kea-operator: bump to v0.1.6

Stop the operator's reconcile hot-loop, which was hot-reloading Kea about 9 times a second and flooding the dhcp-system logs.

apps/base/artifactapi/api-deployment.yaml

@@ -36,7 +36,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
+          image: git.unkin.net/unkin/artifactapi:v3.12.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/image-keeper.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: image-keeper
-  namespace: artifactapi
-spec:
-  selector:
-    matchLabels:
-      app: image-keeper
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: image-keeper
-    spec:
-      automountServiceAccountToken: false
-      priorityClassName: low
-      tolerations:
-        - operator: Exists
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-        # artifactapi is distroless with no exit-0 flag, so run a static busybox as `true`
-        - name: copy-true
-          image: busybox:1.37.0-musl
-          imagePullPolicy: IfNotPresent
-          command: ["cp", "/bin/busybox", "/keeper/true"]
-          volumeMounts:
-            - name: keeper
-              mountPath: /keeper
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
-          imagePullPolicy: IfNotPresent
-          command: ["/keeper/true"]
-          volumeMounts:
-            - name: keeper
-              mountPath: /keeper
-              readOnly: true
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
-          imagePullPolicy: IfNotPresent
-          command: ["true"]
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-      containers:
-        - name: pause
-          image: rancher/mirrored-pause:3.6
-          imagePullPolicy: IfNotPresent
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-      volumes:
-        - name: keeper
-          emptyDir: {}

apps/base/artifactapi/kustomization.yaml

@@ -11,7 +11,6 @@ resources:
   - cnpg_pooler.yaml
   - gateway.yaml
   - httproute.yaml
-  - image-keeper.yaml
   - namespace.yaml
   - oauth2-proxy-configmap.yaml
   - oauth2-proxy-deployment.yaml

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
+          image: git.unkin.net/unkin/artifactapi-ui:v3.12.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/dhcp-system/cr/keaapi.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 1
-  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/kea-api:v0.1.7
+  image: git.unkin.net/unkin/kea-api:v0.1.3
   tokenSecretName: kea-api-token
   service:
     type: ClusterIP

apps/base/dhcp-system/cr/keacluster.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/kea:v0.1.7
+  image: git.unkin.net/unkin/kea:v0.1.3
   domainName: main.unkin.net
   defaultLeaseTime: 1200
   maxLeaseTime: 86400

apps/base/dhcp-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/kea-operator:v0.1.7
+          image: git.unkin.net/unkin/kea-operator:v0.1.6
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/mail/cnpg_backup.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: cnpg-mail-backup
-  namespace: mail
-spec:
-  displayName: "CNPG backup owner (mail)"
-  uid: cnpg-mail-backup
-  maxBuckets: 5
-  secretName: cnpg-mail-backup-s3
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: cnpg-mail
-  namespace: mail
-spec:
-  placementTarget: ec
-  bucketName: cnpg-mail
-  ownerRef: cnpg-mail-backup
-  versioning: false
-  tags:
-    app: mail
-    purpose: cnpg-backup
-  retainOnDelete: true
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg-mail-nightly
-  namespace: mail
-spec:
-  schedule: "0 20 4 * * *"
-  immediate: false
-  backupOwnerReference: self
-  method: barmanObjectStore
-  cluster:
-    name: stalwart-db

apps/base/mail/cnpg_cluster.yaml

@@ -1,118 +0,0 @@
----
-# Stalwart metadata store. No bootstrap secret: CNPG mints stalwart-db-app
-# (username/password/dbname/uri) for Stalwart to consume.
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: stalwart-db
-  namespace: mail
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  backup:
-    retentionPolicy: 30d
-    barmanObjectStore:
-      destinationPath: s3://cnpg-mail
-      endpointURL: https://s3.ceph.unkin.net
-      endpointCA:
-        name: vault-ca-cert
-        key: ca.crt
-      s3Credentials:
-        accessKeyId:
-          name: cnpg-mail-backup-s3
-          key: AWS_ACCESS_KEY_ID
-        secretAccessKey:
-          name: cnpg-mail-backup-s3
-          key: AWS_SECRET_ACCESS_KEY
-      serverName: stalwart-db
-      data:
-        compression: bzip2
-        jobs: 2
-      wal:
-        compression: zstd
-        maxParallel: 2
-  bootstrap:
-    initdb:
-      database: stalwart
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: stalwart
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      hot_standby_feedback: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      pg_stat_statements.max: "10000"
-      pg_stat_statements.track: top
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    shared_preload_libraries:
-      - pg_stat_statements
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: "1"
-      memory: 1Gi
-    requests:
-      cpu: 50m
-      memory: 512Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/mail/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_backup.yaml
-  - cnpg_cluster.yaml
-  - namespace.yaml
-  - stalwart-blobs-bucket.yaml

