wip: Gateway Setup

2026-03-13 16:05:15 +01:00
132 changed files with 1004 additions and 834 deletions
@@ -1,3 +0,0 @@
-FROM busybox
-
-COPY keycloak-themes/oceanbox /theme
@@ -1,109 +0,0 @@
-/* Oceanbox Keycloak Login Theme
- *
- * Branding aligned with oceanbox.io:
- *   Primary teal:    #0bb4aa
- *   Dark teal:       #37746F
- *   Deep blue:       #031275
- *   Background:      #f9fafd
- *   Text:            #101010
- */
-
-:root {
-    --pf-v5-global--primary-color--100: #0bb4aa;
-    --pf-v5-global--primary-color--200: #099e95;
-    --pf-v5-global--link--Color: #0bb4aa;
-    --pf-v5-global--link--Color--hover: #031275;
-}
-
-.login-pf body {
-    background: #f9fafd url("../img/oceanbox-bg.png") no-repeat center bottom fixed;
-    background-size: cover;
-    height: 100%;
-}
-
-/* Login container layout */
-.pf-v5-c-login__container {
-    grid-template-columns: 34rem;
-    grid-template-areas: "header"
-                         "main";
-}
-
-/* Logo */
-div.kc-logo-text {
-    background-image: url('../img/oceanbox-logo-text.png');
-    height: 80px;
-    width: 360px;
-    background-repeat: no-repeat;
-    background-size: contain;
-    background-position: center;
-    margin: 0 auto;
-}
-
-div.kc-logo-text span {
-    display: none;
-}
-
-/* Header */
-#kc-header-wrapper {
-    font-size: 29px;
-    text-transform: uppercase;
-    letter-spacing: 3px;
-    line-height: 1.2em;
-    white-space: normal;
-    color: #37746F !important;
-    text-align: center;
-}
-
-/* Login card */
-.pf-v5-c-login__main {
-    border-radius: 8px;
-    box-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
-}
-
-/* Primary button */
-.pf-v5-c-button.pf-m-primary {
-    --pf-v5-c-button--m-primary--BackgroundColor: #0bb4aa;
-    --pf-v5-c-button--m-primary--hover--BackgroundColor: #099e95;
-    --pf-v5-c-button--m-primary--active--BackgroundColor: #37746F;
-    --pf-v5-c-button--m-primary--focus--BackgroundColor: #099e95;
-    border-radius: 4px;
-}
-
-/* Links */
-.pf-v5-c-button.pf-m-link {
-    --pf-v5-c-button--m-link--Color: #0bb4aa;
-    --pf-v5-c-button--m-link--hover--Color: #031275;
-}
-
-a {
-    color: #0bb4aa;
-}
-
-a:hover {
-    color: #031275;
-}
-
-/* Form inputs */
-.pf-v5-c-form-control > input,
-.pf-v5-c-form-control > textarea {
-    border-radius: 4px;
-}
-
-#kc-recovery-codes-list {
-    columns: 2;
-}
-
-#certificate_subjectDN {
-    overflow-wrap: break-word;
-}
-
-hr {
-    margin-top: var(--pf-v5-global--spacer--sm);
-    margin-bottom: var(--pf-v5-global--spacer--md);
-}
-
-@media (min-width: 768px) {
-    div.pf-v5-c-login__main-header {
-        grid-template-columns: 70% 30%;
-    }
-}
@@ -1,5 +0,0 @@
-parent=keycloak.v2
-import=common/keycloak
-
-stylesCommon=vendor/patternfly-v5/patternfly.min.css vendor/patternfly-v5/patternfly-addons.css
-styles=css/styles.css css/oceanbox.css
@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.18
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.18
+appVersion: v1.46.5
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.42.18
+  tag: v1.46.5
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.42.18
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.42.18"
+appVersion: "v1.46.5"
@@ -10,7 +10,7 @@ image:
  # This sets the pull policy for images.
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.42.18
+  tag: v1.46.5
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
  - name: gitlab-pull-secret
@@ -0,0 +1,46 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "docs.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httpRoute.rules }}
+    - {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+    {{- end }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-{{ $fullName }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  endpointSelector:
+    matchLabels:
+      {{- include "docs.selectorLabels" . | nindent 6 }}
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
+{{- end }}
@@ -46,8 +46,13 @@ service:
  type: ClusterIP
  port: 8080
 ingress:
-  enabled: true
+  enabled: false
  className: nginx
+httpRoute:
+  enabled: false
+  parentRefs: []
+  hostnames: []
+  rules: []
 persistence:
  enabled: false
  size: 1G
@@ -0,0 +1,46 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "makai.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "makai.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httpRoute.rules }}
+    - {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+    {{- end }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-{{ $fullName }}
+  labels:
+    {{- include "makai.labels" . | nindent 4 }}
+spec:
+  endpointSelector:
+    matchLabels:
+      {{- include "makai.selectorLabels" . | nindent 6 }}
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
+{{- end }}
@@ -46,8 +46,13 @@ service:
  type: ClusterIP
  port: 8080
 ingress:
-  enabled: true
+  enabled: false
  className: nginx
+httpRoute:
+  enabled: false
+  parentRefs: []
+  hostnames: []
+  rules: []
 persistence:
  enabled: false
  size: 1G
@@ -1,6 +0,0 @@
-dependencies:
- name: diagrid-dashboard
-  repository: file://../diagrid-dashboard
-  version: 0.1.0
-digest: sha256:4fdb3148a2a6439223d7844a3083da2de324dd47e5cb3ac4a5d9c436e6e2c775
-generated: "2026-02-25T16:15:48.608231856+01:00"
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.7.1
+version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.7.1
+appVersion: v1.6.13
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/plume/plume
