Commit Graph

Select branches

Hide Pull Requests

benvin/add-bind-operator

benvin/argocd-image-updater-deploy

benvin/artifactapi-tf-signing

benvin/artifactkeeper

benvin/externaldns-debug-logging

benvin/externaldns-fix

benvin/fix-externaldns-crashing

benvin/grafana-operator

benvin/grafana-schemas

benvin/helm_virtual

benvin/kubeconform-crd-schemas

benvin/litellm-sso

benvin/media-apps-argocd

benvin/oauth2-proxy-image-fix

benvin/opa_policies

benvin/postfix

benvin/resolver-validate-except

benvin/stalwart

benvin/traefik-ldaps-entrypoint

fix-kanidm-replication-config

issue-155-open-webui-litellm

main

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#112

#113

#114

#115

#116

#117

#118

#119

#12

#120

#121

#122

#123

#124

#125

#126

#127

#128

#129

#13

#130

#131

#132

#133

#134

#135

#136

#137

#138

#139

#14

#140

#141

#142

#143

#144

#145

#146

#147

#148

#149

#15

#150

#151

#152

#153

#156

#157

#158

#159

#16

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#173

#174

#175

#176

#177

#178

#179

#18

#180

#181

#182

#183

#184

#185

#186

#187

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#197

#198

#199

#2

#20

#200

#201

#202

#203

#204

#205

#206

#207

#208

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#225

#226

#227

#228

#229

#23

#230

#231

#232

#233

#234

#235

#236

#237

#238

#239

#24

#240

#241

#242

#243

#244

#245

#246

#247

#248

#249

#25

#250

#251

#252

#253

#254

#255

#256

#257

#258

#259

#26

#260

#261

#262

#263

#264

#265

#266

#267

#268

#269

#27

#270

#271

#272

#273

#274

#275

#276

#277

#278

#279

#28

#280

#281

#282

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#292

#293

#294

#295

#296

#297

#298

#299

#3

#30

#300

#301

#302

#303

#304

#305

#306

#308

#309

#31

#310

#311

#312

#313

#314

#315

#316

#317

#318

#319

#32

#320

#327

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#338

#339

#34

#340

#341

#342

#343

#344

#345

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#358

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#384

#385

#386

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#4

#40

#400

#401

#402

#403

#404

#405

#406

#407

#408

#409

#41

#410

#411

#412

#413

#414

#415

#416

#417

#418

#419

#42

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#43

#430

#431

#432

#433

#434

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

Mono Color

• a52a419dfd Point media apps at the real mediafs library via a static CephFS PV Ben Vincent 2026-08-09 13:39:40 +10:00
• e03aeca101 Add media-apps stack to ArgoCD Ben Vincent 2026-08-09 13:25:25 +10:00
• 4d58f37ea5 Fix cert-manager recursive-nameserver ControllerConfiguration field (#347) unkinben 2026-08-09 12:35:38 +10:00
• 07bd94c55a Wire API_TOKEN_PEPPERS into NetBox config (#346) unkinben 2026-08-09 12:33:30 +10:00
• 2739a29778 Bump kea images to v0.1.3 (HA peer DNS startup wait) (#344) unkinben 2026-08-08 23:36:25 +10:00
• 5e409f5f06 traefik-internal: add ldaps :636 entrypoint for authentik LDAPS (#345) unkinben 2026-08-08 23:19:18 +10:00
• ef4f5f68a0 traefik-internal: add ldaps :636 entrypoint for authentik LDAPS benvin/traefik-ldaps-entrypoint Ben Vincent 2026-08-08 23:16:50 +10:00
• 4c2f275f04 puppet: reduce privilege in namespace workloads (#307) (#319) unkinben 2026-08-08 22:36:44 +10:00
