feat: deploy argocd-image-updater via Helm

Deploys ArgoCD Image Updater into the argocd-image-updater namespace.
Vault-managed secrets provide registry credentials for git.unkin.net
and an ArgoCD API token.

Prerequisites before syncing:
- Create Vault role argocd-image-updater in k8s/au/syd1
- Populate kv/service/argocd-image-updater/registry-creds (key: creds, value: <user>:<token>)
- Create ArgoCD local user image-updater and store token at kv/service/argocd-image-updater/argocd-token

apps/base/argocd-image-updater/kustomization.yaml

@@ -4,5 +4,5 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
-  - gateway.yaml
+  - vaultauth.yaml
-  - httproute.yaml
+  - vaultstaticsecret.yaml

apps/base/argocd-image-updater/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: vault
+  name: argocd-image-updater

apps/base/argocd-image-updater/vaultauth.yaml

@@ -3,15 +3,15 @@ apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
   name: default
-  namespace: mailgateway
+  namespace: argocd-image-updater
 spec:
   allowedNamespaces:
-    - mailgateway
+    - argocd-image-updater
   kubernetes:
     audiences:
       - vault
-    role: default
+    role: argocd-image-updater
-    serviceAccount: default
+    serviceAccount: argocd-image-updater
     tokenExpirationSeconds: 600
   method: kubernetes
   mount: k8s/au/syd1

apps/base/argocd-image-updater/vaultstaticsecret.yaml

@@ -0,0 +1,40 @@
+---
+# Credentials for polling the git.unkin.net container registry.
+# Vault KV path: kv/service/argocd-image-updater/registry-creds
+# Required key: creds — value format: "<username>:<token>"
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: registry-creds
+  namespace: argocd-image-updater
+spec:
+  destination:
+    create: true
+    name: registry-creds
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: service/argocd-image-updater/registry-creds
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+# ArgoCD API token for image updater to discover and update Applications.
+# Vault KV path: kv/service/argocd-image-updater/argocd-token
+# Required key: token — generate via: argocd account generate-token --account image-updater
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: argocd-token
+  namespace: argocd-image-updater
+spec:
+  destination:
+    create: true
+    name: argocd-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: service/argocd-image-updater/argocd-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/artifactapi/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: artifactapi
-  namespace: artifactapi
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: artifactapi.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: artifactapi.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: artifactapi-tls
-        mode: Terminate

apps/base/artifactapi/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: artifactapi-http-redirect
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: artifactapi
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: artifactapi
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: artifactapi
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: artifactapi-api
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/artifactapi/ingress.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    nginx.ingress.kubernetes.io/proxy-body-size: 10g
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+  name: artifactapi-ingress
+  namespace: artifactapi
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: artifactapi.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: artifactapi-api
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - artifactapi.k8s.syd1.au.unkin.net
+      secretName: artifactapi-tls

apps/base/artifactapi/kustomization.yaml

@@ -6,8 +6,7 @@ resources:
   - artifactapi-deployment.yaml
   - artifactapi-hpa.yaml
   - configmap.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml
   - namespace.yaml
   - postgres-deployment.yaml
   - pvc.yaml

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,7 +6,6 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
-      - "^kanidm/"
       - "^openvoxproject/"
       - "^stakater/reloader"
       - "^voxpupuli/puppetboard"
@@ -20,10 +19,7 @@ remotes:
     package: "docker"
     description: "Docker Hub registry"
     immutable_patterns:
-      - "^library/almalinux"
       - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
       - "^library/nginx"
       - "^library/postgres"
       - "^library/redis"
@@ -31,8 +27,7 @@ remotes:
       - "^bitnami/"
       - "^curlimages/curl"
       - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/consul"
+      - "^hashicorp/vault-secrets-operator"
-      - "^hashicorp/vault"
       - "^jfrog/"
       - "^rancher/"
       - "^traefik/"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -26,9 +26,7 @@ remotes:
       - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
       - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
       - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
       - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
       - "lxc/incus/.*.tar.gz$"
       - "mikefarah/yq/.*/yq_linux_amd64$"
       - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -56,7 +54,6 @@ remotes:
       - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
       - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
       - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
     cache:
       immutable_ttl: 0
       mutable_ttl: 7200

