chore: migrate to artifactapi helm virtual repo

- replace all helm repos with artifactapi/virtual/helm - update projects with accepted repos - set resource requests/limits for woodpecker jobs
feat: add litellm to new aitooling ArgoCD project (#94 )
2026-05-02 17:24:24 +10:00 · 2026-05-01 21:40:26 +10:00 · 2026-05-01 21:17:16 +10:00 · 2026-04-30 23:59:01 +10:00 · 2026-04-27 13:16:02 +10:00 · 2026-04-26 16:20:53 +10:00
68 changed files with 1695 additions and 387 deletions
@@ -6,3 +6,13 @@ steps:
    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
    commands:
      - make kubeconform
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -6,3 +6,13 @@ steps:
    image: git.unkin.net/unkin/almalinux9-base:20260308
    commands:
      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 250m
+          limits:
+            memory: 1Gi
+            cpu: 1
@@ -19,8 +19,8 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: artifactapi
-          image: git.unkin.net/unkin/almalinux9-artifactapi:latest
-          imagePullPolicy: Always
+          image: git.unkin.net/unkin/artifactapi:v2.7.1
+          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
              name: http
@@ -60,10 +60,30 @@ spec:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
-            - mountPath: /app/remotes.yaml
-              mountPropagation: None
+            - mountPath: /etc/artifactapi/conf.d/config.yaml
              name: remotes-config
-              subPath: remotes.yaml
+              subPath: config.yaml
+            - mountPath: /etc/artifactapi/conf.d/local-generic.yaml
+              name: remotes-config
+              subPath: local-generic.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
+              name: remotes-config
+              subPath: remote-alpine.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
+              name: remotes-config
+              subPath: remote-docker.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
+              name: remotes-config
+              subPath: remote-generic.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
+              name: remotes-config
+              subPath: remote-helm.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
+              name: remotes-config
+              subPath: remote-rpm.yaml
+            - mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
+              name: remotes-config
+              subPath: virtual-helm.yaml
      restartPolicy: Always
      volumes:
        - configMap:
@@ -5,7 +5,7 @@ metadata:
  name: artifactapi-env
  namespace: artifactapi
 data:
-  CONFIG_PATH: /app/remotes.yaml
+  CONFIG_PATH: /etc/artifactapi/conf.d/
  DBHOST: postgres-service
  DBNAME: artifacts
  DBPORT: "5432"
@@ -18,6 +18,13 @@ resources:
 configMapGenerator:
  - name: remotes-config
    files:
-      - resources/remotes.yaml
+      - resources/conf.d/config.yaml
+      - resources/conf.d/local-generic.yaml
+      - resources/conf.d/remote-generic.yaml
+      - resources/conf.d/remote-alpine.yaml
+      - resources/conf.d/remote-rpm.yaml
+      - resources/conf.d/remote-docker.yaml
+      - resources/conf.d/remote-helm.yaml
+      - resources/conf.d/virtual-helm.yaml
    options:
      disableNameSuffixHash: true
@@ -0,0 +1,3 @@
+# Global artifactapi configuration.
+# S3, Redis, and database connection settings are injected via environment variables.
+# Add any top-level overrides here if needed.
@@ -0,0 +1,7 @@
+locals:
+  local-generic:
+    package: "generic"
+    description: "Local generic file repository"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 0
@@ -0,0 +1,10 @@
+remotes:
+  alpine:
+    base_url: "https://dl-cdn.alpinelinux.org"
+    package: "alpine"
+    description: "Alpine Linux APK package repository"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.apk$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
@@ -0,0 +1,92 @@
+remotes:
+  ghcr:
+    base_url: "https://ghcr.io"
+    package: "docker"
+    description: "GitHub Container Registry"
+    immutable_patterns:
+      - "^cloudnative-pg/cloudnative-pg"
+      - "^emberstack/helm-charts"
+      - "^openvoxproject/"
+      - "^stakater/reloader"
+      - "^voxpupuli/puppetboard"
+      - "^woodpecker-ci/helm"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  dockerhub:
+    base_url: "https://registry-1.docker.io"
+    package: "docker"
+    description: "Docker Hub registry"
+    immutable_patterns:
+      - "^library/busybox"
+      - "^library/nginx"
+      - "^library/postgres"
+      - "^library/redis"
+      - "^beats/filebeat"
+      - "^bitnami/"
+      - "^curlimages/curl"
+      - "^emberstack/kubernetes-reflector"
+      - "^hashicorp/vault-secrets-operator"
+      - "^jfrog/"
+      - "^rancher/"
+      - "^ubi9/ubi-minimal"
+      - "^victoriametrics/"
+      - "^woodpeckerci/"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  quay:
+    base_url: "https://quay.io"
+    package: "docker"
+    description: "Quay.io container registry"
+    immutable_patterns:
+      - "^brancz/kube-rbac-proxy"
+      - "^cephcsi/cephcsi"
+      - "^jetstack/cert-manager-"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  k8s-registry:
+    base_url: "https://registry.k8s.io"
+    package: "docker"
+    description: "Kubernetes container registry"
+    immutable_patterns:
+      - "^external-dns/external-dns"
+      - "^sig-storage/"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  gitlab:
+    base_url: "https://registry.gitlab.com"
+    package: "docker"
+    description: "GitLab container registry"
+    immutable_patterns:
+      - "^purelb/purelb"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  elastic:
+    base_url: "https://docker.elastic.co"
+    package: "docker"
+    description: "Elastic container registry"
+    immutable_patterns:
+      - "^eck/eck-operator"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  gcr:
+    base_url: "https://gcr.io"
+    package: "docker"
+    description: "Google Container Registry"
+    immutable_patterns:
+      - "^k8s-staging-nfd/charts"
+      - "^k8s-staging-nfd/node-feature-discovery"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
@@ -0,0 +1,126 @@
+remotes:
+  github:
+    base_url: "https://github.com"
+    package: "generic"
+    description: "GitHub releases and files"
+    mutable_patterns:
+      - ".*/archive/refs/heads/.*.tar.gz$"
+    immutable_patterns:
