feat(opa): add conftest OPA policies and pre-commit hook

Adds three policy files under policy/ plus a pre-commit hook that
runs conftest against all staged YAML manifests (excluding chart
templates).

Policies:
  no_ingress.rego
    Deny Ingress resources — cluster uses Gateway API only.

  gateway_api.rego
    HTTPRoute/TLSRoute: require explicit group/kind on parentRefs and
    group/kind/weight on backendRefs (PR #162, #165).
    Gateway: require explicit group on certificateRefs (PR #153).
    All fields are defaulted by the controller; omitting them causes
    permanent ArgoCD OutOfSync.

  resource_normalization.rego
    CPU integer: deny unquoted integer cpu values (PR #163).
    CPU milliCPU: deny values like 1000m/2000m that normalise to "1"/"2" (PR #164).
    Memory Mi→Gi: deny 1024Mi/2048Mi etc. that normalise to 1Gi/2Gi (PR #163).
    clusterIP null: deny Service with explicit null clusterIP (PR #166).

Also fixes all existing violations found by the new policies across
puppet deployments and reposync cronjobs (resource normalization).
kanidm/tlsroute.yaml and puppet/service_puppetdb.yaml are excluded
from this commit as they are addressed in PRs #165 and #166.

.gitignore

@@ -1,3 +1,2 @@
 manifests/
 apps/**/charts/
-ci/crd-schemas/

.pre-commit-config.yaml

@@ -6,7 +6,7 @@ repos:
       - id: check-executables-have-shebangs
       - id: check-json
       - id: check-added-large-files
-        args: ['--maxkb=2048']
+        args: ['--maxkb=500']
       - id: check-merge-conflict
       - id: check-shebang-scripts-are-executable
       - id: check-symlinks
@@ -40,3 +40,10 @@ repos:
         entry: ci/validate-no-secrets.sh
         language: system
         pass_filenames: false
+      - id: conftest_policies
+        name: OPA policy checks (conftest)
+        entry: conftest test --policy policy/
+        language: system
+        types: [yaml]
+        exclude: ".*/charts/.*|.*/templates/.*|\\.woodpecker/.*"
+        pass_filenames: true

.woodpecker/kubeconform.yaml

@@ -2,21 +2,6 @@ when:
   - event: pull_request
 
 steps:
-  - name: generate-schemas
-    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
-    commands:
-      - make generate-schemas
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
-
   - name: kubeconform
     image: git.unkin.net/unkin/almalinux9-kubetest:20260319
     commands:

Makefile

@@ -11,11 +11,6 @@ kubeconform:
 	@ci/validate-apps.sh && \
 	ci/validate-clusters.sh
 
-# Generate JSON schemas from CRD definitions for kubeconform
-# Run when CRD versions change, then commit ci/crd-schemas/
-generate-schemas:
-	@ci/generate-crd-schemas.sh
-
 # Clean all generated manifests
 clean:
 	@rm -rf manifests/

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,7 +6,6 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
-      - "^open-webui/open-webui"
       - "^openvoxproject/"
       - "^stakater/reloader"
       - "^stalwartlabs/stalwart"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -36,7 +36,6 @@ remotes:
       - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
       - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
       - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
       - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
       - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
       - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"

apps/base/kanidm/README.md

@@ -1,32 +0,0 @@
-# kanidm
-
-Single-replica kanidm identity server deployment.
-
-## Initial setup
-
-After the pod starts for the first time, generate the admin and idm_admin credentials:
-
-```bash
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account admin
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account idm_admin
-```
-
-## Adding replication
-
-If replication is needed in the future:
-
-1. Scale the StatefulSet to 3 replicas and add `podAntiAffinity` to spread across nodes.
-2. Add a `[replication]` section to `configmap.yaml` per pod (origin is pod-specific:
-   `repl://kanidm-N.kanidm-headless.kanidm.svc.cluster.local:8444`).
-3. Add the replication port (8444) back to the StatefulSet container ports and headless service.
-4. Restore `rbac.yaml` for the cert-publisher sidecar, or exchange certificates manually:
-
-```bash
-# On each pod, get its replication certificate
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd renew-replication-certificate
-
-# Add each peer's certificate to the other pods' configs under:
-# [replication."repl://<peer-fqdn>:8444"]
-# type = "mutual-pull"
-# partner_cert = "<cert>"
-```