apps/base/cattle-system/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
-  name: rancher
-  namespace: cattle-system
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: rancher-tls
-        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher-http-redirect
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: rancher
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/cattle-system/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - rancher.k8s.syd1.au.unkin.net
+      secretName: rancher-tls
+  rules:
+    - host: rancher.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml

apps/base/consul/gateway.yaml

@@ -1,53 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: consul
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    cert-manager.io/alt-names: consul.service.consul
-    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: consul.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: consul.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: consul-tls
-    - name: consul-svc
-      port: 443
-      protocol: HTTPS
-      hostname: consul.service.consul
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: consul-tls

apps/base/consul/httproute.yaml

@@ -1,71 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul-http-redirect
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: consul
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: consul
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: consul-ui
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul-svc
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.service.consul
-  parentRefs:
-    - name: consul
-      sectionName: consul-svc
-  rules:
-    - backendRefs:
-        - name: consul-ui
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/consul/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: consul

apps/base/litellm/cnpg_cluster.yaml

@@ -76,11 +76,11 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: 1
+      cpu: 500m
-      memory: 1024Mi
+      memory: 512Mi
     requests:
       cpu: 250m
-      memory: 512Mi
+      memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800

apps/base/litellm/deployment.yaml

@@ -56,10 +56,10 @@ spec:
           resources:
             limits:
               cpu: "2"
-              memory: 8Gi
+              memory: 6Gi
             requests:
               cpu: 250m
-              memory: 6Gi
+              memory: 2Gi
           volumeMounts:
             - mountPath: /app/config.yaml
               name: config

apps/base/litellm/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: litellm
-  namespace: litellm
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: litellm.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: litellm.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: litellm-tls
-        mode: Terminate

apps/base/litellm/hpa.yaml

@@ -10,14 +10,14 @@ spec:
     kind: Deployment
     name: litellm
   minReplicas: 2
-  maxReplicas: 4
+  maxReplicas: 10
   metrics:
     - type: Resource
       resource:
         name: cpu
         target:
           type: Utilization
-          averageUtilization: 80
+          averageUtilization: 60
   behavior:
     scaleUp:
       stabilizationWindowSeconds: 0
@@ -25,7 +25,7 @@ spec:
       policies:
         - type: Percent
           value: 100
-          periodSeconds: 60
+          periodSeconds: 30
         - type: Pods
           value: 4
           periodSeconds: 30
@@ -34,7 +34,7 @@ spec:
       selectPolicy: Min
       policies:
         - type: Percent
-          value: 30
+          value: 10
           periodSeconds: 60
         - type: Pods
           value: 2

apps/base/litellm/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: litellm-http-redirect
-  namespace: litellm
-spec:
-  hostnames:
-    - litellm.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: litellm
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  hostnames:
-    - litellm.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: litellm
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: litellm
-          port: 4000
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/litellm/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: litellm
+  namespace: litellm
+spec:
+  rules:
+    - host: litellm.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: litellm
+                port:
+                  number: 4000
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - litellm.k8s.syd1.au.unkin.net
+      secretName: litellm-tls

apps/base/litellm/kustomization.yaml

@@ -7,8 +7,7 @@ resources:
   - cnpg_pooler.yaml
   - deployment.yaml
   - hpa.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml
   - namespace.yaml
   - redis-deployment.yaml
   - redis-pvc.yaml

apps/base/mailgateway/certificate.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: postfix-smtp-tls
-  namespace: mailgateway
-spec:
-  secretName: postfix-smtp-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: mail.main.unkin.net
-  dnsNames:
-    - mail.main.unkin.net
-    - smtp-in.main.unkin.net
-  privateKey:
-    size: 4096
-    algorithm: RSA

