chore: update npins dependencies

Automated update of Nix dependencies via npins.

    Updated packages:
    +      "hash": "sha256-RuGWBqXVEsZwwBvRGS/nRrA6PQyOQwVaAu139Z853Bk="

.envrc

@@ -1,16 +1,13 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
-watch_file npins/sources.json
+watch_file nix/sources.json
+watch_file nix/checks.nix
 
 # Load .env file if it exists
 dotenv_if_exists
 
+# Set npins dir
+export NPINS_DIRECTORY="nix"
+
 # Activate development shell
-if type lorri &>/dev/null; then
-    echo "direnv: using lorri from PATH ($(type -p lorri))"
-    eval "$(lorri direnv)"
-else
-    # fall back to using direnv's builtin nix support
-    # to prevent bootstrapping problems.
 use nix
-fi

.gitlab-ci.yml

@@ -0,0 +1,54 @@
+# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
+default:
+  tags:
+    - nix
+
+include:
+  - project: oceanbox/gitlab-ci
+    ref: v4.5
+    file: template/Base.gitlab-ci.yml
+# stages:
+# - release
+
+# image:
+# name: alpine/helm:latest
+# entrypoint: ["/bin/bash", "-c"]
+
+# release:
+# stage: release
+# rules:
+# - if: "$CI_COMMIT_BRANCH =~ /^main/"
+# when: always
+# - when: never
+# script:
+# - |
+# cd $CI_PROJECT_DIR
+# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
+# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
+# if [ ! -z $pack ]; then
+# chart=$(basename $pack)
+# curl --request POST \
+# --user gitlab-ci-token:$CI_JOB_TOKEN \
+# --form "chart=@${chart}" \
+# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
+# fi
+# done
+
+# rebuild:
+# stage: release
+# rules:
+# - when: manual
+# allow_failure: true
+# script:
+# - |
+# cd $CI_PROJECT_DIR
+# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
+# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
+# if [ ! -z $pack ]; then
+# chart=$(basename $pack)
+# curl --request POST \
+# --user gitlab-ci-token:$CI_JOB_TOKEN \
+# --form "chart=@${chart}" \
+# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
+# fi
+# done

bootstrap/helmfile-cmp/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/helmfile/helmfile:v1.3.1
+FROM ghcr.io/helmfile/helmfile:v1.1.9
 
 RUN mkdir -p /home/argocd/cmp-server/config/
 COPY plugin.yaml /home/argocd/cmp-server/config/

bootstrap/helmfile-cmp/deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-img=git.oceanbox.io/platform/manifests/helmfile-cmp
+img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
 tag=${1:-latest}
 
 docker build -t "${img}":"${tag}" .

bootstrap/keycloak-theme/Dockerfile

@@ -1,3 +0,0 @@
-FROM busybox
-
-COPY keycloak-themes/oceanbox /theme

bootstrap/keycloak-theme/keycloak-themes/oceanbox/login/resources/css/oceanbox.css

@@ -1,109 +0,0 @@
-/* Oceanbox Keycloak Login Theme
- *
- * Branding aligned with oceanbox.io:
- *   Primary teal:    #0bb4aa
- *   Dark teal:       #37746F
- *   Deep blue:       #031275
- *   Background:      #f9fafd
- *   Text:            #101010
- */
-
-:root {
-    --pf-v5-global--primary-color--100: #0bb4aa;
-    --pf-v5-global--primary-color--200: #099e95;
-    --pf-v5-global--link--Color: #0bb4aa;
-    --pf-v5-global--link--Color--hover: #031275;
-}
-
-.login-pf body {
-    background: #f9fafd url("../img/oceanbox-bg.png") no-repeat center bottom fixed;
-    background-size: cover;
-    height: 100%;
-}
-
-/* Login container layout */
-.pf-v5-c-login__container {
-    grid-template-columns: 34rem;
-    grid-template-areas: "header"
-                         "main";
-}
-
-/* Logo */
-div.kc-logo-text {
-    background-image: url('../img/oceanbox-logo-text.png');
-    height: 80px;
-    width: 360px;
-    background-repeat: no-repeat;
-    background-size: contain;
-    background-position: center;
-    margin: 0 auto;
-}
-
-div.kc-logo-text span {
-    display: none;
-}
-
-/* Header */
-#kc-header-wrapper {
-    font-size: 29px;
-    text-transform: uppercase;
-    letter-spacing: 3px;
-    line-height: 1.2em;
-    white-space: normal;
-    color: #37746F !important;
-    text-align: center;
-}
-
-/* Login card */
-.pf-v5-c-login__main {
-    border-radius: 8px;
-    box-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
-}
-
-/* Primary button */
-.pf-v5-c-button.pf-m-primary {
-    --pf-v5-c-button--m-primary--BackgroundColor: #0bb4aa;
-    --pf-v5-c-button--m-primary--hover--BackgroundColor: #099e95;
-    --pf-v5-c-button--m-primary--active--BackgroundColor: #37746F;
-    --pf-v5-c-button--m-primary--focus--BackgroundColor: #099e95;
-    border-radius: 4px;
-}
-
-/* Links */
-.pf-v5-c-button.pf-m-link {
-    --pf-v5-c-button--m-link--Color: #0bb4aa;
-    --pf-v5-c-button--m-link--hover--Color: #031275;
-}
-
-a {
-    color: #0bb4aa;
-}
-
-a:hover {
-    color: #031275;
-}
-
-/* Form inputs */
-.pf-v5-c-form-control > input,
-.pf-v5-c-form-control > textarea {
-    border-radius: 4px;
-}
-
-#kc-recovery-codes-list {
-    columns: 2;
-}
-
-#certificate_subjectDN {
-    overflow-wrap: break-word;
-}
-
-hr {
-    margin-top: var(--pf-v5-global--spacer--sm);
-    margin-bottom: var(--pf-v5-global--spacer--md);
-}
-
-@media (min-width: 768px) {
-    div.pf-v5-c-login__main-header {
-        grid-template-columns: 70% 30%;
-    }
-}

bootstrap/keycloak-theme/keycloak-themes/oceanbox/login/theme.properties

@@ -1,5 +0,0 @@
-parent=keycloak.v2
-import=common/keycloak
-
-stylesCommon=vendor/patternfly-v5/patternfly.min.css vendor/patternfly-v5/patternfly-addons.css
-styles=css/styles.css css/oceanbox.css