-  tag: v1.7.1
+  tag: v1.6.13
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -90,5 +90,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
 diagrid-dashboard:
  enabled: false
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.18
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.18
+appVersion: v1.46.5
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.42.18
+  tag: v1.46.5
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -15,7 +15,7 @@ releases:
 - name: argocd
  namespace: argocd
  chart: argo/argo-cd
-  version: 9.4.17
+  version: 9.4.10
  condition: argo.enabled
  values:
  - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
  namespace: argocd
  chart: argo/argo-rollouts
-  version: 2.40.9
+  version: 2.40.6
  condition: argo.rollouts.enabled
  values:
  - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
  namespace: argocd
  chart: argo/argo-workflows
-  version: 1.0.10
+  version: 0.47.5
  condition: argo.workflows.enabled
  missingFileHandler: Info
 - name: manifests
@@ -1,46 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/helmfile.json
-
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
- name: catalyst
-  oci: true
-  url: 'public.ecr.aws/diagrid'
-
-commonLabels:
-  tier: system
-
-releases:
- name: catalyst
-  namespace: cra-agent
-  chart: catalyst/catalyst
-  version: 1.47.0
-  condition: catalyst.enabled
-  values:
-  - ../values/catalyst/values/values.yaml
-  - ../values/catalyst/values/values-{{ .Environment.Name }}.yaml
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/catalyst/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
- name: manifests
-  namespace: cra-agent
-  chart: manifests
-  condition: catalyst.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/catalyst/env.yaml.gotmpl
-  - ../values/catalyst/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/catalyst/manifests
-    - manifests
@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
  namespace: cert-manager
  chart: cert-manager/cert-manager
-  version: v1.20.2
+  version: v1.19.4
  condition: cert_manager.enabled
  values:
  - ../values/cert-manager/values/cert-manager.yaml.gotmpl
@@ -11,6 +11,7 @@ releases:
  condition: docs.enabled
  values:
  - ../values/docs/values/values.yaml
+  - ../values/docs/values/values.yaml.gotmpl
  - ../values/docs/values/values-{{ .Environment.Name }}.yaml
  postRenderer: ../bin/kustomizer
  postRendererArgs:
@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
  namespace: dragonfly
  chart: dragonfly/dragonfly-operator
-  version: v1.5.0
+  version: v1.4.0
  condition: dragonfly.enabled
  values:
  - ../values/dragonfly/values/dragonfly.yaml.gotmpl
@@ -13,10 +13,11 @@ releases:
 - name: gitea
  namespace: gitea
  chart: gitea/gitea
-  version: 12.5.3
+  version: 12.5.0
  condition: gitea.enabled
  values:
  - ../values/gitea/values/values.yaml
+  - ../values/gitea/values/values.yaml.gotmpl
  - ../values/gitea/values/values-{{ .Environment.Name }}.yaml
  postRenderer: ../bin/kustomizer
  postRendererArgs:
@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
  namespace: ingress-nginx
  chart: ingress-nginx/ingress-nginx
-  version: 4.15.1
+  version: 4.14.3
  condition: nginx.enabled
  values:
  - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
  namespace: keycloak
  chart: bitnami/keycloak
-  version: 25.2.0
+  version: 24.9.0
  condition: keycloak.enabled
  values:
  - ../values/keycloak/values/values.yaml
@@ -8,7 +8,7 @@ releases:
 - name: kueue
  namespace: kueue-system
  chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.17.1
+  version: 0.15.0
  condition: kueue.enabled
  values:
  - ../values/kueue/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: loki
  namespace: loki
  chart: loki/loki
-  version: 6.55.0
+  version: 6.53.0
  condition: loki.enabled
  values:
  - ../values/loki/values/loki.yaml.gotmpl
@@ -11,6 +11,7 @@ releases:
  condition: makai.enabled
  values:
  - ../values/makai/values/values.yaml
+  - ../values/makai/values/values.yaml.gotmpl
  - ../values/makai/values/values-{{ .Environment.Name }}.yaml
  postRenderer: ../bin/kustomizer
  postRendererArgs:
@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
  namespace: mariadb-operator
  chart: mariadb-operator/mariadb-operator
-  version: 26.3.0
+  version: 25.10.4
  condition: mariadb_operator.enabled
  values:
  - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl
@@ -16,7 +16,7 @@ releases:
  namespace: {{ .Environment.Name }}-openfga
  {{- end }}
  chart: openfga/openfga
-  version: 0.3.2
+  version: 0.2.55
  condition: openfga.enabled
  values:
  - ../values/openfga/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
  namespace: otel
  chart: open-telemetry/opentelemetry-collector
-  version: 0.150.1
+  version: 0.146.1
  condition: otel.enabled
  values:
  - ../values/opentelemetry-collector/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: prometheus
  namespace: prometheus
  chart: prometheus/kube-prometheus-stack
-  version: 82.15.1
+  version: 82.10.1
  condition: prometheus.enabled
  values:
  - ../values/prometheus/values/prometheus.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
  namespace: slinky
  chart: slurm-operator/slurm-operator
-  version: 1.0.3
+  version: 1.0.2
  condition: slurm_operator.enabled
  values:
  - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: slurm
  namespace: slurm
  chart: slurm/slurm
-  version: 1.0.3
+  version: 1.0.2
  condition: slurm.enabled