apps/base/mailgateway/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: rspamd
-  namespace: mailgateway
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rspamd.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rspamd.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: rspamd-tls
-        mode: Terminate

apps/base/mailgateway/httproute.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  parentRefs:
-    - name: rspamd
-      namespace: mailgateway
-  hostnames:
-    - rspamd.k8s.syd1.au.unkin.net
-  rules:
-    - backendRefs:
-        - name: rspamd
-          port: 11334

apps/base/mailgateway/kustomization.yaml

@@ -1,36 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - certificate.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - postfix-deployment.yaml
-  - postfix-hpa.yaml
-  - rspamd-deployment.yaml
-  - rspamd-hpa.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: postfix-config
-    files:
-      - main.cf=resources/postfix/main.cf
-      - master.cf=resources/postfix/master.cf
-    options:
-      disableNameSuffixHash: true
-  - name: postfix-maps
-    files:
-      - transport=resources/postfix/transport
-    options:
-      disableNameSuffixHash: true
-  - name: rspamd-config
-    files:
-      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
-      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
-      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
-    options:
-      disableNameSuffixHash: true

apps/base/mailgateway/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: mailgateway

apps/base/mailgateway/postfix-deployment.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: postfix
-  namespace: mailgateway
-spec:
-  selector:
-    matchLabels:
-      app: postfix
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: postfix
-    spec:
-      initContainers:
-        - name: postmap
-          image: tozd/postfix:alpine-322
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              for f in /etc/postfix/maps/*; do
-                base=$(basename "$f")
-                cp "$f" /tmp/"$base"
-                postmap hash:/tmp/"$base"
-                cp /tmp/"${base}.db" /etc/postfix/db/
-              done
-          volumeMounts:
-            - name: postfix-maps
-              mountPath: /etc/postfix/maps
-              readOnly: true
-            - name: postfix-db
-              mountPath: /etc/postfix/db
-      containers:
-        - name: postfix
-          image: tozd/postfix:alpine-322
-          ports:
-            - containerPort: 25
-              name: smtp
-              protocol: TCP
-            - containerPort: 587
-              name: submission
-              protocol: TCP
-          env:
-            # Keep these in sync with main.cf so the tozd startup postconf calls are no-ops
-            - name: MAILNAME
-              value: "mail.main.unkin.net"
-            - name: MY_NETWORKS
-              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
-            - name: MY_DESTINATION
-              value: "localhost.localdomain, localhost"
-            - name: LOG_TO_STDOUT
-              value: "1"
-          livenessProbe:
-            tcpSocket:
-              port: 25
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            tcpSocket:
-              port: 25
-            initialDelaySeconds: 15
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: postfix-config
-              mountPath: /etc/postfix/main.cf
-              subPath: main.cf
-            - name: postfix-config
-              mountPath: /etc/postfix/master.cf
-              subPath: master.cf
-            - name: postfix-db
-              mountPath: /etc/postfix/transport.db
-              subPath: transport.db
-            - name: postfix-tls
-              mountPath: /etc/postfix/tls
-              readOnly: true
-            - name: spool
-              mountPath: /var/spool/postfix
-      volumes:
-        - name: postfix-config
-          configMap:
-            name: postfix-config
-        - name: postfix-maps
-          configMap:
-            name: postfix-maps
-        - name: postfix-db
-          emptyDir: {}
-        - name: postfix-tls
-          secret:
-            secretName: postfix-smtp-tls
-        - name: spool
-          emptyDir: {}

apps/base/mailgateway/postfix-hpa.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: postfix-hpa
-  namespace: mailgateway
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: postfix
-  minReplicas: 2
-  maxReplicas: 6
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 60
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60