+      - ".*/archive/refs/tags/.*.tar.gz$"
+      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
+      - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
+      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
+      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
+      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
+      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
+      - "coder/code-server/.*/code-server-.*-amd64.rpm$"
+      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
+      - "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
+      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
+      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
+      - "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
+      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
+      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
+      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
+      - "hadolint/hadolint/.*/hadolint-linux-x86_64$"
+      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
+      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
+      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+      - "lxc/incus/.*.tar.gz$"
+      - "mikefarah/yq/.*/yq_linux_amd64$"
+      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
+      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
+      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
+      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
+      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
+      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
+      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
+      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
+      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
+      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
+      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
+      - "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
+      - "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
+      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
+      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
+      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
+      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  github_user:
+    base_url: "https://raw.githubusercontent.com"
+    package: "generic"
+    description: "GitHub User Content"
+    immutable_patterns:
+      - "argoproj/argo-cd/.*.yaml$"
+      - "yannh/kubernetes-json-schema/master/.*.json$"
+      - "datreeio/CRDs-catalog/main/.*.json$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  gitea-dl:
+    base_url: "https://dl.gitea.com"
+    package: "generic"
+    description: "Gitea download site"
+    immutable_patterns:
+      - "act_runner/.*/act_runner-.*-linux-amd64$"
+      - "tea/.*/tea-.*-linux-amd64$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  hashicorp-releases:
+    base_url: "https://releases.hashicorp.com"
+    package: "generic"
+    description: "HashiCorp product releases"
+    immutable_patterns:
+      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
+      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
+      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
+      - "vault/.*vault_.*_linux_amd64\\.zip$"
+      - "vault/.*vault_.*_windows_amd64\\.zip$"
+      - "vault/.*vault_.*_darwin_amd64\\.zip$"
+      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
+      - "consul/.*/consul_.*_linux_amd64\\.zip$"
+      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
+      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
+      - "packer/.*/packer_.*_linux_amd64\\.zip$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  rarlab:
+    base_url: "https://www.rarlab.com"
+    package: "generic"
+    description: "RARLab"
+    immutable_patterns:
+      - "rar/rarlinux-x64-.*.tar.gz"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  claude-ai:
+    base_url: "https://downloads.claude.ai"
+    package: "generic"
+    description: "Anthropic Claude Code binary releases"
+    mutable_patterns:
+      - "claude-code-releases/.*/manifest.json$"
+    immutable_patterns:
+      - "claude-code-releases/.*/linux-x64/claude$"
+      - "claude-code-releases/.*/linux-arm64/claude$"
+      - "claude-code-releases/.*/linux-x64-musl/claude$"
+      - "claude-code-releases/.*/linux-arm64-musl/claude$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
@@ -0,0 +1,121 @@
+remotes:
+  ceph-csi:
+    base_url: "https://ceph.github.io/csi-charts"
+    package: "helm"
+    description: "Ceph CSI driver Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  cnpg:
+    base_url: "https://cloudnative-pg.github.io/charts"
+    package: "helm"
+    description: "CloudNativePG operator Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  elastic-helm:
+    base_url: "https://helm.elastic.co"
+    package: "helm"
+    description: "Elastic stack Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  external-dns:
+    base_url: "https://kubernetes-sigs.github.io/external-dns/"
+    package: "helm"
+    description: "ExternalDNS Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  hashicorp-helm:
+    base_url: "https://helm.releases.hashicorp.com"
+    package: "helm"
+    description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  intel-helm:
+    base_url: "https://intel.github.io/helm-charts/"
+    package: "helm"
+    description: "Intel Helm charts (device plugins)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  jetstack:
+    base_url: "https://charts.jetstack.io"
+    package: "helm"
+    description: "Jetstack Helm charts (cert-manager)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  purelb:
+    base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
+    package: "helm"
+    description: "PureLB load balancer Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  rancher-stable:
+    base_url: "https://releases.rancher.com/server-charts/stable"
+    package: "helm"
+    description: "Rancher stable Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  stakater:
+    base_url: "https://stakater.github.io/stakater-charts"
+    package: "helm"
+    description: "Stakater Helm charts (Reloader)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  victoriametrics:
+    base_url: "https://victoriametrics.github.io/helm-charts/"
