Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

Update dragonfly-operator Docker tag to v1.4.0
Update Helm release plugin-barman-cloud to v0.5.0
2026-02-13 17:11:31 +00:00 · 2026-02-13 17:00:13 +00:00 · 2026-02-13 16:57:12 +00:00 · 2026-02-13 16:50:03 +00:00 · 2026-02-13 16:47:05 +00:00 · 2026-02-13 17:41:43 +01:00
557 changed files with 1998 additions and 58715 deletions
@@ -1,54 +0,0 @@
-# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
-default:
-  tags:
-    - nix
-
-include:
-  - project: oceanbox/gitlab-ci
-    ref: v4.5
-    file: template/Base.gitlab-ci.yml
-# stages:
-# - release
-
-# image:
-# name: alpine/helm:latest
-# entrypoint: ["/bin/bash", "-c"]
-
-# release:
-# stage: release
-# rules:
-# - if: "$CI_COMMIT_BRANCH =~ /^main/"
-# when: always
-# - when: never
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done
-
-# rebuild:
-# stage: release
-# rules:
-# - when: manual
-# allow_failure: true
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done
@@ -1,27 +0,0 @@
-apiVersion: v2
-name: sys
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"
-dependencies: # A list of the chart requirements (optional)
-  - name: sys-cilium-policies
-    condition: cilium.enabled
@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-applicationset-ingress
-  namespace: argocd
-spec:
-  description: Allow access from the ingress controller
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: applicationset-controller
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-notifications
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD Notifications
-  egress:
-    - toFQDNs:
-        - matchName: slack.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: notifications-controller
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-repo-access-applicationset
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD repo Applicationset
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: applicationset-controller
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-repo-access
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD repo server
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: repo-server
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-chartmuseum-ingress
-  namespace: argocd
-spec:
-  description: Allow access to the chartmuseum ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: chartmuseum
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-image-updater-repo-access
-  namespace: argocd
-spec:
-  description: Allow argoCD image updater to access github container registry
-  egress:
-    - toFQDNs:
-        - matchName: ghcr.io
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-image-updater
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-ingress
-  namespace: argocd
-spec:
-  description: Allow access from the ingress controller
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: server
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: argocd
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-microsoft-sso
-  namespace: argocd
-spec:
-  description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
-  egress:
-    - toFQDNs:
-        - matchName: login.microsoftonline.com
-        - matchPattern: '*.microsoftonline.com'
-        - matchName: github.com
-        - matchName: api.github.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-dex-server
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics-rollout
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argo-rollouts
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8090"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics-workflows
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argo-workflows
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "9090"
-              protocol: TCP
@@ -1,30 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argocd
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8082"
-              protocol: TCP
-            - port: "8080"
-              protocol: TCP
-            - port: "9001"
-              protocol: TCP
-            - port: "9121"
-              protocol: TCP
-            - port: "8084"
-              protocol: TCP
-            - port: "8083"
-              protocol: TCP
-            - port: "5558"
-              protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server-to-cert-manager
-  namespace: cert-manager
-spec:
-  description: Allow the API server to communicate with the cert-manager pods
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cert-manager
-spec:
-  description: Allow the Kube API server to communicate with cert-manager
-  egress:
-    - toEntities:
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: cert-manager
-spec:
-  description: Allow Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9402"
-              protocol: TCP
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-traffic
-  namespace: cert-manager
-spec:
-  description: Allow the world to communicate with cert-manager
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-spire
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-server
-  namespace: cilium-spire
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: "8081"
-              protocol: TCP
@@ -1,22 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-test
-spec:
-  egress:
-    - toEndpoints:
-        - {}
-    - toEntities:
-        - cluster
-    - toEntities:
-        - remote-node
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - cluster
-    - fromEntities:
-        - world
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-acme-solvers
-spec:
-  description: Policy for ingress for Acme Solvers.