apps/base/mailgateway/resources/postfix/main.cf

@@ -1,46 +0,0 @@
-# Basic identity — kept in sync with MAILNAME/MY_NETWORKS/MY_DESTINATION env vars
-# so the tozd startup script's postconf calls are no-ops
-myhostname = mail.main.unkin.net
-myorigin = main.unkin.net
-mydestination = localhost.localdomain, localhost
-mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
-inet_protocols = ipv4
-inet_interfaces = all
-
-# No local delivery — we're a relay-only gateway
-local_transport = error:no local delivery
-alias_maps =
-alias_database =
-
-# Relay inbound mail for these domains to Stalwart
-relay_domains = main.unkin.net unkin.net
-transport_maps = hash:/etc/postfix/transport
-
-# rspamd milter (same namespace — short DNS name resolves)
-smtpd_milters = inet:rspamd:11332
-non_smtpd_milters = inet:rspamd:11332
-milter_default_action = accept
-milter_protocol = 6
-milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
-
-# Inbound TLS (cert from cert-manager Certificate resource)
-smtpd_use_tls = yes
-smtpd_tls_security_level = may
-smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
-smtpd_tls_key_file = /etc/postfix/tls/tls.key
-smtpd_tls_loglevel = 1
-
-# Outbound TLS (opportunistic)
-smtp_tls_security_level = may
-smtp_tls_loglevel = 1
-
-# Message size limit (50 MiB)
-message_size_limit = 52428800
-mailbox_size_limit = 0
-
-# Queue retention
-maximal_queue_lifetime = 5d
-bounce_queue_lifetime = 1d
-
-# Log to stdout for k8s log collection
-maillog_file = /dev/stdout

apps/base/mailgateway/resources/postfix/master.cf

@@ -1,42 +0,0 @@
-# ==========================================================================
-# service type  private unpriv  chroot  wakeup  maxproc command + args
-#               (yes)   (yes)   (yes)   (never) (100)
-# ==========================================================================
-
-# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
-smtp      inet  n       -       n       -       -       smtpd
-
-# Submission (port 587) — TLS required, relay from trusted mynetworks only
-submission inet n       -       n       -       -       smtpd
-  -o syslog_name=postfix/submission
-  -o smtpd_tls_security_level=encrypt
-  -o smtpd_sasl_auth_enable=no
-  -o smtpd_reject_unlisted_recipient=no
-  -o smtpd_relay_restrictions=permit_mynetworks,reject
-  -o milter_macro_daemon_name=ORIGINATING
-
-# Internal postfix processes
-pickup    unix  n       -       n       60      1       pickup
-cleanup   unix  n       -       n       -       0       cleanup
-qmgr      unix  n       -       n       300     1       qmgr
-tlsmgr    unix  -       -       n       1000?   1       tlsmgr
-rewrite   unix  -       -       n       -       -       trivial-rewrite
-bounce    unix  -       -       n       -       0       bounce
-defer     unix  -       -       n       -       0       bounce
-trace     unix  -       -       n       -       0       bounce
-verify    unix  -       -       n       -       1       verify
-flush     unix  n       -       n       1000?   0       flush
-proxymap  unix  -       -       n       -       -       proxymap
-proxywrite unix -       -       n       -       1       proxymap
-smtp      unix  -       -       n       -       -       smtp
-relay     unix  -       -       n       -       -       smtp
-showq     unix  n       -       n       -       -       showq
-error     unix  -       -       n       -       -       error
-retry     unix  -       -       n       -       -       error
-discard   unix  -       -       n       -       -       discard
-local     unix  -       n       n       -       -       local
-virtual   unix  -       n       n       -       -       virtual
-lmtp      unix  -       -       n       -       -       lmtp
-anvil     unix  -       -       n       -       1       anvil
-scache    unix  -       -       n       -       1       scache
-postlog   unix-dgram n  -       n       -       1       postlogd

apps/base/mailgateway/resources/postfix/transport

@@ -1,2 +0,0 @@
-.unkin.net        smtp:[stalwart.stalwart.svc.cluster.local]:25
-unkin.net         smtp:[stalwart.stalwart.svc.cluster.local]:25

