": "object",
+              "x-kubernetes-map-type": "atomic"
+            },
+            "reference": {
+              "maxLength": 512,
+              "minLength": 3,
+              "pattern": "^[^:@]+(:[^:@/]+|@sha256:[a-fA-F0-9]{64})$",
+              "type": "string"
+            }
+          },
+          "required": [
+            "path",
+            "reference"
+          ],
+          "type": "object"
+        },
+        "plugins": {
+          "items": {
+            "properties": {
+              "name": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "version": {
+                "pattern": "^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?|latest)$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "name",
+              "version"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "uid": {
+          "maxLength": 40,
+          "pattern": "^[a-zA-Z0-9-_]+$",
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.uid is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "url": {
+          "pattern": "^https?://.+$",
+          "type": "string"
+        },
+        "urlAuthorization": {
+          "properties": {
+            "basicAuth": {
+              "properties": {
+                "password": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "name": {
+                      "default": "",
+                      "type": "string"
+                    },
+                    "optional": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object",
+                  "x-kubernetes-map-type": "atomic"
+                },
+                "username": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "name": {
+                      "default": "",
+                      "type": "string"
+                    },
+                    "optional": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object",
+                  "x-kubernetes-map-type": "atomic"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "instanceSelector"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "Only one of folderUID or folderRef can be declared at the same time",
+          "rule": "(has(self.folderUID) && !(has(self.folderRef))) || (has(self.folderRef) && !(has(self.folderUID))) || !(has(self.folderRef) && (has(self.folderUID)))"
+        },
+        {
+          "message": "folder field cannot be set when folderUID or folderRef is already declared",
+          "rule": "(has(self.folder) && !(has(self.folderRef) || has(self.folderUID))) || !(has(self.folder))"
+        },
+        {
+          "message": "spec.uid is immutable",
+          "rule": "((!has(oldSelf.uid) && !has(self.uid)) || (has(oldSelf.uid) && has(self.uid)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "NoMatchingInstances": {
+          "type": "boolean"
+        },
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "contentCache": {
+          "format": "byte",
+          "type": "string"
+        },
+        "contentTimestamp": {
+          "format": "date-time",
+          "type": "string"
+        },
+        "contentUrl": {
+          "type": "string"
+        },
+        "hash": {
+          "type": "string"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        },
+        "uid": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanadatasource_v1beta1.json

@@ -0,0 +1,306 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "datasource": {
+          "properties": {
+            "access": {
+              "type": "string"
+            },
+            "basicAuth": {
+              "type": "boolean"
+            },
+            "basicAuthUser": {
+              "type": "string"
+            },
+            "database": {
+              "type": "string"
+            },
+            "editable": {
+              "type": "boolean"
+            },
+            "isDefault": {
+              "type": "boolean"
+            },
+            "jsonData": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "name": {
+              "type": "string"
+            },
+            "orgId": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "secureJsonData": {
+              "type": "object",
+              "x-kubernetes-preserve-unknown-fields": true
+            },
+            "type": {
+              "type": "string"
+            },
+            "uid": {
+              "type": "string"
+            },
+            "url": {
+              "type": "string"
+            },
+            "user": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "plugins": {
+          "items": {
+            "properties": {
+              "name": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "version": {
+                "pattern": "^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?|latest)$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "name",
+              "version"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "uid": {
+          "maxLength": 40,
+          "pattern": "^[a-zA-Z0-9-_]+$",
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.uid is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "valuesFrom": {
+          "items": {
+            "properties": {
+              "targetPath": {
+                "type": "string"
+              },
+              "valueFrom": {
+                "properties": {
+                  "configMapKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  },
+                  "secretKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  }
+                },
+                "type": "object",
+                "x-kubernetes-validations": [
+                  {
+                    "message": "Either configMapKeyRef or secretKeyRef must be set",
+                    "rule": "(has(self.configMapKeyRef) && !has(self.secretKeyRef)) || (!has(self.configMapKeyRef) && has(self.secretKeyRef))"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "targetPath",
+              "valueFrom"
+            ],
+            "type": "object"
+          },
+          "maxItems": 99,
+          "type": "array"
+        }
+      },
+      "required": [
+        "datasource",
+        "instanceSelector"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "spec.uid is immutable",
+          "rule": "((!has(oldSelf.uid) && !has(self.uid)) || (has(oldSelf.uid) && has(self.uid)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "NoMatchingInstances": {
+          "type": "boolean"
+        },
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "hash": {
+          "type": "string"
+        },
+        "lastMessage": {
+          "type": "string"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        },
+        "uid": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanafolder_v1beta1.json