-  endpointSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,24 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-dns
-spec:
-  description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-        - rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchExpressions:
-      - key: io.kubernetes.pod.namespace
-        operator: NotIn
-        values:
-          - kube-system
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-mariadb-operator
-spec:
-  description: allow mariadb instances to be reached by operator
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: mariadb
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: mariadb-operator
-            io.kubernetes.pod.namespace: mariadb-operator
-      toPorts:
-        - ports:
-            - port: "3306"
-              protocol: TCP
@@ -1,20 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-spec:
-  description: Policy for egress for CNPG Backups.
-  egress:
-    - toFQDNs:
-      {{- range .Values.s3.hosts }}
-        - matchName: {{ . | quote }}
-      {{- end }}
-      {{- range .Values.s3.patterns }}
-        - matchPattern: {{ . | quote }}
-      {{- end }}
-    - toCIDR:
-      {{- range .Values.s3.cidr }}
-        - {{ . | quote }}
-      {{- end }}
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: cilium-health-checks
-spec:
-  description: Health checks
-  egress:
-    - toEntities:
-        - remote-node
-  endpointSelector:
-    matchLabels:
-      reserved:health: ""
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,9 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: deny-all
-spec:
-  description: Deny all
-  egress: []
-  endpointSelector: {}
-  ingress: []
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cnpg
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: postgres-operator
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: cnpg
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kube-downscaler
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      application: downscaler-py-kube-downscaler
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: kube-downscaler
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-        - host
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: hubble.*.*.*
-        - matchPattern: hubble.*.*.*.*
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: ingress-nginx
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ingress-nginx
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9913"
-              protocol: TCP
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toCIDR:
-        - 10.139.2.10/32
-    - toCIDR:
-        - 10.139.2.11/32
-    - toCIDR:
-        - 10.139.2.20/32
-    - toCIDR:
-        - 10.139.2.21/32
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-ingress-nginx
-  namespace: ingress-nginx
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
-  ingress:
-    - fromEntities:
-        - world
-    - toPorts:
-        - ports:
-            - port: "80"
-              protocol: TCP
-            - port: "443"
-              protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: jaeger
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-jaeger
-  namespace: jaeger
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: jaeger-operator
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kafka
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kafka-operator
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: kafka
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-controller-metrics
-  namespace: kube-system
-spec:
-  description: Allow Controller Metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-controller-manager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "10257"
-              protocol: TCP
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-csi-webhook
-  namespace: kube-system
-spec:
-  endpointSelector:
-    matchLabels:
-      app: csi-snapshot-webhook
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-metrics
-  namespace: kube-system
-spec:
-  description: Allow DNS metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9153"
-              protocol: TCP
@@ -1,31 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-world
-  namespace: kube-system
-spec:
-  description: Allow DNS World
-  egress:
-    - toCIDR:
-        - 8.8.8.8/32
-        - 172.31.254.11/32
-        - 1.1.1.1/32
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: '*'
-    - toEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns
-  namespace: kube-system
-spec:
-  description: Allow DNS
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.pod.namespace
-              operator: Exists
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: kube-system
-spec:
-  description: Allow Host Traffic
-  egress:
-    - toEntities:
-        - remote-node
-        - host
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-ingress
-  namespace: kube-system
-spec:
-  description: Allow Hubble ingress
-  endpointSelector:
-    matchLabels:
-      k8s-app: hubble-ui
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-oauth2-ingress
-  namespace: kube-system
-spec:
-  description: Allow Hubble OAuth2 ingress
-  endpointSelector:
-    matchLabels:
-      k8s-app: oauth2-proxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-relay-metrics
-  namespace: kube-system
-spec:
-  description: Allow Hubble Relay Metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: hubble-relay
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9966"
-              protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-microsoft-sso
-  namespace: kube-system
-spec:
-  description: Allow Microsoft SSO
-  egress:
-    - toFQDNs:
-        - matchName: login.microsoftonline.com
-        - matchPattern: '*.microsoftonline.com'
-        - matchName: graph.microsoft.com
-  endpointSelector:
-    matchLabels:
-      k8s-app: oauth2-proxy
@@ -1,26 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-namespace-traffic
-  namespace: kube-system
-spec:
-  description: Allow Namespace Traffic
-  egress:
-    - toEndpoints:
-        - {}
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEndpoints:
-        - {}
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-proxy-metrics
-  namespace: kube-system
-spec:
-  description: Allow Proxy metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-proxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "10249"
-              protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: kubelet-serving-cert-approver
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kyverno
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: kyverno
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kyverno
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "8000"
-              protocol: TCP
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-kyverno
-  namespace: kyverno
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kyverno
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-loki-backend-to-api-server
-  namespace: loki
-spec:
-  description: Promtail needs to reach kube-apiserver
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: backend
-      app.kubernetes.io/instance: loki
@@ -1,20 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: loki
-spec:
-  description: Allow Prometheus read and write
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: loki
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "3100"
-              protocol: TCP
-            - port: "3500"
-              protocol: TCP
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-promtail-to-api-server
-  namespace: loki
-spec:
-  description: Promtail needs to reach kube-apiserver
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: promtail
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-stats-grafana
-  namespace: loki
-spec:
-  description: Allow stats
-  egress:
-    - toFQDNs:
-        - matchName: stats.grafana.org
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: loki
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: mariadb-operator
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: mariadb-operator
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-to-mariadb
-  namespace: mariadb-operator
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: mariadb-operator
-  ingress:
-    - fromEntities:
-        - host
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: mariadb-operator
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: mariadb-operator
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: mariadb-operator
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-        - remote-node
-      toPorts:
-        - ports:
-            - port: "443"
-              protocol: TCP
-            - port: "9443"
-              protocol: TCP
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: mayastor
-spec:
-  description: Allow Host Traffic
-  egress:
-    - toEntities:
-        - remote-node
-        - host
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-agent-core
-  namespace: mayastor
-spec:
-  description: Allow Remote to Agent Core
-  endpointSelector:
-    matchLabels:
-      app: agent-core
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-etcd
-  namespace: mayastor
-spec:
-  description: Allow Remote to Etcd
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: etcd
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-maya
-  namespace: mayastor
-spec:
-  description: Allow Remote to Mayastor
-  endpointSelector:
-    matchLabels:
-      app: api-rest
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-kube-api
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app: minio
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-minio-operator
-spec:
-  description: Allow access to the Kube API server
-  endpointSelector:
-    matchLabels:
-      app: minio
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: minio-operator
-      toPorts:
-        - ports:
-            - port: "9000"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-nodeport-ingress
-spec:
-  description: Allow access to the Kube API server
-  endpointSelector:
-    matchLabels:
-      app: minio
-  ingress:
-    - fromEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: "9000"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: minio-operator
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: odigos-system