apps/base/mailgateway/resources/rspamd/local.d/dkim_signing.conf

@@ -1,13 +0,0 @@
-enabled = true;
-selector = "mail";
-
-domain {
-    main.unkin.net {
-        privkey = "/etc/rspamd/dkim/private_key";
-        selector = "mail";
-    }
-    unkin.net {
-        privkey = "/etc/rspamd/dkim/private_key";
-        selector = "mail";
-    }
-}

apps/base/mailgateway/resources/rspamd/local.d/milter_headers.conf

@@ -1,2 +0,0 @@
-extended_spam_headers = true;
-use = ["x-spam-status", "x-spam-score", "authentication-results"];

apps/base/mailgateway/resources/rspamd/local.d/worker-proxy.inc

@@ -1,7 +0,0 @@
-milter = yes;
-bind_socket = "*:11332";
-
-upstream "local" {
-    default = yes;
-    self_scan = yes;
-}

apps/base/mailgateway/rspamd-deployment.yaml

@@ -1,75 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  selector:
-    matchLabels:
-      app: rspamd
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: rspamd
-    spec:
-      securityContext:
-        runAsUser: 11333
-        runAsGroup: 11333
-        fsGroup: 11333
-      containers:
-        - name: rspamd
-          image: rspamd/rspamd:4.0.1
-          ports:
-            - containerPort: 11332
-              name: milter
-              protocol: TCP
-            - containerPort: 11333
-              name: worker
-              protocol: TCP
-            - containerPort: 11334
-              name: controller
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 11334
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 11334
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: rspamd-config
-              mountPath: /etc/rspamd/local.d
-              readOnly: true
-            - name: dkim-keys
-              mountPath: /etc/rspamd/dkim
-              readOnly: true
-            - name: rspamd-data
-              mountPath: /var/lib/rspamd
-      volumes:
-        - name: rspamd-config
-          configMap:
-            name: rspamd-config
-        - name: dkim-keys
-          secret:
-            secretName: dkim-keys
-        - name: rspamd-data
-          emptyDir: {}

apps/base/mailgateway/rspamd-hpa.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: rspamd-hpa
-  namespace: mailgateway
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: rspamd
-  minReplicas: 2
-  maxReplicas: 6
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 30
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60

apps/base/mailgateway/services.yaml

@@ -1,64 +0,0 @@
----
-# Internal service for rspamd - used by postfix pods in the same namespace
-apiVersion: v1
-kind: Service
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  selector:
-    app: rspamd
-  ports:
-    - name: milter
-      port: 11332
-      targetPort: 11332
-      protocol: TCP
-    - name: worker
-      port: 11333
-      targetPort: 11333
-      protocol: TCP
-    - name: controller
-      port: 11334
-      targetPort: 11334
-      protocol: TCP
----
-# Internal ClusterIP for postfix - used by stalwart for outbound relay
-apiVersion: v1
-kind: Service
-metadata:
-  name: postfix
-  namespace: mailgateway
-spec:
-  selector:
-    app: postfix
-  ports:
-    - name: smtp
-      port: 25
-      targetPort: 25
-      protocol: TCP
-    - name: submission
-      port: 587
-      targetPort: 587
-      protocol: TCP
----
-# External LoadBalancer for inbound MX (internet → postfix)
-apiVersion: v1
-kind: Service
-metadata:
-  name: postfix-external
-  namespace: mailgateway
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: smtp-in.main.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.199.1
-    purelb.io/service-group: dmz
-    purelb.io/addresses: 198.18.199.1
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: postfix
-  ports:
-    - name: smtp
-      port: 25
-      targetPort: 25
-      protocol: TCP

apps/base/mailgateway/vaultstaticsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: dkim-keys
-  namespace: mailgateway
-spec:
-  destination:
-    create: true
-    name: dkim-keys
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/mailgateway/default/dkim-keys
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/paperclip/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: paperclip
-  namespace: paperclip
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: paperclip.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: paperclip.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: paperclip-tls
-        mode: Terminate