apps/base/mail/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: mail

apps/base/mail/stalwart-blobs-bucket.yaml

@@ -1,30 +0,0 @@
----
-# Stalwart S3 blob store. The owner user has read-write on its own bucket; the
-# operator mints AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / S3_ENDPOINT into
-# stalwart-blobs-s3.
-apiVersion: ceph.unkin.net/v1alpha1
-kind: ObjectStoreUser
-metadata:
-  name: stalwart-blobs
-  namespace: mail
-spec:
-  displayName: "Stalwart blob store owner"
-  uid: mail-stalwart-blobs
-  maxBuckets: 5
-  secretName: stalwart-blobs-s3
-  retainOnDelete: true
----
-apiVersion: ceph.unkin.net/v1alpha1
-kind: Bucket
-metadata:
-  name: stalwart-blobs
-  namespace: mail
-spec:
-  placementTarget: ec
-  bucketName: stalwart-blobs
-  ownerRef: stalwart-blobs
-  versioning: false
-  tags:
-    app: stalwart
-    purpose: blob-store
-  retainOnDelete: true

apps/base/pdbmux/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         - name: pdbmux
           # Image is published by the pdbmux repo's .woodpecker/docker.yaml on
           # a v* tag. It only exists after that tag is cut (see PR merge gates).
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.5.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.4.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/woodpecker/kustomization.yaml

@@ -20,7 +20,6 @@ resources:
   - serviceaccount_repospawner_ci.yaml
   - serviceaccount_terraform_artifactapi.yaml
   - serviceaccount_terraform_authentik.yaml
-  - serviceaccount_terraform_binarylane.yaml
   - serviceaccount_terraform_enc.yaml
   - serviceaccount_terraform_git.yaml
   - serviceaccount_terraform_netbox.yaml

apps/base/woodpecker/serviceaccount_terraform_binarylane.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-binarylane
-  namespace: woodpecker

apps/overlays/au-syd1/consul/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/consul
+
+helmCharts:
+  - name: consul
+    repo: https://helm.releases.hashicorp.com
+    version: "1.9.7"
+    releaseName: consul
+    namespace: consul
+    valuesFile: values.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/consul/values.yaml

@@ -0,0 +1,77 @@
+global:
+  name: consul
+  datacenter: au-syd1
+  domain: consul
+
+  acls:
+    # Enable chart-managed ACL tokens/policies for Consul system components.
+    manageSystemACLs: true
+    # Source the bootstrap/management token from a pre-existing Kubernetes secret
+    # instead of letting the chart generate one. The secret is synced from Vault
+    # via VSO (see ../../../base/consul/vaultauth.yaml and vaultstaticsecret.yaml).
+    # When this secret is populated the server-acl-init job SKIPS bootstrapping and
+    # uses the supplied token as the management token, so the k8s cluster bootstraps
+    # with the SAME initial_management token as the authoritative VM cluster.
+    bootstrapToken:
+      secretName: consul-bootstrap-acl-token
+      secretKey: token
+
+server:
+  image: hashicorp/consul:1.22.7
+  replicas: 5
+  bootstrapExpect: 5
+  storage: 10Gi
+  storageClass: cephrbd-fast-delete
+
+  connect: true
+
+  disruptionBudget:
+    maxUnavailable: 1
+
+  extraConfig: |
+    {
+      "acl": {
+        "enabled": true,
+        "default_policy": "deny",
+        "down_policy": "extend-cache",
+        "enable_token_persistence": true
+      },
+      "disable_remote_exec": true,
+      "disable_update_check": true,
+      "performance": {
+        "raft_multiplier": 10
+      },
+      "ports": {
+        "dns": 8600,
+        "grpc": 8502,
+        "http": 8500,
+        "https": -1
+      },
+      "primary_datacenter": "au-syd1"
+    }
+
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 2Gi
+      cpu: "1"
+
+client:
+  enabled: false
+
+ui:
+  enabled: true
+  service:
+    type: ClusterIP
+
+connectInject:
+  enabled: false
+
+dns:
+  enabled: true
+  type: LoadBalancer
+  annotations: |
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.5

apps/overlays/au-syd1/mail/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/mail

argocd/applicationsets/platform.yaml

@@ -34,7 +34,6 @@ spec:
       - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/k8up-system
       - path: apps/overlays/*/kanidm
-      - path: apps/overlays/*/mail
       - path: apps/overlays/*/netbox
       - path: apps/overlays/*/node-feature-discovery
       - path: apps/overlays/*/pdbmux

argocd/projects/platform.yaml

@@ -49,8 +49,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'kanidm'
       server: https://kubernetes.default.svc
-    - namespace: 'mail'
-      server: https://kubernetes.default.svc
     - namespace: 'netbox'
       server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'