feat: add pre-commit workflow

- enforce pre-commit is run for all pull-requests
- fix end-of-line for existing files

.pre-commit-config.yaml

@@ -35,6 +35,16 @@ repos:
   # Kubernetes manifest validation
   - repo: local
     hooks:
+      - id: kubeconform_validate_apps
+        name: kubeconform validate apps
+        entry: ci/validate-apps.sh
+        language: system
+        pass_filenames: false
+      - id: kubeconform_validate_clusters
+        name: kubeconform validate clusters
+        entry: ci/validate-clusters.sh
+        language: system
+        pass_filenames: false
       - id: no_plain_secrets
         name: prevent plain kubernetes secrets
         entry: ci/validate-no-secrets.sh

.woodpecker/kubeconform.yaml

@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: kubeconform
-    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
-    commands:
-      - make kubeconform
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2

.woodpecker/pre-commit.yaml

@@ -3,16 +3,7 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-base:20260308
+    image: git.unkin.net/unkin/almalinux9-base:latest
     commands:
+      - dnf install uv kustomize kubeconform helm -y
       - uvx pre-commit run --all-files
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 250m
-          limits:
-            memory: 1Gi
-            cpu: 1

Makefile

@@ -6,11 +6,6 @@ build:
 	@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
 	@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
 
-# kubeconform
-kubeconform:
-	@ci/validate-apps.sh && \
-	ci/validate-clusters.sh
-
 # Clean all generated manifests
 clean:
 	@rm -rf manifests/

apps/base/artifactapi/artifactapi-deployment.yaml

@@ -1,92 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: artifactapi-deployment
-  namespace: artifactapi
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  selector:
-    matchLabels:
-      app: artifactapi
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    spec:
-      automountServiceAccountToken: true
-      containers:
-        - name: artifactapi
-          image: git.unkin.net/unkin/artifactapi:v2.7.2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8000
-              name: http
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: artifactapi-env
-                optional: false
-            - secretRef:
-                name: environment
-                optional: false
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "1"
-              memory: 4Gi
-            requests:
-              cpu: 100m
-              memory: 256Mi
-          volumeMounts:
-            - mountPath: /etc/artifactapi/conf.d/config.yaml
-              name: remotes-config
-              subPath: config.yaml
-            - mountPath: /etc/artifactapi/conf.d/local-generic.yaml
-              name: remotes-config
-              subPath: local-generic.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
-              name: remotes-config
-              subPath: remote-alpine.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
-              name: remotes-config
-              subPath: remote-docker.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
-              name: remotes-config
-              subPath: remote-generic.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
-              name: remotes-config
-              subPath: remote-helm.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
-              name: remotes-config
-              subPath: remote-rpm.yaml
-            - mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
-              name: remotes-config
-              subPath: virtual-helm.yaml
-      restartPolicy: Always
-      volumes:
-        - configMap:
-            name: remotes-config
-            optional: false
-          name: remotes-config

apps/base/artifactapi/artifactapi-hpa.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: artifactapi-hpa
-  namespace: artifactapi
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: artifactapi-deployment
-  minReplicas: 2
-  maxReplicas: 10
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 60
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 30
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 10
-          periodSeconds: 60
-        - type: Pods
-          value: 2
-          periodSeconds: 60

apps/base/artifactapi/configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: artifactapi-env
-  namespace: artifactapi
-data:
-  CONFIG_PATH: /etc/artifactapi/conf.d/
-  DBHOST: postgres-service
-  DBNAME: artifacts
-  DBPORT: "5432"
-  DBUSER: artifacts
-  MINIO_BUCKET: artifactapi
-  MINIO_ENDPOINT: radosgw.service.consul
-  MINIO_SECURE: "true"
-  REDIS_URL: redis://redis-service:6379
-  REQUESTS_CA_BUNDLE: /etc/pki/tls/certs/ca-bundle.crt
-  SSL_CERT_FILE: /etc/pki/tls/certs/ca-bundle.crt
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: postgres-env
-  namespace: artifactapi
-data:
-  POSTGRES_DB: artifacts
-  POSTGRES_USER: artifacts

apps/base/artifactapi/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: artifactapi
-  namespace: artifactapi
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: artifactapi.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: artifactapi.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: artifactapi-tls
-        mode: Terminate

apps/base/artifactapi/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: artifactapi-http-redirect
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: artifactapi
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: artifactapi
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: artifactapi
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: artifactapi-api
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/artifactapi/kustomization.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - artifactapi-deployment.yaml
-  - artifactapi-hpa.yaml
-  - configmap.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - postgres-deployment.yaml
-  - pvc.yaml
-  - redis-deployment.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: remotes-config
-    files:
-      - resources/conf.d/config.yaml
-      - resources/conf.d/local-generic.yaml
-      - resources/conf.d/remote-generic.yaml
-      - resources/conf.d/remote-alpine.yaml
-      - resources/conf.d/remote-rpm.yaml
-      - resources/conf.d/remote-docker.yaml
-      - resources/conf.d/remote-helm.yaml
-      - resources/conf.d/virtual-helm.yaml
-    options:
-      disableNameSuffixHash: true

apps/base/artifactapi/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: artifactapi

apps/base/artifactapi/postgres-deployment.yaml

@@ -1,76 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: postgres-deployment
-  namespace: artifactapi
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: postgres
-  strategy:
-    type: Recreate
-  template:
-    spec:
-      automountServiceAccountToken: true
-      containers:
-        - name: postgres
-          image: postgres:15-alpine
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 5432
-              name: postgres
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: postgres-env
-                optional: false
-            - secretRef:
-                name: postgres-password
-                optional: false
-          readinessProbe:
-            exec:
-              command:
-                - pg_isready
-                - -U
-                - artifacts
-                - -d
-                - artifacts
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          livenessProbe:
-            exec:
-              command:
-                - pg_isready
-                - -U
-                - artifacts
-                - -d
-                - artifacts
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /var/lib/postgresql/data
-              mountPropagation: None
-              name: pgdata
-              subPath: pgdata
-      restartPolicy: Always
-      volumes:
-        - name: pgdata
-          persistentVolumeClaim:
-            claimName: artifactapi-postgres-pgdata

apps/base/artifactapi/pvc.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: artifactapi-postgres-pgdata
-  namespace: artifactapi
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: artifactapi-redis-data
-  namespace: artifactapi
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/artifactapi/redis-deployment.yaml