apps/base/kanidm/configmap.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kanidm-config
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+data:
+  server.toml: |
+    version = "2"
+
+    domain = "auth.unkin.net"
+    origin = "https://auth.unkin.net"
+    bindaddress = "[::]:8443"
+    db_path = "/data/kanidm.db"
+    db_arc_size = 2048
+    tls_chain = "/data/tls/tls.crt"
+    tls_key = "/data/tls/tls.key"
+    log_level = "info"
+
+    [online_backup]
+    path = "/data/backups/"
+    schedule = "0 22 * * *"
+    versions = 7
+
+    [replication]
+    origin = "__REPL_ORIGIN__"
+    bindaddress = "[::]:8444"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kanidm-repl-certs
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+data: {}

apps/base/kanidm/kustomization.yaml

@@ -5,23 +5,12 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - serviceaccount.yaml
+  - rbac.yaml
   - certificate.yaml
+  - configmap.yaml
   - service.yaml
   - statefulset.yaml
   - poddisruptionbudget.yaml
   - gateway.yaml
   - httproute.yaml
   - tlsroute.yaml
-
-configMapGenerator:
-  - name: kanidm-config
-    namespace: kanidm
-    options:
-      disableNameSuffixHash: true
-      labels:
-        app.kubernetes.io/name: kanidm
-        app.kubernetes.io/instance: kanidm
-    files:
-      - server-0.toml=resources/server-0.toml
-      - server-1.toml=resources/server-1.toml
-      - server-2.toml=resources/server-2.toml

apps/base/kanidm/resources/server-0.toml

@@ -1,27 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"
-
-[replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
-
-[replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"

apps/base/kanidm/resources/server-1.toml

@@ -1,27 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"
-
-[replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
-
-[replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"

apps/base/kanidm/resources/server-2.toml

@@ -1,27 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"
-
-[replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
-
-[replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"

apps/base/kanidm/statefulset.yaml

@@ -36,10 +36,24 @@ spec:
         fsGroup: 1000
       initContainers:
         - name: config-init
-          image: busybox:1.36
+          image: kanidm/server:1.10.3
           command: ["/bin/sh", "-c"]
           args:
-            - cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
+            - |
+              set -e
+              REPL_ORIGIN="repl://${POD_NAME}.kanidm-headless.kanidm.svc.cluster.local:8444"
+              sed "s|__REPL_ORIGIN__|${REPL_ORIGIN}|g" /config-template/server.toml > /config/server.toml
+              for peer in kanidm-0 kanidm-1 kanidm-2; do
+                if [ "${peer}" = "${POD_NAME}" ]; then
+                  continue
+                fi
+                cert_file="/repl-certs/${peer}"
+                if [ -s "${cert_file}" ]; then
+                  fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
+                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
+                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+                fi
+              done
           env:
             - name: POD_NAME
               valueFrom:
@@ -48,12 +62,41 @@ spec:
           volumeMounts:
             - name: config-template
               mountPath: /config-template
-              readOnly: true
             - name: config
               mountPath: /config
+            - name: repl-certs
+              mountPath: /repl-certs
+              readOnly: true
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
+        - name: repl-cert-publisher
+          image: bitnami/kubectl:1.33
+          restartPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              until kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null | grep -q '^# certificate:'; do
+                sleep 30
+              done
+              while true; do
+                cert=$(kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null \
+                  | grep '^# certificate:' | sed 's/^# certificate: "\(.*\)"$/\1/')
+                if [ -n "${cert}" ]; then
+                  kubectl patch configmap kanidm-repl-certs \
+                    --type=merge \
+                    -p "{\"data\":{\"${POD_NAME}\":\"${cert}\"}}"
+                fi
+                sleep 3600
+              done
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
       containers:
         - name: kanidm
           image: kanidm/server:1.10.3
@@ -101,6 +144,9 @@ spec:
             name: kanidm-config
         - name: config
           emptyDir: {}
+        - name: repl-certs
+          configMap:
+            name: kanidm-repl-certs
         - name: tls
           secret:
             secretName: kanidm-tls