@@ -0,0 +1,180 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "parentFolderRef": {
+          "type": "string"
+        },
+        "parentFolderUID": {
+          "type": "string"
+        },
+        "permissions": {
+          "type": "string"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "title": {
+          "type": "string"
+        },
+        "uid": {
+          "maxLength": 40,
+          "pattern": "^[a-zA-Z0-9-_]+$",
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.uid is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        }
+      },
+      "required": [
+        "instanceSelector"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "Only one of parentFolderUID or parentFolderRef can be set",
+          "rule": "(has(self.parentFolderUID) && !(has(self.parentFolderRef))) || (has(self.parentFolderRef) && !(has(self.parentFolderUID))) || !(has(self.parentFolderRef) && (has(self.parentFolderUID)))"
+        },
+        {
+          "message": "spec.uid is immutable",
+          "rule": "((!has(oldSelf.uid) && !has(self.uid)) || (has(oldSelf.uid) && has(self.uid)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "NoMatchingInstances": {
+          "type": "boolean"
+        },
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "hash": {
+          "type": "string"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanalibrarypanel_v1beta1.json

@@ -0,0 +1,482 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "configMapRef": {
+          "properties": {
+            "key": {
+              "type": "string"
+            },
+            "name": {
+              "default": "",
+              "type": "string"
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "key"
+          ],
+          "type": "object",
+          "x-kubernetes-map-type": "atomic"
+        },
+        "contentCacheDuration": {
+          "type": "string"
+        },
+        "datasources": {
+          "items": {
+            "properties": {
+              "datasourceName": {
+                "type": "string"
+              },
+              "inputName": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "datasourceName",
+              "inputName"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "envFrom": {
+          "items": {
+            "properties": {
+              "configMapKeyRef": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "default": "",
+                    "type": "string"
+                  },
+                  "optional": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "key"
+                ],
+                "type": "object",
+                "x-kubernetes-map-type": "atomic"
+              },
+              "secretKeyRef": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "default": "",
+                    "type": "string"
+                  },
+                  "optional": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "key"
+                ],
+                "type": "object",
+                "x-kubernetes-map-type": "atomic"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "envs": {
+          "items": {
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              },
+              "valueFrom": {
+                "properties": {
+                  "configMapKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  },
+                  "secretKeyRef": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "default": "",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "x-kubernetes-map-type": "atomic"
+                  }
+                },
+                "type": "object"
+              }
+            },
+            "required": [
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "folderRef": {
+          "type": "string"
+        },
+        "folderUID": {
+          "type": "string"
+        },
+        "grafanaCom": {
+          "properties": {
+            "id": {
+              "type": "integer"
+            },
+            "revision": {
+              "type": "integer"
+            }
+          },
+          "required": [
+            "id"
+          ],
+          "type": "object"
+        },
+        "gzipJson": {
+          "format": "byte",
+          "type": "string"
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "json": {
+          "type": "string"
+        },
+        "jsonnet": {
+          "type": "string"
+        },
+        "jsonnetLib": {
+          "properties": {
+            "fileName": {
+              "type": "string"
+            },
+            "gzipJsonnetProject": {
+              "format": "byte",
+              "type": "string"
+            },
+            "jPath": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "fileName",
+            "gzipJsonnetProject"
+          ],
+          "type": "object"
+        },
+        "oci": {
+          "properties": {
+            "insecurePlainHTTP": {
+              "type": "boolean"
+            },
+            "path": {
+              "maxLength": 512,
+              "minLength": 1,
+              "type": "string"
+            },
+            "pullSecretRef": {
+              "properties": {
+                "name": {
+                  "default": "",
+                  "type": "string"
+                }
+              },
+              "type": "object",
+              "x-kubernetes-map-type": "atomic"
+            },
+            "reference": {
+              "maxLength": 512,
+              "minLength": 3,
+              "pattern": "^[^:@]+(:[^:@/]+|@sha256:[a-fA-F0-9]{64})$",
+              "type": "string"
+            }
+          },
+          "required": [
+            "path",
+            "reference"
+          ],
+          "type": "object"
+        },
+        "plugins": {
+          "items": {
+            "properties": {
+              "name": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "version": {
+                "pattern": "^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?|latest)$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "name",
+              "version"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "uid": {
+          "maxLength": 40,
+          "pattern": "^[a-zA-Z0-9-_]+$",
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.uid is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "url": {
+          "pattern": "^https?://.+$",
+          "type": "string"
+        },
+        "urlAuthorization": {
+          "properties": {
+            "basicAuth": {
+              "properties": {
+                "password": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "name": {
+                      "default": "",
+                      "type": "string"
+                    },
+                    "optional": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object",
+                  "x-kubernetes-map-type": "atomic"
+                },
+                "username": {
+                  "properties": {
+                    "key": {
+                      "type": "string"
+                    },
+                    "name": {
+                      "default": "",
+                      "type": "string"
+                    },
+                    "optional": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ],
+                  "type": "object",
+                  "x-kubernetes-map-type": "atomic"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "instanceSelector"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "Only one of folderUID or folderRef can be declared at the same time",
+          "rule": "(has(self.folderUID) && !(has(self.folderRef))) || (has(self.folderRef) && !(has(self.folderUID))) || !(has(self.folderRef) && (has(self.folderUID)))"
+        },
+        {
+          "message": "spec.uid is immutable",
+          "rule": "((!has(oldSelf.uid) && !has(self.uid)) || (has(oldSelf.uid) && has(self.uid)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "contentCache": {
+          "format": "byte",
+          "type": "string"
+        },
+        "contentTimestamp": {
+          "format": "date-time",
+          "type": "string"
+        },
+        "contentUrl": {
+          "type": "string"
+        },
+        "hash": {
+          "type": "string"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        },
+        "uid": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanamanifest_v1beta1.json

