fix: correct external-dns target IP to 198.18.200.4

fix(artifactapi): add traefik.io/instance label to Gateway
feat(artifactapi): migrate Ingress to Gateway API
2026-05-23 01:33:16 +10:00 · 2026-05-23 01:33:16 +10:00 · 2026-05-23 01:33:16 +10:00 · 2026-05-23 01:31:28 +10:00 · 2026-05-23 01:31:03 +10:00 · 2026-05-23 01:29:54 +10:00
59 changed files with 1019 additions and 143 deletions
@@ -19,7 +19,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: artifactapi
-          image: git.unkin.net/unkin/artifactapi:v2.7.1
+          image: git.unkin.net/unkin/artifactapi:v2.7.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -0,0 +1,29 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: artifactapi-tls
+        mode: Terminate
@@ -0,0 +1,20 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: artifactapi-api
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,32 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/proxy-body-size: 10g
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-  name: artifactapi-ingress
-  namespace: artifactapi
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: artifactapi.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: artifactapi-api
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - artifactapi.k8s.syd1.au.unkin.net
-      secretName: artifactapi-tls
@@ -6,7 +6,8 @@ resources:
  - artifactapi-deployment.yaml
  - artifactapi-hpa.yaml
  - configmap.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - postgres-deployment.yaml
  - pvc.yaml
@@ -19,7 +19,10 @@ remotes:
    package: "docker"
    description: "Docker Hub registry"
    immutable_patterns:
+      - "^library/almalinux"
      - "^library/busybox"
+      - "^library/debian"
+      - "^library/fedora"
      - "^library/nginx"
      - "^library/postgres"
      - "^library/redis"
@@ -30,6 +33,7 @@ remotes:
      - "^hashicorp/vault-secrets-operator"
      - "^jfrog/"
      - "^rancher/"
+      - "^traefik/"
      - "^ubi9/ubi-minimal"
      - "^victoriametrics/"
      - "^woodpeckerci/"
@@ -26,6 +26,9 @@ remotes:
      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
+      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
+      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
      - "lxc/incus/.*.tar.gz$"
      - "mikefarah/yq/.*/yq_linux_amd64$"
      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -53,6 +56,7 @@ remotes:
      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
+      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
    cache:
      immutable_ttl: 0
      mutable_ttl: 7200
@@ -109,6 +109,17 @@ remotes:
      immutable_ttl: 0
      mutable_ttl: 3600

+  traefik:
+    base_url: "https://traefik.github.io/charts"
+    package: "helm"
+    description: "Traefik Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
  victoriametrics:
    base_url: "https://victoriametrics.github.io/helm-charts/"
    package: "helm"
@@ -119,3 +130,14 @@ remotes:
    cache:
      immutable_ttl: 0
      mutable_ttl: 3600
+
+  argo-helm:
+    base_url: "https://argoproj.github.io/argo-helm"
+    package: "helm"
+    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
@@ -13,4 +13,6 @@ virtuals:
      - purelb
      - rancher-stable
      - stakater
+      - traefik
      - victoriametrics
+      - argo-helm
@@ -0,0 +1,29 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
+  name: rancher
+  namespace: cattle-system
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: rancher-tls
+        mode: Terminate
@@ -0,0 +1,20 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: rancher
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80
@@ -6,4 +6,5 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -7,12 +7,12 @@ resources:

 helmCharts:
  - name: intel-device-plugins-operator
-    repo: https://intel.github.io/helm-charts/
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "0.35.0"
    releaseName: intel-device-plugins-operator
    namespace: inteldeviceplugins-system
  - name: intel-device-plugins-gpu
-    repo: https://intel.github.io/helm-charts/
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "0.34.1"
    releaseName: intel-gpu-plugin
    namespace: inteldeviceplugins-system
@@ -10,6 +10,8 @@ spec:
      app: litellm
  template:
    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
      labels:
        app: litellm
    spec:
@@ -31,6 +33,8 @@ spec:
          envFrom:
            - secretRef:
                name: litellm-credentials
+            - configMapRef:
+                name: litellm-env
          livenessProbe:
            httpGet:
              path: /health/liveliness
@@ -51,11 +55,11 @@ spec:
            timeoutSeconds: 5
          resources:
            limits:
-              cpu: "1"
-              memory: 2Gi
+              cpu: "2"
+              memory: 6Gi
            requests:
              cpu: 250m
-              memory: 512Mi
+              memory: 2Gi