+    package: "helm"
+    description: "VictoriaMetrics observability Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
@@ -0,0 +1,154 @@
+remotes:
+  almalinux:
+    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
+    package: "rpm"
+    description: "AlmaLinux RPM package repository"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - ".*/install.img"
+      - ".*/squashfs.img"
+      - ".*/updates.img"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  ceph-reef:
+    base_url: "https://download.ceph.com/rpm-reef/"
+    package: "rpm"
+    description: "Ceph Reef 18"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  ceph-squid:
+    base_url: "https://download.ceph.com/rpm-squid/"
+    package: "rpm"
+    description: "Ceph Squid 19"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  ceph-tentacle:
+    base_url: "https://download.ceph.com/rpm-tentacle/"
+    package: "rpm"
+    description: "Ceph Tentacle 20"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  epel:
+    base_url: "https://gsl-syd.mm.fcix.net/epel"
+    package: "rpm"
+    description: "EPEL (Extra Packages for Enterprise Linux)"
+    immutable_patterns:
+      - ".*/Everything/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - "RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  fedora:
+    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
+    package: "rpm"
+    description: "Fedora Linux RPM package repository"
+    immutable_patterns:
+      - "releases/.*/Everything/x86_64/.*\\.rpm$"
+      - "updates/.*/Everything/x86_64/.*\\.rpm$"
+      - "development/.*/Everything/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  frr:
+    base_url: "https://rpm.frrouting.org/repo"
+    package: "rpm"
+    description: "FRR RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  mariadb:
+    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
+    package: "rpm"
+    description: "MariaDB RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  openvox:
+    base_url: "https://yum.voxpupuli.org"
+    package: "rpm"
+    description: "OpenVox RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - "GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  postgresql:
+    base_url: "https://download.postgresql.org/pub/repos/yum"
+    package: "rpm"
+    description: "PostgreSQL RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/RPM-GPG-KEY-.*$"
+      - ".*/PGDG-RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  rke2:
+    base_url: "https://rpm.rancher.io"
+    package: "rpm"
+    description: "RKE2 RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - "public.key$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  zfs:
+    base_url: "http://download.zfsonlinux.org"
+    package: "rpm"
+    description: "ZFS RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
@@ -0,0 +1,16 @@
+virtuals:
+  helm:
+    package: "helm"
+    description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
+    members:
+      - ceph-csi
+      - cnpg
+      - elastic-helm
+      - external-dns
+      - hashicorp-helm
+      - intel-helm
+      - jetstack
+      - purelb
+      - rancher-stable
+      - stakater
+      - victoriametrics
@@ -1,287 +0,0 @@
-remotes:
-  github:
-    base_url: "https://github.com"
-    type: "remote"
-    package: "generic"
-    description: "GitHub releases and files"
-    include_patterns:
-      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
-      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
-      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
-      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
-      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
-      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
-      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
-      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
-      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
-      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
-      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-      - "lxc/incus/.*.tar.gz$"
-      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
-      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
-      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
-      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
-      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
-      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
-      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
-      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  github_user:
-    base_url: "https://raw.githubusercontent.com"
-    type: "remote"
-    package: "generic"
-    description: "GitHub User Content"
-    include_patterns:
-      - "argoproj/argo-cd/.*.yaml$"
-      - "yannh/kubernetes-json-schema/master/.*.json$"
-      - "datreeio/CRDs-catalog/main/.*.json$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  gitea-dl:
-    base_url: "https://dl.gitea.com"
-    type: "remote"
-    package: "generic"
-    description: "Gitea download site"
-    include_patterns:
-      - "act_runner/.*/act_runner-.*-linux-amd64$"
-      - "tea/.*/tea-.*-linux-amd64$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  hashicorp-releases:
-    base_url: "https://releases.hashicorp.com"
-    type: "remote"
-    package: "generic"
-    description: "HashiCorp product releases"
-    include_patterns:
-      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
-      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
-      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
-      - "vault/.*vault_.*_linux_amd64\\.zip$"
-      - "vault/.*vault_.*_windows_amd64\\.zip$"
-      - "vault/.*vault_.*_darwin_amd64\\.zip$"
-      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
-      - "consul/.*/consul_.*_linux_amd64\\.zip$"
-      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
-      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
-      - "packer/.*/packer_.*_linux_amd64\\.zip$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  rarlab:
-    base_url: "https://www.rarlab.com"
-    type: "remote"
-    package: "generic"
-    description: "RARLab"
-    include_patterns:
-      - "rar/rarlinux-x64-.*.tar.gz"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  alpine:
-    base_url: "https://dl-cdn.alpinelinux.org"
-    type: "remote"
-    package: "alpine"
-    description: "Alpine Linux APK package repository"