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.35.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.35.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  repository: registry.gitlab.com/oceanbox/poseidon/atlantis
-  tag: v1.46.5
+  tag: v1.35.2
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -116,5 +116,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
 diagrid-dashboard:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.46.5
+version: v1.35.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.46.5"
+appVersion: "v1.35.2"

charts/codex/values.yaml

@@ -6,11 +6,11 @@
 replicaCount: 1
 # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
 image:
-  repository: git.oceanbox.io/oceanbox/poseidon/codex
+  repository: registry.gitlab.com/oceanbox/poseidon/codex
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.46.5
+  tag: v1.35.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/diagrid-dashboard/templates/statestore.yaml

@@ -8,7 +8,6 @@ data:
     kind: Component
     metadata:
       name: statestore
-      namespace: {{ .Values.statestore.namespace | default "default" }}
     scopes:
       - {{ .Values.statestore.scope }}
     spec:
@@ -18,10 +17,10 @@ data:
         - name: redisUsername
           value: default
         - name: redisPassword
-          value: {{ .Values.statestore.password | default "secret" }}
+          value: secret
         - name: actorStateStore
           value: "true"
         - name: redisDB
-          value: "{{ .Values.statestore.redisDB | default "0" }}"
+          value: "1"
       type: state.redis
       version: v1

charts/diagrid-dashboard/values.yaml

@@ -5,9 +5,6 @@
 statestore:
   scope: my-scope
   redis: my-redis
-  namespace: default
-  password: secret
-  redisDB: "0"
 
 # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
 replicaCount: 1

charts/docs/templates/deployment.yaml

@@ -42,11 +42,11 @@ spec:
               value: "3"
           livenessProbe:
             httpGet:
-              path: /healthz
+              path: /
               port: http
           readinessProbe:
             httpGet:
-              path: /healthz
+              path: /
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

charts/docs/values.yaml

@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/documentation/docs
+  repository:  registry.gitlab.com/oceanbox/documentation
   tag: v0.1.0
   pullPolicy: IfNotPresent
 init:
@@ -21,8 +21,8 @@ env:
     valueFrom:
       fieldRef:
         fieldPath: metadata.namespace
-# imagePullSecrets:
+imagePullSecrets:
-  # - name: gitea-pull-secret
+  - name: gitea-pull-secret
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:

charts/plume/Chart.yaml

@@ -4,12 +4,7 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.6.13
+version: v1.6.7
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.6.13
+appVersion: v1.6.7
-dependencies:
-  - name: diagrid-dashboard
-    version: "0.1.0"
-    repository: "file://../diagrid-dashboard"
-    condition: diagrid-dashboard.enabled

charts/plume/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/plume/plume
+  repository: registry.gitlab.com/oceanbox/plume
-  tag: v1.6.13
+  tag: v1.6.7
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -90,6 +90,3 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
-diagrid-dashboard:
-  enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.35.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.35.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -4,8 +4,8 @@
 
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
+  repository: registry.gitlab.com/oceanbox/poseidon/sorcerer
-  tag: v1.46.5
+  tag: v1.35.2
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -108,6 +108,7 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
 diagrid-dashboard:
   enabled: false
   statestore:

envs/environments.yaml.gotmpl

@@ -20,11 +20,4 @@ environments:
     - ../values/*/env.yaml.gotmpl
     - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
     missingFileHandler: Info
-  beta:
-    values:
-    - ../values/env.yaml
-    - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-    - ../values/*/env.yaml.gotmpl
-    - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-    missingFileHandler: Info
 

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.4.10
+  version: 7.9.1
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
   namespace: argocd
   chart: argo/argo-rollouts
-  version: 2.40.6
+  version: 2.40.5
   condition: argo.rollouts.enabled
   values:
   - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 0.47.5
+  version: 0.45.27
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests
@@ -66,3 +66,4 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/argo/manifests
     - _argo
+

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.4
+  version: v1.19.2
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/cilium.yaml.gotmpl

@@ -3,8 +3,7 @@ bases:
 
 repositories:
 - name: cilium
-  oci: true
+  url: 'https://helm.cilium.io'
-  url: 'quay.io/cilium/charts'
 
 commonLabels:
   tier: system
@@ -16,11 +15,11 @@ releases:
 - name: cilium
   namespace: kube-system
   chart: cilium/cilium
-  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.19.1{{ else if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "ekman" }}1.19.1{{ else }}1.16.19{{ end }}
+  version: 1.16.2
   condition: cilium.enabled
   values:
   - ../values/cilium/values/cilium.yaml.gotmpl
-  - ../values/cilium/values/cilium-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/cilium/values/cilium-{{ .Environment.Name }}.yaml.gotmpl
   missingFileHandler: Info
 - name: manifests
   namespace: cilium
@@ -56,3 +55,4 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/cilium/cilium-manifests
     - manifests
+

helmfile.d/docs.yaml.gotmpl

@@ -6,7 +6,7 @@ commonLabels:
 
 releases:
 - name: docs
-  namespace: docs
+  namespace: {{ .Environment.Name }}-docs
   chart: ../charts/docs
   condition: docs.enabled
   values:
@@ -17,7 +17,7 @@ releases:
   - ../values/docs/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: docs
+  namespace: {{ .Environment.Name }}-docs
   chart: manifests
   condition: docs.enabled
   missingFileHandler: Info