apps/base/kanidm/tlsroute.yaml

@@ -13,14 +13,9 @@ spec:
     - auth.unkin.net
     - au.auth.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
+    - name: kanidm
       sectionName: https-passthrough
   rules:
     - backendRefs:
-        - group: ""
-          kind: Service
-          name: kanidm
+        - name: kanidm
           port: 8443
-          weight: 1

apps/base/priority-classes/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - priorityclasses.yaml

apps/base/priority-classes/priorityclasses.yaml

@@ -1,36 +0,0 @@
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: low
-value: 100
-preemptionPolicy: Never
-globalDefault: false
-description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: power
-value: 100
-preemptionPolicy: Never
-globalDefault: false
-description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: medium
-value: 10000
-preemptionPolicy: PreemptLowerPriority
-globalDefault: false
-description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: high
-value: 100000
-preemptionPolicy: PreemptLowerPriority
-globalDefault: false
-description: "High-importance services. Will preempt medium- and low-priority pods if necessary."

apps/base/puppet/deployment_puppetboard.yaml

@@ -150,7 +150,7 @@ spec:
               memory: 350Mi
               cpu: 100m
             limits:
-              memory: 1024Mi
+              memory: 1Gi
               cpu: 500m
           securityContext:
             runAsNonRoot: true

apps/base/puppet/deployment_puppetdb.yaml

@@ -35,7 +35,7 @@ spec:
           imagePullPolicy: IfNotPresent
           resources:
             limits:
-              cpu: 1
+              cpu: "1"
               memory: 1536Mi
             requests:
               cpu: 250m

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -31,11 +31,11 @@ spec:
         imagePullPolicy: IfNotPresent
         resources:
           limits:
-            cpu: 2
-            memory: 3072Mi
+            cpu: "2"
+            memory: 3Gi
           requests:
             cpu: 500m
-            memory: 1024Mi
+            memory: 1Gi
         ports:
         - containerPort: 8140
           name: puppetserver

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -35,11 +35,11 @@ spec:
           imagePullPolicy: IfNotPresent
           resources:
             limits:
-              cpu: 2
+              cpu: "2"
               memory: 3500Mi
             requests:
               cpu: 250m
-              memory: 1024Mi
+              memory: 1Gi
           ports:
             - containerPort: 8140
               name: puppetserver

apps/base/puppet/service_puppetdb.yaml

@@ -9,6 +9,7 @@ metadata:
   name: puppetdb
   namespace: puppet
 spec:
+  clusterIP: null
   ports:
   - name: pdb-http
     port: 8080

apps/base/reposync/cronjob_reposync-almalinux9-appstream.yaml

@@ -53,7 +53,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: 2000m
+                  cpu: "2"
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/reposync/cronjob_reposync-almalinux9-baseos.yaml

@@ -56,7 +56,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: 2000m
+                  cpu: "2"
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/reposync/cronjob_reposync-epel9.yaml

@@ -53,7 +53,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: 2000m
+                  cpu: "2"
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/reposync/cronjob_reposync-openvox7.yaml

@@ -52,7 +52,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: 2000m
+                  cpu: "2"
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/vault/kustomization.yaml