  values:
  - ../values/slurm/values/slurm.yaml.gotmpl
@@ -14,7 +14,7 @@ releases:
 - name: umami
  namespace: analytics
  chart: umami/umami
-  version: 7.7.20
+  version: 7.7.2
  condition: umami.enabled
  values:
  - ../values/umami/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: velero
  namespace: velero
  chart: velero/velero
-  version: 12.0.0
+  version: 11.4.0
  condition: velero.enabled
  values:
  - ../values/velero/values/velero.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: x509-exporter
  namespace: x509-exporter
  chart: x509-exporter/x509-certificate-exporter
-  version: 3.20.1
+  version: 3.19.1
  condition: x509_exporter.enabled
  values:
  - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl
@@ -1,19 +0,0 @@
-{
-  buildGoModule,
-  fetchFromGitHub,
-}:
-buildGoModule rec {
-  pname = "kueuectl";
-  version = "0.16.3";
-
-  src = fetchFromGitHub {
-    owner = "kubernetes-sigs";
-    repo = "kueue";
-    rev = "v${version}";
-    hash = "sha256-JbU+ZoQ+YriaiIbbVCe45OTYycxYRanLhmQAdpE+xQ4=";
-  };
-
-  vendorHash = null;
-
-  subPackages = [ "cmd/kueuectl" ];
-}
@@ -25,7 +25,7 @@ treefmt.evalModule pkgs {
    # --- Nix formatting ---
    nixfmt = {
      enable = true;
-      package = pkgs.nixfmt;
+      package = pkgs.nixfmt-rfc-style;
    };
    statix.enable = true;
    deadnix.enable = true;
@@ -1,10 +1,23 @@
 {
  "pins": {
+    "git-hooks": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "cachix",
+        "repo": "git-hooks.nix"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/a1ef738813b15cf8ec759bdff5761b027e3e1d23.tar.gz",
+      "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U="
+    },
    "nixpkgs": {
      "type": "Channel",
      "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre961788.75690239f08f/nixexprs.tar.xz",
-      "hash": "sha256-p0h/nSeqzIkbn/2uFC4keoIPwmqXGHsX0gkCXM7km00="
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
+      "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
    },
    "treefmt-nix": {
      "type": "Git",
@@ -15,9 +28,9 @@
      },
      "branch": "main",
      "submodules": false,
-      "revision": "71b125cd05fbfd78cab3e070b73544abe24c5016",
-      "url": "https://github.com/numtide/treefmt-nix/archive/71b125cd05fbfd78cab3e070b73544abe24c5016.tar.gz",
-      "hash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk="
+      "revision": "337a4fe074be1042a35086f15481d763b8ddc0e7",
+      "url": "https://github.com/numtide/treefmt-nix/archive/337a4fe074be1042a35086f15481d763b8ddc0e7.tar.gz",
+      "hash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk="
    }
  },
  "version": 7
@@ -7,7 +7,6 @@ let
    overlays = [ ];
  };
  treefmt = import ./nix/treefmt.nix { };
-  kueuectl = pkgs.callPackage ./nix/kueuectl.nix { };
 in
 pkgs.mkShellNoCC {
  packages = [
@@ -28,7 +27,6 @@ pkgs.mkShellNoCC {
    pkgs.kubectl-rook-ceph

    # other tools activate when needed
-    kueuectl
    # pkgs.step-cli
    # pkgs.linkerd
    # pkgs.cmctl
@@ -37,15 +35,12 @@ pkgs.mkShellNoCC {
    # pkgs.renovate
    # pkgs.graphviz
    # pkgs.hubble
-    pkgs.cilium-cli
-    pkgs.dapr-cli
+    # pkgs.dapr-cli
  ];

  # Environment variables
  ARGOCD_ENV_CLUSTER_NAME = "ekman";
  HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
-  API_SERVER_IP = "localhost";
-  API_SERVER_PORT = "7445";

  # Alternative shells
  passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {
@@ -28,6 +28,7 @@ spec:
    managedNamespaceMetadata:
      labels:
        component: sys
+        shared-gateway-access: "true"
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
@@ -0,0 +1,40 @@
+{{- if .Values.clusterConfig.gatewayAPI.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+    sectionName: https-internal
+  hostnames:
+  - argocd.{{ .Values.clusterConfig.domain }}
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: "/"
+    backendRefs:
+    - name: argocd-server
+      port: 80
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-argocd
+  namespace: argocd
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-server
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": argocd
+{{- end }}
@@ -94,12 +94,6 @@ spec:
    server: https://kubernetes.default.svc
  - namespace: jobset-system
    server: https://kubernetes.default.svc
-  - namespace: dex
-    server: https://kubernetes.default.svc
-  - namespace: cra-agent
-    server: https://kubernetes.default.svc
-  - namespace: catalyst
-    server: https://kubernetes.default.svc
  sourceRepos:
  - https://argoproj.github.io/argo-helm
  - https://kubernetes-sigs.github.io/metrics-server/
@@ -143,8 +137,6 @@ spec:
  - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
  - docker.gitea.com
  - https://operator.mariadb.com/mariadb-enterprise-operator
-  - https://ot-container-kit.github.io/helm-charts
  - https://operator.mariadb.com
+  - https://ot-container-kit.github.io/helm-charts
  - https://twin.github.io/helm-charts
-  - https://charts.dexidp.io
-  - public.ecr.aws/diagrid/catalyst
@@ -4,13 +4,16 @@ global:
 ## Ref: https://github.com/argoproj/argo-cd
 ##
 configs:
-  {{- if .Values.argocd.anyNamespaces.enabled }}
  params:
+    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
+    server.insecure: "true"
+    {{- end }}
+    {{- if .Values.argocd.anyNamespaces.enabled }}
    applicationsetcontroller.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
    # TODO(kai): anyapp will disable PR review apps. Look into anyapp settings to fix it