apps/base/paperclip/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: paperclip-http-redirect
-  namespace: paperclip
-spec:
-  hostnames:
-    - paperclip.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: paperclip
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  hostnames:
-    - paperclip.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: paperclip
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: paperclip
-          port: 3100
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/paperclip/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: paperclip
+  namespace: paperclip
+spec:
+  rules:
+    - host: paperclip.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: paperclip
+                port:
+                  number: 3100
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - paperclip.k8s.syd1.au.unkin.net
+      secretName: paperclip-tls

apps/base/paperclip/kustomization.yaml

@@ -6,8 +6,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - deployment.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml
   - namespace.yaml
   - services.yaml
   - vaultauth.yaml

apps/base/puppet/gateway_puppetboard.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  labels:
-    traefik.io/instance: internal
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: puppetboard.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: puppetboard.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: puppetboard-tls
-        mode: Terminate

apps/base/puppet/gateway_puppetdb.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  labels:
-    traefik.io/instance: internal
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: puppetdb.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: puppetdb-tls
-        mode: Terminate

apps/base/puppet/httproute_puppetboard.yaml

@@ -1,52 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard-http-redirect
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetboard.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetboard
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetboard.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetboard
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: puppetboard
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/puppet/httproute_puppetdb.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetdb.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetdb
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: puppetdb
-          port: 8080
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/puppet/ingress_puppetboard.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetboard.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetboard
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - puppetboard.k8s.syd1.au.unkin.net
+      secretName: puppetboard-tls

apps/base/puppet/ingress_puppetdb.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetdb.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetdb
+                port:
+                  number: 8080
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - puppetdb.k8s.syd1.au.unkin.net
+      secretName: puppetdb-tls

apps/base/puppet/kustomization.yaml

@@ -25,10 +25,8 @@ resources:
   - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - gateway_puppetboard.yaml
+  - ingress_puppetboard.yaml
-  - httproute_puppetboard.yaml
+  - ingress_puppetdb.yaml
-  - gateway_puppetdb.yaml
-  - httproute_puppetdb.yaml
   - service_puppetserver-agents-to-puppet.yaml
   - service_puppet-headless.yaml
   - service_puppet.yaml

apps/base/traefik-system/gatewayclass-external.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: traefik-external
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/gatewayclass-internal.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: internal
-  name: traefik-internal
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gatewayclass-internal.yaml
-  - gatewayclass-external.yaml

apps/base/traefik-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik-system

apps/base/vault/gateway.yaml

@@ -1,52 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: vault
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    cert-manager.io/alt-names: vault.service.consul,vault.query.consul
-    external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: vault.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: vault.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: vault-tls
-    - name: vault-direct
-      port: 8200
-      protocol: HTTPS
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: vault-tls

apps/base/vault/httproute.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault-http-redirect
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-spec:
-  hostnames:
-    - vault.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: vault
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-spec:
-  hostnames:
-    - vault.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: vault
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: vault
-          port: 8200
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault-consul
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-spec:
-  hostnames:
-    - vault.service.consul
-    - vault.query.consul
-  parentRefs:
-    - name: vault
-      sectionName: vault-direct
-  rules:
-    - backendRefs:
-        - name: vault
-          port: 8200
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/vault/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/woodpecker/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - namespace.yaml
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
-  - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_vault.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-vault
-  namespace: woodpecker

apps/overlays/au-syd1/argocd-image-updater/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/argocd-image-updater
+
+helmCharts:
+  - name: argocd-image-updater
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.10.3"
+    releaseName: argocd-image-updater
+    namespace: argocd-image-updater
+    valuesFile: values.yaml