          volumeMounts:
            - mountPath: /app/config.yaml
              name: config
@@ -0,0 +1,29 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: litellm
+  namespace: litellm
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: litellm-tls
+        mode: Terminate
@@ -0,0 +1,20 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: litellm
+          port: 4000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: litellm
-  namespace: litellm
-spec:
-  rules:
-    - host: litellm.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: litellm
-                port:
-                  number: 4000
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - litellm.k8s.syd1.au.unkin.net
-      secretName: litellm-tls
@@ -7,7 +7,8 @@ resources:
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
@@ -21,3 +22,8 @@ configMapGenerator:
      - config.yaml=resources/config.yaml
    options:
      disableNameSuffixHash: true
+  - name: litellm-env
+    literals:
+      - STORE_MODEL_IN_DB=True
+    options:
+      disableNameSuffixHash: true
@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: paperclip-postgres
+  namespace: paperclip
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: paperclip
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: paperclip
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600
@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: paperclip-pooler-rw
+  namespace: paperclip
+spec:
+  cluster:
+    name: paperclip-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw
@@ -0,0 +1,108 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  selector:
+    matchLabels:
+      app: paperclip
+  template:
+    metadata:
+      labels:
+        app: paperclip
+    spec:
+      containers:
+        - name: paperclip
+          image: ghcr.io/paperclipai/paperclip:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3100
+              name: http
+              protocol: TCP
+          env:
+            - name: PORT
+              value: "3100"
+            - name: PAPERCLIP_BIND
+              value: custom
+            - name: PAPERCLIP_BIND_HOST
+              value: 0.0.0.0
+            - name: PAPERCLIP_API_URL
+              value: https://paperclip.k8s.syd1.au.unkin.net
+            - name: BETTER_AUTH_BASE_URL
+              value: https://paperclip.k8s.syd1.au.unkin.net
+            - name: PAPERCLIP_ALLOWED_HOSTNAMES
+              value: paperclip.k8s.syd1.au.unkin.net,localhost
+            - name: PAPERCLIP_HOME
+              value: /paperclip
+            - name: PAPERCLIP_INSTANCE_ID
+              value: default
+            - name: PAPERCLIP_DEPLOYMENT_MODE
+              value: authenticated
+            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
+              value: private
+            - name: SERVE_UI
+              value: "true"
+            - name: HEARTBEAT_SCHEDULER_ENABLED
+              value: "true"
+            - name: PAPERCLIP_MIGRATION_AUTO_APPLY
+              value: "true"
+            - name: PAPERCLIP_STORAGE_PROVIDER
+              value: s3
+            - name: PAPERCLIP_STORAGE_S3_BUCKET
+              value: paperclip
+            - name: PAPERCLIP_STORAGE_S3_REGION
+              value: us-east-1
+            - name: PAPERCLIP_STORAGE_S3_ENDPOINT
+              value: https://radosgw.service.consul
+            - name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
+              value: "true"
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/ssl/paperclip/ca.crt
+          envFrom:
+            - secretRef:
+                name: paperclip-credentials
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /etc/ssl/paperclip
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3100
+              httpHeaders:
+                - name: Host
+                  value: localhost
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3100
+              httpHeaders:
+                - name: Host
+                  value: localhost
+            failureThreshold: 3
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: "1"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 512Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+      restartPolicy: Always
@@ -0,0 +1,29 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: paperclip
+  namespace: paperclip
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: paperclip-tls
+        mode: Terminate
@@ -0,0 +1,20 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: paperclip
+          port: 3100
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - deployment.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperclip
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 3100
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: paperclip
+  sessionAffinity: None
+  type: ClusterIP
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: paperclip
+spec:
+  allowedNamespaces:
+    - paperclip