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.4.0
+  version: v1.3.1
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/gatus.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: gatus
   namespace: uptime
   chart: gatus/gatus
-  version: 1.5.0
+  version: 1.4.5
   condition: gatus.enabled
   values:
   - ../values/gatus/values/values.yaml

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.14.3
+  version: 4.14.1
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/jobset.yaml.gotmpl

@@ -1,41 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
-- name: jobset
-  oci: true
-  url: registry.k8s.io/jobset/charts
-
-releases:
-- name: jobset
-  namespace: jobset-system
-  chart: jobset/jobset
-  version: 0.11.1
-  condition: jobset.enabled
-  values:
-  - ../values/jobset/values/jobset.yaml.gotmpl
-  - ../values/jobset/values/jobset-{{ .Environment.Name }}.yaml.gotmpl
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/jobset/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: jobset-system
-  chart: manifests
-  condition: jobset.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/jobset/env.yaml.gotmpl
-  - ../values/jobset/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/jobset/manifests
-    - manifests

helmfile.d/keycloak.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
   namespace: keycloak
   chart: bitnami/keycloak
-  version: 25.2.0
+  version: 24.0.2
   condition: keycloak.enabled
   values:
   - ../values/keycloak/values/values.yaml

helmfile.d/kueue.yaml.gotmpl

@@ -8,7 +8,7 @@ releases:
 - name: kueue
   namespace: kueue-system
   chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.16.2
+  version: 0.15.0
   condition: kueue.enabled
   values:
   - ../values/kueue/values/values.yaml

helmfile.d/kyverno.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: kyverno
   namespace: kyverno
   chart: kyverno/kyverno
-  version: 3.7.1
+  version: 3.6.1
   condition: kyverno.enabled
   values:
   - ../values/kyverno/values/kyverno.yaml.gotmpl

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 6.53.0
+  version: 6.42.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/makai.yaml.gotmpl

@@ -6,7 +6,7 @@ commonLabels:
 
 releases:
 - name: makai
-  namespace: makai
+  namespace: {{ .Environment.Name }}-makai
   chart: ../charts/makai
   condition: makai.enabled
   values:
@@ -17,7 +17,7 @@ releases:
   - ../values/makai/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: makai
+  namespace: {{ .Environment.Name }}-makai
   chart: manifests
   condition: makai.enabled
   missingFileHandler: Info

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.10.4
+  version: 25.10.3
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.56
+  version: 0.2.50
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.146.1
+  version: 0.142.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/postgres-operator.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
   namespace: cnpg
   chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.5.0
+  version: 0.3.1
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 82.10.3
+  version: 72.7.0
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/rabbitmq.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: {{ .Environment.Name }}-rabbitmq
   namespace: rabbitmq
   chart: bitnami/rabbitmq
-  version: 16.0.14
+  version: 13.0.3
   condition: rabbitmq.enabled
   values:
   - ../values/rabbitmq/values/values.yaml

helmfile.d/slurm-operator.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
   namespace: slinky
   chart: slurm-operator/slurm-operator
-  version: 1.0.2
+  version: 0.4.1
   condition: slurm_operator.enabled
   values:
   - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl

helmfile.d/slurm.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm
   namespace: slurm
   chart: slurm/slurm
-  version: 1.0.2
+  version: 0.4.1
   condition: slurm.enabled
   values:
   - ../values/slurm/values/slurm.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.7.3
+  version: 6.0.1
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 12.0.0
+  version: 11.3.2
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

nix/kueuectl.nix

@@ -1,19 +0,0 @@
-{
-  buildGoModule,
-  fetchFromGitHub,
-}:
-buildGoModule rec {
-  pname = "kueuectl";
-  version = "0.16.3";
-
-  src = fetchFromGitHub {
-    owner = "kubernetes-sigs";
-    repo = "kueue";
-    rev = "v${version}";
-    hash = "sha256-JbU+ZoQ+YriaiIbbVCe45OTYycxYRanLhmQAdpE+xQ4=";
-  };
-
-  vendorHash = null;
-
-  subPackages = [ "cmd/kueuectl" ];
-}

nix/sources.json

@@ -0,0 +1,24 @@
+{
+  "pins": {
+    "git-hooks": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "cachix",
+        "repo": "git-hooks.nix"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/a1ef738813b15cf8ec759bdff5761b027e3e1d23.tar.gz",
+      "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U="
+    },
+    "nixpkgs": {
+      "type": "Channel",
+      "name": "nixpkgs-unstable",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre937085.6308c3b21396/nixexprs.tar.xz",
+      "hash": "sha256-RuGWBqXVEsZwwBvRGS/nRrA6PQyOQwVaAu139Z853Bk="
+    }
+  },
+  "version": 7
+}

nix/treefmt.nix

@@ -1,71 +0,0 @@
-{
-  sources ? import ../npins,
-  pkgs ? import sources.nixpkgs { },
-  treefmt ? import sources.treefmt-nix,
-}:
-let
-  globalExcludes = [
-    "npins/default.nix"
-    "attic"
-    "vcluster"
-    ".*vendor"
-    ".*chart/.*"
-    ".*schema.json"
-  ];
-in
-treefmt.evalModule pkgs {
-  projectRootFile = ".git/config";
-
-  settings = {
-    excludes = globalExcludes;
-  };
-
-  programs = {
-
-    # --- Nix formatting ---
-    nixfmt = {
-      enable = true;
-      package = pkgs.nixfmt-rfc-style;
-    };
-    statix.enable = true;
-    deadnix.enable = true;
-
-    # --- Shell ---
-    shellcheck = {
-      enable = true;
-      excludes = [
-        "vcluster/"
-        "attic/"
-      ];
-    };
-
-    shfmt.enable = true;
-
-    # --- YAML ---
-    yamllint = {
-      enable = true;
-      excludes = [
-        "attic/"
-        "charts/templates/"
-        "charts/"
-        "values/"
-        "vcluster/"
-      ];
-      settings = {
-        extends = "default";
-        rules = {
-          document-start = "disable";
-          line-length = {
-            max = 300;
-          };
-        };
-      };
-    };
-
-    # --- JSON ---
-    jsonfmt.enable = true;
-
-    # Optional: keep JSON sorted
-    # prettier.enable = true;
-  };
-}