@@ -1,66 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    deployment.kubernetes.io/revision: "1"
-  name: redis-deployment
-  namespace: artifactapi
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  strategy:
-    type: Recreate
-  template:
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
-          command:
-            - redis-server
-            - --save
-            - "20"
-            - "1"
-          ports:
-            - containerPort: 6379
-              name: redis
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              mountPropagation: None
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: artifactapi-redis-data

apps/base/artifactapi/resources/conf.d/config.yaml

@@ -1,3 +0,0 @@
-# Global artifactapi configuration.
-# S3, Redis, and database connection settings are injected via environment variables.
-# Add any top-level overrides here if needed.

apps/base/artifactapi/resources/conf.d/local-generic.yaml

@@ -1,7 +0,0 @@
-locals:
-  local-generic:
-    package: "generic"
-    description: "Local generic file repository"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 0

apps/base/artifactapi/resources/conf.d/remote-alpine.yaml

@@ -1,10 +0,0 @@
-remotes:
-  alpine:
-    base_url: "https://dl-cdn.alpinelinux.org"
-    package: "alpine"
-    description: "Alpine Linux APK package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.apk$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -1,98 +0,0 @@
-remotes:
-  ghcr:
-    base_url: "https://ghcr.io"
-    package: "docker"
-    description: "GitHub Container Registry"
-    immutable_patterns:
-      - "^cloudnative-pg/cloudnative-pg"
-      - "^emberstack/helm-charts"
-      - "^kanidm/"
-      - "^openvoxproject/"
-      - "^stakater/reloader"
-      - "^voxpupuli/puppetboard"
-      - "^woodpecker-ci/helm"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  dockerhub:
-    base_url: "https://registry-1.docker.io"
-    package: "docker"
-    description: "Docker Hub registry"
-    immutable_patterns:
-      - "^library/almalinux"
-      - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
-      - "^library/nginx"
-      - "^library/postgres"
-      - "^library/redis"
-      - "^beats/filebeat"
-      - "^bitnami/"
-      - "^curlimages/curl"
-      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/consul"
-      - "^hashicorp/vault"
-      - "^jfrog/"
-      - "^rancher/"
-      - "^traefik/"
-      - "^ubi9/ubi-minimal"
-      - "^victoriametrics/"
-      - "^woodpeckerci/"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  quay:
-    base_url: "https://quay.io"
-    package: "docker"
-    description: "Quay.io container registry"
-    immutable_patterns:
-      - "^brancz/kube-rbac-proxy"
-      - "^cephcsi/cephcsi"
-      - "^jetstack/cert-manager-"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  k8s-registry:
-    base_url: "https://registry.k8s.io"
-    package: "docker"
-    description: "Kubernetes container registry"
-    immutable_patterns:
-      - "^external-dns/external-dns"
-      - "^sig-storage/"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  gitlab:
-    base_url: "https://registry.gitlab.com"
-    package: "docker"
-    description: "GitLab container registry"
-    immutable_patterns:
-      - "^purelb/purelb"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  elastic:
-    base_url: "https://docker.elastic.co"
-    package: "docker"
-    description: "Elastic container registry"
-    immutable_patterns:
-      - "^eck/eck-operator"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  gcr:
-    base_url: "https://gcr.io"
-    package: "docker"
-    description: "Google Container Registry"
-    immutable_patterns:
-      - "^k8s-staging-nfd/charts"
-      - "^k8s-staging-nfd/node-feature-discovery"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -1,130 +0,0 @@
-remotes:
-  github:
-    base_url: "https://github.com"
-    package: "generic"
-    description: "GitHub releases and files"
-    mutable_patterns:
-      - ".*/archive/refs/heads/.*.tar.gz$"
-    immutable_patterns:
-      - ".*/archive/refs/tags/.*.tar.gz$"
-      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
-      - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
-      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
-      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
-      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
-      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
-      - "coder/code-server/.*/code-server-.*-amd64.rpm$"
-      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
-      - "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
-      - "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
-      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
-      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
-      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
-      - "hadolint/hadolint/.*/hadolint-linux-x86_64$"
-      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
-      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
-      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
-      - "lxc/incus/.*.tar.gz$"
-      - "mikefarah/yq/.*/yq_linux_amd64$"
-      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
-      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
-      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
-      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
-      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
-      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
-      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
-      - "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
-      - "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
-      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
-      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
-      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  github_user:
-    base_url: "https://raw.githubusercontent.com"
-    package: "generic"
-    description: "GitHub User Content"
-    immutable_patterns:
-      - "argoproj/argo-cd/.*.yaml$"
-      - "yannh/kubernetes-json-schema/master/.*.json$"
-      - "datreeio/CRDs-catalog/main/.*.json$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  gitea-dl:
-    base_url: "https://dl.gitea.com"
-    package: "generic"
-    description: "Gitea download site"
-    immutable_patterns:
-      - "act_runner/.*/act_runner-.*-linux-amd64$"
-      - "tea/.*/tea-.*-linux-amd64$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  hashicorp-releases:
-    base_url: "https://releases.hashicorp.com"
-    package: "generic"
-    description: "HashiCorp product releases"
-    immutable_patterns:
-      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
-      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
-      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
-      - "vault/.*vault_.*_linux_amd64\\.zip$"
-      - "vault/.*vault_.*_windows_amd64\\.zip$"
-      - "vault/.*vault_.*_darwin_amd64\\.zip$"
-      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
-      - "consul/.*/consul_.*_linux_amd64\\.zip$"
-      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
-      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
-      - "packer/.*/packer_.*_linux_amd64\\.zip$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  rarlab:
-    base_url: "https://www.rarlab.com"
-    package: "generic"
-    description: "RARLab"
-    immutable_patterns:
-      - "rar/rarlinux-x64-.*.tar.gz"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  claude-ai:
-    base_url: "https://downloads.claude.ai"
-    package: "generic"
-    description: "Anthropic Claude Code binary releases"
-    mutable_patterns:
-      - "claude-code-releases/.*/manifest.json$"
-    immutable_patterns:
-      - "claude-code-releases/.*/linux-x64/claude$"
-      - "claude-code-releases/.*/linux-arm64/claude$"
-      - "claude-code-releases/.*/linux-x64-musl/claude$"
-      - "claude-code-releases/.*/linux-arm64-musl/claude$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-helm.yaml

@@ -1,143 +0,0 @@
-remotes:
-  ceph-csi:
-    base_url: "https://ceph.github.io/csi-charts"
-    package: "helm"
-    description: "Ceph CSI driver Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  cnpg:
-    base_url: "https://cloudnative-pg.github.io/charts"
-    package: "helm"
-    description: "CloudNativePG operator Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  elastic-helm:
-    base_url: "https://helm.elastic.co"
-    package: "helm"
-    description: "Elastic stack Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  external-dns:
-    base_url: "https://kubernetes-sigs.github.io/external-dns/"
-    package: "helm"
-    description: "ExternalDNS Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  hashicorp-helm:
-    base_url: "https://helm.releases.hashicorp.com"
-    package: "helm"
-    description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  intel-helm:
-    base_url: "https://intel.github.io/helm-charts/"
-    package: "helm"
-    description: "Intel Helm charts (device plugins)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  jetstack:
-    base_url: "https://charts.jetstack.io"
-    package: "helm"
-    description: "Jetstack Helm charts (cert-manager)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  purelb:
-    base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
-    package: "helm"
-    description: "PureLB load balancer Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  rancher-stable:
-    base_url: "https://releases.rancher.com/server-charts/stable"
-    package: "helm"
-    description: "Rancher stable Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  stakater:
-    base_url: "https://stakater.github.io/stakater-charts"
-    package: "helm"
-    description: "Stakater Helm charts (Reloader)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  traefik:
-    base_url: "https://traefik.github.io/charts"
-    package: "helm"
-    description: "Traefik Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  victoriametrics:
-    base_url: "https://victoriametrics.github.io/helm-charts/"
-    package: "helm"
-    description: "VictoriaMetrics observability Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  argo-helm:
-    base_url: "https://argoproj.github.io/argo-helm"
-    package: "helm"
-    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600

apps/base/artifactapi/resources/conf.d/remote-rpm.yaml

@@ -1,154 +0,0 @@
-remotes:
-  almalinux:
-    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
-    package: "rpm"
-    description: "AlmaLinux RPM package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-reef:
-    base_url: "https://download.ceph.com/rpm-reef/"
-    package: "rpm"
-    description: "Ceph Reef 18"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-squid:
-    base_url: "https://download.ceph.com/rpm-squid/"
-    package: "rpm"
-    description: "Ceph Squid 19"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-tentacle:
-    base_url: "https://download.ceph.com/rpm-tentacle/"
-    package: "rpm"
-    description: "Ceph Tentacle 20"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  epel:
-    base_url: "https://gsl-syd.mm.fcix.net/epel"
-    package: "rpm"
-    description: "EPEL (Extra Packages for Enterprise Linux)"
-    immutable_patterns:
-      - ".*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - "RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  fedora:
-    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
-    package: "rpm"
-    description: "Fedora Linux RPM package repository"
-    immutable_patterns:
-      - "releases/.*/Everything/x86_64/.*\\.rpm$"
-      - "updates/.*/Everything/x86_64/.*\\.rpm$"
-      - "development/.*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  frr:
-    base_url: "https://rpm.frrouting.org/repo"
-    package: "rpm"
-    description: "FRR RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  mariadb:
-    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
-    package: "rpm"
-    description: "MariaDB RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  openvox:
-    base_url: "https://yum.voxpupuli.org"
-    package: "rpm"
-    description: "OpenVox RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  postgresql:
-    base_url: "https://download.postgresql.org/pub/repos/yum"
-    package: "rpm"
-    description: "PostgreSQL RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-      - ".*/PGDG-RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  rke2:
-    base_url: "https://rpm.rancher.io"
-    package: "rpm"
-    description: "RKE2 RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "public.key$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  zfs:
-    base_url: "http://download.zfsonlinux.org"
-    package: "rpm"
-    description: "ZFS RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/virtual-helm.yaml

@@ -1,18 +0,0 @@
-virtuals:
-  helm:
-    package: "helm"
-    description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
-    members:
-      - ceph-csi
-      - cnpg
-      - elastic-helm
-      - external-dns
-      - hashicorp-helm
-      - intel-helm
-      - jetstack
-      - purelb
-      - rancher-stable
-      - stakater
-      - traefik
-      - victoriametrics
-      - argo-helm

apps/base/artifactapi/services.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: artifactapi-api
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: artifactapi
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres-service
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: postgres
-      port: 5432
-      protocol: TCP
-      targetPort: postgres
-  selector:
-    app: postgres
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis-service
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
-      targetPort: redis
-  selector:
-    app: redis
-  sessionAffinity: None
-  type: ClusterIP

apps/base/artifactapi/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: artifactapi
-spec:
-  allowedNamespaces:
-    - artifactapi
-  kubernetes:
-    audiences:
-      - vault
-    role: artifactapi
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/artifactapi/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: environment
-  namespace: artifactapi
-spec:
-  destination:
-    create: true
-    name: environment
-    overwrite: false
-  hmacSecretData: true
-  mount: kv
-  path: service/artifactapi/environment
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-password
-  namespace: artifactapi
-spec:
-  destination:
-    create: true
-    name: postgres-password
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: service/artifactapi/postgres-password
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/cattle-system/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
-  name: rancher
-  namespace: cattle-system
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: rancher-tls
-        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher-http-redirect
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: rancher
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/cattle-system/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/cattle-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cattle-system

apps/base/cattle-system/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cattle-system
-  kubernetes:
-    role: rancher
-    serviceAccount: rancher
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/cattle-system/vaultstaticsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: rancher-bootstrap-secret
-  namespace: cattle-system
-spec:
-  vaultAuthRef: rancher
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/rancher/bootstrap-password
-  refreshAfter: 5m
-  destination:
-    name: rancher-bootstrap-secret
-    create: true

apps/base/cert-manager/clusterrole.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: cert-manager-vault-token-creator
-  labels:
-    app.kubernetes.io/name: "cert-manager-config"
-    app.kubernetes.io/instance: "cert-manager-config"
-rules:
-- apiGroups: [""]
-  resources: ["serviceaccounts/token"]
-  verbs: ["create"]

apps/base/cert-manager/clusterrolebinding.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cert-manager-vault-token-creator
-  labels:
-    app.kubernetes.io/name: "cert-manager-config"
-    app.kubernetes.io/instance: "cert-manager-config"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-vault-token-creator
-subjects:
-- kind: ServiceAccount
-  name: cert-manager
-  namespace: cert-manager

apps/base/cert-manager/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - clusterrole.yaml
-  - clusterrolebinding.yaml

apps/base/cert-manager/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager

apps/base/cert-manager/serviceaccount.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault-issuer
-  namespace: cert-manager
-  labels:
-    app.kubernetes.io/name: "cert-manager-config"
-    app.kubernetes.io/instance: "cert-manager-config"
-    app.kubernetes.io/component: "vault-issuer"
-automountServiceAccountToken: true

apps/base/certificates/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vault-ca-cert.yaml

apps/base/certificates/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: certificates

apps/base/certificates/vault-ca-cert.yaml

@@ -1,59 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: vault-ca-cert
-  namespace: certificates
-  labels:
-    app.kubernetes.io/name: vault-ca-cert
-    app.kubernetes.io/part-of: vault-secrets-operator
-  annotations:
-    description: "Vault CA certificate replicated to all namespaces"
-    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ""
-type: Opaque
-stringData:
-  ca.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
-    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
-    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
-    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
-    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
-    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
-    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
-    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
-    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
-    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
-    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
-    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
-    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
-    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
-    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
-    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
-    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
-    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
-    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
-    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
-    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
-    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
-    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
-    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
-    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
-    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
-    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
-    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
-    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
-    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
-    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
-    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
-    4gqd
-    -----END CERTIFICATE-----

apps/base/cnpg-system/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml

apps/base/cnpg-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cnpg-system

apps/base/consul/gateway.yaml

@@ -1,53 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: consul
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    cert-manager.io/alt-names: consul.service.consul
-    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: consul.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: consul.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: consul-tls
-    - name: consul-svc
-      port: 443
-      protocol: HTTPS
-      hostname: consul.service.consul
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: consul-tls

apps/base/consul/httproute.yaml

@@ -1,71 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul-http-redirect
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: consul
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: consul
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: consul-ui
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: consul-svc
-  namespace: consul
-  labels:
-    app.kubernetes.io/name: consul
-    app.kubernetes.io/instance: consul
-spec:
-  hostnames:
-    - consul.service.consul
-  parentRefs:
-    - name: consul
-      sectionName: consul-svc
-  rules:
-    - backendRefs:
-        - name: consul-ui
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/consul/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gateway.yaml
-  - httproute.yaml

apps/base/consul/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: consul

apps/base/csi-cephfs/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - storageclass.yaml

apps/base/csi-cephfs/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: csi-cephfs

apps/base/csi-cephfs/storageclass.yaml

@@ -1,83 +0,0 @@
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: cephfs-raid6-delete
-provisioner: cephfs.csi.ceph.com
-reclaimPolicy: Delete
-allowVolumeExpansion: true
-parameters:
-  clusterID: "cephfs_csi_ssd_ec_6_2"
-  fsName: "cephfs"
-  subVolumeGroup: csi_ssd_ec_6_2
-  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"
-
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: cephfs-raid6-retain
-provisioner: cephfs.csi.ceph.com
-reclaimPolicy: Retain
-allowVolumeExpansion: true
-parameters:
-  clusterID: "cephfs_csi_ssd_ec_6_2"
-  fsName: "cephfs"
-  subVolumeGroup: csi_ssd_ec_6_2
-  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"
-
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: cephfs-raid5-delete
-provisioner: cephfs.csi.ceph.com
-reclaimPolicy: Delete
-allowVolumeExpansion: true
-parameters:
-  clusterID: "cephfs_csi_ssd_ec_4_1"
-  fsName: "cephfs"
-  subVolumeGroup: csi_ssd_ec_4_1
-  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"
-
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: cephfs-raid5-retain
-provisioner: cephfs.csi.ceph.com
-reclaimPolicy: Retain
-allowVolumeExpansion: true
-parameters:
-  clusterID: "cephfs_csi_ssd_ec_4_1"
-  fsName: "cephfs"
-  subVolumeGroup: csi_ssd_ec_4_1
-  csi.storage.k8s.io/provisioner-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-expand-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/node-stage-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephfs"
-  csi.storage.k8s.io/controller-publish-secret-name: "csi-cephfs-secret"
-  csi.storage.k8s.io/controller-publish-secret-namespace: "csi-cephfs"

apps/base/csi-cephfs/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: ceph-csi-cephfs
-  namespace: csi-cephfs
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - csi-cephfs
-  kubernetes:
-    role: ceph-csi
-    serviceAccount: ceph-csi-cephfs-csi-cephfs-provisioner
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/csi-cephfs/vaultstaticsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: csi-cephfs-secret
-  namespace: csi-cephfs
-spec:
-  vaultAuthRef: ceph-csi-cephfs
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/csi/ceph-cephfs-secret
-  refreshAfter: 5m
-  destination:
-    name: csi-cephfs-secret
-    create: true

apps/base/csi-cephrbd/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - storageclass.yaml

apps/base/csi-cephrbd/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: csi-cephrbd

apps/base/csi-cephrbd/storageclass.yaml

@@ -1,39 +0,0 @@
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: cephrbd-fast-delete
-  annotations:
-    storageclass.kubernetes.io/is-default-class: "true"
-provisioner: rbd.csi.ceph.com
-reclaimPolicy: Delete
-allowVolumeExpansion: true
-parameters:
-  clusterID: "de96a98f-3d23-465a-a899-86d3d67edab8"
-  pool: "kubernetes"
-  imageFeatures: "layering"
-  csi.storage.k8s.io/provisioner-secret-name: "csi-rbd-secret"
-  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephrbd"
-  csi.storage.k8s.io/controller-expand-secret-name: "csi-rbd-secret"
-  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephrbd"
-  csi.storage.k8s.io/node-stage-secret-name: "csi-rbd-secret"
-  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephrbd"
-
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: cephrbd-fast-retain
-provisioner: rbd.csi.ceph.com
-reclaimPolicy: Retain
-allowVolumeExpansion: true
-parameters:
-  clusterID: "de96a98f-3d23-465a-a899-86d3d67edab8"
-  pool: "kubernetes"
-  imageFeatures: "layering"
-  csi.storage.k8s.io/provisioner-secret-name: "csi-rbd-secret"
-  csi.storage.k8s.io/provisioner-secret-namespace: "csi-cephrbd"
-  csi.storage.k8s.io/controller-expand-secret-name: "csi-rbd-secret"
-  csi.storage.k8s.io/controller-expand-secret-namespace: "csi-cephrbd"
-  csi.storage.k8s.io/node-stage-secret-name: "csi-rbd-secret"
-  csi.storage.k8s.io/node-stage-secret-namespace: "csi-cephrbd"

apps/base/csi-cephrbd/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: ceph-csi-rbd
-  namespace: csi-cephrbd
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - csi-cephrbd
-  kubernetes:
-    role: ceph-csi
-    serviceAccount: ceph-csi-rbd-csi-rbd-provisioner
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/csi-cephrbd/vaultstaticsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: csi-rbd-secret
-  namespace: csi-cephrbd
-spec:
-  vaultAuthRef: ceph-csi-rbd
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/csi/ceph-rbd-secret
-  refreshAfter: 5m
-  destination:
-    name: csi-rbd-secret
-    create: true

apps/base/elastic-system/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml

apps/base/elastic-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: elastic-system
-  name: elastic-system

apps/base/externaldns/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/externaldns/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: externaldns

apps/base/externaldns/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: externaldns
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - externaldns
-  kubernetes:
-    role: externaldns
-    serviceAccount: externaldns
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/externaldns/vaultstaticsecret.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: externaldns-tsig
-  namespace: externaldns
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/externaldns/tsig
-  refreshAfter: 5m
-  destination:
-    name: externaldns-tsig
-    create: true
-  rolloutRestartTargets:
-    - kind: Deployment
-      name: externaldns

apps/base/inteldeviceplugins-system/kustomization.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-
-helmCharts:
-  - name: intel-device-plugins-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "0.35.0"
-    releaseName: intel-device-plugins-operator
-    namespace: inteldeviceplugins-system
-  - name: intel-device-plugins-gpu
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "0.34.1"
-    releaseName: intel-gpu-plugin
-    namespace: inteldeviceplugins-system
-    valuesFile: values-gpu-plugin.yaml

apps/base/inteldeviceplugins-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: inteldeviceplugins-system

apps/base/inteldeviceplugins-system/values-gpu-plugin.yaml

@@ -1,13 +0,0 @@
----
-name: intel-gpu-device-plugin
-sharedDevNum: 4
-logLevel: 2
-enableMonitoring: true
-allocationPolicy: "none"
-image:
-  hub: intel
-  tag: ""  # Use latest from chart
-nodeSelector:
-  intel.feature.node.kubernetes.io/gpu: 'true'
-nodeFeatureRule: true
-tolerations: []

apps/base/litellm/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: litellm-postgres
-  namespace: litellm
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: litellm
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: litellm
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 1
-      memory: 1024Mi
-    requests:
-      cpu: 250m
-      memory: 512Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/litellm/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: litellm-postgres-pooler
-  namespace: litellm
-spec:
-  cluster:
-    name: litellm-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/litellm/deployment.yaml

@@ -1,71 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  selector:
-    matchLabels:
-      app: litellm
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: litellm
-    spec:
-      containers:
-        - name: litellm
-          image: docker.litellm.ai/berriai/litellm-database:main-stable
-          imagePullPolicy: Always
-          args:
-            - --config
-            - /app/config.yaml
-            - --port
-            - "4000"
-            - --num_workers
-            - "8"
-          ports:
-            - containerPort: 4000
-              name: http
-              protocol: TCP
-          envFrom:
-            - secretRef:
-                name: litellm-credentials
-            - configMapRef:
-                name: litellm-env
-          livenessProbe:
-            httpGet:
-              path: /health/liveliness
-              port: 4000
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /health/readiness
-              port: 4000
-            failureThreshold: 3
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "2"
-              memory: 8Gi
-            requests:
-              cpu: 250m
-              memory: 6Gi
-          volumeMounts:
-            - mountPath: /app/config.yaml
-              name: config
-              subPath: config.yaml
-      restartPolicy: Always
-      volumes:
-        - name: config
-          configMap:
-            name: litellm-config

apps/base/litellm/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: litellm
-  namespace: litellm
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: litellm.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: litellm.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: litellm-tls
-        mode: Terminate

apps/base/litellm/hpa.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: litellm-hpa
-  namespace: litellm
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: litellm
-  minReplicas: 2
-  maxReplicas: 4
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 80
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 60
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60
-        - type: Pods
-          value: 2
-          periodSeconds: 60

apps/base/litellm/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: litellm-http-redirect
-  namespace: litellm
-spec:
-  hostnames:
-    - litellm.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: litellm
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  hostnames:
-    - litellm.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: litellm
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: litellm
-          port: 4000
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/litellm/kustomization.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - deployment.yaml
-  - hpa.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - redis-deployment.yaml
-  - redis-pvc.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: litellm-config
-    files:
-      - config.yaml=resources/config.yaml
-    options:
-      disableNameSuffixHash: true
-  - name: litellm-env
-    literals:
-      - STORE_MODEL_IN_DB=True
-    options:
-      disableNameSuffixHash: true

apps/base/litellm/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: litellm

apps/base/litellm/redis-deployment.yaml

@@ -1,67 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: redis
-  namespace: litellm
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
-          command:
-            - redis-server
-            - --save
-            - "20"
-            - "1"
-          ports:
-            - containerPort: 6379
-              name: redis
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              mountPropagation: None
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: litellm-redis-data

apps/base/litellm/redis-pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: litellm-redis-data
-  namespace: litellm
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/litellm/resources/config.yaml

@@ -1,15 +0,0 @@
-model_list: []
-
-router_settings:
-  redis_host: redis-service
-  redis_port: 6379
-
-general_settings:
-  use_redis_transaction_buffer: true
-
-litellm_settings:
-  cache: true
-  cache_params:
-    type: redis
-    host: redis-service
-    port: 6379

apps/base/litellm/services.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 4000
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: litellm
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis-service
-  namespace: litellm
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
-      targetPort: redis
-  selector:
-    app: redis
-  sessionAffinity: None
-  type: ClusterIP

apps/base/litellm/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: litellm
-spec:
-  allowedNamespaces:
-    - litellm
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/litellm/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: litellm
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/litellm/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: litellm-credentials
-  namespace: litellm
-spec:
-  destination:
-    create: true
-    name: litellm-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/litellm/default/litellm-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/node-feature-discovery/intel-nodefeaturerules.yaml

@@ -1,152 +0,0 @@
----
-apiVersion: nfd.k8s-sigs.io/v1alpha1
-kind: NodeFeatureRule
-metadata:
-  name: intel-dp-devices
-  namespace: node-feature-discovery
-spec:
-  rules:
-    - name: "intel.dlb"
-      labels:
-        "intel.feature.node.kubernetes.io/dlb": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            device: {op: In, value: ["2710"]}
-            class: {op: In, value: ["0b40"]}
-        - feature: kernel.loadedmodule
-          matchExpressions:
-            dlb2: {op: Exists}
-
-    - name: "intel.dsa"
-      labels:
-        "intel.feature.node.kubernetes.io/dsa": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            device: {op: In, value: ["0b25", "11fb", "1212"]}
-            class: {op: In, value: ["0880"]}
-        - feature: kernel.loadedmodule
-          matchExpressions:
-            idxd: {op: Exists}
-
-    - name: "intel.fpga-arria10"
-      labels:
-        "intel.feature.node.kubernetes.io/fpga-arria10": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            device: {op: In, value: ["09c4"]}
-            class: {op: In, value: ["1200"]}
-      matchAny:
-        - matchFeatures:
-            - feature: kernel.loadedmodule
-              matchExpressions:
-                dfl_pci: {op: Exists}
-        - matchFeatures:
-            - feature: kernel.loadedmodule
-              matchExpressions:
-                intel_fpga_pci: {op: Exists}
-
-    - name: "intel.gpu"
-      labels:
-        "intel.feature.node.kubernetes.io/gpu": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            class: {op: In, value: ["0300", "0380"]}
-      matchAny:
-        - matchFeatures:
-            - feature: kernel.loadedmodule
-              matchExpressions:
-                i915: {op: Exists}
-        - matchFeatures:
-            - feature: kernel.enabledmodule
-              matchExpressions:
-                i915: {op: Exists}
-        - matchFeatures:
-            - feature: kernel.loadedmodule
-              matchExpressions:
-                xe: {op: Exists}
-        - matchFeatures:
-            - feature: kernel.enabledmodule
-              matchExpressions:
-                xe: {op: Exists}
-
-    - name: "intel.iaa"
-      labels:
-        "intel.feature.node.kubernetes.io/iaa": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            device: {op: In, value: ["0cfe", "1216"]}
-            class: {op: In, value: ["0880"]}
-        - feature: kernel.loadedmodule
-          matchExpressions:
-            idxd: {op: Exists}
-
-    - name: "intel.qat"
-      labels:
-        "intel.feature.node.kubernetes.io/qat": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            device: {op: In, value: ["37c8", "4940", "4942", "4944", "4946", "4948"]}
-            class: {op: In, value: ["0b40"]}
-        - feature: kernel.loadedmodule
-          matchExpressions:
-            intel_qat: {op: Exists}
-      matchAny:
-        - matchFeatures:
-            - feature: kernel.loadedmodule
-              matchExpressions:
-                vfio_pci: {op: Exists}
-        - matchFeatures:
-            - feature: kernel.enabledmodule
-              matchExpressions:
-                vfio-pci: {op: Exists}
-
-    - name: "intel.sgx"
-      labels:
-        "intel.feature.node.kubernetes.io/sgx": "true"
-      extendedResources:
-        sgx.intel.com/epc: "@cpu.security.sgx.epc"
-      matchFeatures:
-        - feature: cpu.cpuid
-          matchExpressions:
-            SGX: {op: Exists}
-            SGXLC: {op: Exists}
-        - feature: cpu.security
-          matchExpressions:
-            sgx.enabled: {op: IsTrue}
-        - feature: kernel.config
-          matchExpressions:
-            X86_SGX: {op: Exists}
-
-    - name: "intel.npu"
-      labels:
-        "intel.feature.node.kubernetes.io/npu": "true"
-      matchFeatures:
-        - feature: pci.device
-          matchExpressions:
-            vendor: {op: In, value: ["8086"]}
-            class: {op: In, value: ["1200"]}
-            device: {
-              op: In,
-              value: ["7e4c", "643e", "ad1d", "7d1d"]
-            }
-      matchAny:
-        - matchFeatures:
-            - feature: kernel.loadedmodule
-              matchExpressions:
-                intel_vpu: {op: Exists}
-        - matchFeatures:
-            - feature: kernel.enabledmodule
-              matchExpressions:
-                intel_vpu: {op: Exists}

apps/base/node-feature-discovery/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - intel-nodefeaturerules.yaml
-
-helmCharts:
-  - name: node-feature-discovery
-    repo: oci://gcr.io/k8s-staging-nfd/charts
-    version: "0.0.0-master"
-    releaseName: node-feature-discovery
-    namespace: node-feature-discovery

apps/base/node-feature-discovery/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: node-feature-discovery

apps/base/observability/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml

apps/base/observability/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/name: observability
-  name: observability

apps/base/paperclip/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: paperclip-postgres
-  namespace: paperclip
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: paperclip
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: paperclip
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/paperclip/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: paperclip-pooler-rw
-  namespace: paperclip
-spec:
-  cluster:
-    name: paperclip-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/paperclip/deployment.yaml

@@ -1,108 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  selector:
-    matchLabels:
-      app: paperclip
-  template:
-    metadata:
-      labels:
-        app: paperclip
-    spec:
-      containers:
-        - name: paperclip
-          image: ghcr.io/paperclipai/paperclip:latest
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 3100
-              name: http
-              protocol: TCP
-          env:
-            - name: PORT
-              value: "3100"
-            - name: PAPERCLIP_BIND
-              value: custom
-            - name: PAPERCLIP_BIND_HOST
-              value: 0.0.0.0
-            - name: PAPERCLIP_API_URL
-              value: https://paperclip.k8s.syd1.au.unkin.net
-            - name: BETTER_AUTH_BASE_URL
-              value: https://paperclip.k8s.syd1.au.unkin.net
-            - name: PAPERCLIP_ALLOWED_HOSTNAMES
-              value: paperclip.k8s.syd1.au.unkin.net,localhost
-            - name: PAPERCLIP_HOME
-              value: /paperclip
-            - name: PAPERCLIP_INSTANCE_ID
-              value: default
-            - name: PAPERCLIP_DEPLOYMENT_MODE
-              value: authenticated
-            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
-              value: private
-            - name: SERVE_UI
-              value: "true"
-            - name: HEARTBEAT_SCHEDULER_ENABLED
-              value: "true"
-            - name: PAPERCLIP_MIGRATION_AUTO_APPLY
-              value: "true"
-            - name: PAPERCLIP_STORAGE_PROVIDER
-              value: s3
-            - name: PAPERCLIP_STORAGE_S3_BUCKET
-              value: paperclip
-            - name: PAPERCLIP_STORAGE_S3_REGION
-              value: us-east-1
-            - name: PAPERCLIP_STORAGE_S3_ENDPOINT
-              value: https://radosgw.service.consul
-            - name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
-              value: "true"
-            - name: NODE_EXTRA_CA_CERTS
-              value: /etc/ssl/paperclip/ca.crt
-          envFrom:
-            - secretRef:
-                name: paperclip-credentials
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /etc/ssl/paperclip
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /api/health
-              port: 3100
-              httpHeaders:
-                - name: Host
-                  value: localhost
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /api/health
-              port: 3100
-              httpHeaders:
-                - name: Host
-                  value: localhost
-            failureThreshold: 3
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "1"
-              memory: 2Gi
-            requests:
-              cpu: 250m
-              memory: 512Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-      restartPolicy: Always