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,34 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: paperclip
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/paperclip/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: paperclip-credentials
+  namespace: paperclip
+spec:
+  destination:
+    create: true
+    name: paperclip-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/paperclip/default/paperclip-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,33 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: puppetboard-tls
+        mode: Terminate
@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetboard
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetboard.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetboard
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetboard.k8s.syd1.au.unkin.net
-      secretName: puppetboard-tls
@@ -25,7 +25,8 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
+  - gateway_puppetboard.yaml
+  - httproute_puppetboard.yaml
  - ingress_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: traefik-external
+spec:
+  controllerName: traefik.io/gateway-controller
@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: internal
+  name: traefik-internal
+spec:
+  controllerName: traefik.io/gateway-controller
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gatewayclass-internal.yaml
+  - gatewayclass-external.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik-system
@@ -6,5 +6,6 @@ resources:
  - namespace.yaml
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
+  - serviceaccount_terraform_vault.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-vault
+  namespace: woodpecker
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: ceph-csi-cephfs
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://ceph.github.io/csi-charts
    version: "3.15.0"
    releaseName: ceph-csi-cephfs
    namespace: csi-cephfs
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: ceph-csi-rbd
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://ceph.github.io/csi-charts
    version: "3.15.1"
    releaseName: ceph-csi-rbd
    namespace: csi-cephrbd
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: external-dns
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.19.0"
+    version: "1.21.1"
    releaseName: externaldns
    namespace: externaldns
    valuesFile: values.yaml
@@ -24,6 +24,8 @@ policy: "sync"
 sources:
  - service
  - ingress
+  - gateway-httproute
+  - gateway-grpcroute

 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -49,3 +51,5 @@ extraArgs:
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx
+
+logLevel: debug
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/paperclip
@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/traefik-system
+
+helmCharts:
+  - name: traefik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "40.0.0"
+    releaseName: traefik-internal
+    namespace: traefik-system
+    valuesFile: values-internal.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
+  - name: traefik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "40.0.0"
+    releaseName: traefik-external
+    namespace: traefik-system
+    valuesFile: values-external.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
@@ -0,0 +1,98 @@
+image:
+  tag: v3.7.0
+
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+gateway:
+  enabled: false
+
+gatewayClass:
+  enabled: false
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+providers:
+  kubernetesCRD:
+    enabled: false
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: true
+    experimentalChannel: false
+    namespaces: []
+    nativeLBByDefault: false
+    labelSelector: "traefik.io/instance=external"
+
+logs:
+  access:
+    enabled: true
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+  notAppendXForwardedFor: false
+
+service:
+  enabled: true
+  single: true
+  annotations:
+    purelb.io/service-group: "dmz"
+    purelb.io/addresses: 198.18.199.0
+  annotationsTCP: {}
+  annotationsUDP: {}
+  labels: {}
+  spec:
+    type: LoadBalancer
+    loadBalancerIP: "198.18.199.0"
+  additionalServices: {}
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 5
+  metrics: []
+  behavior: {}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: "{{ template \"traefik.fullname\" . }}"
+
+persistence:
+  enabled: false
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
+        topologyKey: kubernetes.io/hostname
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
+enabled: true
@@ -0,0 +1,98 @@
+image:
+  tag: v3.7.0
+
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+gateway:
+  enabled: false
+
+gatewayClass:
+  enabled: false
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+providers:
+  kubernetesCRD:
+    enabled: false
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: true
+    experimentalChannel: false
+    namespaces: []
+    nativeLBByDefault: false
