feat(artifactapi): add valkey/valkey to dockerhub allowed patterns

Required for stalwart in-memory store (rate limiting, locks, OAuth codes).

apps/base/artifactapi/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: artifactapi
-      kind: Gateway
-      name: artifactapi
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: artifactapi
-      kind: Gateway
-      name: artifactapi
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: artifactapi-api
-          kind: Service
-          name: artifactapi-api
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,7 +6,7 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
-      - "^open-webui/open-webui"
+      - "^kanidm/"
       - "^openvoxproject/"
       - "^stakater/reloader"
       - "^stalwartlabs/stalwart"
@@ -35,7 +35,6 @@ remotes:
       - "^hashicorp/consul"
       - "^hashicorp/vault"
       - "^jfrog/"
-      - "^kanidm/"
       - "^rancher/"
       - "^rspamd/rspamd"
       - "^tozd/postfix"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -5,7 +5,6 @@ remotes:
     description: "GitHub releases and files"
     mutable_patterns:
       - ".*/archive/refs/heads/.*.tar.gz$"
-      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
     immutable_patterns:
       - ".*/archive/refs/tags/.*.tar.gz$"
       - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
@@ -36,7 +35,6 @@ remotes:
       - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
       - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
       - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
       - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
       - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
       - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"

apps/base/cattle-system/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - rancher.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: rancher
-      kind: Gateway
-      name: rancher
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - rancher.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: rancher
-      kind: Gateway
-      name: rancher
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: rancher
-          kind: Service
-          name: rancher
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/consul/httproute.yaml

@@ -11,9 +11,7 @@ spec:
   hostnames:
     - consul.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: consul
-      kind: Gateway
-      name: consul
       sectionName: http
   rules:
     - filters:
@@ -38,17 +36,12 @@ spec:
   hostnames:
     - consul.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: consul
-      kind: Gateway
-      name: consul
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: consul-ui
-          kind: Service
-          name: consul-ui
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix
@@ -66,17 +59,12 @@ spec:
   hostnames:
     - consul.service.consul
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: consul
-      kind: Gateway
-      name: consul
       sectionName: consul-svc
   rules:
     - backendRefs:
-        - group: ""
+        - name: consul-ui
-          kind: Service
-          name: consul-ui
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/kanidm/README.md

@@ -1,51 +0,0 @@
-# kanidm
-
-Three-replica kanidm identity server with Vault-managed replication certificates.
-
-## Architecture
-
-- Per-pod `server-N.toml` in `resources/` — each has its own replication origin hardcoded
-- `config-init` busybox init container copies the right config and injects peer certs from the
-  vault-synced `kanidm-repl-certs` Secret at pod startup
-- `reloader.stakater.com/auto: "true"` triggers a rolling restart when the ConfigMap or Secret changes
-- Vault path: `kv/kubernetes/namespace/kanidm/default/repl-certs`
-  - Keys: `kanidm-0`, `kanidm-1`, `kanidm-2` — each holds that pod's replication certificate
-
-## Initial setup
-
-After the first pod starts, generate the admin credentials:
-
-```bash
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml admin
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml idm_admin
-```
-
-## Replication certificate rotation
-
-When certs need to be renewed, update vault and reloader will roll the StatefulSet:
-
-```bash
-# Get new cert from a pod
-kubectl exec -it -n kanidm kanidm-N -- /sbin/kanidmd renew-replication-certificate -c /config/server.toml
-
-# Write updated cert to vault (reloader triggers restart automatically)
-vault kv patch kv/kubernetes/namespace/kanidm/default/repl-certs "kanidm-N=<cert>"
-```
-
-## Resolving domain UUID mismatch
-
-If pods initialized independently (each with a different domain UUID), replication will fail with
-`Consumer Domain UUID does not match`. Fix by resetting kanidm-1 and kanidm-2 to sync from
-kanidm-0 (the authoritative node):
-
-```bash
-# Scale down to avoid split-brain during reset
-kubectl scale statefulset -n kanidm kanidm --replicas=1
-
-# Delete the stale PVCs for the replica pods
-kubectl delete pvc -n kanidm data-kanidm-1 data-kanidm-2
-
-# Scale back up — replicas start with empty DBs and automatic_refresh=true
-# will trigger a full sync from kanidm-0 once TLS peer certs are verified
-kubectl scale statefulset -n kanidm kanidm --replicas=3
-```