npins/sources.json

@@ -1,24 +0,0 @@
-{
-  "pins": {
-    "nixpkgs": {
-      "type": "Channel",
-      "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre961788.75690239f08f/nixexprs.tar.xz",
-      "hash": "sha256-p0h/nSeqzIkbn/2uFC4keoIPwmqXGHsX0gkCXM7km00="
-    },
-    "treefmt-nix": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "numtide",
-        "repo": "treefmt-nix"
-      },
-      "branch": "main",
-      "submodules": false,
-      "revision": "71b125cd05fbfd78cab3e070b73544abe24c5016",
-      "url": "https://github.com/numtide/treefmt-nix/archive/71b125cd05fbfd78cab3e070b73544abe24c5016.tar.gz",
-      "hash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk="
-    }
-  },
-  "version": 7
-}

shell.nix

@@ -1,51 +1,57 @@
 let
-  sources = import ./npins;
+  sources = import ./nix;
   system = builtins.currentSystem;
   pkgs = import sources.nixpkgs {
     inherit system;
     config = { };
     overlays = [ ];
   };
-  treefmt = import ./nix/treefmt.nix { };
+  checks = import ./nix/checks.nix;
-  kueuectl = pkgs.callPackage ./nix/kueuectl.nix { };
 in
 pkgs.mkShellNoCC {
-  packages = [
+  name = "clstr";
+
+  packages =
+    with pkgs;
+    [
       # dev tools
-    pkgs.just
+      just
-    pkgs.npins
+      npins
-    treefmt.config.build.wrapper
 
       # helm
-    pkgs.helmfile
+      helmfile
-    pkgs.kubernetes-helm
+      kubernetes-helm
 
       # kubectl tools
-    pkgs.kubectl-cnpg
+      kubectl-cnpg
-    pkgs.kubectl-neat
+      kubectl-neat
-    pkgs.kubectl-graph
+      kubelogin
-    pkgs.kubectl-klock
+      kubelogin-oidc
-    pkgs.kubectl-rook-ceph
+      kubectl-rook-ceph
+      kubectl-graph
+      kubectl-klock
+      graphviz
 
       # other tools activate when needed
-    kueuectl
+      # step-cli
-    # pkgs.step-cli
+      # linkerd
-    # pkgs.linkerd
+      # cmctl
-    # pkgs.cmctl
+      # rclone
-    # pkgs.rclone
+      # velero
-    # pkgs.velero
+      renovate
-    # pkgs.renovate
+
-    # pkgs.graphviz
+      # dapr
-    # pkgs.hubble
+      dapr-cli
-    pkgs.cilium-cli
+    ]
-    pkgs.dapr-cli
+    ++ checks.enabledPackages;
-  ];
 
   # Environment variables
   ARGOCD_ENV_CLUSTER_NAME = "ekman";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
-  API_SERVER_IP = "localhost";
+
-  API_SERVER_PORT = "7445";
+  shellHook = builtins.concatStringsSep "\n" [
+    checks.shellHook
+  ];
 
   # Alternative shells
   passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {
@@ -53,6 +59,9 @@ pkgs.mkShellNoCC {
       packages = [
         pkgs.npins
       ];
+      shellHook = ''
+        export NPINS_DIRECTORY="nix"
+      '';
     };
   };
 }

values/argo/env.yaml.gotmpl

@@ -24,7 +24,11 @@ argocd:
       cpu: 250m
   repoServers:
   - name: "helmfile-cmp"
-    image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
+    image: "registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest"
+    imagePullSecrets:
+      - gitlab-pull-secret
+  - name: "kustomize-helm-with-rewrite"
+    image: "registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest"
     imagePullSecrets:
       - gitlab-pull-secret
   additional_rbac_settings:

values/argo/manifests/sys-project.yaml

@@ -92,15 +92,9 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: postfix
     server: https://kubernetes.default.svc
-  - namespace: jobset-system
-    server: https://kubernetes.default.svc
-  - namespace: dex
-    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
-  - https://git.oceanbox.io/platform/manifests.git
-  - https://git.oceanbox.io/platform/manifests
   - https://gitlab.com/oceanbox/manifests.git
   - https://kubernetes.github.io/ingress-nginx
   - https://cloudnative-pg.github.io/charts
@@ -133,13 +127,9 @@ spec:
   - ghcr.io/slinkyproject/charts/slurm-operator
   - ghcr.io/slinkyproject/charts/slurm-operator-crds
   - ghcr.io/spegel-org/helm-charts
-  - quay.io/cilium/charts
-  - quay.io/jetstack/charts
-  - registry.k8s.io/jobset/charts/jobset
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
   - docker.gitea.com
   - https://operator.mariadb.com/mariadb-enterprise-operator
   - https://operator.mariadb.com
   - https://ot-container-kit.github.io/helm-charts
   - https://twin.github.io/helm-charts
-  - https://charts.dexidp.io