@@ -6,4 +6,3 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
-  - role_k8s-service-registration.yaml

apps/base/vault/role_k8s-service-registration.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: vault-k8s-service-registration
-  namespace: vault
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: vault-k8s-service-registration
-  namespace: vault
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: vault-k8s-service-registration
-subjects:
-  - kind: ServiceAccount
-    name: vault
-    namespace: vault

apps/overlays/au-syd1/consul/values.yaml

@@ -37,7 +37,7 @@ server:
       cpu: 100m
     limits:
       memory: 2Gi
-      cpu: "1"
+      cpu: 1000m
 
 client:
   enabled: false

apps/overlays/au-syd1/priority-classes/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/priority-classes

apps/overlays/au-syd1/vault/values.yaml

@@ -40,7 +40,9 @@ server:
           }
         }
 
-        service_registration "kubernetes" {}
+        service_registration "consul" {
+          address = "consul-server.consul.svc.cluster.local:8500"
+        }
 
   dataStorage:
     enabled: true
@@ -48,14 +50,6 @@ server:
     storageClass: cephrbd-fast-delete
     accessMode: ReadWriteOnce
 
-  extraEnv:
-    - name: VAULT_K8S_NAMESPACE
-      value: vault
-    - name: VAULT_K8S_POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-
   statefulSet:
     securityContext:
       container:

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -2,7 +2,6 @@ agent:
   replicaCount: 3
   env:
     WOODPECKER_MAX_WORKFLOWS: "8"
-    WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
     WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
     WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
     WOODPECKER_BACKEND_K8S_STORAGE_RWX: false

argocd/applicationsets/platform.yaml

@@ -22,7 +22,6 @@ spec:
       - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/priority-classes
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system

argocd/projects/platform.yaml

@@ -31,8 +31,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
-    - namespace: 'priority-classes'
-      server: https://kubernetes.default.svc
     - namespace: 'purelb'
       server: https://kubernetes.default.svc
     - namespace: 'puppet'

ci/generate-crd-schemas.py

@@ -1,49 +0,0 @@
-#!/usr/bin/env -S uv run
-# /// script
-# requires-python = ">=3.11"
-# dependencies = ["pyyaml"]
-# ///
-"""
-Extract OpenAPI v3 schemas from CRD YAML on stdin and write JSON schema files
-to the output directory for use with kubeconform.
-
-Usage: kustomize build ... | ci/generate-crd-schemas.py <output-dir>
-"""
-import sys
-import json
-import os
-
-import yaml
-
-
-def main() -> int:
-    output_dir = sys.argv[1] if len(sys.argv) > 1 else "ci/crd-schemas"
-    count = 0
-
-    for doc in yaml.safe_load_all(sys.stdin):
-        if not doc or doc.get("kind") != "CustomResourceDefinition":
-            continue
-
-        group = doc["spec"]["group"]
-        kind = doc["spec"]["names"]["kind"]
-        group_dir = os.path.join(output_dir, group)
-        os.makedirs(group_dir, exist_ok=True)
-
-        for ver in doc["spec"].get("versions", []):
-            if not ver.get("served", True):
-                continue
-            schema = ver.get("schema", {}).get("openAPIV3Schema")
-            if not schema:
-                continue
-            fname = os.path.join(group_dir, f"{kind.lower()}_{ver['name']}.json")
-            with open(fname, "w") as f:
-                json.dump({"$schema": "http://json-schema.org/schema#", **schema}, f, indent=2)
-                f.write("\n")
-            print(f"  wrote {fname}", file=sys.stderr)
-            count += 1
-
-    return count
-
-
-if __name__ == "__main__":
-    print(main())

ci/generate-crd-schemas.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# Extract OpenAPI v3 schemas from CRD definitions in all kustomize overlays
-# and write JSON schema files to ci/crd-schemas/ for kubeconform validation.
-#
-# Run this script whenever CRD versions change, then commit the output.
-# Usage: ci/generate-crd-schemas.sh [output-dir]
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-OUTPUT_DIR="${1:-${SCRIPT_DIR}/crd-schemas}"
-mkdir -p "$OUTPUT_DIR"
-
-total=0
-
-while IFS= read -r -d "" k; do
-  dir="$(dirname "$k")"
-  n=$(kustomize build --enable-helm "$dir" 2>/dev/null \
-    | "$SCRIPT_DIR/generate-crd-schemas.py" "$OUTPUT_DIR") || continue
-  total=$((total + n))
-done < <(find apps/overlays clusters -name kustomization.yaml -print0 | sort -z)
-
-echo "Generated ${total} schema(s) in ${OUTPUT_DIR}" >&2

ci/validate-apps.sh

@@ -6,7 +6,6 @@ KUBE_VERSION="1.33.7"
 schema_args=(
   -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
   -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
-  -schema-location "file://${PWD}/ci/crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
 )
 
 while IFS= read -r -d "" k; do
@@ -19,6 +18,6 @@ while IFS= read -r -d "" k; do
         -summary \
         -output pretty \
         -verbose \
-        -skip GpuDevicePlugin,LBNodeAgent,ServiceGroup \
+        -skip CustomResourceDefinition,GpuDevicePlugin,LBNodeAgent,ServiceGroup \
         "${schema_args[@]}"
 done < <(find apps/overlays -name kustomization.yaml -print0)

ci/validate-clusters.sh

@@ -6,7 +6,6 @@ KUBE_VERSION="1.33.7"
 schema_args=(
   -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
   -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
-  -schema-location "file://${PWD}/ci/crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
 )
 
 while IFS= read -r -d "" k; do

policy/gateway_api.rego

@@ -0,0 +1,94 @@
+package main
+
+# Gateway API resources require several fields to be set explicitly even though
+# the Gateway API controller defaults them. ArgoCD diffs desired vs live by
+# string comparison, so any field the controller defaults that is absent from
+# the git manifest causes a permanent OutOfSync.
+#
+# Affected resources:
+#   HTTPRoute / TLSRoute — parentRefs and backendRefs (see PR #162, #165)
+#   Gateway              — listeners[*].tls.certificateRefs (see PR #153)
+
+_route_kinds := {"HTTPRoute", "TLSRoute"}
+
+# ---- parentRefs: group must be "gateway.networking.k8s.io" ----
+
+deny contains msg if {
+    _route_kinds[input.kind]
+    ref := input.spec.parentRefs[i]
+    object.get(ref, "group", null) != "gateway.networking.k8s.io"
+    msg := sprintf(
+        "%s %s/%s parentRefs[%d]: add 'group: gateway.networking.k8s.io' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
+        [input.kind, input.metadata.namespace, input.metadata.name, i],
+    )
+}
+
+# ---- parentRefs: kind must be "Gateway" ----
+
+deny contains msg if {
+    _route_kinds[input.kind]
+    ref := input.spec.parentRefs[i]
+    object.get(ref, "kind", null) != "Gateway"
+    msg := sprintf(
+        "%s %s/%s parentRefs[%d]: add 'kind: Gateway' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
+        [input.kind, input.metadata.namespace, input.metadata.name, i],
+    )
+}
+
+# ---- backendRefs: group must be present (may be empty string "") ----
+
+deny contains msg if {
+    _route_kinds[input.kind]
+    rule := input.spec.rules[ri]
+    ref := rule.backendRefs[bi]
+    not _has_key(ref, "group")
+    msg := sprintf(
+        "%s %s/%s rules[%d].backendRefs[%d]: add 'group: \"\"' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
+        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
+    )
+}
+
+# ---- backendRefs: kind must be "Service" ----
+
+deny contains msg if {
+    _route_kinds[input.kind]
+    rule := input.spec.rules[ri]
+    ref := rule.backendRefs[bi]
+    object.get(ref, "kind", null) != "Service"
+    msg := sprintf(
+        "%s %s/%s rules[%d].backendRefs[%d]: add 'kind: Service' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
+        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
+    )
+}
+
+# ---- backendRefs: weight must be present ----
+
+deny contains msg if {
+    _route_kinds[input.kind]
+    rule := input.spec.rules[ri]
+    ref := rule.backendRefs[bi]
+    not _has_key(ref, "weight")
+    msg := sprintf(
+        "%s %s/%s rules[%d].backendRefs[%d]: add 'weight: 1' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
+        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
+    )
+}
+
+# ---- Gateway certificateRefs: group must be present (may be empty string "") ----
+
+deny contains msg if {
+    input.kind == "Gateway"
+    listener := input.spec.listeners[li]
+    ref := listener.tls.certificateRefs[ci]
+    not _has_key(ref, "group")
+    msg := sprintf(
+        "Gateway %s/%s listeners[%d].tls.certificateRefs[%d]: add 'group: \"\"' — admission webhook defaults this field, causing ArgoCD OutOfSync when omitted",
+        [input.metadata.namespace, input.metadata.name, li, ci],
+    )
+}
+
+# ---- Helper: key presence check (works for null, "", and any defined value) ----
+
+_has_key(obj, key) if {
+    _ = obj[key]
+}

policy/no_ingress.rego

@@ -0,0 +1,13 @@
+package main
+
+# Deny all Kubernetes Ingress resources.
+# This cluster uses Gateway API (HTTPRoute + Gateway) for ingress routing.
+# Ingress is the legacy API and must not be added.
+
+deny contains msg if {
+    input.kind == "Ingress"
+    msg := sprintf(
+        "%s/%s: Ingress resources are forbidden — use Gateway API HTTPRoute instead",
+        [input.metadata.namespace, input.metadata.name],
+    )
+}

policy/resource_normalization.rego

@@ -0,0 +1,173 @@
+package main
+
+# Kubernetes normalizes resource quantity values on write. ArgoCD diffs by
+# string comparison, so a non-canonical value in git will always differ from
+# the live object, causing permanent OutOfSync.
+#
+# Rules enforced here:
+#   CPU integers  — k8s converts integer 1 to string "1" (see PR #163)
+#   CPU milliCPU  — k8s converts 1000m → "1", 2000m → "2", etc. (PR #164)
+#   Memory Mi→Gi  — k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc. (PR #163)
+#   clusterIP null — k8s assigns a real IP; null in git always differs
+#                    from the live assigned value (see PR #166)
+
+# ---- Container helpers ----
+# Extracts containers from Deployment/StatefulSet/DaemonSet/Job/CronJob/Pod
+
+_containers contains c if { c := input.spec.template.spec.containers[_] }
+_containers contains c if { c := input.spec.template.spec.initContainers[_] }
+_containers contains c if { c := input.spec.containers[_] }
+_containers contains c if { c := input.spec.initContainers[_] }
+_containers contains c if { c := input.spec.jobTemplate.spec.template.spec.containers[_] }
+
+# ---- CPU: must not be an integer ----
+# YAML `cpu: 1` (unquoted) parses as JSON integer; k8s stores as string "1".
+
+deny contains msg if {
+    c := _containers[_]
+    cpu := c.resources.limits.cpu
+    is_number(cpu)
+    msg := sprintf(
+        "%s container %q: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
+        [input.kind, c.name, cpu, cpu],
+    )
+}
+
+deny contains msg if {
+    c := _containers[_]
+    cpu := c.resources.requests.cpu
+    is_number(cpu)
+    msg := sprintf(
+        "%s container %q: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
+        [input.kind, c.name, cpu, cpu],
+    )
+}
+
+deny contains msg if {
+    input.kind == "Cluster"
+    cpu := input.spec.resources.limits.cpu
+    is_number(cpu)
+    msg := sprintf(
+        "Cluster %s/%s: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name, cpu, cpu],
+    )
+}
+
+deny contains msg if {
+    input.kind == "Cluster"
+    cpu := input.spec.resources.requests.cpu
+    is_number(cpu)
+    msg := sprintf(
+        "Cluster %s/%s: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name, cpu, cpu],
+    )
+}
+
+# ---- CPU: milliCPU divisible by 1000 normalizes to a whole number ----
+# k8s converts 1000m → "1", 2000m → "2". Use the canonical whole-number form.
+
+_milli_whole(cpu) := n if {
+    is_string(cpu)
+    endswith(cpu, "m")
+    val := to_number(substring(cpu, 0, count(cpu) - 1))
+    val % 1000 == 0
+    val > 0
+    n := val / 1000
+}
+
+deny contains msg if {
+    c := _containers[_]
+    n := _milli_whole(c.resources.limits.cpu)
+    msg := sprintf(
+        "%s container %q: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
+        [input.kind, c.name, c.resources.limits.cpu, n],
+    )
+}
+
+deny contains msg if {
+    c := _containers[_]
+    n := _milli_whole(c.resources.requests.cpu)
+    msg := sprintf(
+        "%s container %q: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
+        [input.kind, c.name, c.resources.requests.cpu, n],
+    )
+}
+
+deny contains msg if {
+    input.kind == "Cluster"
+    n := _milli_whole(input.spec.resources.limits.cpu)
+    msg := sprintf(
+        "Cluster %s/%s: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name, input.spec.resources.limits.cpu, n],
+    )
+}
+
+deny contains msg if {
+    input.kind == "Cluster"
+    n := _milli_whole(input.spec.resources.requests.cpu)
+    msg := sprintf(
+        "Cluster %s/%s: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name, input.spec.resources.requests.cpu, n],
+    )
+}
+
+# ---- Memory: Mi values divisible by 1024 normalize to Gi ----
+# k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc.
+
+_mi_canonical(mem) := canonical if {
+    endswith(mem, "Mi")
+    val := to_number(substring(mem, 0, count(mem) - 2))
+    val % 1024 == 0
+    val > 0
+    canonical := sprintf("%vGi", [val / 1024])
+}
+
+deny contains msg if {
+    c := _containers[_]
+    canonical := _mi_canonical(c.resources.limits.memory)
+    msg := sprintf(
+        "%s container %q: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
+        [input.kind, c.name, c.resources.limits.memory, canonical],
+    )
+}
+
+deny contains msg if {
+    c := _containers[_]
+    canonical := _mi_canonical(c.resources.requests.memory)
+    msg := sprintf(
+        "%s container %q: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
+        [input.kind, c.name, c.resources.requests.memory, canonical],
+    )
+}
+
+deny contains msg if {
+    input.kind == "Cluster"
+    canonical := _mi_canonical(input.spec.resources.limits.memory)
+    msg := sprintf(
+        "Cluster %s/%s: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name, input.spec.resources.limits.memory, canonical],
+    )
+}
+
+deny contains msg if {
+    input.kind == "Cluster"
+    canonical := _mi_canonical(input.spec.resources.requests.memory)
+    msg := sprintf(
+        "Cluster %s/%s: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name, input.spec.resources.requests.memory, canonical],
+    )
+}
+
+# ---- Service: clusterIP must not be null ----
+# k8s assigns a real IP on creation; clusterIP is immutable afterward.
+# Setting null in git means desired=null vs live=10.x.x.x → permanent OutOfSync.
+# Remove the field and let k8s own it.
+
+deny contains msg if {
+    input.kind == "Service"
+    input.spec.clusterIP == null
+    msg := sprintf(
+        "Service %s/%s has 'clusterIP: null' — remove this field; Kubernetes assigns the IP on creation and it causes ArgoCD OutOfSync",
+        [input.metadata.namespace, input.metadata.name],
+    )
+}