apps/base/kanidm/certificate.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kanidm-tls
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  secretName: kanidm-tls
-  issuerRef:
-    kind: ClusterIssuer
-    name: vault-issuer
-  commonName: auth.unkin.net
-  dnsNames:
-    - auth.unkin.net
-    - au.auth.unkin.net
-    - kanidm.k8s.syd1.au.unkin.net
-    - kanidm.kanidm.svc.cluster.local
-    - kanidm-0.kanidm-headless.kanidm.svc.cluster.local
-    - kanidm-1.kanidm-headless.kanidm.svc.cluster.local
-    - kanidm-2.kanidm-headless.kanidm.svc.cluster.local
-  privateKey:
-    algorithm: RSA
-    size: 4096

apps/base/kanidm/gateway.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-    traefik.io/instance: internal
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https-passthrough
-      port: 443
-      protocol: TLS
-      tls:
-        mode: Passthrough
-      allowedRoutes:
-        namespaces:
-          from: Same

apps/base/kanidm/httproute.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: kanidm-http-redirect
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  hostnames:
-    - kanidm.k8s.syd1.au.unkin.net
-    - auth.unkin.net
-    - au.auth.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/kanidm/kustomization.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - certificate.yaml
-  - service.yaml
-  - statefulset.yaml
-  - poddisruptionbudget.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - tlsroute.yaml
-
-configMapGenerator:
-  - name: kanidm-config
-    namespace: kanidm
-    options:
-      disableNameSuffixHash: true
-      labels:
-        app.kubernetes.io/name: kanidm
-        app.kubernetes.io/instance: kanidm
-    files:
-      - server-0.toml=resources/server-0.toml
-      - server-1.toml=resources/server-1.toml
-      - server-2.toml=resources/server-2.toml

apps/base/kanidm/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kanidm

apps/base/kanidm/poddisruptionbudget.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kanidm
-      app.kubernetes.io/instance: kanidm

apps/base/kanidm/rbac.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kanidm-repl
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["kanidm-repl-certs"]
-    verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kanidm-repl
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-subjects:
-  - kind: ServiceAccount
-    name: kanidm
-    namespace: kanidm
-roleRef:
-  kind: Role
-  name: kanidm-repl
-  apiGroup: rbac.authorization.k8s.io

apps/base/kanidm/resources/server-0.toml

@@ -1,19 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-1.toml

@@ -1,19 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-2.toml

@@ -1,19 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"

apps/base/kanidm/service.yaml

@@ -1,43 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  type: ClusterIP
-  ports:
-    - name: https
-      port: 8443
-      targetPort: https
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm-headless
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - name: https
-      port: 8443
-      targetPort: https
-      protocol: TCP
-    - name: replication
-      port: 8444
-      targetPort: replication
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm

apps/base/kanidm/serviceaccount.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm

apps/base/kanidm/statefulset.yaml

@@ -1,133 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kanidm
-  namespace: kanidm
-  annotations:
-    reloader.stakater.com/auto: "true"
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  serviceName: kanidm-headless
-  replicas: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kanidm
-      app.kubernetes.io/instance: kanidm
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: kanidm
-        app.kubernetes.io/instance: kanidm
-    spec:
-      serviceAccountName: kanidm
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: kanidm
-                  app.kubernetes.io/instance: kanidm
-              topologyKey: kubernetes.io/hostname
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        fsGroup: 1000
-      initContainers:
-        - name: config-init
-          image: busybox:1.36
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
-              for peer in kanidm-0 kanidm-1 kanidm-2; do
-                [ "${peer}" = "${POD_NAME}" ] && continue
-                cert_file="/repl-certs/${peer}"
-                [ -s "${cert_file}" ] || continue
-                fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
-                printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
-                  "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-              readOnly: true
-            - name: config
-              mountPath: /config
-            - name: repl-certs
-              mountPath: /repl-certs
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-      containers:
-        - name: kanidm
-          image: kanidm/server:1.10.3
-          command: ["/sbin/kanidmd"]
-          args: ["server", "-c", "/config/server.toml"]
-          ports:
-            - name: https
-              containerPort: 8443
-              protocol: TCP
-            - name: replication
-              containerPort: 8444
-              protocol: TCP
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: config
-              mountPath: /config
-              readOnly: true
-            - name: tls
-              mountPath: /data/tls
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          resources:
-            requests:
-              memory: 256Mi
-              cpu: 100m
-            limits:
-              memory: 1Gi
-              cpu: 500m
-          readinessProbe:
-            tcpSocket:
-              port: 8443
-            initialDelaySeconds: 15
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              port: 8443
-            initialDelaySeconds: 30
-            periodSeconds: 30
-      volumes:
-        - name: config-template
-          configMap:
-            name: kanidm-config
-        - name: config
-          emptyDir: {}
-        - name: repl-certs
-          secret:
-            secretName: kanidm-repl-certs
-        - name: tls
-          secret:
-            secretName: kanidm-tls
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: [ReadWriteOnce]
-        storageClassName: cephrbd-fast-delete
-        resources:
-          requests:
-            storage: 10Gi

apps/base/kanidm/tlsroute.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TLSRoute
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  hostnames:
-    - kanidm.k8s.syd1.au.unkin.net
-    - auth.unkin.net
-    - au.auth.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
-      sectionName: https-passthrough
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: kanidm
-          port: 8443
-          weight: 1

apps/base/kanidm/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: kanidm
-spec:
-  allowedNamespaces:
-    - kanidm
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/kanidm/vaultstaticsecret.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: repl-certs
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: kubernetes/namespace/kanidm/default/repl-certs
-  refreshAfter: 5m
-  destination:
-    name: kanidm-repl-certs
-    create: true
-    overwrite: true
-  hmacSecretData: true

apps/base/litellm/cnpg_cluster.yaml

@@ -76,8 +76,8 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: "1"
+      cpu: 1
-      memory: 1Gi
+      memory: 1024Mi
     requests:
       cpu: 250m
       memory: 512Mi

apps/base/litellm/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - litellm.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: litellm
-      kind: Gateway
-      name: litellm
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - litellm.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: litellm
-      kind: Gateway
-      name: litellm
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: litellm
-          kind: Service
-          name: litellm
           port: 4000
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/paperclip/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - paperclip.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: paperclip
-      kind: Gateway
-      name: paperclip
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - paperclip.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: paperclip
-      kind: Gateway
-      name: paperclip
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: paperclip
-          kind: Service
-          name: paperclip
           port: 3100
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/priority-classes/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - priorityclasses.yaml

apps/base/priority-classes/priorityclasses.yaml

@@ -1,36 +0,0 @@
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: low
-value: 100
-preemptionPolicy: Never
-globalDefault: false
-description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: power
-value: 100
-preemptionPolicy: Never
-globalDefault: false
-description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: medium
-value: 10000
-preemptionPolicy: PreemptLowerPriority
-globalDefault: false
-description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: high
-value: 100000
-preemptionPolicy: PreemptLowerPriority
-globalDefault: false
-description: "High-importance services. Will preempt medium- and low-priority pods if necessary."

apps/base/puppet/httproute_puppetboard.yaml

@@ -13,9 +13,7 @@ spec:
   hostnames:
     - puppetboard.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: puppetboard
-      kind: Gateway
-      name: puppetboard
       sectionName: http
   rules:
     - filters:
@@ -42,17 +40,12 @@ spec:
   hostnames:
     - puppetboard.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: puppetboard
-      kind: Gateway
-      name: puppetboard
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: puppetboard
-          kind: Service
-          name: puppetboard
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/puppet/httproute_puppetdb.yaml