apps/overlays/au-syd1/argocd-image-updater/values.yaml

@@ -0,0 +1,33 @@
+config:
+  argocd:
+    grpcWeb: false
+    serverAddress: argocd-server.argocd
+    insecure: true
+    plaintext: false
+
+  registries:
+    - name: git.unkin.net
+      api_url: https://git.unkin.net
+      prefix: git.unkin.net
+      credentials: secret:argocd-image-updater/registry-creds#creds
+      insecure: false
+
+authScripts:
+  enabled: false
+
+extraEnv:
+  - name: ARGOCD_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: argocd-token
+        key: token
+
+gitCommitUser: "ArgoCD Image Updater"
+gitCommitEmail: "argocd-image-updater@unkin.net"
+
+rbac:
+  enabled: true
+
+serviceAccount:
+  create: true
+  name: argocd-image-updater

apps/overlays/au-syd1/cert-manager/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: cert-manager
     repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "v1.20.2"
+    version: "v1.19.2"
     releaseName: cert-manager
     namespace: cert-manager
     valuesFile: values.yaml

apps/overlays/au-syd1/cert-manager/values.yaml

@@ -1,11 +1,6 @@
 crds:
   enabled: true
 
-config:
-  apiVersion: controller.config.cert-manager.io/v1alpha1
-  kind: ControllerConfiguration
-  enableGatewayAPI: true
-
 replicaCount: 2
 
 resources:

apps/overlays/au-syd1/consul/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/consul
-
-helmCharts:
-  - name: consul
-    repo: https://helm.releases.hashicorp.com
-    version: "1.9.7"
-    releaseName: consul
-    namespace: consul
-    valuesFile: values.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/consul/values.yaml

@@ -1,58 +0,0 @@
-global:
-  name: consul
-  datacenter: au-syd1
-  domain: consul
-
-server:
-  image: hashicorp/consul:1.22.7
-  replicas: 5
-  bootstrapExpect: 5
-  storage: 10Gi
-  storageClass: cephrbd-fast-delete
-
-  connect: true
-
-  disruptionBudget:
-    maxUnavailable: 1
-
-  extraConfig: |
-    {
-      "disable_remote_exec": true,
-      "disable_update_check": true,
-      "performance": {
-        "raft_multiplier": 10
-      },
-      "ports": {
-        "dns": 8600,
-        "grpc": 8502,
-        "http": 8500,
-        "https": -1
-      },
-      "primary_datacenter": "au-syd1"
-    }
-
-  resources:
-    requests:
-      memory: 256Mi
-      cpu: 100m
-    limits:
-      memory: 2Gi
-      cpu: 1000m
-
-client:
-  enabled: false
-
-ui:
-  enabled: true
-  service:
-    type: ClusterIP
-
-connectInject:
-  enabled: false
-
-dns:
-  enabled: true
-  type: LoadBalancer
-  annotations: |
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.5

apps/overlays/au-syd1/externaldns/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: external-dns
     repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.21.1"
+    version: "1.19.0"
     releaseName: externaldns
     namespace: externaldns
     valuesFile: values.yaml

apps/overlays/au-syd1/externaldns/values.yaml

@@ -24,8 +24,6 @@ policy: "sync"
 sources:
   - service
   - ingress
-  - gateway-httproute
-  - gateway-grpcroute
 
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -51,5 +49,3 @@ extraArgs:
   - --rfc2136-tsig-axfr
   - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
   - --ingress-class=nginx
-
-logLevel: debug

apps/overlays/au-syd1/mailgateway/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/mailgateway

apps/overlays/au-syd1/traefik-system/kustomization.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/traefik-system
-
-helmCharts:
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-internal
-    namespace: traefik-system
-    valuesFile: values-internal.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-external
-    namespace: traefik-system
-    valuesFile: values-external.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/traefik-system/values-external.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=external"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "dmz"
-    purelb.io/addresses: 198.18.199.0
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.199.0"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -1,100 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=internal"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.4
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.200.4"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-  vault-direct:
-    port: 8200
-
-enabled: true

apps/overlays/au-syd1/vault/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/vault
-
-helmCharts:
-  - name: vault
-    repo: https://helm.releases.hashicorp.com
-    version: "0.32.0"
-    releaseName: vault
-    namespace: vault
-    valuesFile: values.yaml

