fix: use chart logLevel value instead of duplicate extraArg

apps/base/artifactapi/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: artifactapi
-  namespace: artifactapi
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: artifactapi.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: artifactapi.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: artifactapi-tls
-        mode: Terminate

apps/base/artifactapi/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: artifactapi-http-redirect
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: artifactapi
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: artifactapi
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: artifactapi
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: artifactapi-api
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/artifactapi/ingress.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    nginx.ingress.kubernetes.io/proxy-body-size: 10g
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+  name: artifactapi-ingress
+  namespace: artifactapi
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: artifactapi.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: artifactapi-api
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - artifactapi.k8s.syd1.au.unkin.net
+      secretName: artifactapi-tls

apps/base/artifactapi/kustomization.yaml

@@ -6,8 +6,7 @@ resources:
   - artifactapi-deployment.yaml
   - artifactapi-hpa.yaml
   - configmap.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml
   - namespace.yaml
   - postgres-deployment.yaml
   - pvc.yaml

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,7 +6,6 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
-      - "^kanidm/"
       - "^openvoxproject/"
       - "^stakater/reloader"
       - "^voxpupuli/puppetboard"
@@ -31,8 +30,7 @@ remotes:
       - "^bitnami/"
       - "^curlimages/curl"
       - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/consul"
+      - "^hashicorp/vault-secrets-operator"
-      - "^hashicorp/vault"
       - "^jfrog/"
       - "^rancher/"
       - "^traefik/"

apps/base/cattle-system/gateway.yaml

@@ -15,13 +15,6 @@ metadata:
 spec:
   gatewayClassName: traefik-internal
   listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
@@ -31,7 +24,6 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - group: ""
+          - kind: Secret
-            kind: Secret
             name: rancher-tls
         mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -1,28 +1,6 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
-metadata:
-  name: rancher-http-redirect
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
 metadata:
   name: rancher
   namespace: cattle-system

apps/base/consul/gateway.yaml

@@ -1,53 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: consul
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    cert-manager.io/alt-names: consul.service.consul
-    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: consul.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: consul.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: consul-tls
-    - name: consul-svc
-      port: 443
-      protocol: HTTPS
-      hostname: consul.service.consul
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: consul-tls

apps/base/consul/httproute.yaml

@@ -1,71 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul-http-redirect
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: consul
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: consul
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: consul-ui
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul-svc
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.service.consul
-  parentRefs:
-    - name: consul
-      sectionName: consul-svc
-  rules:
-    - backendRefs:
-        - name: consul-ui
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/consul/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/consul/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: consul

apps/base/litellm/cnpg_cluster.yaml

@@ -76,11 +76,11 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: 1
+      cpu: 500m
-      memory: 1024Mi
+      memory: 512Mi
     requests:
       cpu: 250m
-      memory: 512Mi
+      memory: 256Mi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800

apps/base/litellm/deployment.yaml

@@ -56,10 +56,10 @@ spec:
           resources:
             limits:
               cpu: "2"
-              memory: 8Gi
+              memory: 6Gi
             requests:
               cpu: 250m
-              memory: 6Gi
+              memory: 2Gi
           volumeMounts:
             - mountPath: /app/config.yaml
               name: config

apps/base/litellm/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: litellm
-  namespace: litellm
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: litellm.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: litellm.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: litellm-tls
-        mode: Terminate

apps/base/litellm/hpa.yaml

@@ -10,14 +10,14 @@ spec:
     kind: Deployment
     name: litellm
   minReplicas: 2
-  maxReplicas: 4
+  maxReplicas: 10
   metrics:
     - type: Resource
       resource:
         name: cpu
         target:
           type: Utilization
-          averageUtilization: 80
+          averageUtilization: 60
   behavior:
     scaleUp:
       stabilizationWindowSeconds: 0
@@ -25,7 +25,7 @@ spec:
       policies:
         - type: Percent
           value: 100
-          periodSeconds: 60
+          periodSeconds: 30
         - type: Pods
           value: 4
           periodSeconds: 30
@@ -34,7 +34,7 @@ spec:
       selectPolicy: Min
       policies:
         - type: Percent
-          value: 30
+          value: 10
           periodSeconds: 60
         - type: Pods
           value: 2