@@ -0,0 +1,300 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "patch": {
+          "properties": {
+            "env": {
+              "items": {
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "valueFrom": {
+                    "properties": {
+                      "configMapKeyRef": {
+                        "properties": {
+                          "key": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "default": "",
+                            "type": "string"
+                          },
+                          "optional": {
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "key"
+                        ],
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "grafanaRef": {
+                        "properties": {
+                          "apiVersion": {
+                            "type": "string"
+                          },
+                          "fieldPath": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "fieldPath"
+                        ],
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      },
+                      "secretKeyRef": {
+                        "properties": {
+                          "key": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "default": "",
+                            "type": "string"
+                          },
+                          "optional": {
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "key"
+                        ],
+                        "type": "object",
+                        "x-kubernetes-map-type": "atomic"
+                      }
+                    },
+                    "type": "object"
+                  }
+                },
+                "required": [
+                  "name",
+                  "valueFrom"
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            },
+            "scripts": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "scripts"
+          ],
+          "type": "object"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "template": {
+          "properties": {
+            "apiVersion": {
+              "type": "string"
+            },
+            "kind": {
+              "type": "string",
+              "x-kubernetes-validations": [
+                {
+                  "message": "Value is immutable",
+                  "rule": "self == oldSelf"
+                }
+              ]
+            },
+            "metadata": {
+              "properties": {
+                "annotations": {
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "type": "object"
+                },
+                "labels": {
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "type": "object"
+                },
+                "name": {
+                  "type": "string",
+                  "x-kubernetes-validations": [
+                    {
+                      "message": "Value is immutable",
+                      "rule": "self == oldSelf"
+                    }
+                  ]
+                },
+                "namespace": {
+                  "type": "string",
+                  "x-kubernetes-validations": [
+                    {
+                      "message": "Value is immutable",
+                      "rule": "self == oldSelf"
+                    }
+                  ]
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object",
+              "x-kubernetes-validations": [
+                {
+                  "message": "namespace is immutable",
+                  "rule": "((!has(oldSelf.__namespace__) && !has(self.__namespace__)) || (has(oldSelf.__namespace__) && has(self.__namespace__)))"
+                }
+              ]
+            },
+            "spec": {
+              "x-kubernetes-preserve-unknown-fields": true
+            }
+          },
+          "required": [
+            "apiVersion",
+            "kind",
+            "metadata"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "instanceSelector",
+        "template"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanamutetiming_v1beta1.json