values/argo/values/argocd.yaml.gotmpl

@@ -15,7 +15,7 @@ configs:
     application.resourceTrackingMethod: annotation+label
     application.instanceLabelKey: app.kubernetes.io/instance
     create: true
-    # NOTE: callback URL for dex
+    # NOTE(kai): callback URL for dex
     url: "https://argocd.{{ .Values.clusterConfig.domain }}"
     resource.compareoptions: |
       ignoreAggregatedRoles: true
@@ -81,7 +81,6 @@ configs:
       p, role:org-admin, applications, *, */*, allow
       p, role:org-admin, projects, *, *, allow
       p, role:org-admin, logs, get, *, allow
-      p, role:org-admin, logs, get, */*, allow
       p, role:org-admin, clusters, get, *, allow
       p, role:org-admin, clusters, update, *, allow
       p, role:org-admin, repositories, get, *, allow
@@ -168,7 +167,7 @@ repoServer:
   extraContainers:
   - command:
     - /var/run/argocd/argocd-cmp-server
-    image: {{ .image }}
+    image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
     env:
     - name: HELM_GIT_ACCESS_TOKEN
       valueFrom:
@@ -177,7 +176,7 @@ repoServer:
           name: oceanbox-gitops-repo
           optional: false
     imagePullPolicy: Always
-    name: {{ .name }}
+    name: helmfile-cmp
     securityContext:
       runAsNonRoot: true
       runAsUser: 999
@@ -192,6 +191,23 @@ repoServer:
       name: cmp-tmp
     - mountPath: /helm-working-dir
       name: helm-working-dir
+  - command:
+    - /var/run/argocd/argocd-cmp-server
+    image: {{ .image }}
+    imagePullPolicy: Always
+    name: {{ .name }}
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 999
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    volumeMounts:
+    - mountPath: /var/run/argocd
+      name: var-files
+    - mountPath: /home/argocd/cmp-server/plugins
+      name: plugins
+    - mountPath: /tmp
+      name: cmp-tmp
   volumes:
   - name: cmp-tmp
     emptyDir: {}
@@ -267,6 +283,10 @@ applicationSet:
     ingressClassName: nginx
     annotations:
       cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
+      # {{- with .Values.clusterConfig.ingress_whitelist}}
+      # NOTE(kai): include gitlab and github webhook ranges
+      # nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }},192.30.252.0/22,140.82.112.0/20,34.74.226.27/28,34.74.226.0/24
+      # {{- end }}
     hostname: "argocd-applicationset.{{ .Values.clusterConfig.domain }}"
     tls:
       - secretName: argocd-applicationset-tls

values/atlantis/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,3 @@
 atlantis:
   enabled: true
+

values/atlantis/env.yaml.gotmpl

@@ -1,4 +1,5 @@
 atlantis:
   enabled: false
-  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
+  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
   env: {{ .Environment.Name }}
+

values/atlantis/kustomize/beta/appsettings.json

@@ -1,96 +0,0 @@
-{
-    "oidc": {
-        "issuer": "https://auth.oceanbox.io/realms/oceanbox",
-        "authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
-        "token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
-        "jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
-        "userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
-        "end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
-        "device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
-        "clientId": "atlantis",
-        "clientSecret": "",
-        "scopes": [
-            "openid",
-            "email",
-            "offline_access",
-            "profile"
-        ],
-        "audiences": [
-            "atlantis",
-            "atlantis_dev",
-            "sorcerer",
-            "sorcerer_dev"
-        ]
-    },
-    "sso": {
-        "cookieDomain": ".oceanbox.io",
-        "cookieName": ".obx.beta",
-        "ttl": 12.0,
-        "signedOutRedirectUri": "https://maps.beta.oceanbox.io",
-        "realm": "atlantis",
-        "environment": "prod",
-        "keyStore": {
-            "kind": "azure",
-            "uri": "https://atlantis.blob.core.windows.net",
-            "key": "dataprotection-keys"
-        },
-        "keyVault": {
-            "kind": "azure",
-            "uri": "https://atlantisvault.vault.azure.net",
-            "key": "dataencryption-keys"
-        }
-    },
-    "fga": {
-      "apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
-      "apiKey": "",
-      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
-      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
-    },
-    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
-    "plainAuthUsers": [
-        {
-            "username": "admin",
-            "password": "en-to-tre-fire",
-            "groups": [ "/oceanbox" ],
-            "roles": [ "admin" ]
-        },
-        {
-            "username": "sorcerer",
-            "password": "fire tre to en",
-            "groups": [ "/oceanbox" ],
-            "roles": [ "admin" ]
-        },
-        {
-            "username": "archivist",
-            "password": "en-to-tre-fire",
-            "groups": [ "/oceanbox" ],
-            "roles": [ "admin" ]
-        }
-    ],
-    "plume": "plume.data.oceanbox.io",
-    "redis": "beta-atlantis-redis:6379",
-    "objectStore": "https://atlantis.blob.core.windows.net",
-    "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
-    "sorcerer" : "https://sorcerer.beta.ekman.oceanbox.io",
-    "allowedOrigins": [
-        "https://maps.beta.oceanbox.io"
-    ],
-    "appName": "atlantis",
-    "appEnv": "prod",
-    "appNamespace": "atlantis",
-    "appVersion": "2.95.1",
-    "otelCollector": "http://opentelemetry-collector.otel.svc:4317",
-    "pubsubName": "pubsub",
-    "pubsubTopic": "hipster-atlantis",
-    "slurm": {
-        "baseUrl": "https://slurmrestd.ekman.oceanbox.io/",
-        "slurmApi": "slurm/v0.0.42/",
-        "dbdApi": "slurmdbd/v0.0.42/",
-        "accessToken": ""
-    },
-    "amqp": {
-        "auth": "user:hunny-bunny",
-        "host": "10.255.241.201:30673"
-    },
-    "fenceRadius": 1250.0
-}

values/atlantis/kustomize/beta/bindings.yaml

@@ -1,22 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: slurm-events
-spec:
-  type: bindings.rabbitmq
-  version: v1
-  metadata:
-  - name: host
-    secretKeyRef:
-      name: prod-atlantis-rabbitmq
-      key:  connString
-  - name: queueName
-    value: beta-slurm-job-events
-  - name: durable
-    value: true
-  - name: contentType
-    value: "application/json"
-  - name: route
-    value: /events/slurm
-scopes:
-  - beta-atlantis