apps/base/litellm/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: litellm-http-redirect
-  namespace: litellm
-spec:
-  hostnames:
-    - litellm.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: litellm
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  hostnames:
-    - litellm.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: litellm
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: litellm
-          port: 4000
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/litellm/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: litellm
+  namespace: litellm
+spec:
+  rules:
+    - host: litellm.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: litellm
+                port:
+                  number: 4000
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - litellm.k8s.syd1.au.unkin.net
+      secretName: litellm-tls

apps/base/litellm/kustomization.yaml

@@ -7,8 +7,7 @@ resources:
   - cnpg_pooler.yaml
   - deployment.yaml
   - hpa.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml
   - namespace.yaml
   - redis-deployment.yaml
   - redis-pvc.yaml

apps/base/paperclip/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: paperclip
-  namespace: paperclip
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: paperclip.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: paperclip.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: paperclip-tls
-        mode: Terminate

apps/base/paperclip/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: paperclip-http-redirect
-  namespace: paperclip
-spec:
-  hostnames:
-    - paperclip.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: paperclip
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  hostnames:
-    - paperclip.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: paperclip
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: paperclip
-          port: 3100
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/paperclip/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: paperclip
+  namespace: paperclip
+spec:
+  rules:
+    - host: paperclip.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: paperclip
+                port:
+                  number: 3100
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - paperclip.k8s.syd1.au.unkin.net
+      secretName: paperclip-tls

apps/base/paperclip/kustomization.yaml

@@ -6,8 +6,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - deployment.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml
   - namespace.yaml
   - services.yaml
   - vaultauth.yaml

apps/base/puppet/gateway_puppetboard.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  labels:
-    traefik.io/instance: internal
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: puppetboard.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: puppetboard.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: puppetboard-tls
-        mode: Terminate

apps/base/puppet/gateway_puppetdb.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  labels:
-    traefik.io/instance: internal
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: puppetdb.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: puppetdb-tls
-        mode: Terminate

apps/base/puppet/httproute_puppetboard.yaml

@@ -1,52 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard-http-redirect
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetboard.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetboard
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetboard.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetboard
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: puppetboard
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/puppet/httproute_puppetdb.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetdb.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetdb
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: puppetdb
-          port: 8080
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/puppet/ingress_puppetboard.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetboard.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetboard
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - puppetboard.k8s.syd1.au.unkin.net
+      secretName: puppetboard-tls

apps/base/puppet/ingress_puppetdb.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetdb.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetdb
+                port:
+                  number: 8080
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - puppetdb.k8s.syd1.au.unkin.net
+      secretName: puppetdb-tls

apps/base/puppet/kustomization.yaml

@@ -25,10 +25,8 @@ resources:
   - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - gateway_puppetboard.yaml
+  - ingress_puppetboard.yaml
-  - httproute_puppetboard.yaml
+  - ingress_puppetdb.yaml
-  - gateway_puppetdb.yaml
-  - httproute_puppetdb.yaml
   - service_puppetserver-agents-to-puppet.yaml
   - service_puppet-headless.yaml
   - service_puppet.yaml

apps/base/stalwart/certificate.yaml

@@ -1,36 +0,0 @@
----
-# TLS cert for stalwart's own HTTPS/IMAPS/STARTTLS listeners (mail.main.unkin.net)
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: stalwart-tls
-  namespace: stalwart
-spec:
-  secretName: stalwart-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: mail.main.unkin.net
-  dnsNames:
-    - mail.main.unkin.net
-  privateKey:
-    size: 4096
-    algorithm: RSA
----
-# TLS cert for Traefik Gateway (internal k8s admin URL)
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: stalwart-gateway-tls
-  namespace: stalwart
-spec:
-  secretName: stalwart-gateway-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: mail.k8s.syd1.au.unkin.net
-  dnsNames:
-    - mail.k8s.syd1.au.unkin.net
-  privateKey:
-    size: 4096
-    algorithm: RSA