@@ -0,0 +1,212 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "editable": {
+          "default": true,
+          "type": "boolean",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.editable is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "name": {
+          "type": "string"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "time_intervals": {
+          "items": {
+            "properties": {
+              "days_of_month": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "location": {
+                "type": "string"
+              },
+              "months": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "times": {
+                "items": {
+                  "properties": {
+                    "end_time": {
+                      "type": "string"
+                    },
+                    "start_time": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "end_time",
+                    "start_time"
+                  ],
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              "weekdays": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "years": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "type": "object"
+          },
+          "minItems": 1,
+          "type": "array"
+        }
+      },
+      "required": [
+        "instanceSelector",
+        "name",
+        "time_intervals"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafananotificationpolicy_v1beta1.json

@@ -0,0 +1,314 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "editable": {
+          "type": "boolean",
+          "x-kubernetes-validations": [
+            {
+              "message": "Value is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "route": {
+          "properties": {
+            "active_time_intervals": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "continue": {
+              "type": "boolean"
+            },
+            "group_by": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "group_interval": {
+              "type": "string"
+            },
+            "group_wait": {
+              "type": "string"
+            },
+            "match_re": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "matchers": {
+              "items": {
+                "properties": {
+                  "isEqual": {
+                    "type": "boolean"
+                  },
+                  "isRegex": {
+                    "type": "boolean"
+                  },
+                  "name": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "isRegex",
+                  "value"
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            },
+            "mute_time_intervals": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "object_matchers": {
+              "items": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "type": "array"
+            },
+            "provenance": {
+              "type": "string"
+            },
+            "receiver": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "repeat_interval": {
+              "type": "string"
+            },
+            "routeSelector": {
+              "properties": {
+                "matchExpressions": {
+                  "items": {
+                    "properties": {
+                      "key": {
+                        "type": "string"
+                      },
+                      "operator": {
+                        "type": "string"
+                      },
+                      "values": {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array",
+                        "x-kubernetes-list-type": "atomic"
+                      }
+                    },
+                    "required": [
+                      "key",
+                      "operator"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "x-kubernetes-list-type": "atomic"
+                },
+                "matchLabels": {
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object",
+              "x-kubernetes-map-type": "atomic"
+            },
+            "routes": {
+              "x-kubernetes-preserve-unknown-fields": true
+            }
+          },
+          "required": [
+            "receiver"
+          ],
+          "type": "object",
+          "x-kubernetes-validations": [
+            {
+              "message": "continue is invalid on the top level route node",
+              "rule": "!has(self.__continue__)"
+            },
+            {
+              "message": "match_re is invalid on the top level route node",
+              "rule": "!has(self.match_re)"
+            },
+            {
+              "message": "matchers is invalid on the top level route node",
+              "rule": "!has(self.matchers)"
+            },
+            {
+              "message": "object_matchers is invalid on the top level route node",
+              "rule": "!has(self.object_matchers)"
+            },
+            {
+              "message": "mute_time_intervals is invalid on the top level route node",
+              "rule": "!has(self.mute_time_intervals)"
+            },
+            {
+              "message": "active_time_intervals is invalid on the top level route node",
+              "rule": "!has(self.active_time_intervals)"
+            }
+          ]
+        },
+        "suspend": {
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "instanceSelector",
+        "route"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "spec.editable is immutable",
+          "rule": "((!has(oldSelf.editable) && !has(self.editable)) || (has(oldSelf.editable) && has(self.editable)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "discoveredRoutes": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafananotificationpolicyroute_v1beta1.json

@@ -0,0 +1,199 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "active_time_intervals": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "continue": {
+          "type": "boolean"
+        },
+        "group_by": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "group_interval": {
+          "type": "string"
+        },
+        "group_wait": {
+          "type": "string"
+        },
+        "match_re": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "matchers": {
+          "items": {
+            "properties": {
+              "isEqual": {
+                "type": "boolean"
+              },
+              "isRegex": {
+                "type": "boolean"
+              },
+              "name": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "isRegex",
+              "value"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "mute_time_intervals": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "object_matchers": {
+          "items": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "provenance": {
+          "type": "string"
+        },
+        "receiver": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "repeat_interval": {
+          "type": "string"
+        },
+        "routeSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic"
+        },
+        "routes": {
+          "x-kubernetes-preserve-unknown-fields": true
+        }
+      },
+      "required": [
+        "receiver"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafananotificationtemplate_v1beta1.json