-    include_patterns:
-      - ".*/x86_64/.*\\.apk$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  almalinux:
-    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
-    type: "remote"
-    package: "rpm"
-    description: "AlmaLinux RPM package repository"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-reef:
-    base_url: "https://download.ceph.com/rpm-reef/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Reef 18"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-squid:
-    base_url: "https://download.ceph.com/rpm-squid/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Squid 19"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-tentacle:
-    base_url: "https://download.ceph.com/rpm-tentacle/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Tentacle 20"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  epel:
-    base_url: "https://gsl-syd.mm.fcix.net/epel"
-    type: "remote"
-    package: "rpm"
-    description: "EPEL (Extra Packages for Enterprise Linux)"
-    include_patterns:
-      - ".*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - "RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  fedora:
-    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
-    type: "remote"
-    package: "rpm"
-    description: "Fedora Linux RPM package repository"
-    include_patterns:
-      - "releases/.*/Everything/x86_64/.*\\.rpm$"
-      - "updates/.*/Everything/x86_64/.*\\.rpm$"
-      - "development/.*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  frr:
-    base_url: "https://rpm.frrouting.org/repo"
-    type: "remote"
-    package: "rpm"
-    description: "FRR RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  mariadb:
-    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
-    type: "remote"
-    package: "rpm"
-    description: "MariaDB RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  openvox:
-    base_url: "https://yum.voxpupuli.org"
-    type: "remote"
-    package: "rpm"
-    description: "OpenVox RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  postgresql:
-    base_url: "https://download.postgresql.org/pub/repos/yum"
-    type: "remote"
-    package: "rpm"
-    description: "PostgreSQL RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-      - ".*/PGDG-RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  rke2:
-    base_url: "https://rpm.rancher.io"
-    type: "remote"
-    package: "rpm"
-    description: "RKE2 RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "public.key$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  zfs:
-    base_url: "http://download.zfsonlinux.org"
-    type: "remote"
-    package: "rpm"
-    description: "ZFS RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-
-  local-generic:
-    type: "local"
-    package: "generic"
-    description: "Local generic file repository"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: elastic-system
+  name: elastic-system
@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: litellm-postgres
+  namespace: litellm
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: litellm
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: litellm
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600
@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: litellm-postgres-pooler
+  namespace: litellm
+spec:
+  cluster:
+    name: litellm-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw
@@ -0,0 +1,67 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  selector:
+    matchLabels:
+      app: litellm
+  template:
+    metadata:
+      labels:
+        app: litellm
+    spec:
+      containers:
+        - name: litellm
+          image: docker.litellm.ai/berriai/litellm-database:main-stable
+          imagePullPolicy: Always
+          args:
+            - --config
+            - /app/config.yaml
+            - --port
+            - "4000"
+            - --num_workers
+            - "8"
+          ports:
+            - containerPort: 4000
+              name: http
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: litellm-credentials
+          livenessProbe:
+            httpGet:
+              path: /health/liveliness
+              port: 4000
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health/readiness
+              port: 4000
+            failureThreshold: 3
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: "1"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 512Mi
+          volumeMounts:
+            - mountPath: /app/config.yaml
+              name: config
+              subPath: config.yaml
+      restartPolicy: Always
+      volumes:
+        - name: config
+          configMap:
+            name: litellm-config
@@ -0,0 +1,41 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: litellm-hpa
+  namespace: litellm
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: litellm
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 60
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 30
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 10
+          periodSeconds: 60
+        - type: Pods
+          value: 2
+          periodSeconds: 60
@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  name: litellm
+  namespace: litellm
+spec:
+  rules:
+    - host: litellm.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: litellm
+                port:
+                  number: 4000
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - litellm.k8s.syd1.au.unkin.net
+      secretName: litellm-tls
@@ -0,0 +1,23 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - deployment.yaml
+  - hpa.yaml
+  - ingress.yaml
+  - namespace.yaml
+  - redis-deployment.yaml
+  - redis-pvc.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: litellm-config
+    files:
+      - config.yaml=resources/config.yaml
+    options:
+      disableNameSuffixHash: true
@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: jfrog
+  name: litellm
@@ -0,0 +1,67 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: litellm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - redis-server
+            - --save
+            - "20"
+            - "1"
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            failureThreshold: 3
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - mountPath: /data
+              mountPropagation: None
+              name: data
+      restartPolicy: Always