apps/base/stalwart/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: stalwart-postgres
-  namespace: stalwart
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: stalwart
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: stalwart
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: "2"
-      memory: 2Gi
-    requests:
-      cpu: 500m
-      memory: 1Gi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 20Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/stalwart/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: stalwart-postgres-pooler
-  namespace: stalwart
-spec:
-  cluster:
-    name: stalwart-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "50"
-      max_client_conn: "200"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/stalwart/gateway.yaml

@@ -1,38 +0,0 @@
----
-# Traefik gateway for stalwart web admin UI (separate from the LoadBalancer HTTPS port)
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: mail.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: mail.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: stalwart
-  namespace: stalwart
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: mail.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: mail.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: stalwart-gateway-tls
-        mode: Terminate

apps/base/stalwart/httproute.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: stalwart
-  namespace: stalwart
-spec:
-  parentRefs:
-    - name: stalwart
-      namespace: stalwart
-  hostnames:
-    - mail.k8s.syd1.au.unkin.net
-  rules:
-    - backendRefs:
-        - name: stalwart
-          port: 8080

apps/base/stalwart/kustomization.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - certificate.yaml
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - services.yaml
-  - stalwart-deployment.yaml
-  - stalwart-hpa.yaml
-  - valkey.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: stalwart-config
-    files:
-      - config.toml=resources/config.toml
-    options:
-      disableNameSuffixHash: true

apps/base/stalwart/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: stalwart