    applicationsetcontroller.enable.scm.providers: "false"
    application.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
-  {{- end }}
+    {{- end }}
  cm:
    application.resourceTrackingMethod: annotation+label
    application.instanceLabelKey: app.kubernetes.io/instance
@@ -238,6 +241,9 @@ server:
    serviceMonitor:
      enabled: true
  ingress:
+    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
+    enabled: false
+    {{- else }}
    enabled: true
    ingressClassName: nginx
    annotations:
@@ -254,6 +260,7 @@ server:
      - secretName: argocd-tls
        hosts:
          - "argocd.{{ .Values.clusterConfig.domain }}"
+    {{- end }}
 applicationSet:
  metrics:
    enabled: true
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: beta-atlantis-actor-config
-data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
-  XTRACT_QUEUE: "prod-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
-  PLUME_QUEUE: "prod-queue"
@@ -7,9 +7,4 @@
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    secretRef:
-      name: prod-atlantis-env
- op: add
-  path: /spec/template/spec/containers/0/envFrom/-
-  value:
-    configMapRef:
-      name: beta-atlantis-actor-config
+      name: prod-atlantis-env
@@ -14,7 +14,6 @@ patches:
 resources:
  - ../base
  - rbac.yaml
-  - actor-config.yaml
  - tracing.yaml
  - bindings.yaml
  - pubsub.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - beta-atlantis-appsettings
-  - beta-atlantis-actor-config
  resources:
  - configmaps
  verbs:
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: prod-atlantis-actor-config
-data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
-  XTRACT_QUEUE: "prod-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
-  PLUME_QUEUE: "prod-queue"
@@ -7,9 +7,4 @@
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    secretRef:
-      name: prod-atlantis-env
- op: add
-  path: /spec/template/spec/containers/0/envFrom/-
-  value:
-    configMapRef:
-      name: prod-atlantis-actor-config
+      name: prod-atlantis-env
@@ -13,7 +13,6 @@ patches:
 resources:
  - ../base
  - secrets.yaml
-  - actor-config.yaml
  - rbac.yaml
  - tracing.yaml
  - bindings.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - prod-atlantis-appsettings
-  - prod-atlantis-actor-config
  resources:
  - configmaps
  verbs:
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: staging-atlantis-actor-config
-data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
-  XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
-  PLUME_QUEUE: "dev-queue"
@@ -7,9 +7,4 @@
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    secretRef:
-      name: staging-atlantis-env
- op: add
-  path: /spec/template/spec/containers/0/envFrom/-
-  value:
-    configMapRef:
-      name: staging-atlantis-actor-config
+      name: staging-atlantis-env
@@ -14,7 +14,6 @@ resources:
  - ../base
  - rbac.yaml
  - secrets.yaml
-  - actor-config.yaml
  - tracing.yaml
  - bindings.yaml
  - pubsub.yaml
@@ -22,4 +21,4 @@ resources:
  - subscriptions.yaml
  - configurations.yaml
  - secretstore.yaml
-  - keyvault.yaml
+  - keyvault.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - staging-atlantis-appsettings
-  - staging-atlantis-actor-config
  resources:
  - configmaps
  verbs:
@@ -2,7 +2,7 @@ replicaCount: 1

 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.48.1
+  tag: v1.46.2

 podAnnotations:
  dapr.io/app-id: "beta-atlantis"
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: d83c8790-debug
+  tag: 23006866-debug
 podAnnotations:
  dapr.io/app-id: "staging-atlantis"
 env:
@@ -1,4 +0,0 @@
-catalyst:
-  enabled: false
-  autosync: false
-  env: {{ .Environment.Name }}
@@ -1,42 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: catalyst
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    namespace: cra-agent
-    server: https://kubernetes.default.svc
-  project: sys
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-      - name: CLUSTER_NAME
-        value: {{ .Values.clusterConfig.cluster }}
-      - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.catalyst.env }}
-      - name: HELMFILE_FILE_PATH
-        value: catalyst.yaml.gotmpl
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: aux
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
-    {{- if .Values.catalyst.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
-{{- end }}
@@ -1,11 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: catalyst-db
-  namespace: cra-agent
-spec:
-  instances: 1
-  imageName: ghcr.io/cloudnative-pg/postgresql:18
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
@@ -1,15 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-catalyst
-  namespace: cra-agent
-spec:
-  description: Allow Catalyst API
-  egress:
-    - toFQDNs:
-        - matchPattern: binaries.prisma.sh
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cra-agent
-{{- end }}
@@ -1,18 +0,0 @@
-agent:
-  config:
-    project:
-      default_managed_state_store_type: postgresql-shared-external
-      external_postgresql:
-        enabled: true
-        auth_type: connectionString
-        namespace: postgres
-        connection_string_host: catalyst-db-rw.cra-agent.svc.cluster.local
-        connection_string_port: 5432
-        connection_string_username: app
-        connection_string_password: 5kDx7c9rSXxk32uEhCnMMHIpSWtg85SXDcpRJg58qskDMTtaalxWdCR9SfBcayjw
-        connection_string_database: app
-gateway:
-  tls:
-    enabled: true
-    existingSecret: cra-agent-tls
-join_token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsidXJuOmNsb3VkZ3JpZCIsInVybjphZG1pbmdyaWQiXSwiZXhwIjoxNzc2MjU4MjE4LCJob3N0SWQiOiJ6dnpna3p6cyIsImh0dHBzOi8vZGlhZ3JpZC5pby9lbWFpbCI6IiIsImh0dHBzOi8vZGlhZ3JpZC5pby9vcmdJZCI6ImNhMzRjMWY5LTliMWMtNGI5Yi04MDlhLWI3MTgzYTE1MWQxMiIsImlzcyI6ImRpYWdyaWQuaW8iLCJqdGkiOiI5NTc3NDk1Nzc5NDQ1OTgyIiwicmVnaW9uSWQiOiJraW5kLXJlZ2lvbiIsInN1YiI6ImpvaW5Ub2tlbiJ9.a-xAzGsnDHGFoNRt4cR6BSihyirSCvy_EhksEu0Ok2g"
@@ -13,7 +13,7 @@ spec:
    annotations:
      load-balancer.hetzner.cloud/location: hel1
      load-balancer.hetzner.cloud/type: lb11
-      load-balancer.hetzner.cloud/name: load-balancer-2
+      load-balancer.hetzner.cloud/name: load-balancer-1
      load-balancer.hetzner.cloud/use-private-ip: "true"
      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
      load-balancer.hetzner.cloud/http-redirect-https: "false"
@@ -42,6 +42,36 @@ spec:
          selector:
            matchLabels:
              shared-gateway-access: "true"
+    - name: https-hel1
+      protocol: HTTPS
+      port: 443
+      hostname: "*.hel1.oceanbox.io"
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-hel1-oceanbox-io
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: https-internal
+      protocol: HTTPS
+      port: 443
+      hostname: "*.adm.hel1.obx"
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-adm-hel1-obx
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
    - name: ssh
      protocol: TCP
      port: 22
@@ -65,4 +95,28 @@ spec:
  issuerRef:
    name: letsencrypt-prod-dns01
    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-hel1-oceanbox-io
+spec:
+  secretName: wildcard-hel1-oceanbox-io
+  dnsNames:
+    - "*.hel1.oceanbox.io"
+  issuerRef:
+    name: letsencrypt-prod-dns01
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-adm-hel1-obx
+spec:
+  secretName: wildcard-adm-hel1-obx
+  dnsNames:
+    - "*.adm.hel1.obx"
+  issuerRef:
+    name: ca-issuer
+    kind: ClusterIssuer
 {{- end}}
@@ -1,18 +1,15 @@
 cilium:
  enabled: true
-  clustermesh:
-    enabled: false
-    clusterId: 2
-    # NodePort until L2LB is available (kubeproxyless)
-    apiserverServiceType: NodePort
-  # TODO: WireGuard blocks all traffic on ekman -- disable until root cause is found.
+  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
+  # keys so encrypted traffic is unreadable by them.
+  # TODO: re-enable after migration
  encryption:
    enabled: false
  envoy:
    enabled: true
  # kube-proxy stays running during migration; disable replacement until done.
  # TODO: set to true after migration
-  kubeProxyReplacement: true
+  kubeProxyReplacement: false
  # Direct apiserver connection -- do not rely on the kubernetes service IP
  # during migration since we are touching the CNI layer.
  # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
@@ -1,7 +1,5 @@
 cilium:
  enabled: true
-  clustermesh:
-    enabled: false
  envoy:
    enabled: true
  nodePort:
@@ -1,8 +1,5 @@
 cilium:
  enabled: true
-  clustermesh:
-    enabled: false
-    clusterId: 1
  nodePort:
    enabled: true
  l2announcement:
@@ -30,8 +30,4 @@ cilium:
  loadbalancerPool:
    enabled: false
    cidr: []
-  clustermesh:
-    enabled: false
-    clusterId: 0
-    apiserverServiceType: LoadBalancer
  cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
@@ -1,16 +1,3 @@
-cluster:
-  name: {{ .Values.cilium.cluster }}
-  id: {{ .Values.cilium.clustermesh.clusterId }}
-{{- if .Values.cilium.clustermesh.enabled }}
-clustermesh:
-  useAPIServer: true
-  apiserver:
-    service:
-      type: {{ .Values.cilium.clustermesh.apiserverServiceType }}
-    tls:
-      auto:
-        method: helm
-{{- end }}
 authentication:
  mutual:
    spire:
@@ -103,7 +90,7 @@ operator:
  prometheus:
    enabled: true
    port: 12301
-    serviceMonitor:
+    serviceMointor:
      enabled: true
      port: 12302
  rollOutPods: true
@@ -38,4 +38,4 @@ volumeMounts:
    readOnly: true
    subPath: appsettings.json
 image:
-  tag: 74ed3e11-debug
+  tag: 38eeb4cc-debug
@@ -28,6 +28,9 @@ spec:
      - name: HELMFILE_FILE_PATH
        value: docs.yaml.gotmpl
  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        shared-gateway-access: "true"
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
@@ -0,0 +1 @@
+{{- /* HTTPRoute and CiliumNetworkPolicy are managed by the docs chart template */ -}}
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "6960aed0-debug"
+  tag: "e9fd3fc6-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -0,0 +1,46 @@
+replicaCount: 1
+image:
+  tag: "e9fd3fc6-debug"
+env:
+  - name: APP_VERSION
+    value: "0.0.0"
+  - name: LOG_LEVEL
+    value: "1"
+{{- if .Values.clusterConfig.gatewayAPI.enabled }}
+ingress:
+  enabled: false
+  className: "nginx"
+httpRoute:
+  enabled: true
+  parentRefs:
+    - name: shared-gateway
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - docs.oceanbox.io
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: "/"
+{{- else }}
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: docs.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - docs.oceanbox.io
+      secretName: docs-tls
+{{- end }}
@@ -1,32 +1,38 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12
-  labels:
-    app.kubernetes.io/component: drupal
  name: drupal
  namespace: fornix
 spec:
-  ingressClassName: nginx
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+    sectionName: https-hel1
+  hostnames:
+  - drupal.hel1.oceanbox.io
  rules:
-    - host: drupal.hel1.oceanbox.io
-      http:
-        paths:
-          - backend:
-              service:
-                name: drupal
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - drupal.hel1.oceanbox.io
-      secretName: drupal-tls
+  - matches:
+    - path:
+        type: PathPrefix
+        value: "/"
+    backendRefs:
+    - name: drupal
+      port: 80
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-drupal
+  namespace: fornix
+spec:
+  endpointSelector:
+    matchLabels:
+      app: drupal
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": fornix
@@ -8,7 +8,7 @@ clusterConfig:
  initca: "/var/lib/kubernetes/secrets"
  apiserver: "ekman-manage"
  apiserverip: "10.255.241.99"
-  etcd_nodes: ["10.255.241.80, 10.255.241.100, 10.255.241.99"]
+  etcd_nodes: ["10.255.241.80, 10.255.241.90, 10.255.241.99"]
  k8s_nodes:
    [
      "10.255.241.80, 10.255.241.90, 10.255.241.99, 10.255.241.100, 10.255.241.101, 10.255.241.102, 10.255.241.103, 10.255.241.104, 10.255.241.105, 10.255.241.106, 10.255.241.107, 10.255.241.108, 10.255.241.109, 10.255.241.110, 10.255.241.111, 10.255.241.112, 10.255.241.113, 10.255.241.114, 10.255.241.116, 10.255.241.121, 10.255.241.122, 10.255.241.123, 10.255.241.124, 10.255.241.125, 10.255.241.126, 10.255.241.127, 10.255.241.128",
@@ -20,6 +20,8 @@ clusterConfig:
    patterns: []
    cidr: []
  nodes: []
+  gatewayAPI:
+    enabled: true
  ingress_whitelist:
    - 10.0.0.0/8
    - 172.16.0.0/12
@@ -20,6 +20,8 @@ clusterConfig:
    - 192.168.0.0/16
    - 172.19.255.0/24
    - 100.64.0.0/12 # tailnet
+  gatewayAPI:
+    enabled: false
  ingress_hostnetwork: false
  ingress_hostport: false
  ingress_nodeport: true
@@ -31,6 +31,9 @@ spec:
    targetRevision: main
    ref: values
  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        shared-gateway-access: "true"
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
@@ -0,0 +1,38 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: fornix
+  namespace: fornix
+spec:
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+    sectionName: https-hel1
+  hostnames:
+  - fornix.hel1.oceanbox.io
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: "/"
+    backendRefs:
+    - name: fornix
+      port: 8085
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-fornix
+  namespace: fornix
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: fornix
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": fornix
@@ -3,7 +3,7 @@ drupalUrl: http://drupal

 replicaCount: 1
 ingress:
-  enabled: true
+  enabled: false
  className: "nginx"
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
@@ -26,6 +26,7 @@ spec:
    managedNamespaceMetadata:
      labels:
        component: sys
+        shared-gateway-access: "true"
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
@@ -1,8 +1,48 @@
+{{- if .Values.clusterConfig.gatewayAPI.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: gatus
+  namespace: uptime
+spec:
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+    sectionName: https-internal
+  hostnames:
+  - uptime.{{ .Values.clusterConfig.domain }}
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: "/"
+    backendRefs:
+    - name: gatus
+      port: 80
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-gatus
+  namespace: uptime
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: gatus
+  ingress:
+  - fromCIDRSet:
+    {{- range .Values.clusterConfig.ingress_whitelist }}
+    - cidr: {{ . }}
+    {{- end }}
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": uptime
+{{- else }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
+    cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
    nginx.ingress.kubernetes.io/backend-protocol: HTTP
    nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, x-gatus-cache
    nginx.ingress.kubernetes.io/enable-cors: "true"
@@ -15,7 +55,7 @@ metadata:
 spec:
  ingressClassName: nginx
  rules:
-    - host: uptime.adm.hel1.obx
+    - host: uptime.{{ .Values.clusterConfig.domain }}
      http:
        paths:
          - backend:
@@ -27,5 +67,6 @@ spec:
            pathType: ImplementationSpecific
  tls:
    - hosts:
-        - uptime.adm.hel1.obx
+        - uptime.{{ .Values.clusterConfig.domain }}
      secretName: gatus-tls
+{{- end }}
@@ -139,3 +139,12 @@ config:
        environment: staging
      alerts:
        - type: custom
+
+    - name: Plume Dev TOS
+      <<: *https-endpoint
+      group: "Experimental Services"
+      url: https://plume.ekman.oceanbox.io/healthz
+      extra-labels:
+        environment: staging
+      alerts:
+        - type: custom
@@ -14,11 +14,36 @@ spec:
    - path:
        type: PathPrefix
        value: "/"
+    timeouts:
+      request: 600s
+      backendRequest: 600s
    backendRefs:
    - name: gitea-http
      port: 3000

 ---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-gateway-to-gitea
+  namespace: gitea
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+  - fromCIDRSet:
+    - cidr: 10.0.0.0/8
+    - cidr: 172.16.0.0/12
+    - cidr: 192.168.0.0/16
+    - cidr: 172.19.255.0/24
+    - cidr: 100.64.0.0/12
+    - cidr: 185.125.160.4/32
+    - cidr: 37.27.203.38/32
+  - fromEndpoints:
+    - matchLabels:
+        "k8s:io.kubernetes.pod.namespace": gitea
+---
 apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: TCPRoute
 metadata:
@@ -3,7 +3,7 @@ replicaCount: 1
 image:
  registry: "docker.gitea.com"
  repository: gitea
-  tag: "1.26.0"
+  tag: "1.25.4"

 resources:
  requests:
@@ -0,0 +1,8 @@
+{{- /* Gateway API: disable ingress when cilium gateway is enabled (HTTPRoute is in manifests/gateway-routes.yaml) */ -}}
+{{- if .Values.clusterConfig.gatewayAPI.enabled }}
+ingress:
+  enabled: false
+{{- else }}
+ingress:
+  enabled: true
+{{- end }}
@@ -13,7 +13,7 @@ env:
  HEADSCALE_OIDC_ONLY_START_IF_OIDC_IS_AVAILABLE: "true"
  HEADSCALE_OIDC_ISSUER: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
  HEADSCALE_OIDC_CLIENT_ID: "688e9096-f140-4498-a46a-e3d1939184de"
-  HEADSCALE_OIDC_CLIENT_SECRET: "wms8Q~RC7xyAmIoocVe.gIFGpJw-Odmtep0ZObDn"
+  HEADSCALE_OIDC_CLIENT_SECRET: "dPW8Q~1rctY-D0Ih.A1-1KqLl0uj1rX_ixNTcbrh"

  # -- Split DNS for obx and ts.obx
  HEADSCALE_DNS_NAMESERVERS_SPLIT: |
@@ -13,7 +13,7 @@ env:
  HEADSCALE_OIDC_ONLY_START_IF_OIDC_IS_AVAILABLE: "true"
  HEADSCALE_OIDC_ISSUER: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
  HEADSCALE_OIDC_CLIENT_ID: "688e9096-f140-4498-a46a-e3d1939184de"
-  HEADSCALE_OIDC_CLIENT_SECRET: "wms8Q~RC7xyAmIoocVe.gIFGpJw-Odmtep0ZObDn"
+  HEADSCALE_OIDC_CLIENT_SECRET: "dPW8Q~1rctY-D0Ih.A1-1KqLl0uj1rX_ixNTcbrh"

  # -- Split DNS for obx and ts.obx
  HEADSCALE_DNS_NAMESERVERS_SPLIT: |
@@ -255,7 +255,6 @@ configMaps:
            { "action": "accept", "src": [ "faith.iha@oceanbox.io" ], "dst": [ "faith.iha@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
-            { "action": "accept", "src": [ "erlend.mundal@oceanbox.io" ], "dst": [ "erlend.mundal@oceanbox.io:*" ] },
            // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
          ]
        }
@@ -354,7 +353,7 @@ configMaps:
           { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
           { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-diadash.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "mrtz-diadash.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
@@ -38,7 +38,7 @@ spec:
   - group: ""
     kind: Secret
     name: jobset-webhook-server-cert
-     namespace: jobset-system
+     namespace: default
     jsonPointers:
       - /data
 {{- end }}
@@ -8,7 +8,6 @@ kubectl cp -n keycloak oceanbox-realm.json prod-keycloak-0:/tmp/backup/oceanbox-
 kubectl cp -n keycloak oceanbox-users-0.json prod-keycloak-0:/tmp/backup/oceanbox-users-0.json
 kc.sh -Djgroups.bind.port=7801 import --dir /tmp/backup
 ```
-
 ## Theme

-The keycloak theme is maintained at [git.oceanbox.io/platform/keycloak-theme](https://git.oceanbox.io/platform/keycloak-theme) and is deployed via an init container using the `git.oceanbox.io/platform/keycloak-theme` image.
+Our keycloak theme is inserted using the image provided [here](https://gitlab.com/oceanbox/keycloak-theme)
@@ -33,8 +33,10 @@ spec:
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
+      # - ServerSideApply=true
    {{- if .Values.keycloak.autosync }}
    automated:
      prune: true
+      # selfHeal: false
    {{- end }}
 {{- end }}
@@ -1,14 +1,26 @@
 replicaCount: 2

+# NOTE(mrtz): Hack for working with bitnami legacy registry
+global:
+  security:
+    allowInsecureImages: true
+image:
+    repository: bitnamilegacy/keycloak
+
+production: true
+
+proxy: edge
+
 auth:
  adminPassword: en to tre fire
+  adminUser: admin
  existingSecret: ""
  managementPassword: ""
+  managementUser: manager

 postgresql:
  enabled: false

-resourcesPreset: "none"
 resources:
  limits:
    cpu: 750m
@@ -36,7 +48,37 @@ extraVolumes:
  name: theme

 ingress:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  enabled: true
  hostname: auth.oceanbox.io
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true
+
+adminIngress:
+  enabled: false
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    oceanbox.io/expose: internal
+  hostname: keycloak.adm.oceanbox.io
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true

 keycloakConfigCli:
  enabled: false
@@ -51,8 +93,8 @@ keycloakConfigCli:

 initContainers: |
  - name: keycloak-theme-provider
-    image: git.oceanbox.io/platform/keycloak-theme:latest
-    imagePullPolicy: IfNotPresent
+    image: docker.io/juselius/oceanbox-theme:1.2
+    imagePullPolicy: Always
    command:
      - sh
    args:
@@ -1,7 +1,22 @@
 replicaCount: 1

+# NOTE(mrtz): Hack for working with bitnami legacy registry
+global:
+  security:
+    allowInsecureImages: true
+image:
+    repository: bitnamilegacy/keycloak
+
+production: true
+
+proxy: edge
+
 auth:
  adminPassword: en to tre fire
+  adminUser: admin
+  existingSecret: ""
+  managementPassword: ""
+  managementUser: manager

 postgresql:
  enabled: true
@@ -9,5 +24,58 @@ postgresql:
    postgresPassword: "avatar mustiness economic"
    password: "punctured abstain facility"

+extraVolumeMounts:
+- mountPath: /opt/bitnami/keycloak/themes/oceanbox
+  name: theme
+
+extraVolumes:
+- emptyDir: {}
+  name: theme
+
 ingress:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  enabled: true
  hostname: auth.srv.oceanbox.io
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true
+
+adminIngress:
+  enabled: false
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    oceanbox.io/expose: internal
+  hostname: auth.adm.oceanbox.io
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true
+
+initContainers: |
+  - name: keycloak-theme-provider
+    image: docker.io/juselius/oceanbox-theme:1.2
+    imagePullPolicy: Always
+    command:
+      - sh
+    args:
+      - -c
+      - |
+        echo "Copying theme..."