+    labelSelector: "traefik.io/instance=internal"
+
+logs:
+  access:
+    enabled: true
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+  notAppendXForwardedFor: false
+
+service:
+  enabled: true
+  single: true
+  annotations:
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.4
+  annotationsTCP: {}
+  annotationsUDP: {}
+  labels: {}
+  spec:
+    type: LoadBalancer
+    loadBalancerIP: "198.18.200.4"
+  additionalServices: {}
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 5
+  metrics: []
+  behavior: {}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: "{{ template \"traefik.fullname\" . }}"
+
+persistence:
+  enabled: false
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
+        topologyKey: kubernetes.io/hostname
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
+enabled: true
@@ -9,7 +9,7 @@ resources:

 helmCharts:
  - name: victoria-metrics-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://victoriametrics.github.io/helm-charts/
    version: "0.57.1"
    releaseName: victoria-metrics-operator
    namespace: vm-system
@@ -10,7 +10,7 @@ resources:
 helmCharts:
  - name: vault-secrets-operator
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.2.0"
+    version: "1.3.0"
    releaseName: vault-secrets-operator
    namespace: vso-system
    valuesFile: values.yaml
@@ -11,6 +11,7 @@ spec:
      revision: HEAD
      directories:
      - path: apps/overlays/*/litellm
+      - path: apps/overlays/*/paperclip
  template:
    metadata:
      name: 'aitooling-{{path[3]}}'
@@ -25,6 +25,7 @@ spec:
      - path: apps/overlays/*/reflector-system
      - path: apps/overlays/*/reloader-system
      - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/traefik-system
      - path: apps/overlays/*/vm-system
      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
@@ -11,6 +11,8 @@ spec:
  destinations:
    - namespace: 'litellm'
      server: https://kubernetes.default.svc
+    - namespace: 'paperclip'
+      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
    - group: ''
      kind: Namespace
@@ -8,7 +8,6 @@ spec:
  description: Observability stack (metrics, monitoring)
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
-    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
  destinations:
    - namespace: 'observability'
      server: https://kubernetes.default.svc
@@ -9,8 +9,8 @@ spec:
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    - https://purelb.github.io/purelb/charts
    - oci://gcr.io/k8s-staging-nfd/charts
-    - oci://ghcr.io/emberstack/helm-charts
    - oci://ghcr.io/woodpecker-ci/helm/woodpecker
  destinations:
    - namespace: '*-system'
@@ -60,6 +60,10 @@ spec:
      kind: Certificate
    - group: 'cert-manager.io'
      kind: Issuer
+    - group: 'gateway.networking.k8s.io'
+      kind: GatewayClass
+    - group: 'networking.k8s.io'
+      kind: IngressClass
  namespaceResourceWhitelist:
    - group: '*'
      kind: '*'
@@ -8,7 +8,7 @@ spec:
  description: Storage infrastructure and CSI drivers
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
-    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    - https://ceph.github.io/csi-charts
  destinations:
    - namespace: 'csi-*'
      server: https://kubernetes.default.svc
@@ -0,0 +1,25 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+  namespace: argocd
+spec:
+  template:
+    spec:
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+      containers:
+        - name: argocd-repo-server
+          env:
+            - name: SSL_CERT_DIR
+              value: /etc/ssl/certs:/custom-certs
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-certs
+              readOnly: true
@@ -0,0 +1,21 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.unkin.net/unkin/argocd-apps
+    targetRevision: HEAD
+    path: clusters/au-syd1/bootstrap
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
@@ -0,0 +1,50 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-tls-certs-cm
+  namespace: argocd
+data:
+  artifactapi.k8s.syd1.au.unkin.net: |
+    -----BEGIN CERTIFICATE-----
+    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
+    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
+    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
+    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
+    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
+    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
+    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
+    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
+    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
+    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
+    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
+    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
+    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
+    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