apps/base/stalwart/resources/config.toml

@@ -1,228 +0,0 @@
-[server]
-hostname = "mail.main.unkin.net"
-greeting = "Stalwart ESMTP"
-
-# SMTP relay listener (receives from postfix for local delivery)
-[server.listener."smtp-relay"]
-bind = ["0.0.0.0:25"]
-protocol = "smtp"
-greeting = "Stalwart SMTP Relay"
-
-[server.listener."smtp-relay".proxy]
-trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
-
-# SMTP submission listener (user-facing, TLS required)
-[server.listener."submission"]
-bind = ["0.0.0.0:587"]
-protocol = "smtp"
-greeting = "Stalwart SMTP Submission"
-tls.require = true
-
-[server.listener."submission".proxy]
-trusted-networks = ["127.0.0.0/8", "::1"]
-
-# IMAP listener
-[server.listener."imap"]
-bind = ["0.0.0.0:143"]
-protocol = "imap"
-
-[server.listener."imap".proxy]
-trusted-networks = ["127.0.0.0/8", "::1"]
-
-# IMAPS listener (implicit TLS)
-[server.listener."imaps"]
-bind = ["0.0.0.0:993"]
-protocol = "imap"
-tls.implicit = true
-
-[server.listener."imaps".proxy]
-trusted-networks = ["127.0.0.0/8", "::1"]
-
-# HTTPS (web admin + JMAP) for external LoadBalancer
-[server.listener."https"]
-bind = ["0.0.0.0:443"]
-protocol = "http"
-tls.implicit = true
-
-[server.listener."https".proxy]
-trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
-
-# Plain HTTP for Traefik reverse proxy (TLS terminated at Traefik)
-[server.listener."http-internal"]
-bind = ["0.0.0.0:8080"]
-protocol = "http"
-
-[server.listener."http-internal".proxy]
-trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
-
-[server.tls]
-enable = true
-implicit = false
-certificate = "default"
-
-[server.http]
-use-x-forwarded = true
-permissive-cors = false
-
-[webadmin]
-path = "/var/lib/stalwart/webadmin"
-auto-update = true
-resource = "https://artifactapi.k8s.syd1.au.unkin.net/generic/github/stalwartlabs/webadmin/releases/latest/download/webadmin.zip"
-
-# PostgreSQL store (via CNPG pooler)
-[store."postgresql"]
-type = "postgresql"
-host = "stalwart-postgres-pooler.stalwart.svc.cluster.local"
-port = 5432
-database = "stalwart"
-user = "stalwart"
-password = "%{env:POSTGRES_PASSWORD}%"
-timeout = "15s"
-
-[store."postgresql".tls]
-enable = true
-allow-invalid-certs = false
-
-[store."postgresql".pool]
-max-connections = 10
-
-[store."postgresql".purge]
-frequency = "0 3 *"
-
-# S3/Ceph-RGW store for blobs
-[store."s3"]
-type = "s3"
-bucket = "stalwart-maildata"
-region = "syd1"
-access-key = "%{env:S3_ACCESS_KEY}%"
-secret-key = "%{env:S3_SECRET_KEY}%"
-endpoint = "https://radosgw.service.consul"
-timeout = "30s"
-key-prefix = "stalwart/"
-compression = "lz4"
-
-[store."s3".purge]
-frequency = "30 5 *"
-
-# Valkey in-memory store (rate limiting, locks, OAuth codes, greylisting)
-[store."valkey"]
-type = "redis"
-urls = ["redis://stalwart-valkey.stalwart.svc.cluster.local:6379"]
-
-# Storage assignment
-[storage]
-data = "postgresql"
-fts = "postgresql"
-blob = "s3"
-lookup = "postgresql"
-directory = "internal"
-in-memory = "valkey"
-
-# Directory configuration
-[directory.internal]
-type = "internal"
-store = "postgresql"
-
-# Fallback admin (password hash from Vault)
-[authentication.fallback-admin]
-user = "admin"
-secret = "%{env:ADMIN_PASSWORD_HASH}%"
-
-[authentication]
-[authentication.directory]
-directories = ["internal"]
-
-[authorization]
-directory = "internal"
-
-# JMAP configuration
-[jmap]
-directory = "internal"
-
-[jmap.protocol]
-request-max-size = 10485760
-get.max-objects = 500
-query.max-results = 5000
-changes.max-results = 5000
-upload.max-size = 50000000
-upload.ttl = "1h"
-
-# IMAP configuration
-[imap]
-directory = "internal"
-
-[imap.protocol]
-max-requests = 64
-
-# Inbound rate limiting
-[[queue.limiter.inbound]]
-key = ["remote_ip"]
-rate = "500/1s"
-enable = true
-
-# Outbound routing through postfix relay
-[queue]
-path = "/var/lib/stalwart/queue"
-
-[queue.schedule]
-retry = ["2s", "5s", "1m", "5m", "15m", "30m", "1h", "2h"]
-notify = ["1d", "3d"]
-expire = "5d"
-
-[session.extensions]
-future-release = "7d"
-
-# Route local domain mail locally, everything else through postfix relay
-[queue.strategy]
-route = [
-    { if = "is_local_domain('', rcpt_domain)", then = "'local'" },
-    { else = "'relay'" }
-]
-
-[queue.route."local"]
-type = "local"
-
-[queue.route."relay"]
-type = "relay"
-address = "postfix.mailgateway.svc.cluster.local"
-port = 25
-protocol = "smtp"
-
-[queue.route."relay".tls]
-implicit = false
-allow-invalid-certs = false
-
-# Session configuration
-[session.ehlo]
-reject-non-fqdn = false
-
-[session.rcpt]
-type = "internal"
-store = "postgresql"
-max-recipients = 25
-
-[session.data]
-max-messages = 10
-max-message-size = 52428800
-
-# Spam filtering offloaded to postfix/rspamd — disable internal spam filter
-[spam-filter]
-enable = false
-
-# TLS certificate (cert-manager issues to /etc/stalwart/tls/)
-[certificate."default"]
-cert = "%{file:/etc/stalwart/tls/tls.crt}%"
-private-key = "%{file:/etc/stalwart/tls/tls.key}%"
-default = true
-
-# Logging
-[tracer]
-type = "log"
-level = "info"
-ansi = false
-multiline = true
-
-# Metrics
-[metrics]
-prometheus.enable = true
-prometheus.port = 9090