apps/base/paperclip/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: paperclip
-  namespace: paperclip
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: paperclip.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: paperclip.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: paperclip-tls
-        mode: Terminate

apps/base/paperclip/httproute.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: paperclip-http-redirect
-  namespace: paperclip
-spec:
-  hostnames:
-    - paperclip.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: paperclip
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  hostnames:
-    - paperclip.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: paperclip
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: paperclip
-          port: 3100
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/paperclip/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - deployment.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/paperclip/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: paperclip

apps/base/paperclip/services.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 3100
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: paperclip
-  sessionAffinity: None
-  type: ClusterIP

apps/base/paperclip/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: paperclip
-spec:
-  allowedNamespaces:
-    - paperclip
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/paperclip/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: paperclip
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/paperclip/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: paperclip-credentials
-  namespace: paperclip
-spec:
-  destination:
-    create: true
-    name: paperclip-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/paperclip/default/paperclip-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/puppet/cnpg_cluster.yaml

@@ -1,112 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: puppet-postgres
-  namespace: puppet
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: puppetdb
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: puppetdb
-      secret:
-        name: postgres-credentials
-      postInitApplicationSQL:
-        - CREATE EXTENSION IF NOT EXISTS pg_trgm;
-        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
-        - GRANT CONNECT ON DATABASE puppetdb TO puppetdb_read;
-        - GRANT USAGE ON SCHEMA public TO puppetdb_read;
-        - GRANT SELECT ON ALL TABLES IN SCHEMA public TO puppetdb_read;
-        - ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO puppetdb_read;
-  managed:
-    roles:
-      - name: puppetdb_read
-        ensure: present
-        comment: PuppetDB read-only database user
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: postgres-read-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/puppet/cnpg_pooler.yaml

@@ -1,66 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: puppet-postgres-pooler
-  namespace: puppet
-spec:
-  cluster:
-    name: puppet-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: puppet-postgres-pooler-ro
-  namespace: puppet
-spec:
-  cluster:
-    name: puppet-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler-ro
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler-ro
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: ro

apps/base/puppet/configmap_puppetboard-config.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard-config
-  namespace: puppet
-data:
-  PUPPETDB_HOST: "puppetdb"
-  PUPPETDB_PORT: "8081"
-  PUPPETDB_SSL_VERIFY: "/opt/puppetboard/ssl/ca.pem"
-  PUPPETDB_CERT: "/opt/puppetboard/ssl/puppetboard.pem"
-  PUPPETDB_KEY: "/opt/puppetboard/ssl/puppetboard.key"
-  LOGLEVEL: "debug"
-  PUPPETDB_TIMEOUT: "20"
-  UNRESPONSIVE_HOURS: "3"
-  ENABLE_CATALOG: "False"
-  ENABLE_QUERY: "True"
-  LOCALISE_TIMESTAMP: "True"
-  OFFLINE_MODE: "True"
-  DEFAULT_ENVIRONMENT: "*"
-  REPORTS_COUNT: "40"

apps/base/puppet/configmap_puppetdb-config.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb-config
-  namespace: puppet
-data:
-  USE_OPENVOXSERVER: "true"
-  OPENVOXSERVER_HOSTNAME: "puppetca"
-  OPENVOXSERVER_PORT: "8140"
-  DNS_ALT_NAMES: "openvoxdb,puppetdb,puppetdb.k8s.syd1.au.unkin.net,puppetdb.puppet.svc.cluster.local"
-  OPENVOXDB_POSTGRES_HOSTNAME: "puppet-postgres-pooler"
-  OPENVOXDB_POSTGRES_DATABASE: "puppetdb"
-  OPENVOXDB_POSTGRES_PORT: "5432"
-  OPENVOXDB_READ_POSTGRES_HOSTNAME: "puppet-postgres-pooler-ro"
-  OPENVOXDB_READ_POSTGRES_DATABASE: "puppetdb"
-  OPENVOXDB_READ_POSTGRES_PORT: "5432"
-  PUPPETDB_JAVA_ARGS: ""

apps/base/puppet/configmap_puppetdb-read-database.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb-read-database-conf
-  namespace: puppet
-data:
-  read-database.conf: |
-    read-database: {
-      subname: "//"${OPENVOXDB_READ_POSTGRES_HOSTNAME}":"${OPENVOXDB_READ_POSTGRES_PORT}"/"${OPENVOXDB_READ_POSTGRES_DATABASE}
-      username: ${OPENVOXDB_READ_POSTGRES_USER}
-      password: ${OPENVOXDB_READ_POSTGRES_PASSWORD}
-    }

apps/base/puppet/configmap_puppetserver-compiler-config.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetserver-compilers
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetserver-compiler-config
-  namespace: puppet
-data:
-  OPENVOXSERVER_PORT: "8140"
-  DNS_ALT_NAMES: "puppetserver-compiler,puppet,puppet.k8s.syd1.au.unkin.net"
-  OPENVOXDB_SERVER_URLS: "https://puppetdb:8081"
-  CA_ENABLED: "false"
-  CA_HOSTNAME: "puppetca"
-  CA_PORT: "8140"
-  PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"

apps/base/puppet/configmap_puppetserver-init-config.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetserver-init
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetserver-init-config
-  namespace: puppet
-data:
-  PUPPET_DATA_DIR: "/etc/puppetlabs/code/environments"
-  PUPPET_SSL_DIR: "/etc/puppetlabs/puppet/ssl/certs"
-  PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"