+    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
+    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
+    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
+    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
+    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
+    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
+    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
+    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
+    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
+    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
+    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
+    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
+    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
+    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
+    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
+    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
+    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
+    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
+    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
+    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
+    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
+    4gqd
+    -----END CERTIFICATE-----
@@ -3,11 +3,21 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
+  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
+  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
  - au-syd1-apps.yaml
+  - argocd-self-app.yaml

 patches:
  - path: argocd-cm-patch.yaml
    target:
      kind: ConfigMap
      name: argocd-cm
+  - path: argocd-tls-certs-patch.yaml
+    target:
+      kind: ConfigMap
+      name: argocd-tls-certs-cm
+  - path: argocd-repo-server-vault-ca-patch.yaml
+    target:
+      kind: Deployment
+      name: argocd-repo-server
Author	SHA1	Message	Date
unkinben	cc84d40253	fix: correct external-dns target IP to 198.18.200.4 ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-05-23 01:33:16 +10:00
unkinben	f71f5df0aa	fix(artifactapi): add traefik.io/instance label to Gateway	2026-05-23 01:33:16 +10:00
unkinben	b99b5096e5	feat(artifactapi): migrate Ingress to Gateway API Replace nginx Ingress with Gateway + HTTPRoute using the traefik-internal GatewayClass. TLS is terminated at the Gateway listener via cert-manager.	2026-05-23 01:33:16 +10:00
unkinben	2c6d88aa6b	feat(puppet): migrate puppetboard Ingress to Gateway API (#130 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetdb.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetboard-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #130	2026-05-23 01:31:28 +10:00
unkinben	58368948d9	feat(paperclip): migrate Ingress to Gateway API (#133 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the paperclip app cleanly - [ ] cert-manager issues the `paperclip-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #133	2026-05-23 01:31:03 +10:00
unkinben	4f5c3f7ea0	feat(litellm): migrate Ingress to Gateway API (#134 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the litellm app cleanly - [ ] cert-manager issues the `litellm-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://litellm.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #134	2026-05-23 01:29:54 +10:00
unkinben	fd87cb96b5	feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs (#143 ) ## Changes - Upgrade external-dns chart from 1.19.0 → 1.21.1 (app v0.19.0 → v0.21.0) - Remove `gateway-tcproute` source — `TCPRoute` CRD is not installed, causing crash-loop - Add `gateway-tlsroute` source — `TLSRoute` CRD is installed (Gateway API 1.5.1) ## Why The pod was crash-looping every minute with `failed to list *v1alpha2.TCPRoute: the server could not find the requested resource` because the TCPRoute CRD doesn't exist in this cluster. TLSRoute was previously removed but its CRD does exist. Reviewed-on: #143	2026-05-23 01:28:20 +10:00
unkinben	d619f9195e	benvin/externaldns_compatability (#142 ) Reviewed-on: #142	2026-05-23 01:17:20 +10:00
unkinben	1944dbbfcd	temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout (#140 ) Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found. Reviewed-on: #140	2026-05-23 01:07:45 +10:00
unkinben	0940cc20f8	fix(traefik): listen on port 443 directly for Gateway API compatibility (#138 ) ## Problem Gateway listeners with `port: 443` were rejected with `PortUnavailable: Cannot find entryPoint for Gateway: no matching entryPoint for port 443 and protocol "HTTPS"`. Traefik matches Gateway listener ports against its internal entryPoint ports (pod-level), not the Service's `exposedPort`. The `websecure` entryPoint was configured on port `8443`, so port `443` listeners had no match. ## Fix - `ports.websecure.port: 443` — Traefik now binds directly on 443 - `securityContext.capabilities.add: [NET_BIND_SERVICE]` — allows a non-root process to bind to privileged ports (<1024) The Service `exposedPort` stays at `443`, so external connectivity is unchanged. All existing Gateway listeners (`port: 443`) are correct as-is. Applies to both internal and external Traefik instances. ## Test plan - [ ] Traefik pods restart cleanly - [ ] `kubectl get gateway -A` shows listeners as `Programmed: True` - [ ] `https://rancher.k8s.syd1.au.unkin.net` (already merged) is reachable Reviewed-on: #138	2026-05-23 00:44:13 +10:00
unkinben	20ce2b1b92	feat(cattle-system): migrate rancher Ingress to Gateway API (#132 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the cattle-system app cleanly - [ ] cert-manager issues the `rancher-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://rancher.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #132	2026-05-23 00:24:57 +10:00
unkinben	64dc5a0242	fix(traefik): add instance labels to GatewayClasses (#137 ) ## Problem GatewayClasses were `Unknown` even after controllerName was fixed. The `kubernetesGateway` `labelSelector` applies to all watched resources, including GatewayClasses themselves. Since neither GatewayClass had a `traefik.io/instance` label, both Traefik instances filtered them out and never accepted them. ## Fix - `gatewayclass-internal.yaml`: add `traefik.io/instance: internal` - `gatewayclass-external.yaml`: add `traefik.io/instance: external` ## Test plan - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #137	2026-05-23 00:23:18 +10:00
unkinben	57c14d32c0	fix(traefik): remove invalid controllerName flag causing CrashLoopBackOff (#136 ) ## URGENT — Traefik pods are CrashLoopBackOff The merged PR #135 added `--providers.kubernetesgateway.controllerName` as an `additionalArguments` entry. Traefik v3.7.0 does not support this flag and fails immediately on startup. Old replica sets are still running (one pod each) but new pods cannot come up. ## Fix - Remove `additionalArguments` from both `values-internal.yaml` and `values-external.yaml` - Revert GatewayClass `controllerName` back to `traefik.io/gateway-controller` (the hardcoded Traefik default — no override mechanism exists in v3.7.0) ## After merge GatewayClasses will remain `Unknown` until a separate solution for internal/external separation is implemented (the `labelSelector` approach needs further investigation). Reviewed-on: #136	2026-05-22 23:58:56 +10:00
unkinben	2df359c4a9	fix(traefik): set controllerName on GatewayClasses and Traefik providers (#135 ) ## Problem Both GatewayClasses (`traefik-internal`, `traefik-external`) were stuck as `Unknown`. Neither Traefik deployment had `controllerName` set in `kubernetesGateway`, so both defaulted to `traefik.io/gateway-controller` — which matched neither GatewayClass. ## Fix - `gatewayclass-internal.yaml`: `controllerName: traefik.io/gateway-controller-internal` - `gatewayclass-external.yaml`: `controllerName: traefik.io/gateway-controller-external` - `values-internal.yaml`: added `controllerName: traefik.io/gateway-controller-internal` - `values-external.yaml`: added `controllerName: traefik.io/gateway-controller-external` ## Test plan - [ ] ArgoCD syncs traefik-system cleanly - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #135	2026-05-22 23:44:06 +10:00
unkinben	f53a2dc4f8	fix: terraform_vault must be RFC1123 compliant (#128 ) Reviewed-on: #128	2026-05-21 23:19:20 +10:00
unkinben	c5dd3cc5cb	feat: add terraform_vault role (#127 ) this adds a service account that can be used to run the terraform_vault workflows with, so that we can access the jwt to generate a token Reviewed-on: #127	2026-05-21 23:13:48 +10:00
unkinben	462b2b3f4f	feat(externaldns): add Gateway API sources for httproute, tlsroute, grpcroute, tcproute, udproute (#126 ) Reviewed-on: #126	2026-05-18 00:11:33 +10:00
unkinben	73c9b3f603	fix(traefik): replace invalid controllername flag with labelSelector for v3 (#125 ) Remove --providers.kubernetesgateway.controllername which does not exist in Traefik v3, update GatewayClass controllerName to the standard v3 value, and use labelSelector on each instance's kubernetesGateway provider to differentiate internal vs external traffic. Reviewed-on: #125	2026-05-18 00:03:12 +10:00
unkinben	9a01a9ef19	fix: enable gateway/ingress class on platform project (#124 ) - add missing classes to platform required to deploy traefik system Reviewed-on: #124	2026-05-17 23:56:12 +10:00
unkinben	53553ddcfd	feat: deploy internal/external traefik routers (#119 ) deploy traefik for internal and external applications. port forwarding from the external routers will only occur to the IP of the traefik-external service. - traefik-internal and traefik-external added - each is a different deployment Reviewed-on: #119	2026-05-17 23:44:50 +10:00
unkinben	5d3ff3a0f4	feat(artifactapi): allow kubeconform and kustomize from GitHub (#123 ) Adds immutable patterns for yannh/kubeconform and kubernetes-sigs/kustomize to fix 403 Forbidden errors when downloading their Linux amd64 releases. Reviewed-on: #123	2026-05-17 12:19:27 +10:00