apps/base/stalwart/services.yaml

@@ -1,57 +0,0 @@
----
-# Internal service - postfix connects here to deliver inbound mail
-apiVersion: v1
-kind: Service
-metadata:
-  name: stalwart
-  namespace: stalwart
-spec:
-  selector:
-    app: stalwart
-  ports:
-    - name: smtp-relay
-      port: 25
-      targetPort: 25
-      protocol: TCP
-    - name: http-internal
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-    - name: metrics
-      port: 9090
-      targetPort: 9090
-      protocol: TCP
----
-# External LoadBalancer for user-facing mail services
-apiVersion: v1
-kind: Service
-metadata:
-  name: stalwart-external
-  namespace: stalwart
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: mail.main.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.199.2
-    purelb.io/service-group: dmz
-    purelb.io/addresses: 198.18.199.2
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: stalwart
-  ports:
-    - name: submission
-      port: 587
-      targetPort: 587
-      protocol: TCP
-    - name: imap
-      port: 143
-      targetPort: 143
-      protocol: TCP
-    - name: imaps
-      port: 993
-      targetPort: 993
-      protocol: TCP
-    - name: https
-      port: 443
-      targetPort: 443
-      protocol: TCP

apps/base/stalwart/stalwart-deployment.yaml

@@ -1,109 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: stalwart
-  namespace: stalwart
-spec:
-  selector:
-    matchLabels:
-      app: stalwart
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: stalwart
-    spec:
-      securityContext:
-        runAsUser: 2000
-        runAsGroup: 2000
-        fsGroup: 2000
-      containers:
-        - name: stalwart
-          image: ghcr.io/stalwartlabs/stalwart:v0.16.6
-          ports:
-            - containerPort: 25
-              name: smtp-relay
-              protocol: TCP
-            - containerPort: 587
-              name: submission
-              protocol: TCP
-            - containerPort: 143
-              name: imap
-              protocol: TCP
-            - containerPort: 993
-              name: imaps
-              protocol: TCP
-            - containerPort: 443
-              name: https
-              protocol: TCP
-            - containerPort: 8080
-              name: http-internal
-              protocol: TCP
-            - containerPort: 9090
-              name: metrics
-              protocol: TCP
-          env:
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-credentials
-                  key: password
-            - name: S3_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: s3-credentials
-                  key: access_key
-            - name: S3_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: s3-credentials
-                  key: secret_key
-            - name: ADMIN_PASSWORD_HASH
-              valueFrom:
-                secretKeyRef:
-                  name: stalwart-admin
-                  key: password_hash
-          livenessProbe:
-            httpGet:
-              path: /healthz/live
-              port: 8080
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /healthz/ready
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 250m
-              memory: 512Mi
-            limits:
-              cpu: "2"
-              memory: 2Gi
-          volumeMounts:
-            - name: config
-              mountPath: /etc/stalwart/config.toml
-              subPath: config.toml
-              readOnly: true
-            - name: tls
-              mountPath: /etc/stalwart/tls
-              readOnly: true
-            - name: data
-              mountPath: /var/lib/stalwart
-      volumes:
-        - name: config
-          configMap:
-            name: stalwart-config
-        - name: tls
-          secret:
-            secretName: stalwart-tls
-        - name: data
-          emptyDir: {}

apps/base/stalwart/stalwart-hpa.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: stalwart-hpa
-  namespace: stalwart
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: stalwart
-  minReplicas: 2
-  maxReplicas: 6
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 60
-        - type: Pods
-          value: 2
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60