@@ -13,17 +13,12 @@ spec:
   hostnames:
     - puppetdb.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: puppetdb
-      kind: Gateway
-      name: puppetdb
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: puppetdb
-          kind: Service
-          name: puppetdb
           port: 8080
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/puppet/service_puppetdb.yaml

@@ -9,6 +9,7 @@ metadata:
   name: puppetdb
   namespace: puppet
 spec:
+  clusterIP: null
   ports:
   - name: pdb-http
     port: 8080

apps/base/vault/httproute.yaml

@@ -11,9 +11,7 @@ spec:
   hostnames:
     - vault.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: vault
-      kind: Gateway
-      name: vault
       sectionName: http
   rules:
     - filters:
@@ -38,17 +36,12 @@ spec:
   hostnames:
     - vault.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: vault
-      kind: Gateway
-      name: vault
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: vault
-          kind: Service
-          name: vault
           port: 8200
-          weight: 1
       matches:
         - path:
             type: PathPrefix
@@ -67,17 +60,12 @@ spec:
     - vault.service.consul
     - vault.query.consul
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: vault
-      kind: Gateway
-      name: vault
       sectionName: vault-direct
   rules:
     - backendRefs:
-        - group: ""
+        - name: vault
-          kind: Service
-          name: vault
           port: 8200
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/vault/kustomization.yaml

@@ -6,4 +6,3 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
-  - role_k8s-service-registration.yaml

apps/base/vault/role_k8s-service-registration.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: vault-k8s-service-registration
-  namespace: vault
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: vault-k8s-service-registration
-  namespace: vault
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: vault-k8s-service-registration
-subjects:
-  - kind: ServiceAccount
-    name: vault
-    namespace: vault

apps/overlays/au-syd1/consul/values.yaml

@@ -37,7 +37,7 @@ server:
       cpu: 100m
     limits:
       memory: 2Gi
-      cpu: "1"
+      cpu: 1000m
 
 client:
   enabled: false

apps/overlays/au-syd1/kanidm/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/kanidm

apps/overlays/au-syd1/priority-classes/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/priority-classes

apps/overlays/au-syd1/vault/values.yaml

@@ -40,7 +40,9 @@ server:
           }
         }
 
-        service_registration "kubernetes" {}
+        service_registration "consul" {
+          address = "consul-server.consul.svc.cluster.local:8500"
+        }
 
   dataStorage:
     enabled: true
@@ -48,14 +50,6 @@ server:
     storageClass: cephrbd-fast-delete
     accessMode: ReadWriteOnce
 
-  extraEnv:
-    - name: VAULT_K8S_NAMESPACE
-      value: vault
-    - name: VAULT_K8S_POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-
   statefulSet:
     securityContext:
       container:

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -2,7 +2,6 @@ agent:
   replicaCount: 3
   env:
     WOODPECKER_MAX_WORKFLOWS: "8"
-    WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
     WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
     WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
     WOODPECKER_BACKEND_K8S_STORAGE_RWX: false

argocd/applicationsets/platform.yaml

@@ -20,9 +20,7 @@ spec:
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
-      - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/priority-classes
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
@@ -45,12 +43,6 @@ spec:
       destination:
         server: https://kubernetes.default.svc
         namespace: '{{path[3]}}'  # Use directory name as namespace
-      ignoreDifferences:
-      - group: ""
-        kind: ConfigMap
-        name: kanidm-repl-certs
-        jsonPointers:
-        - /data
       syncPolicy:
         automated:
           prune: true

argocd/projects/platform.yaml

@@ -27,12 +27,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
-    - namespace: 'kanidm'
-      server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
-    - namespace: 'priority-classes'
-      server: https://kubernetes.default.svc
     - namespace: 'purelb'
       server: https://kubernetes.default.svc
     - namespace: 'puppet'