unkinben	c3002dc3c1	feat(artifactapi): allow kubecolor releases from GitHub (#122 ) Reviewed-on: #122	2026-05-11 23:39:48 +10:00
unkinben	27db33536a	feat(artifactapi): allow almalinux, debian, and fedora from Docker Hub (#121 ) Reviewed-on: #121	2026-05-10 22:56:39 +10:00
unkinben	8a7068a1c4	feat(artifactapi): add argo-helm as a remote and virtual helm member (#120 ) Reviewed-on: #120	2026-05-10 22:53:43 +10:00
unkinben	1cefd3b78e	feat: change argocd crds source to artifactapi (#118 ) - migrate argocd crds to come from the artifactapi service Reviewed-on: #118	2026-05-10 21:12:44 +10:00
unkinben	842d774fc3	feat: deploy gatewayapi crds (#117 ) - enable gateway api crds Reviewed-on: #117	2026-05-10 21:05:56 +10:00
unkinben	4c8827ce35	feat: add traefik/gatewayapi (#116 ) enable access to charts/containers/api-specs so that we can migrate from nginx-ingress to gateway api and traefik Reviewed-on: #116	2026-05-10 17:07:33 +10:00
unkinben	5e03215f4d	chore: migrate reloader/reflector to virtual/helm (#115 ) Reviewed-on: #115	2026-05-05 21:42:23 +10:00
unkinben	02ee82da1e	feat: update vso to 1.3.0 (#114 ) - updates the vso helm chart from 1.2.0 to 1.3.0 Reviewed-on: #114	2026-05-05 00:01:58 +10:00
unkinben	18c519f979	chore: remove hashicorp helm repo (#113 ) - no longer required, this is in virtual/helm repo in artifactapi Reviewed-on: #113	2026-05-03 23:51:44 +10:00
unkinben	dd0e297c14	chore: mount vault CA for helm TLS trust and add ArgoCD self-management (#112 ) - Patch argocd-repo-server to mount vault-ca-cert and set SSL_CERT_DIR so helm subprocesses trust the internal CA when pulling charts - Add argocd Application pointing at clusters/au-syd1/bootstrap so ArgoCD manages its own install going forward Reviewed-on: #112	2026-05-03 22:47:53 +10:00
unkinben	6fb98d66b0	chore: add vault CA cert to argocd-tls-certs-cm for helm TLS trust (#111 ) Patches argocd-tls-certs-cm with the Vault CA chain so ArgoCD can verify TLS when pulling Helm charts from artifactapi.k8s.syd1.au.unkin.net. Reviewed-on: #111	2026-05-03 17:13:25 +10:00
unkinben	bcea7df925	chore: swap vso to virtual helm repo (#109 ) - testing if there will be any changes after merging, before merging all of them Reviewed-on: #109	2026-05-03 16:49:53 +10:00
unkinben	f45194282b	chore: add resource requests/limits to workflows (#110 ) have seen some contention on woodpecker jobs, because they are not being scheduled correctly. we need to set correct limits/requests so that they can be accurately scheduled. - set limits/requests for all workflows Reviewed-on: #110	2026-05-03 16:49:46 +10:00
unkinben	260b2d4364	chore: mount vault CA cert for Node.js TLS trust in paperclip (#108 ) Mount the vault-ca-cert secret and set NODE_EXTRA_CA_CERTS so Node.js trusts the internal CA chain when making outbound TLS connections. Reviewed-on: #108	2026-05-03 00:10:08 +10:00
unkinben	156b545249	fix: set Host header on paperclip health probes to bypass hostname guard (#107 ) The privateHostnameGuard middleware blocks requests where the Host header is not in the allowlist. Kubelet httpGet probes use the pod IP as the Host header, which is never in the allowlist. Setting Host: localhost ensures probes are always permitted. Reviewed-on: #107	2026-05-02 23:01:59 +10:00
unkinben	0883f327e9	chore: update trusted hostnames (#106 ) - remove scheme from paperclip.k8s.. - add localhost (what probe is hitting) Reviewed-on: #106	2026-05-02 22:40:21 +10:00
unkinben	04b7c04366	chore: fix livenessProbe for paperclip (#105 ) Reviewed-on: #105	2026-05-02 22:28:52 +10:00
unkinben	9914186fd5	chore: additional papaerclip environemnt variables (#104 ) https://github.com/paperclipai/paperclip/issues/3121 Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/104	2026-05-02 22:11:38 +10:00
unkinben	f55b7065f1	fix: rename pgpooler to include rw (#103 ) - undo previous change (target pgcluster name) - actually rename the pgpooler Reviewed-on: #103	2026-05-02 21:39:51 +10:00
unkinben	87a5a271c3	fix: set pgpooler name to include -rw (#102 ) - this matches the credentials set for paperclip Reviewed-on: #102	2026-05-02 21:35:23 +10:00
unkinben	8e7bc289f6	chore: enable access to paperclip namespace (#101 ) Reviewed-on: #101	2026-05-02 21:30:59 +10:00
unkinben	e156cd10bd	feat: deploy paperclip to au-syd1 via ArgoCD (aitooling project) (#100 ) Adds base manifests and au-syd1 overlay for Paperclip (AI agent orchestration platform), following the litellm deployment pattern. Updates aitooling ApplicationSet to include the paperclip path. Closes #99 Reviewed-on: #100	2026-05-02 21:27:51 +10:00
unkinben	fe714694bf	chore: bump artifactapi to 2.7.2 (#98 ) Reviewed-on: #98	2026-05-02 17:19:56 +10:00
unkinben	6138afb98b	feat: add litellm-env configmap with STORE_MODEL_IN_DB=True (#97 ) Reviewed-on: #97	2026-05-01 22:17:53 +10:00
unkinben	949ddb76e4	chore: litellm ooming (#95 ) - update memory and cpu resources Reviewed-on: #95	2026-05-01 21:54:00 +10:00