apps/base/stalwart/valkey.yaml

@@ -1,58 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: stalwart-valkey
-  namespace: stalwart
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: stalwart-valkey
-  template:
-    metadata:
-      labels:
-        app: stalwart-valkey
-    spec:
-      containers:
-        - name: valkey
-          image: valkey/valkey:8-alpine
-          args:
-            - "--save"
-            - ""
-            - "--appendonly"
-            - "no"
-          ports:
-            - containerPort: 6379
-              name: valkey
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-          livenessProbe:
-            tcpSocket:
-              port: 6379
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 5
-            periodSeconds: 5
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: stalwart-valkey
-  namespace: stalwart
-spec:
-  selector:
-    app: stalwart-valkey
-  ports:
-    - port: 6379
-      targetPort: 6379
-      name: valkey

apps/base/stalwart/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: stalwart
-spec:
-  allowedNamespaces:
-    - stalwart
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/stalwart/vaultstaticsecret.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: stalwart
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/stalwart/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: s3-credentials
-  namespace: stalwart
-spec:
-  destination:
-    create: true
-    name: s3-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/stalwart/default/s3-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: stalwart-admin
-  namespace: stalwart
-spec:
-  destination:
-    create: true
-    name: stalwart-admin
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/stalwart/default/stalwart-admin
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/vault/gateway.yaml

@@ -1,52 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: vault
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    cert-manager.io/alt-names: vault.service.consul,vault.query.consul
-    external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: vault.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: vault.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: vault-tls
-    - name: vault-direct
-      port: 8200
-      protocol: HTTPS
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: vault-tls

apps/base/vault/httproute.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault-http-redirect
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-spec:
-  hostnames:
-    - vault.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: vault
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-spec:
-  hostnames:
-    - vault.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: vault
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: vault
-          port: 8200
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: vault-consul
-  namespace: vault
-  labels:
-    app.kubernetes.io/name: vault
-    app.kubernetes.io/instance: vault
-spec:
-  hostnames:
-    - vault.service.consul
-    - vault.query.consul
-  parentRefs:
-    - name: vault
-      sectionName: vault-direct
-  rules:
-    - backendRefs:
-        - name: vault
-          port: 8200
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/vault/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/vault/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: vault

apps/overlays/au-syd1/cert-manager/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: cert-manager
     repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "v1.20.2"
+    version: "v1.19.2"
     releaseName: cert-manager
     namespace: cert-manager
     valuesFile: values.yaml

apps/overlays/au-syd1/cert-manager/values.yaml

@@ -1,11 +1,6 @@
 crds:
   enabled: true
 
-config:
-  apiVersion: controller.config.cert-manager.io/v1alpha1
-  kind: ControllerConfiguration
-  enableGatewayAPI: true
-
 replicaCount: 2
 
 resources:

apps/overlays/au-syd1/consul/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/consul
-
-helmCharts:
-  - name: consul
-    repo: https://helm.releases.hashicorp.com
-    version: "1.9.7"
-    releaseName: consul
-    namespace: consul
-    valuesFile: values.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/consul/values.yaml

@@ -1,58 +0,0 @@
-global:
-  name: consul
-  datacenter: au-syd1
-  domain: consul
-
-server:
-  image: hashicorp/consul:1.22.7
-  replicas: 5
-  bootstrapExpect: 5
-  storage: 10Gi
-  storageClass: cephrbd-fast-delete
-
-  connect: true
-
-  disruptionBudget:
-    maxUnavailable: 1
-
-  extraConfig: |
-    {
-      "disable_remote_exec": true,
-      "disable_update_check": true,
-      "performance": {
-        "raft_multiplier": 10
-      },
-      "ports": {
-        "dns": 8600,
-        "grpc": 8502,
-        "http": 8500,
-        "https": -1
-      },
-      "primary_datacenter": "au-syd1"
-    }
-
-  resources:
-    requests:
-      memory: 256Mi
-      cpu: 100m
-    limits:
-      memory: 2Gi
-      cpu: 1000m
-
-client:
-  enabled: false
-
-ui:
-  enabled: true
-  service:
-    type: ClusterIP
-
-connectInject:
-  enabled: false
-
-dns:
-  enabled: true
-  type: LoadBalancer
-  annotations: |
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.5