• 5ebf2cc581 Bump kea images to v0.1.2 (socket dir 0750 fix) (#343) unkinben 2026-08-08 22:21:36 +10:00
• da4a66046a Add Tier-2 per-app Vector transform pipelines (structured logs) (#320) unkinben 2026-08-08 22:12:46 +10:00
• c722df415a puppetdb: isolate only the stockpile queue per pod (fix #340 crashloop) (#342) unkinben 2026-08-08 20:16:11 +10:00
• 4c7c97ab80 puppetdb: unique per-pod command-queue directory (#340) unkinben 2026-08-08 20:04:17 +10:00
• 5d1cc10588 Pin puppet master to a single Recreate replica (#341) unkinben 2026-08-08 20:02:38 +10:00
• ba7a1a9509 Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339) unkinben 2026-08-08 19:35:31 +10:00
• ca5e29e685 Fix kea CrashLoopBackOff: drop DHCP ntp hostnames, bump to v0.1.1 (#338) unkinben 2026-08-08 18:28:41 +10:00
• b99682861b Point cert-manager DNS-01 at public recursive nameservers (#337) unkinben 2026-08-08 18:14:27 +10:00
• 2360534a38 artifactapi: serve plain HTTP without HTTPS redirect (#336) unkinben 2026-08-05 22:27:27 +10:00
• 38743d58ab Rename terraform-ipam CI ServiceAccount -> terraform-infra (#335) unkinben 2026-08-05 19:40:34 +10:00
• f31552e192 Deploy kea DHCP operator to dhcp-system (#333) unkinben 2026-08-03 00:18:05 +10:00
• f296d0549a Add terraform-ipam CI ServiceAccount (#334) unkinben 2026-08-03 00:17:11 +10:00
• f1c3b9617f Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings (#332) unkinben 2026-08-02 21:49:37 +10:00
• 4fc4aed358 Add cnameStrategy: Follow to ACME DNS-01 solvers (#331) unkinben 2026-08-02 19:01:32 +10:00
• e5c84d0f74 Add kea-operator-ci ServiceAccount for Woodpecker CI (#330) unkinben 2026-08-02 19:01:02 +10:00
• 239ea07d5c Import live vault-issuer ClusterIssuer into GitOps (#328) unkinben 2026-08-02 18:00:00 +10:00
• 131b4e1695 Add bind-external namespace for externally-reachable zones (#329) unkinben 2026-08-02 17:53:34 +10:00
• c0c75d1bbb Add Let's Encrypt RFC2136/TSIG ClusterIssuers (#327) unkinben 2026-08-02 17:47:39 +10:00
• 8d70149467 Add Tier-1 per-app Vector transform pipelines (structured logs) (#318) unkinben 2026-08-01 00:22:32 +10:00
• 5f87d0c96d gitea: use git.k8s ROOT_URL for testing (#317) unkinben 2026-07-31 21:21:05 +10:00
• d04940b1ea Pull in-estate service images from artifactapi docker-internal (#310) unkinben 2026-07-31 20:07:16 +10:00
• a04dcc2975 Add k8s Gitea deployment (migration target for git.unkin.net) (#309) unkinben 2026-07-31 20:03:43 +10:00
• 6a13ca758a cephrgw: recreate cnpg backup buckets on ec placement (step 3) (#316) unkinben 2026-07-30 23:44:50 +10:00
• 7daeb4af65 cephrgw: remove cnpg backup buckets (ec migration step 2) (#315) unkinben 2026-07-30 23:35:55 +10:00
• dfb495d771 Trust internal CA for Authentik SSO; canonical identity.unkin.net for NetBox (#314) unkinben 2026-07-30 22:17:44 +10:00
• 6e8a061b94 cephrgw: allow purge-on-delete for cnpg backup buckets (#313) unkinben 2026-07-30 22:16:18 +10:00
• 23c26e8cc2 cephrgw v0.4.0; move CNPG backup buckets to ec placement (#312) unkinben 2026-07-30 21:08:25 +10:00
• 72c259a2a0 Fix nats-bootstrap: run from /tmp so the nats CLI works under readOnlyRootFS (#311) unkinben 2026-07-30 00:11:16 +10:00
• 9c10b9096a Replace vector-archiver with logarchiver (#308) unkinben 2026-07-29 21:07:20 +10:00
• 96afbcf5e1 Fix NATS auth: wrap env-var passwords in << >> so the server expands them (#306) unkinben 2026-07-29 19:28:27 +10:00
• 7dddf8c5aa Fix logging deploy: enable Vector env interpolation; operator watches logging ns (#301) unkinben 2026-07-29 00:11:33 +10:00
• 57691ef1d5 certificates: restore the validly-signed intermediate in vault-ca-cert (#305) unkinben 2026-07-28 23:14:14 +10:00
• e0eeeb6b04 Use full postgres image on minimal CNPG clusters so WAL archiving works (#304) unkinben 2026-07-28 23:11:30 +10:00
• 7c1cbef722 Trust internal unkin.net CA for ArgoCD OIDC egress (#303) unkinben 2026-07-28 22:17:32 +10:00
• 0ec308b76e Revert external-dns writes back to the legacy VM authoritative (#287) benvin/externaldns-fix unkinben 2026-07-28 22:10:44 +10:00
• d1a7646e09 Bump Woodpecker CI to v3.16.0 (#297) unkinben 2026-07-28 21:48:26 +10:00
• f45cb6989f Add ClickHouse + Vector + NATS JetStream centralized logging (with S3 raw archive) (#296) unkinben 2026-07-28 19:54:27 +10:00
• e6f2cbc363 authentik: raise CNPG postgres memory to stop replica OOMKills (#300) unkinben 2026-07-28 18:16:31 +10:00
• 2ee4c9518c Deploy NetBox (CNPG Postgres, Valkey, Authentik SSO) (#299) unkinben 2026-07-28 18:12:25 +10:00
• 3c2bdf307a Add S3 backups to all CNPG Postgres clusters (#298) unkinben 2026-07-27 23:57:08 +10:00
• b725bf7dcf Add PTR to external-dns managed record types (#295) unkinben 2026-07-26 00:19:10 +10:00
• faa256c764 Fix external-dns PTR flag (--create-ptr) (#294) unkinben 2026-07-26 00:15:33 +10:00
• eff97b8d03 Enable PTR synthesis in external-dns (#292) unkinben 2026-07-26 00:05:54 +10:00
• aff06a633a Roll bind-operator to v0.2.6 (loop-free TSIG-keyed NOTIFY) (#293) unkinben 2026-07-25 23:53:55 +10:00
• 0687c097d6 Revert bind-operator to v0.2.4 (v0.2.5 rolling-restart loop) (#291) unkinben 2026-07-25 23:12:38 +10:00
• 7a889ca326 Flip resolver forwarding for k8s zones to the in-cluster bind (#288) unkinben 2026-07-25 23:08:22 +10:00
• 9452473bf6 Roll cephrgw-operator to v0.3.1 (CRD staleness warning) (#290) unkinben 2026-07-25 23:03:36 +10:00
• 9abb82afb4 Roll bind-operator to v0.2.5 (intra-cluster NOTIFY fix) (#289) unkinben 2026-07-25 23:00:12 +10:00
• 8dc65779a5 Repoint external-dns at the in-cluster bind-externaldns primary (#287) unkinben 2026-07-25 22:41:20 +10:00
• 8eeca2d1fb Reflect externaldns TSIG key into the externaldns namespace (#285) unkinben 2026-07-25 22:37:39 +10:00
• e4afdf59ba Bump cephrgw-operator CRDs to v0.3.0 (#286) unkinben 2026-07-25 22:34:58 +10:00
• 1d87c42fc1 Add advise-mode VPA for every workload (#283) unkinben 2026-07-25 18:30:23 +10:00
• 4d877531b0 Add vpa-system: VPA CRDs + recommender (advise mode) (#281) unkinben 2026-07-25 18:26:15 +10:00
• 614c4b1aa6 Route consul API hostname to the HTTP API (8500) (#282) unkinben 2026-07-25 18:19:38 +10:00
• 3920d76ba2 Add VPA CRDs and kubeconform schemas (#284) unkinben 2026-07-25 18:16:15 +10:00
• a633835550 Enable ACLs on k8s consul with Vault-sourced bootstrap token (#280) unkinben 2026-07-25 17:39:18 +10:00
• 69f304f60d Roll cephrgw-operator to v0.3.0 (safe adoption) (#279) unkinben 2026-07-25 17:09:21 +10:00
• cc81e90a75 Roll artifactapi to v3.7.7 (#278) unkinben 2026-07-25 16:48:12 +10:00
• 05318553d6 Swap puppet compiler ENC to the encapic Go binary (#277) unkinben 2026-07-25 12:40:42 +10:00
• 3af12180fd Switch puppet compiler ENC from Cobbler to encapi (#272) unkinben 2026-07-24 23:42:23 +10:00
• 6d7cdd59e3 pdbmux: deploy the merging PuppetDB proxy in-cluster (#275) unkinben 2026-07-24 23:40:56 +10:00
• 4580a5f6a4 Trust internal CA in cephrgw-operator (fix radosgw TLS) (#276) unkinben 2026-07-24 23:25:03 +10:00
• 739de129e1 Add terraform-enc woodpecker ServiceAccount (#274) unkinben 2026-07-24 23:18:11 +10:00
• 887a8d34cb Roll cephrgw-operator to v0.2.0 (radosgw-native) (#273) unkinben 2026-07-24 23:17:05 +10:00
• 982bf1c837 Merge pull request 'Wire LiteLLM SSO to Authentik (generic OIDC)' (#268) from benvin/litellm-sso into main unkinben 2026-07-24 00:18:41 +10:00
• 39b180aec9 bind-internal: allow k8s pod network to query the resolvers (#271) unkinben 2026-07-21 22:12:44 +10:00
• f835a059f4 Merge pull request 'Bump bind-operator to v0.2.4' (#270) from benvin/bind-operator-v0.2.4 into main unkinben 2026-07-21 00:29:33 +10:00
• 76db3bbfe0 Bump bind-operator to v0.2.4 unkinben 2026-07-21 00:27:34 +10:00
• 7ee5dfbbcd TEMP: forward k8s.syd1.au.unkin.net to external external-dns service (#269) unkinben 2026-07-21 00:14:03 +10:00
• 91080c1504 LiteLLM SSO: request litellm_role scope + map to role benvin/litellm-sso unkinben 2026-07-19 18:43:13 +10:00
• 5380a9fbf4 Wire LiteLLM SSO to Authentik (generic OIDC) unkinben 2026-07-19 18:27:31 +10:00
• 0c1156282f bind-internal: allow localhost to query the authoritative cluster (#267) unkinben 2026-07-19 00:10:56 +10:00
• f61d5ba16d bind-internal: add dashboard.ceph.unkin.net + lb1.unkin.net records (#266) unkinben 2026-07-18 23:50:59 +10:00
• 5a22dd95ef cephrgw-system: source cephrgw-credentials from Vault via VSO (#262) unkinben 2026-07-18 23:18:01 +10:00
• 513c60492b bind-internal: add s3.ceph.unkin.net CNAME -> radosgw.service.consul (#265) unkinben 2026-07-18 16:30:23 +10:00
• 6f62b7873f Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin (#264) unkinben 2026-07-18 16:24:26 +10:00
• 9bdb328d99 Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin (#263) unkinben 2026-07-18 16:23:58 +10:00
• 19f8055144 Deploy cephrgw-operator to cephrgw-system (#261) unkinben 2026-07-18 14:32:11 +10:00
• 706e30a202 bind-internal: add ceph.unkin.net authoritative zone (#260) unkinben 2026-07-17 22:43:27 +10:00
• 197991a6ca bind-internal: allow admin workstation to query the resolver (#259) unkinben 2026-07-16 23:13:31 +10:00
• 8f164873e0 bind-internal: allow admin workstation + router to query authoritative (#258) unkinben 2026-07-16 22:56:22 +10:00
• b1b2112c66 Add terraform-rancher woodpecker ServiceAccount (#257) unkinben 2026-07-16 22:22:13 +10:00
• 421df740ea Add identity.unkin.net internal DNS record (#256) unkinben 2026-07-15 20:53:39 +10:00
• 8a9cdf35fd Bump bind-operator to v0.2.3 (deterministic render) (#255) unkinben 2026-07-12 23:22:04 +10:00
• 1f4c0e11bb Wire ArgoCD to Authentik OIDC (#253) unkinben 2026-07-12 23:04:53 +10:00
• 1f22ec2aa7 Bump bind-operator to v0.2.2 (config-hash rolling restart) (#254) unkinben 2026-07-12 22:52:19 +10:00
• 69788a967c Fix validate-except syntax (resolver crash-loop) (#252) unkinben 2026-07-12 22:26:23 +10:00
• 0f8c816235 Fix validate-except syntax: trailing semicolon after last entry benvin/resolver-validate-except unkinben 2026-07-12 22:21:22 +10:00
• 5e7dc580b7 Exempt internal split-horizon zones from resolver DNSSEC validation (#251) unkinben 2026-07-12 22:17:16 +10:00
• 2706632f54 Exempt internal split-horizon zones from resolver DNSSEC validation unkinben 2026-07-12 22:13:50 +10:00
• 65f18a6380 Bump bind-operator to v0.2.1 (secondary replication fix) (#250) unkinben 2026-07-12 21:43:03 +10:00
• 38ef6c4a09 Bump bind-operator to v0.2.0 and deploy companion TSIG API (#249) unkinben 2026-07-12 19:12:39 +10:00