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: litellm-redis-data
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: litellm-redis-data
+  namespace: litellm
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-delete
+  volumeMode: Filesystem
@@ -0,0 +1,15 @@
+model_list: []
+
+router_settings:
+  redis_host: redis-service
+  redis_port: 6379
+
+general_settings:
+  use_redis_transaction_buffer: true
+
+litellm_settings:
+  cache: true
+  cache_params:
+    type: redis
+    host: redis-service
+    port: 6379
@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 4000
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: litellm
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-service
+  namespace: litellm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: redis
+      port: 6379
+      protocol: TCP
+      targetPort: redis
+  selector:
+    app: redis
+  sessionAffinity: None
+  type: ClusterIP
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: litellm
+spec:
+  allowedNamespaces:
+    - litellm
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,34 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/litellm/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: litellm-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: litellm-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/litellm/default/litellm-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: observability
+  name: observability
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: vm-system
+  name: vm-system
@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: vault-service-account-admin
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-service-account-admin
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
@@ -0,0 +1,32 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/part-of: vault-secrets-operator
+  name: vso-system-vault-secrets-operator-auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault-secrets-operator-controller-manager
+    namespace: vso-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: vso-system-vault-admin-binding
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-admin-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vso-system-vault-service-account-admin
+subjects:
+  - kind: ServiceAccount
+    name: vso-system-vault-admin
+    namespace: vso-system
@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount_vault-admin.yaml
+  - clusterrole_vault-service-account-admin.yaml
+  - clusterrolebindings.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: vso-system
+  name: vso-system
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: vault-admin
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-admin
+  namespace: vso-system
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: rancher
-    repo: https://releases.rancher.com/server-charts/stable
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "2.13.1"
    releaseName: rancher
    namespace: cattle-system
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: cert-manager
-    repo: https://charts.jetstack.io
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "v1.19.2"
    releaseName: cert-manager
    namespace: cert-manager
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: cloudnative-pg
-    repo: https://cloudnative-pg.github.io/charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "0.27.0"
    releaseName: cloudnative-pg-operator
    namespace: cnpg-system
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: ceph-csi-cephfs
-    repo: https://ceph.github.io/csi-charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "3.15.0"
    releaseName: ceph-csi-cephfs
    namespace: csi-cephfs
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: ceph-csi-rbd
-    repo: https://ceph.github.io/csi-charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "3.15.1"
    releaseName: ceph-csi-rbd
    namespace: csi-cephrbd
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: elastic-system
+
+resources:
+  - ../../../base/elastic-system
+
+helmCharts:
+  - name: eck-operator
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "3.2.0"
+    releaseName: elastic-operator
+    namespace: elastic-system
+    valuesFile: values.yaml
@@ -0,0 +1,11 @@
+replicaCount: 2
+resources:
+  limits:
+    cpu: 1
+    memory: 1Gi
+  requests:
+    cpu: 10m
+    memory: 150Mi
+podDisruptionBudget:
+  enabled: true
+  minAvailable: 1
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: external-dns
-    repo: https://kubernetes-sigs.github.io/external-dns/
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "1.19.0"
    releaseName: externaldns
    namespace: externaldns
@@ -1,14 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/jfrog
-
-helmCharts:
-  - name: artifactory-jcr
-    repo: https://charts.jfrog.io
-    version: "107.133.10"
-    releaseName: artifactory-jcr
-    namespace: jfrog
-    valuesFile: values.yaml
@@ -1,63 +0,0 @@
---
-artifactory:
-  ## Artifactory
-  ## See full list of supported Artifactory options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  artifactory:
-    ## Default tag is from the artifactory sub-chart in the requirements.yaml
-    image:
-      registry: releases-docker.jfrog.io
-      repository: jfrog/artifactory-jcr
-    resources: {}
-    #  requests:
-    #    memory: "1Gi"
-    #    cpu: "500m"
-    #  limits:
-    #    memory: "4Gi"
-    #    cpu: "1"
-    ## The following Java options are passed to the java process running Artifactory.
-    ## You should set them according to the resources set above.
-    ## IMPORTANT: Make sure resources.limits.memory is at least 1G more than Xmx.
-    javaOpts: {}
-    # xms: "1g"
-    # xmx: "3g"
-    # other: ""
-  installer:
-    platform: jcr-helm
-  ## Nginx
-  ## See full list of supported Nginx options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  nginx:
-    enabled: true
-    tlsSecretName: ""
-    service:
-      type: LoadBalancer
-  ## Ingress
-  ## See full list of supported Ingress options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  ingress:
-    enabled: false
-    tls:
-  ## PostgreSQL
-  ## See list of supported postgresql options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  ## Configuration values for the PostgreSQL dependency sub-chart
-  ## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md
-  postgresql:
-    enabled: true
-  ## This key is required for upgrades to protect old PostgreSQL chart's breaking changes.