+        cp -R /theme/* /keycloak/themes/oceanbox
+    volumeMounts:
+      - name: theme
+        mountPath: /keycloak/themes/oceanbox
@@ -1,29 +0,0 @@
-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxyHeaders: xforwarded
-
-auth:
-  adminUser: admin
-  managementUser: manager
-
-ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
@@ -1,3 +1,3 @@
-catalyst:
+kueue:
  enabled: true
  autosync: false
@@ -1,85 +1,51 @@
-apiVersion: kueue.x-k8s.io/v1beta2
+apiVersion: kueue.x-k8s.io/v1beta1
 kind: ResourceFlavor
 metadata:
-  name: compute # Just needs to exist, can be managed with tains/tolerations
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  nodeLabels:
-    node-role.kubernetes.io/compute: compute
-    topology.kubernetes.io/group: c1 # Only run on C1 for now
+ name: compute # Just needs to exist, can be managed with tains/tolerations
 ---
-apiVersion: kueue.x-k8s.io/v1beta2
+apiVersion: kueue.x-k8s.io/v1beta1
 kind: ClusterQueue
 metadata:
-   name: cluster-queue
-   annotations:
-     argocd.argoproj.io/sync-wave: "2"
+   name: jobs
 spec:
+  cohort: general
  namespaceSelector: {} # Accept workloads from any namespace
-  queueingStrategy: BestEffortFIFO
-  # preemption:
-    # withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
+  preemption:
+    withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
  resourceGroups:
   - coveredResources: ["cpu", "memory"] # Cover both memory and cpu resources
     flavors:
       - name: compute
         resources:
           - name: "cpu"
-             nominalQuota: '32'
+             nominalQuota: '4'
           - name: "memory"
-             nominalQuota: 64Gi
-# ---
-# apiVersion: kueue.x-k8s.io/v1beta2
-# kind: LocalQueue
-# metadata:
-#   name: prod-queue
-#   namespace: prod-queue
-# spec:
-#   clusterQueue: cluster-queue
+             nominalQuota: 8Gi
 ---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dev-queue
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
---
-apiVersion: kueue.x-k8s.io/v1beta2
-kind: LocalQueue
-metadata:
-  name: dev-queue
-  namespace: dev-queue
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  clusterQueue: cluster-queue
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: prod-queue
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
---
-apiVersion: kueue.x-k8s.io/v1beta2
+apiVersion: kueue.x-k8s.io/v1beta1
 kind: LocalQueue
 metadata:
  name: prod-queue
-  namespace: prod-queue
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
+  namespace: prod-sorcerer
 spec:
-  clusterQueue: cluster-queue
-# ---
-# apiVersion: kueue.x-k8s.io/v1beta2
-# kind: WorkloadPriorityClass
-# metadata:
-#   name: "normal"
-# value: 100
-# ---
-# apiVersion: kueue.x-k8s.io/v1beta2
-# kind: WorkloadPriorityClass
-# metadata:
-#   name: "high"
-# value: 200 # Higher value = higher priority
+  clusterQueue: jobs
+---
+apiVersion: kueue.x-k8s.io/v1beta1
+kind: LocalQueue
+metadata:
+  name: staging-queue
+  namespace: staging-sorcerer
+spec:
+  clusterQueue: jobs
+---
+apiVersion: kueue.x-k8s.io/v1beta1
+kind: WorkloadPriorityClass
+metadata:
+  name: "normal"
+value: 100
+---
+apiVersion: kueue.x-k8s.io/v1beta1
+kind: WorkloadPriorityClass
+metadata:
+  name: "high"
+value: 200 # Higher value = higher priority
@@ -0,0 +1,89 @@
+{{- if eq .Values.clusterConfig.cluster "ekman"}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kueueviz-ingress
+  namespace: kueue-system
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
+spec:
+  rules:
+    - host: kueue.dev.tos.obx
+      http:
+        paths:
+          - path: /ws
+            pathType: Prefix
+            backend:
+              service:
+                name: kueue-kueueviz-backend
+                port:
+                  number: 8080
+          - path: /api(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: kueue-kueueviz-backend
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: kueue-kueueviz-frontend
+                port:
+                  number: 8080
+  tls:
+    - hosts:
+        - kueue.dev.tos.obx
+      secretName: kueueviz-tls
+{{- end}}
+---
+{{- if eq .Values.clusterConfig.cluster "rossby"}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kueueviz-ingress
+  namespace: kueue-system
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  rules:
+    - host: kueue.dev.vtn.obx
+      http:
+        paths:
+          - path: /ws
+            pathType: Prefix
+            backend:
+              service:
+                name: kueue-kueueviz-backend
+                port:
+                  number: 8080
+          - path: /api(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: kueue-kueueviz-backend
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: kueue-kueueviz-frontend
+                port:
+                  number: 8080
+  tls:
+    - hosts:
+        - kueue.dev.vtn.obx
+      secretName: kueueviz-tls
+{{- end}}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`{{- /* HTTPRoute and CiliumNetworkPolicy are managed by the docs chart template */ -}}`