apps/overlays/au-syd1/vault/values.yaml

@@ -1,73 +0,0 @@
-server:
-  image:
-    repository: hashicorp/vault
-    tag: "2.0.1"
-
-  ha:
-    enabled: true
-    replicas: 5
-
-    raft:
-      enabled: true
-      setNodeId: true
-      config: |
-        ui            = true
-        disable_mlock = true
-
-        listener "tcp" {
-          address         = "[::]:8200"
-          cluster_address = "[::]:8201"
-          tls_disable     = "true"
-        }
-
-        storage "raft" {
-          path = "/vault/data"
-
-          retry_join {
-            leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
-          }
-        }
-
-        service_registration "consul" {
-          address = "consul-server.consul.svc.cluster.local:8500"
-        }
-
-  dataStorage:
-    enabled: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-    accessMode: ReadWriteOnce
-
-  statefulSet:
-    securityContext:
-      container:
-        capabilities:
-          add:
-            - IPC_LOCK
-
-  resources:
-    requests:
-      memory: 256Mi
-      cpu: 100m
-    limits:
-      memory: 2Gi
-      cpu: 1000m
-
-injector:
-  enabled: false
-
-ui:
-  enabled: true
-  serviceType: ClusterIP

apps/overlays/au-syd1/woodpecker/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: woodpecker
     repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.6.3"
+    version: "3.5.1"
     releaseName: woodpecker
     namespace: woodpecker
     valuesFile: values.yaml

argocd/applicationsets/imageupdater.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: image-updater-apps
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://git.unkin.net/unkin/argocd-apps
+      revision: HEAD
+      directories:
+      - path: apps/overlays/*/artifactapi
+  template:
+    metadata:
+      name: 'platform-{{path[3]}}'
+      annotations:
+        argocd-image-updater.argoproj.io/image-list: "artifactapi=git.unkin.net/unkin/artifactapi"
+        argocd-image-updater.argoproj.io/artifactapi.update-strategy: semver
+        argocd-image-updater.argoproj.io/write-back-method: git
+        argocd-image-updater.argoproj.io/git-branch: main
+    spec:
+      project: platform
+      source:
+        repoURL: https://git.unkin.net/unkin/argocd-apps
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path[3]}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - ServerSideApply=true

argocd/applicationsets/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 
 resources:
   - aitooling.yaml
+  - imageupdater.yaml
   - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/applicationsets/platform.yaml

@@ -10,26 +10,22 @@ spec:
       repoURL: https://git.unkin.net/unkin/argocd-apps
       revision: HEAD
       directories:
-      - path: apps/overlays/*/artifactapi
+      - path: apps/overlays/*/argocd-image-updater
       - path: apps/overlays/*/cattle-system
       - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/certificates
       - path: apps/overlays/*/cnpg-system
-      - path: apps/overlays/*/consul
       - path: apps/overlays/*/elastic-system
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/mailgateway
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
-      - path: apps/overlays/*/vault
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker
   template:

argocd/projects/platform.yaml

@@ -21,8 +21,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'certificates'
       server: https://kubernetes.default.svc
-    - namespace: 'consul'
-      server: https://kubernetes.default.svc
     - namespace: 'externaldns'
       server: https://kubernetes.default.svc
     - namespace: 'jfrog'
@@ -35,8 +33,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'reposync'
       server: https://kubernetes.default.svc
-    - namespace: 'vault'
-      server: https://kubernetes.default.svc
     - namespace: 'woodpecker'
       server: https://kubernetes.default.svc
   clusterResourceWhitelist:
@@ -64,10 +60,6 @@ spec:
       kind: Certificate
     - group: 'cert-manager.io'
       kind: Issuer
-    - group: 'gateway.networking.k8s.io'
-      kind: GatewayClass
-    - group: 'networking.k8s.io'
-      kind: IngressClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'