-  databaseUpgradeReady: "yes"
-  ## If NOT using the PostgreSQL in this chart (artifactory.postgresql.enabled=false),
-  ## specify custom database details here or leave empty and Artifactory will use embedded derby.
-  ## See full list of database options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  # database:
-  jfconnect:
-    enabled: false
-  rtfs:
-    enabled: false
-  onemodel:
-    enabled: false
-  evidence:
-    enabled: false
-  apptrust:
-    enabled: false
-  unifiedpolicy:
-    enabled: false
-  platformfederation:
-    enabled: false
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/litellm
@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: observability
+
+resources:
+  - ../../../base/observability
+
+helmCharts:
+  - name: victoria-metrics-cluster
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.33.0"
+    releaseName: victoria-metrics-cluster
+    namespace: observability
+    valuesFile: values-vmcluster.yaml
+  - name: victoria-metrics-agent
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.30.0"
+    releaseName: victoria-metrics-agent
+    namespace: observability
+    valuesFile: values-vmagent.yaml
@@ -0,0 +1,102 @@
+image:
+  repository: victoriametrics/vmagent
+  pullPolicy: IfNotPresent
+global:
+  scrape_interval: 15s
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+podAnnotations:
+  prometheus.io/scrape: "true"
+  prometheus.io/port: "8481"
+replicaCount: 3
+extraArgs:
+  envflag.enable: true
+  envflag.prefix: VM_
+  loggerFormat: json
+  httpListenAddr: :8429
+service:
+  enabled: true
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vmagent.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: vmagent.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+  hosts:
+    - name: vmagent.k8s.syd1.au.unkin.net
+      path:
+        - /
+      port: http
+  tls:
+    - hosts:
+        - vmagent.k8s.syd1.au.unkin.net
+      secretName: vmagent-tls
+  ingressClassName: nginx
+remoteWrite:
+  - url: http://victoria-metrics-cluster-vminsert.observability.svc.cluster.local:8480/insert/0/prometheus/
+scrape_configs:
+  - job_name: vmagent
+    static_configs:
+      - targets: ["localhost:8429"]
+  - job_name: "kubernetes-apiservers"
+    kubernetes_sd_configs:
+      - role: endpoints
+    scheme: https
+    tls_config:
+      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      insecure_skip_verify: true
+    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    relabel_configs:
+      - source_labels:
+          - __meta_kubernetes_namespace
+          - __meta_kubernetes_service_name
+          - __meta_kubernetes_endpoint_port_name
+        action: keep
+        regex: default;kubernetes;https
+  - job_name: "kubernetes-nodes"
+    scheme: https
+    tls_config:
+      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      insecure_skip_verify: true
+    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    kubernetes_sd_configs:
+      - role: node
+    relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+  - job_name: "kubernetes-nodes-cadvisor"
+    scheme: https
+    tls_config:
+      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      insecure_skip_verify: true
+    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    kubernetes_sd_configs:
+      - role: node
+    metrics_path: /metrics/cadvisor
+    relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+      - source_labels: [__metrics_path__]
+        target_label: metrics_path
+    metric_relabel_configs:
+      - action: replace
+        source_labels: [pod]
+        regex: '(.+)'
+        target_label: pod_name
+        replacement: '${1}'
+      - action: replace
+        source_labels: [container]
+        regex: '(.+)'
+        target_label: container_name
+        replacement: '${1}'
+      - action: replace
+        target_label: name
+        replacement: k8s_stub
+      - action: replace
+        source_labels: [id]
+        regex: '^/system\.slice/(.+)\.service$'
+        target_label: systemd_service_name
+        replacement: '${1}'
@@ -0,0 +1,185 @@
+vmselect:
+  enabled: true
+  image:
+    repository: victoriametrics/vmselect
+    pullPolicy: IfNotPresent
+    variant: cluster
+  extraArgs:
+    envflag.enable: true
+    envflag.prefix: VM_
+    loggerFormat: json
+    httpListenAddr: :8481
+    dedup.minScrapeInterval: 15s
+    replicationFactor: 2
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1024Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  horizontalPodAutoscaler:
+    enabled: true
+    maxReplicas: 10
+    minReplicas: 2
+    metrics:
+      - type: Resource
+        resource:
+          name: cpu
+          target:
+            type: Utilization
+            averageUtilization: 60
+    behavior:
+      scaleUp:
+        stabilizationWindowSeconds: 0
+        selectPolicy: Max
+        policies:
+          - type: Percent
+            value: 100
+            periodSeconds: 30
+          - type: Pods
+            value: 4
+            periodSeconds: 30
+      scaleDown:
+        stabilizationWindowSeconds: 300
+        selectPolicy: Min
+        policies:
+          - type: Percent
+            value: 10
+            periodSeconds: 60
+          - type: Pods
+            value: 2
+            periodSeconds: 60
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8481"
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+  replicaCount: 2
+  ingress:
+    enabled: true
+    annotations:
+      cert-manager.io/cluster-issuer: vault-issuer
+      cert-manager.io/common-name: vmselect.k8s.syd1.au.unkin.net
+      cert-manager.io/private-key-size: "4096"
+      external-dns.alpha.kubernetes.io/hostname: vmselect.k8s.syd1.au.unkin.net
+      external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    hosts:
+      - name: vmselect.k8s.syd1.au.unkin.net
+        path:
+          - /
+        port: http
+    tls:
+      - hosts:
+          - vmselect.k8s.syd1.au.unkin.net
+        secretName: vmselect-tls
+    ingressClassName: nginx
+
+vminsert:
+  enabled: true
+  image:
+    repository: victoriametrics/vminsert
+    variant: cluster
+    pullPolicy: IfNotPresent
+  extraArgs:
+    envflag.enable: true
+    envflag.prefix: VM_
+    loggerFormat: json
+    httpListenAddr: :8480
+    replicationFactor: 2
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1024Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  horizontalPodAutoscaler:
+    enabled: true
+    maxReplicas: 10
+    minReplicas: 2
+    metrics:
+      - type: Resource
+        resource:
+          name: cpu
+          target:
+            type: Utilization
+            averageUtilization: 60
+    behavior:
+      scaleUp:
+        stabilizationWindowSeconds: 0
+        selectPolicy: Max
+        policies:
+          - type: Percent
+            value: 100
+            periodSeconds: 30
+          - type: Pods
+            value: 4
+            periodSeconds: 30
+      scaleDown:
+        stabilizationWindowSeconds: 300
+        selectPolicy: Min
+        policies:
+          - type: Percent
+            value: 10
+            periodSeconds: 60
+          - type: Pods
+            value: 2
+            periodSeconds: 60
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8480"
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+  replicaCount: 2
+  ingress:
+    enabled: true
+    annotations:
+      cert-manager.io/cluster-issuer: vault-issuer
+      cert-manager.io/common-name: vminsert.k8s.syd1.au.unkin.net
+      cert-manager.io/private-key-size: "4096"
+      external-dns.alpha.kubernetes.io/hostname: vminsert.k8s.syd1.au.unkin.net
+      external-dns.alpha.kubernetes.io/target: 198.18.200.0
+      nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    hosts:
+      - name: vminsert.k8s.syd1.au.unkin.net
+        path:
+          - /
+        port: http
+    tls:
+      - hosts:
+          - vminsert.k8s.syd1.au.unkin.net
+        secretName: vminsert-tls
+    ingressClassName: nginx
+
+vmstorage:
+  enabled: true
+  image:
+    repository: victoriametrics/vmstorage
+    variant: cluster
+    pullPolicy: IfNotPresent
+  retentionPeriod: 180d
+  extraArgs:
+    envflag.enable: true
+    envflag.prefix: VM_
+    loggerFormat: json
+    httpListenAddr: :8482
+    dedup.minScrapeInterval: 15s
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8482"
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+  persistentVolume:
+    enabled: true
+    name: vmstorage-volume
+    accessModes:
+      - ReadWriteOnce
+    storageClassName: cephrbd-fast-delete
+    mountPath: /storage
+    size: 200Gi
+  replicaCount: 3
+  podManagementPolicy: OrderedReady
@@ -7,7 +7,7 @@ resources:

 helmCharts:
  - name: reloader
-    repo: https://stakater.github.io/stakater-charts
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "2.2.8"
    releaseName: reloader
    namespace: reloader-system
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vm-system
+
+resources:
+  - ../../../base/vm-system
+
+helmCharts:
+  - name: victoria-metrics-operator
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.57.1"
+    releaseName: victoria-metrics-operator
+    namespace: vm-system
+    valuesFile: values.yaml
@@ -0,0 +1,9 @@
+logLevel: "info"
+replicaCount: 2
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 50m
+    memory: 128Mi
@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vso-system
+
+resources:
+  - ../../../base/vso-system
+
+helmCharts:
+  - name: vault-secrets-operator
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "1.2.0"
+    releaseName: vault-secrets-operator
+    namespace: vso-system
+    valuesFile: values.yaml
+
+patches:
+  - path: patch_vaultauth-remove-namespace.yaml
+    target:
+      group: secrets.hashicorp.com
+      version: v1beta1
+      kind: VaultAuth
+      name: default
@@ -0,0 +1,2 @@
+- op: remove
+  path: /spec/namespace
@@ -0,0 +1,28 @@
+defaultVaultConnection:
+  enabled: true
+  address: "https://vault.service.consul:8200"
+  skipTLSVerify: false
+  caCertSecret: "vault-ca-cert"
+
+defaultAuthMethod:
+  enabled: true
+  method: "kubernetes"
+  mount: "k8s/au/syd1"
+  namespace: ""
+  kubernetes:
+    role: "default"
+    serviceAccount: "vault-secrets-operator-controller-manager"
+    tokenAudiences: ["vault"]
+
+controller:
+  replicas: 3
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+
+globalVaultAuth:
+  enabled: true
@@ -26,7 +26,7 @@ server:
    WOODPECKER_OPEN: "true"
    WOODPECKER_ADMIN: "unkinben"
    WOODPECKER_DISABLE_USER_AGENT_REGISTRATION: "true"
-    WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx:latest-insecure"
+    WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure"
  extraSecretNamesForEnvFrom:
    - woodpecker-gitea
    - woodpecker-postgres-credentials
@@ -0,0 +1,31 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: aitooling-apps
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://git.unkin.net/unkin/argocd-apps
+      revision: HEAD
+      directories:
+      - path: apps/overlays/*/litellm
+  template:
+    metadata:
+      name: 'aitooling-{{path[3]}}'
+    spec:
+      project: aitooling
+      source:
+        repoURL: https://git.unkin.net/unkin/argocd-apps
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path[3]}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - ServerSideApply=true
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
+  - aitooling.yaml
+  - observability.yaml
  - platform.yaml
  - storage.yaml
@@ -0,0 +1,31 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: observability-apps
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://git.unkin.net/unkin/argocd-apps
+      revision: HEAD
+      directories:
+      - path: apps/overlays/*/observability
+  template:
+    metadata:
+      name: 'observability-{{path[3]}}'
+    spec:
+      project: observability
+      source:
+        repoURL: https://git.unkin.net/unkin/argocd-apps
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path[3]}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - ServerSideApply=true
@@ -15,6 +15,7 @@ spec:
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
      - path: apps/overlays/*/cnpg-system
+      - path: apps/overlays/*/elastic-system
      - path: apps/overlays/*/externaldns
      - path: apps/overlays/*/inteldeviceplugins-system
      - path: apps/overlays/*/jfrog
@@ -24,6 +25,8 @@ spec:
      - path: apps/overlays/*/reflector-system
      - path: apps/overlays/*/reloader-system
      - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
  template:
    metadata:
@@ -0,0 +1,19 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: aitooling
+  namespace: argocd
+spec:
+  description: AI tooling services
+  sourceRepos:
+    - https://git.unkin.net/unkin/argocd-apps
+  destinations:
+    - namespace: 'litellm'