values/atlantis/kustomize/beta/configurations.yaml

@@ -1,20 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: configstore
-spec:
-  type: configuration.redis
-  version: v1
-  metadata:
-  - name: redisHost
-    value: beta-atlantis-redis:6379
-  - name: redisUsername
-    value: default
-  - name: redisPassword
-    secretKeyRef:
-      name: beta-atlantis-redis
-      key:  redis-password
-  - name: redisDB
-    value: "1"
-scopes:
-  - beta-atlantis

values/atlantis/kustomize/beta/default.env

@@ -1 +0,0 @@
-OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm

values/atlantis/kustomize/beta/deployment_patch.yaml

@@ -1,10 +0,0 @@
-- op: add
-  path: /spec/template/spec/containers/0/envFrom/-
-  value:
-    secretRef:
-      name: azure-keyvault
-- op: add
-  path: /spec/template/spec/containers/0/envFrom/-
-  value:
-    secretRef:
-      name: prod-atlantis-env

values/atlantis/kustomize/beta/keyvault.yaml

@@ -1,22 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: azure-keyvault
-spec:
-  type: secretstores.azure.keyvault
-  version: v1
-  metadata:
-  - name: vaultName
-    value: atlantisvault
-  - name: azureTenantId
-    secretKeyRef:
-      name: azure-keyvault
-      key: AZURE_TENANT_ID
-  - name: azureClientId
-    secretKeyRef:
-      name: azure-keyvault
-      key: AZURE_CLIENT_ID
-  - name: azureClientSecret
-    secretKeyRef:
-      name: azure-keyvault
-      key: AZURE_CLIENT_SECRET

values/atlantis/kustomize/beta/kustomization.yaml

@@ -1,24 +0,0 @@
-generatorOptions:
-  disableNameSuffixHash: true
-configMapGenerator:
-- name: beta-atlantis-appsettings
-  files:
-    - appsettings.json
-patches:
-  - target:
-      group: apps
-      version: v1
-      kind: Deployment
-    path: deployment_patch.yaml
-
-resources:
-  - ../base
-  - rbac.yaml
-  - tracing.yaml
-  - bindings.yaml
-  - pubsub.yaml
-  - statestore.yaml
-  - subscriptions.yaml
-  - configurations.yaml
-  - secretstore.yaml
-  - keyvault.yaml

values/atlantis/kustomize/beta/pubsub.yaml

@@ -1,52 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: pubsub
-spec:
-  version: v1
-  type: pubsub.rabbitmq
-  metadata:
-  - name: hostname
-    value: prod-rabbitmq.rabbitmq
-  - name: username
-    value: user
-  - name: password
-    secretKeyRef:
-      name: prod-atlantis-rabbitmq
-      key:  rabbitmq-password
-  - name: protocol
-    value: amqp
-  - name: durable
-    value: true
-  - name: deletedWhenUnused
-    value: false
-  - name: autoAck
-    value: false
-  - name: deliveryMode
-    value: 1
-  - name: requeueInFailure
-    value: false
-  - name: prefetchCount
-    value: 0
-  - name: reconnectWait
-    value: 0
-  - name: concurrencyMode
-    value: parallel
-  - name: publisherConfirm
-    value: false
-  - name: backOffPolicy
-    value: exponential
-  - name: backOffInitialInterval
-    value: 100
-  - name: backOffMaxRetries
-    value: 16
-  - name: enableDeadLetter # Optional enable dead Letter or not
-    value: true
-  - name: maxLen # Optional max message count in a queue
-    value: 3000
-  - name: maxLenBytes # Optional maximum length in bytes of a queue.
-    value: 10485760
-  - name: exchangeKind
-    value: fanout
-  - name: clientName
-    value: "{appID}"

values/atlantis/kustomize/beta/rbac.yaml

@@ -1,40 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: beta-atlantis
-  namespace: beta-atlantis
-rules:
-- apiGroups:
-  - ""
-  resourceNames:
-  - beta-atlantis-appsettings
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - watch
-- apiGroups:
-  - ""
-  resourceNames:
-  - azure-keyvault
-  - beta-atlantis-redis
-  - slurm-access-token
-  resources:
-  - secrets
-  verbs:
-  - get
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: beta-atlantis
-  namespace: beta-atlantis
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: beta-atlantis
-subjects:
-- kind: ServiceAccount
-  name: beta-atlantis
-  namespace: beta-atlantis

values/atlantis/kustomize/beta/secretstore.yaml

@@ -1,10 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: secretstore
-spec:
-  type: secretstores.kubernetes
-  version: v1
-  metadata:
-   - name: defaultNamespace
-     value: beta-atlantis

values/atlantis/kustomize/beta/statestore.yaml

@@ -1,22 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: statestore
-spec:
-  type: state.redis
-  version: v1
-  metadata:
-  - name: redisHost
-    value: beta-atlantis-redis:6379
-  - name: redisUsername
-    value: default
-  - name: redisPassword
-    secretKeyRef:
-      name: beta-atlantis-redis
-      key:  redis-password
-  - name: actorStateStore
-    value: "true"
-  - name: redisDB
-    value: "0"
-scopes:
-  - beta-atlantis

values/atlantis/kustomize/beta/subscriptions.yaml

@@ -1,27 +0,0 @@
-apiVersion: dapr.io/v2alpha1
-kind: Subscription
-metadata:
-  name: hipster-events
-spec:
-  topic: hipster
-  routes:
-    default: /events/hipster
-  pubsubname: pubsub
-  metadata:
-    queueType: quorum
-scopes:
-- beta-atlantis
----
-apiVersion: dapr.io/v2alpha1
-kind: Subscription
-metadata:
-  name: inbox-events
-spec:
-  topic: inbox
-  routes:
-    default: /events/inbox
-  pubsubname: pubsub
-  metadata:
-    queueType: quorum
-scopes:
-- beta-atlantis

