chore: Cleanup old nix code and add helmfile experiments

values/prometheus/manifests/prometheus.yaml

@@ -0,0 +1,74 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: prometheus
+  namespace: argocd
+spec:
+  destination:
+    namespace: prometheus
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfiles/cilium
+    plugin:
+      name: helmfile
+      env:
+        - name: CLUSTER_NAME
+          value: {{ .Values.clusterConfig.cluster }}
+  project: sys
+  syncPolicy:
+    syncOptions:
+    - ServerSideApply=true
+    {{- if .Values.prometheus.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      jqPathExpressions:
+        - '.spec.template.spec.containers[]?.resources'
+    - group: monitoring.coreos.com
+      kind: ServiceMonitor
+      jqPathExpressions:
+        - '.spec.endpoints[]?.relabelings'
+    - group: admissionregistration.k8s.io
+      kind: MutatingWebhookConfiguration
+      jqPathExpressions:
+        - '.webhooks[]?.clientConfig.caBundle'
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+      jqPathExpressions:
+        - '.webhooks[]?.clientConfig.caBundle'
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: prometheus-crd
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: prometheus
+    server: 'https://kubernetes.default.svc'
+  source:
+    repoURL: 'https://prometheus-community.github.io/helm-charts'
+    targetRevision: '14.0.0'
+    chart: prometheus-operator-crds
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    automated: {}
+    syncOptions:
+      - ServerSideApply=true
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+{{- end }}

values/prometheus/values-oceanbox.yaml.gotmpl

@@ -0,0 +1,15 @@
+cilium:
+  enabled: true
+  nodePort:
+    enable: true
+  l2announcement:
+    enable: true
+  loadbalancerPool:
+    enabled: true
+    cidr:
+     - 10.255.241.11/32
+     - 10.255.241.12/32
+     - 10.255.241.13/32
+     - 10.255.241.14/32
+     - 10.255.241.15/32
+

values/prometheus/values.yaml.gotmpl

@@ -0,0 +1,32 @@
+cilium:
+  enabled: false
+  autosync: true
+  spire:
+    enabled: false
+  envoy:
+    enabled: false
+  hubble:
+    ui: true
+    enabled: false
+  encryption:
+    enabled: true
+    type: wireguard
+  kubeProxyReplacement: true
+  l2announcement:
+    enabled: false
+  nodePort:
+    enabled: false
+  gatewayAPI:
+    enabled: false
+  ingressController:
+    enabled: false
+    defaultClass: false
+    loadbalancerMode: shared
+  policyAuditMode: false
+  upgradeCompatability: 1.15
+  k8sServiceHost: localhost
+  k8sServicePort: 7445
+  loadbalancerPool:
+    enabled: false
+    cidr: []
+

values/prometheus/values/prometheus.yaml.gotmpl

@@ -0,0 +1,106 @@
+authentication:
+  mutual:
+    spire:
+      enabled: {{ .Values.cilium.spire.enabled }}
+cgroup:
+  autoMount:
+    enabled: false
+  hostRoot: /sys/fs/cgroup
+dashboards:
+  enabled: true
+  namespace: prometheus
+enableXTSocketFallback: false
+encryption:
+  enabled: {{ .Values.cilium.encryption.enabled }}
+  type: {{ .Values.cilium.encryption.type}}
+envoy:
+  enabled: {{ .Values.cilium.envoy.enabled }}
+  prometheus:
+    serviceMonitor:
+      enabled: {{ .Values.cilium.envoy.enabled }}
+extraConfig:
+  enable-envoy-config: "true"
+hubble:
+  enabled: true
+  tls:
+    auto:
+      method: cronJob
+  metrics:
+    dashboards:
+      enabled: true
+      namespace: prometheus
+    enabled:
+    - dns:query;ignoreAAAA
+    - drop
+    - tcp
+    - flow
+    - icmp
+    - policy:sourceContext=app|workload-name|pod|reserved-identity;destinationContext=app|workload-name|pod|dns|reserved-identity;labelsContext=source_namespace,destination_namespace
+    - httpV2:exemplars=false;labelsContext=source_ip,source_namespace,source_workload,destination_ip,destination_namespace,destination_workload,traffic_direction
+    port: 12304
+    serviceMonitor:
+      enabled: true
+  redact:
+    enabled: true
+  relay:
+    enabled: true
+    prometheus:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+  ui:
+    enabled: {{ .Values.cilium.hubble.ui }}
+ipam:
+  mode: kubernetes
+kubeProxyReplacement: {{ .Values.cilium.kubeProxyReplacement }}
+l2announcements:
+  enabled: {{ .Values.cilium.l2announcement.enabled }}
+k8sServiceHost: {{ .Values.cilium.k8sServiceHost }}
+k8sServicePort: {{ .Values.cilium.k8sServicePort }}
+nodePort:
+  enabled: {{ .Values.cilium.nodePort.enabled }}
+gatewayAPI:
+  enabled: {{ .Values.cilium.gatewayAPI.enabled }}
+ingressController:
+  enabled: {{ .Values.cilium.ingressController.enabled }}
+  default: {{ .Values.cilium.ingressController.defaultClass }}
+  loadbalancerMode: {{ .Values.cilium.ingressController.loadbalancerMode }}
+operator:
+  dashboards:
+    enabled: true
+    namespace: prometheus
+  prometheus:
+    enabled: true
+    port: 12301
+    serviceMointor:
+      enabled: true
+      port: 12302
+  rollOutPods: true
+policyAuditMode: {{ .Values.cilium.policyAuditMode }}
+prometheus:
+  enabled: true
+  port: 12300
+  serviceMonitor:
+    enabled: true
+rollOutCiliumPods: true
+securityContext:
+  capabilities:
+    ciliumAgent:
+    - CHOWN
+    - KILL
+    - NET_ADMIN
+    - NET_RAW
+    - IPC_LOCK
+    - SYS_ADMIN
+    - SYS_RESOURCE
+    - DAC_OVERRIDE
+    - FOWNER
+    - SETGID
+    - SETUID
+    cleanCiliumState:
+    - NET_ADMIN
+    - SYS_ADMIN
+    - SYS_RESOURCE
+{{- with .Values.cilium.upgradeCompatability}}
+upgradeCompatability:  {{ . }}
+{{- end }}