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+  namespaceResourceWhitelist:
+    - group: '*'
+      kind: '*'
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
+  - aitooling.yaml
+  - observability.yaml
  - platform.yaml
  - storage.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: observability
+  namespace: argocd
+spec:
+  description: Observability stack (metrics, monitoring)
+  sourceRepos:
+    - https://git.unkin.net/unkin/argocd-apps
+    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+  destinations:
+    - namespace: 'observability'
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+    - group: 'rbac.authorization.k8s.io'
+      kind: ClusterRole
+    - group: 'rbac.authorization.k8s.io'
+      kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+    - group: '*'
+      kind: '*'
@@ -8,12 +8,7 @@ spec:
  description: Platform infrastructure and core services
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
-    - https://charts.jetstack.io
-    - https://cloudnative-pg.github.io/charts
-    - https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
-    - https://intel.github.io/helm-charts/
-    - https://kubernetes-sigs.github.io/external-dns/
-    - https://releases.rancher.com/server-charts/stable
+    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    - oci://gcr.io/k8s-staging-nfd/charts
    - oci://ghcr.io/emberstack/helm-charts
    - oci://ghcr.io/woodpecker-ci/helm/woodpecker
@@ -8,7 +8,7 @@ spec:
  description: Storage infrastructure and CSI drivers
  sourceRepos:
    - https://git.unkin.net/unkin/argocd-apps
-    - https://ceph.github.io/csi-charts
+    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
  destinations:
    - namespace: 'csi-*'
      server: https://kubernetes.default.svc
Author	SHA1	Message	Date
unkinben	fea2177391	chore: migrate to artifactapi helm virtual repo ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details - replace all helm repos with artifactapi/virtual/helm - update projects with accepted repos - set resource requests/limits for woodpecker jobs	2026-05-02 17:24:24 +10:00
unkinben	5372914803	feat: add litellm to new aitooling ArgoCD project (#94 ) Deploys LiteLLM proxy with CNPG PostgreSQL (3-instance HA), PgBouncer pooler, and Redis cache. Introduces a dedicated aitooling AppProject and ApplicationSet to keep AI tooling services separate from platform infra. Reviewed-on: #94	2026-05-01 21:40:26 +10:00
unkinben	67bb54f092	fix: artifactapi remotes (#93 ) - split each yaml into its own mount Reviewed-on: #93	2026-05-01 21:17:16 +10:00
unkinben	fc568dc8b5	feat: split artifactapi config into conf.d and update to v2.7.1 (#92 ) Split monolithic remotes.yaml into per-type-package files under resources/conf.d/ to align with artifactapi v2.7.1 directory loading. Updated schema: virtuals/locals use dedicated top-level keys, type field removed. Added helm remotes for all kustomize helmCharts repos and OCI patterns to docker remotes. CONFIG_PATH now points to the directory. Reviewed-on: #92	2026-04-30 23:59:01 +10:00
unkinben	1c2c18697d	feat: update artifactapi to 2.3.0 (#91 ) - update to mutable/immutable ttl/patterns - reoganised paths to correct patterns Reviewed-on: #91	2026-04-27 13:16:02 +10:00
unkinben	f2af65bc92	fix: update include patterns (#90 ) - hadolint and nvim were wrong, updating Reviewed-on: #90	2026-04-26 16:20:53 +10:00
unkinben	fdca69d99a	feat: update github remotes (#89 ) - enable access to all tagged, master and main branches as tar/gzip - enable access to additional tool releases Reviewed-on: #89	2026-04-26 16:05:57 +10:00
unkinben	f80be18220	benvin/dockerremotes (#88 ) Reviewed-on: #88	2026-04-25 22:34:59 +10:00
unkinben	3a6d93bc3c	feat: add woodpeckerci/plugin-docker-buildx to WOODPECKER_PLUGINS_PRIVILEGED (#87 ) Plugin is no longer privileged by default in Woodpecker; explicitly list both the standard and latest-insecure variants. Reviewed-on: #87	2026-04-25 20:48:46 +10:00
unkinben	7535d655fe	feat: add docker remotes to artifactapi (#86 ) - set artifactapi to specific version - add dockerhub and ghcr to remotes Reviewed-on: #86	2026-04-25 17:40:35 +10:00
unkinben	3fc9cfa41a	feat: add claude-code remote (#85 ) Reviewed-on: #85	2026-04-25 11:20:47 +10:00
unkinben	7d555cd31a	feat: migrate purelb to ArgoCD (#84 ) Migrate PureLB load balancer from Terragrunt to ArgoCD/Kustomize. Deploys purelb v0.13.0 with two LBNodeAgent and two ServiceGroup CRs (common: 198.18.200.0/24, dmz: 198.18.199.0/24). Adds LBNodeAgent and ServiceGroup to kubeconform skip list (no CRD catalog schema). 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #84	2026-04-07 19:52:17 +10:00
unkinben	f0bdc0231a	feat: migrate vso-system to ArgoCD (#81 ) Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize. Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole, ClusterRoleBindings, and vault-admin ServiceAccount. Note: static service account tokens (kubernetes.io/service-account-token) cannot be stored in git; create manually or via Vault after deployment. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #81	2026-04-07 19:33:50 +10:00
unkinben	b100f3034e	feat: migrate observability to ArgoCD (#82 ) Migrate Victoria Metrics cluster and agent from Terragrunt to ArgoCD/Kustomize. Creates new observability AppProject and ApplicationSet. Deploys victoria-metrics-cluster v0.33.0 (vmselect/vminsert/vmstorage with HPA, PDB, ingress) and victoria-metrics-agent v0.30.0 (3 replicas, k8s scrape configs) in the observability namespace. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #82	2026-04-07 19:15:45 +10:00
unkinben	c3a145acbf	feat: remove jfrog container registry (#83 ) its not used and never really installed correctly. going to change to artifact-keeper which promises to have the same capabilities and is open source. Reviewed-on: #83	2026-04-07 19:03:32 +10:00
unkinben	181bc152e7	feat: migrate vm-system to ArgoCD (#80 ) Migrate Victoria Metrics operator from Terragrunt to ArgoCD/Kustomize. Deploys victoria-metrics-operator v0.57.1 with 2 replicas in vm-system. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #80	2026-03-27 17:04:15 +11:00
unkinben	5bcbd7e1ba	feat: migrate elastic-system to ArgoCD (#79 ) Migrate ECK operator from Terragrunt to ArgoCD/Kustomize. Deploys eck-operator v3.2.0 with 2 replicas and PodDisruptionBudget in the elastic-system namespace. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #79	2026-03-27 17:00:05 +11:00