values/atlantis/kustomize/beta/tracing.yaml

@@ -1,11 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Configuration
-metadata:
-  name: tracing
-spec:
-  tracing:
-    samplingRate: "1"
-    otel:
-      endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
-      protocol: grpc
-      isSecure: false

values/atlantis/kustomize/prod/appsettings.json

@@ -73,8 +73,7 @@
     "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
     "sorcerer" : "https://sorcerer.data.oceanbox.io",
     "allowedOrigins": [
-        "https://maps.oceanbox.io",
+        "https://maps.oceanbox.io"
-        "https://codex.adm.oceanbox.io"
     ],
     "appName": "atlantis",
     "appEnv": "prod",

values/atlantis/kustomize/staging/appsettings.json

@@ -26,7 +26,7 @@
         "cookieDomain": ".oceanbox.io",
         "cookieName": ".obx.staging",
         "ttl": 12.0,
-        "signedOutRedirectUri": "https://maps.dev.oceanbox.io",
+        "signedOutRedirectUri": "https://atlantis.beta.oceanbox.io",
         "realm": "atlantis",
         "environment": "staging",
         "keyStore": {
@@ -76,8 +76,7 @@
         "https://atlantis.beta.oceanbox.io",
         "https://atlantis.dev.oceanbox.io",
         "https://atlantis.local.oceanbox.io:8080",
-        "https://maps.dev.oceanbox.io",
+        "https://maps.dev.oceanbox.io"
-        "https://codex.dev.oceanbox.io"
     ],
     "appName": "atlantis",
     "appEnv": "staging",

values/atlantis/manifests/atlantis.yaml

@@ -27,24 +27,16 @@ spec:
         value: {{ .Values.atlantis.env }}
       - name: HELMFILE_FILE_PATH
         value: atlantis.yaml.gotmpl
-  {{- if ne .Values.atlantis.env "beta" }}
   - repoURL: https://charts.bitnami.com/bitnami
     targetRevision: 20.1.7
     chart: redis
     helm:
       valueFiles:
       - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
-  {{- end }}
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
-  - repoURL: https://git.oceanbox.io/platform/manifests.git
     targetRevision: main
     ref: values
   ignoreDifferences:
-    - kind: Secret
-      name: beta-atlantis-db-superuser
-      jqPathExpressions:
-        - '.data'
-        - '.metadata.labels'
-        - '.metadata.annotations'
     - kind: Secret
       name: azure-keyvault
       jqPathExpressions:
@@ -75,12 +67,6 @@ spec:
         - '.data'
         - '.metadata.labels'
         - '.metadata.annotations'
-    - kind: Secret
-      name: slurm-access-token
-      jqPathExpressions:
-        - '.data'
-        - '.metadata.labels'
-        - '.metadata.annotations'
   syncPolicy:
     syncOptions:
       - CreateNamespace=true

values/atlantis/values/redis-prod.yaml

@@ -2,14 +2,6 @@ architecture: replication
 
 replica:
   replicaCount: 2
-  resources:
-    limits:
-      ephemeral-storage: 1024Mi
-      memory: 192Mi
-    requests:
-      cpu: 150m
-      ephemeral-storage: 50Mi
-      memory: 128Mi
 
 auth:
   enabled: true
@@ -28,3 +20,4 @@ master:
       cpu: 150m
       ephemeral-storage: 50Mi
       memory: 128Mi
+

values/atlantis/values/sec.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-data:
-  redis-password: N2drUGlEN0ZMNA==
-kind: Secret
-metadata:
-  name: beta-sorcerer-redis
-  namespace: beta-sorcerer
-type: Opaque

values/atlantis/values/values-beta.yaml.gotmpl

@@ -1,103 +0,0 @@
-replicaCount: 1
-
-image:
-  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.46.2
-
-podAnnotations:
-  dapr.io/app-id: "beta-atlantis"
-
-env:
-  - name: APP_NAMESPACE
-    value: beta-atlantis
-  - name: APP_VERSION
-    value: "2.97.4-beta"
-  - name: LOG_LEVEL
-    value: "1"
-  - name: ANALYTICS_WEB_ID
-    value: "16e7d807-4db5-45fd-92a9-27393445a153"
-  - name: REDIS_USER
-    value: default
-  - name: REDIS_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: beta-atlantis-redis
-        key: redis-password
-  # Share production database
-  - name: DB_HOST
-    value: prod-atlantis-db-rw.prod-atlantis
-  - name: DB_PORT
-    value: "5432"
-  - name: DB_USER
-    valueFrom:
-      secretKeyRef:
-        name: prod-atlantis-db-superuser
-        key: username
-  - name: DB_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: prod-atlantis-db-superuser
-        key: password
-  - name: DAPR_API_TOKEN
-    valueFrom:
-      secretKeyRef:
-        name: dapr-api-token
-        key: token
-
-ingress:
-  enabled: true
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-  hosts:
-    - host: maps.beta.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-      internal:
-        - path: /internal
-          pathType: ImplementationSpecific
-        - path: /dapr
-          pathType: ImplementationSpecific
-        - path: /actors
-          pathType: ImplementationSpecific
-        - path: /job
-          pathType: ImplementationSpecific
-        - path: /events
-          pathType: ImplementationSpecific
-        - path: /metrics
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-       - maps.beta.oceanbox.io
-      secretName: beta-atlantis-tls
-
-cluster:
-  enabled: false
-  bootstrap: false
-
-redis:
-  enabled: true
-  size: 2Gi
-  secret:
-    name: beta-atlantis-redis
-    key: redis-password
-  backup:
-    enabled: true
-  resources:
-    cpu: 150m
-    memory: 256Mi
-
-resources:
-  limits:
-    cpu: 500m
-    memory: 512Mi
-  requests:
-    cpu: 250m
-    memory: 512Mi
-
-diagrid-dashboard:
-  enabled: false
-  statestore:
-    scope: beta-atlantis
-    redis: beta-atlantis-redis

values/atlantis/values/values-prod.yaml.gotmpl

@@ -73,6 +73,9 @@ cluster:
     enabled: false
 
 resources:
+  limits:
+    cpu: 1
+    memory: 1Gi
   requests:
     cpu: 500m
     memory: 1Gi