apps/overlays/au-syd1/externaldns/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: external-dns
     repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.21.1"
+    version: "1.19.0"
     releaseName: externaldns
     namespace: externaldns
     valuesFile: values.yaml

apps/overlays/au-syd1/externaldns/values.yaml

@@ -25,7 +25,10 @@ sources:
   - service
   - ingress
   - gateway-httproute
+  - gateway-tlsroute
   - gateway-grpcroute
+  - gateway-tcproute
+  - gateway-udproute
 
 # Environment variables for TSIG secret and algorithm from Vault
 env:

apps/overlays/au-syd1/stalwart/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/stalwart

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -94,7 +94,5 @@ ports:
     port: 80
   websecure:
     port: 443
-  vault-direct:
-    port: 8200
 
 enabled: true

apps/overlays/au-syd1/vault/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/vault
-
-helmCharts:
-  - name: vault
-    repo: https://helm.releases.hashicorp.com
-    version: "0.32.0"
-    releaseName: vault
-    namespace: vault
-    valuesFile: values.yaml

apps/overlays/au-syd1/vault/values.yaml

@@ -1,73 +0,0 @@
-server:
-  image:
-    repository: hashicorp/vault
-    tag: "2.0.1"
-
-  ha:
-    enabled: true
-    replicas: 5
-
-    raft:
-      enabled: true
-      setNodeId: true
-      config: |
-        ui            = true
-        disable_mlock = true
-
-        listener "tcp" {
-          address         = "[::]:8200"
-          cluster_address = "[::]:8201"
-          tls_disable     = "true"
-        }
-
-        storage "raft" {
-          path = "/vault/data"
-
-          retry_join {
-            leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
-          }
-          retry_join {
-            leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
-          }
-        }
-
-        service_registration "consul" {
-          address = "consul-server.consul.svc.cluster.local:8500"
-        }
-
-  dataStorage:
-    enabled: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-    accessMode: ReadWriteOnce
-
-  statefulSet:
-    securityContext:
-      container:
-        capabilities:
-          add:
-            - IPC_LOCK
-
-  resources:
-    requests:
-      memory: 256Mi
-      cpu: 100m
-    limits:
-      memory: 2Gi
-      cpu: 1000m
-
-injector:
-  enabled: false
-
-ui:
-  enabled: true
-  serviceType: ClusterIP

apps/overlays/au-syd1/woodpecker/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: woodpecker
     repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.6.3"
+    version: "3.5.1"
     releaseName: woodpecker
     namespace: woodpecker
     valuesFile: values.yaml

argocd/applicationsets/platform.yaml

@@ -15,7 +15,6 @@ spec:
       - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/certificates
       - path: apps/overlays/*/cnpg-system
-      - path: apps/overlays/*/consul
       - path: apps/overlays/*/elastic-system
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
@@ -26,10 +25,8 @@ spec:
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/stalwart
       - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
-      - path: apps/overlays/*/vault
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker
   template:

argocd/projects/platform.yaml

@@ -21,8 +21,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'certificates'
       server: https://kubernetes.default.svc
-    - namespace: 'consul'
-      server: https://kubernetes.default.svc
     - namespace: 'externaldns'
       server: https://kubernetes.default.svc
     - namespace: 'jfrog'
@@ -35,8 +33,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'reposync'
       server: https://kubernetes.default.svc
-    - namespace: 'vault'
-      server: https://kubernetes.default.svc
     - namespace: 'woodpecker'
       server: https://kubernetes.default.svc
   clusterResourceWhitelist: