unkin-agent 8f7b9360ad Put the artifactapi web UI behind Authentik oauth2-proxy ...

Front /ui with an Authentik-authenticated oauth2-proxy while leaving every
package-manager surface unauthenticated.

- Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Add the oauth-credentials VaultStaticSecret.
- Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP
  redirect); everything else to the api Service on both listeners.

2026-09-07 14:02:18 +10:00

..

age-api

Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339)

2026-08-08 19:35:31 +10:00

arrstack

Bump arrproxy images to v0.6.1 (#448)

2026-09-05 11:15:47 +10:00

artifactapi

Put the artifactapi web UI behind Authentik oauth2-proxy

2026-09-07 14:02:18 +10:00

authentik

authentik: use canonical upstream image name for redis_exporter (#430)

2026-08-29 21:18:33 +10:00

bind-external

Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings (#332)

2026-08-02 21:49:37 +10:00

bind-internal

watchstate: expose externally at watchstate.unkin.net (#420)

2026-08-26 21:47:03 +10:00

bind-system

Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings (#332)

2026-08-02 21:49:37 +10:00

cattle-system

fix(gateways): add explicit group/kind/weight to all HTTPRoute refs (#162)

2026-05-24 20:32:37 +10:00

cephrgw-system

Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339)

2026-08-08 19:35:31 +10:00

cert-manager

Deploy repospawner v0.1.0 (#445)

2026-08-30 15:40:06 +10:00

certificates

certificates: restore the validly-signed intermediate in vault-ca-cert (#305)

2026-07-28 23:14:14 +10:00

cheeztv

arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume (#428)

2026-08-29 21:18:09 +10:00

clickhouse-system

Add ClickHouse + Vector + NATS JetStream centralized logging (with S3 raw archive) (#296)

2026-07-28 19:54:27 +10:00

cnpg-system

feat: migrate cnpg-system from Terraform to ArgoCD (#44)

2026-03-19 01:25:50 +11:00

consul

Route consul API hostname to the HTTP API (8500) (#282)

2026-07-25 18:19:38 +10:00

csi-cephfs

Mount mediafs CephFS into arrstack (#391)

2026-08-22 23:05:43 +10:00

csi-cephrbd

observability: scrape existing app metrics (audit + ceph-csi batch) (#239)

2026-07-06 23:57:54 +10:00

dhcp-system

kea-operator: bump to v0.1.5 (#425)

2026-08-29 12:55:13 +10:00

elastic-system

feat: migrate elastic-system to ArgoCD (#79)

2026-03-27 17:00:05 +11:00

encapi

Bump encapi image to v0.1.2 (#450)

2026-09-05 11:23:45 +10:00

externaldns

Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings (#332)

2026-08-02 21:49:37 +10:00

fafflix

arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume (#428)

2026-08-29 21:18:09 +10:00

ghp

ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS (#372)

2026-08-15 18:18:22 +10:00

gitea

gitea: use canonical upstream image name for redis_exporter (#431)

2026-08-29 21:18:44 +10:00

grafana

grafana: stop pinning the internal CA for Authentik OAuth (#440)

2026-08-29 21:52:30 +10:00

grafana-system

grafana-system: deploy grafana-operator

2026-07-05 22:16:30 +10:00

inteldeviceplugins-system

chore: migrate reloader/reflector to virtual/helm (#115)

2026-05-05 21:42:23 +10:00

k8up-system

Deploy k8up backup operator (platform, k8up-system) (#363)

2026-08-14 00:29:15 +10:00

kanidm

Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339)

2026-08-08 19:35:31 +10:00

litellm

litellm: use canonical upstream image name for redis_exporter (#432)

2026-08-29 21:19:01 +10:00

logging

logging: use canonical upstream image names (#433)

2026-08-29 21:55:47 +10:00

mediamark

mediamark: deploy the media marking app (#441)

2026-08-30 15:07:41 +10:00

netbox

netbox: use canonical upstream image name for redis_exporter (#434)

2026-08-29 21:19:27 +10:00

node-feature-discovery

feat: migrate node-feature-discovery and inteldeviceplugins-system to platform project (#48)

2026-03-19 02:14:45 +11:00

observability

observability: fix dropped kubelet/cadvisor metrics, add kube-state-metrics + VMAlert k8s.rules (#399)

2026-08-23 21:38:06 +10:00

paperclip

cephrgw: recreate cnpg backup buckets on ec placement (step 3) (#316)

2026-07-30 23:44:50 +10:00

pdbmux

pdbmux: bump image to v0.2.0 (#455)

2026-09-05 17:05:45 +10:00

priority-classes

feat(platform): add priority-classes app with low/power/medium/high classes (#174)

2026-05-26 23:41:54 +10:00

puppet

puppet: use OPENVOXSERVER_JAVA_ARGS for puppetserver JVM args (#451)

2026-09-05 11:30:22 +10:00

purelb

feat: migrate purelb to ArgoCD (#84)

2026-04-07 19:52:17 +10:00

reflector-system

fix: helm-charts in overlay only (#5)

2026-03-01 16:01:32 +11:00

reloader-system

feat: add reloader (#6)

2026-03-01 16:34:01 +11:00

repospawner

Bump repospawner to v0.1.1 (#446)

2026-08-30 17:07:58 +10:00

reposync

feat: migrate reposync to ArgoCD (#78)

2026-03-27 16:26:35 +11:00

traefik-system

fix(traefik): add instance labels to GatewayClasses (#137)

2026-05-23 00:23:18 +10:00

valkey-operator-system

Install valkey-operator (#365)

2026-08-15 12:32:57 +10:00

vault

feat(vault): switch to Kubernetes service registration (#171)

2026-05-26 00:06:56 +10:00

vm-system

feat: migrate vm-system to ArgoCD (#80)

2026-03-27 17:04:15 +11:00

vpa-system

Add vpa-system: VPA CRDs + recommender (advise mode) (#281)

2026-07-25 18:26:15 +10:00

vso-system

feat: migrate vso-system to ArgoCD (#81)

2026-04-07 19:33:50 +10:00

watchstate

watchstate: use canonical upstream image name for alpine (#435)

2026-08-29 21:19:36 +10:00

woodpecker

woodpecker: add vimpack-ci ServiceAccount (#454)

2026-09-05 13:42:33 +10:00

kustomization.yaml

feat: initial commit

2026-03-01 14:31:16 +11:00