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,6 @@
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: 8e824d4a-debug
-  tag: 23006866-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:
@@ -50,6 +49,23 @@ ingress:
     # nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
     # oceanbox.io/expose: internal
   hosts:
+    - host: atlantis.beta.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
     - host: maps.dev.oceanbox.io
       paths:
         - path: /
@@ -67,8 +83,27 @@ ingress:
           pathType: ImplementationSpecific
         - path: /metrics
           pathType: ImplementationSpecific
+    - host: atlas.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
   tls:
     - hosts:
+        - atlantis.beta.oceanbox.io
+        - atlas.oceanbox.io
         - maps.dev.oceanbox.io
       secretName: staging-atlantis-tls
 cluster:

values/attic/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,2 @@
 attic:
-  enabled: false
+  enabled: true

values/attic/manifests/attic.yaml

@@ -8,9 +8,9 @@ metadata:
 spec:
   destination:
     namespace: attic
-    server: "https://kubernetes.default.svc"
+    server: 'https://kubernetes.default.svc'
   sources:
-    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: HEAD
     path: values/attic/manifests
   project: aux

values/cert-manager/env-hel1.yaml.gotmpl

@@ -1,5 +0,0 @@
-cert_manager:
- enabled: true
- autosync: true
- gatewayApi:
-  enabled: true

values/cert-manager/env.yaml.gotmpl

@@ -1,5 +1,3 @@
 cert_manager:
  enabled: true
  autosync: true
- gatewayApi:
-  enabled: false

values/cert-manager/values/cert-manager.yaml.gotmpl

@@ -3,9 +3,3 @@ enableCertificateOwnerRef: true
 startupapicheck:
   podAnnotations:
     linkerd.io/inject: disabled
-{{- if .Values.cert_manager.gatewayApi.enabled }}
-config:
-  apiVersion: controller.config.cert-manager.io/v1alpha1
-  enableGatewayAPI: true
-  kind: ControllerConfiguration
-{{- end }}

values/cilium/cilium-manifests/gateway.yaml

@@ -1,68 +0,0 @@
-{{- if eq .Values.cilium.cluster "hel1" }}
-# TODO: Move to ListernerSets when those get Promoted to GA
-# Resources:
-# - https://gateway-api.sigs.k8s.io/geps/gep-1713/
-# - https://github.com/kubernetes-sigs/gateway-api/issues/1713
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: shared-gateway
-  namespace: kube-system
-spec:
-  infrastructure:
-    annotations:
-      load-balancer.hetzner.cloud/location: hel1
-      load-balancer.hetzner.cloud/type: lb11
-      load-balancer.hetzner.cloud/name: load-balancer-2
-      load-balancer.hetzner.cloud/use-private-ip: "true"
-      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
-      load-balancer.hetzner.cloud/http-redirect-https: "false"
-  gatewayClassName: cilium
-  listeners:
-    - name: http
-      protocol: HTTP
-      port: 80
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
-    - name: https
-      protocol: HTTPS
-      port: 443
-      tls:
-        certificateRefs:
-          - group: ''
-            kind: Secret
-            name: wildcard-oceanbox-io
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
-    - name: ssh
-      protocol: TCP
-      port: 22
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-oceanbox-io
-spec:
-  secretName: wildcard-oceanbox-io
-  commonName: oceanbox.io
-  dnsNames:
-    - oceanbox.io
-    - "*.oceanbox.io"
-  issuerRef:
-    name: letsencrypt-prod-dns01
-    kind: ClusterIssuer
-{{- end}}

values/cilium/cilium-manifests/policies/allow-ingress-to-cluster.yaml

@@ -1,19 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: "cilium.io/v2"
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-ingress-to-cluster
-  namespace: default
-spec:
-  endpointSelector:
-    matchExpressions:
-      - key: reserved:ingress
-        operator: Exists
-  egress:
-    - toEntities:
-        - cluster
-  ingress:
-    - fromEntities:
-        - world
-        - cluster
-{{- end }}

values/cilium/env-ekman.yaml.gotmpl

@@ -1,22 +0,0 @@
-cilium:
-  enabled: true
-  clustermesh:
-    enabled: false
-    clusterId: 2
-    # NodePort until L2LB is available (kubeproxyless)
-    apiserverServiceType: NodePort
-  # TODO: WireGuard blocks all traffic on ekman -- disable until root cause is found.
-  encryption:
-    enabled: false
-  envoy:
-    enabled: true
-  # kube-proxy stays running during migration; disable replacement until done.
-  # TODO: set to true after migration
-  kubeProxyReplacement: false
-  # Direct apiserver connection -- do not rely on the kubernetes service IP
-  # during migration since we are touching the CNI layer.
-  # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
-  k8sServiceHost: 10.255.241.99
-  k8sServicePort: 6443
-  policyAuditMode: true
-  upgradeCompatability: 1.18

values/cilium/env-hel1.yaml.gotmpl

@@ -1,14 +0,0 @@
-cilium:
-  enabled: true
-  envoy:
-    enabled: true
-  nodePort:
-    enabled: true
-  l2announcement:
-    enabled: true
-  gatewayAPI:
-    enabled: true
-  gatewayTest:
-    enabled: true
-  policyAuditMode: true
-  upgradeCompatability: 1.18