@@ -0,0 +1,163 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "allowCrossNamespaceImport": {
+          "default": false,
+          "type": "boolean"
+        },
+        "editable": {
+          "type": "boolean",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.editable is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "instanceSelector": {
+          "properties": {
+            "matchExpressions": {
+              "items": {
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "operator": {
+                    "type": "string"
+                  },
+                  "values": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array",
+                    "x-kubernetes-list-type": "atomic"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object"
+              },
+              "type": "array",
+              "x-kubernetes-list-type": "atomic"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "x-kubernetes-map-type": "atomic",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceSelector is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "name": {
+          "type": "string"
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string"
+        },
+        "suspend": {
+          "type": "boolean"
+        },
+        "template": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "instanceSelector",
+        "name"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "spec.editable is immutable",
+          "rule": "((!has(oldSelf.editable) && !has(self.editable)) || (has(oldSelf.editable) && has(self.editable)))"
+        },
+        {
+          "message": "disabling spec.allowCrossNamespaceImport requires a recreate to ensure desired state",
+          "rule": "!oldSelf.allowCrossNamespaceImport || (oldSelf.allowCrossNamespaceImport && self.allowCrossNamespaceImport)"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

schemas/grafana.integreatly.org/grafanaserviceaccount_v1beta1.json

@@ -0,0 +1,221 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "apiVersion": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "properties": {
+        "instanceName": {
+          "minLength": 1,
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.instanceName is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "isDisabled": {
+          "default": false,
+          "type": "boolean"
+        },
+        "name": {
+          "minLength": 1,
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.name is immutable",
+              "rule": "self == oldSelf"
+            }
+          ]
+        },
+        "resyncPeriod": {
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
+          "type": "string",
+          "x-kubernetes-validations": [
+            {
+              "message": "spec.resyncPeriod must be greater than 0",
+              "rule": "duration(self) > duration('0s')"
+            }
+          ]
+        },
+        "role": {
+          "enum": [
+            "Viewer",
+            "Editor",
+            "Admin"
+          ],
+          "type": "string"
+        },
+        "suspend": {
+          "default": false,
+          "type": "boolean"
+        },
+        "tokens": {
+          "items": {
+            "properties": {
+              "expires": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "name": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "secretName": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "name"
+            ],
+            "type": "object"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "name"
+          ],
+          "x-kubernetes-list-type": "map"
+        }
+      },
+      "required": [
+        "instanceName",
+        "role"
+      ],
+      "type": "object",
+      "x-kubernetes-validations": [
+        {
+          "message": "spec.name is immutable",
+          "rule": "((!has(oldSelf.name) && !has(self.name)) || (has(oldSelf.name) && has(self.name)))"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "account": {
+          "properties": {
+            "id": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "isDisabled": {
+              "type": "boolean"
+            },
+            "login": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "role": {
+              "type": "string"
+            },
+            "tokens": {
+              "items": {
+                "properties": {
+                  "expires": {
+                    "format": "date-time",
+                    "type": "string"
+                  },
+                  "id": {
+                    "format": "int64",
+                    "type": "integer"
+                  },
+                  "name": {
+                    "type": "string"
+                  },
+                  "secret": {
+                    "properties": {
+                      "name": {
+                        "type": "string"
+                      },
+                      "namespace": {
+                        "type": "string"
+                      }
+                    },
+                    "type": "object"
+                  }
+                },
+                "required": [
+                  "id",
+                  "name"
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "id",
+            "isDisabled",
+            "login",
+            "name",
+            "role"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "items": {
+            "properties": {
+              "lastTransitionTime": {
+                "format": "date-time",
+                "type": "string"
+              },
+              "message": {
+                "maxLength": 32768,
+                "type": "string"
+              },
+              "observedGeneration": {
+                "format": "int64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "reason": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "lastResync": {
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}