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-port-4317
-  namespace: odigos-system
-spec:
-  egress:
-    - toPorts:
-        - ports:
-            - port: "4317"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: one-password
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: one-password-operator
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: one-password
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: opencost
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: opencost
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-otel-collector-loadbalancer-ingress
-  namespace: otel
-spec:
-  description: Allow ingress from world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: opentelemetry-collector
-  ingress:
-    - fromEntities:
-        - world
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-mail-egress
-  namespace: postfix
-spec:
-  description: Allow mailserver to send mails to world
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app: smtp-relay
@@ -1,21 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-mail-ingress
-  namespace: postfix
-spec:
-  description: Allow all services in cluster to send mail
-  endpointSelector:
-    matchLabels:
-      app: smtp-relay
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.pod.namespace
-              operator: Exists
-      toPorts:
-        - ports:
-            - port: "25"
-              protocol: TCP
-            - port: "587"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: postfix
-spec:
-  description: 'Allow prometheus metrics '
-  endpointSelector:
-    matchLabels:
-      app: smtp-relay
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "9154"
-              protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-alerting
-  namespace: prometheus
-spec:
-  description: Allow alerting
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: prom-alertmanager
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-alertmanager-ingress
-  namespace: prometheus
-spec:
-  description: Allow Nginx ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: alertmanager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-metrics
-  namespace: prometheus
-spec:
-  description: Allow DNS metrics
-  egress:
-    - toPorts:
-        - ports:
-            - port: "9153"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-etcd-metrics
-  namespace: prometheus
-spec:
-  description: Allow ETCD metrics
-  egress:
-    - toPorts:
-        - ports:
-            - port: "2379"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-grafana-ingress
-  namespace: prometheus
-spec:
-  description: Allow Grafana ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: grafana
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
renovate-bot	e4d8a55871	Update ghcr.io/juanfont/headscale Docker tag to v0.28.0	2026-02-13 17:11:31 +00:00
renovate-bot	91a6795bfc	Update dragonfly-operator Docker tag to v1.4.0	2026-02-13 17:00:13 +00:00
renovate-bot	46d0dcb545	Update Helm release plugin-barman-cloud to v0.5.0	2026-02-13 16:57:12 +00:00
renovate-bot	a5da0f745a	Update Helm release opentelemetry-collector to v0.145.0	2026-02-13 16:50:03 +00:00
renovate-bot	27f407d685	Update Helm release openfga to v0.2.54	2026-02-13 16:47:05 +00:00
mrtz	e3d70b6c7f	feat: Bump beta to 1.42.2	2026-02-13 17:41:43 +01:00
Gitea Actions	e88544abdb	ci(prod): deploy codex v1.42.2	2026-02-13 16:39:03 +00:00
Gitea Actions	7961dc30db	ci(prod): deploy atlantis v1.42.2	2026-02-13 16:38:59 +00:00
Gitea Actions	fce0f71832	ci(staging): deploy atlantis bc9dccaa-debug	2026-02-13 16:37:47 +00:00
Gitea Actions	4207c28e45	ci(prod): deploy sorcerer v1.42.2	2026-02-13 16:37:31 +00:00
Gitea Actions	abaeae3603	ci(prod): deploy plume v1.6.13	2026-02-13 16:11:27 +00:00
Gitea Actions	6ee7490954	ci(staging): deploy plume 9d99f7cf-debug	2026-02-13 16:11:07 +00:00
Gitea Actions	3cab8a1edf	ci(staging): deploy plume 982a30de-debug	2026-02-13 16:06:07 +00:00
mrtz	461f2a8f7d	fix: Switch plume to gitea	2026-02-13 17:01:28 +01:00
mrtz	debd8fe561	fix: Release	2026-02-13 16:59:36 +01:00
Gitea Actions	7352efcaa5	ci(prod): deploy atlantis v1.42.1	2026-02-13 15:58:08 +00:00
Gitea Actions	c4a6539913	ci(prod): deploy codex v1.42.1	2026-02-13 15:58:05 +00:00
Gitea Actions	14ed79c528	ci(prod): deploy sorcerer v1.42.1	2026-02-13 15:56:56 +00:00
Gitea Actions	e3dcf6b0a8	ci(prod): deploy atlantis v1.42.0	2026-02-13 15:47:35 +00:00
Gitea Actions	add314bbf1	ci(prod): deploy codex v1.42.0	2026-02-13 15:45:14 +00:00
Gitea Actions	aab18c0a72	ci(staging): deploy codex d34652dd-debug	2026-02-13 15:44:23 +00:00
Gitea Actions	d311fcc17c	ci(staging): deploy atlantis d34652dd-debug	2026-02-13 15:44:14 +00:00
Gitea Actions	3f1ca12a8a	ci(prod): deploy sorcerer v1.42.0	2026-02-13 15:43:42 +00:00
Gitea Actions	bde7b6068a	ci(staging): deploy plume d9375078-debug	2026-02-13 15:16:18 +00:00
Gitea Actions	d317537799	ci(staging): deploy plume bfbc0be1-debug	2026-02-13 14:50:51 +00:00
Gitea Actions	8e5016284e	ci(staging): deploy plume ff7983ec-debug	2026-02-13 14:44:28 +00:00
Gitea Actions	9ecf89c8d0	ci(staging): deploy plume c10e4b29-debug	2026-02-13 14:31:00 +00:00
mrtz	9416ea5512	feat(poseidon): Release beta 1.41.7	2026-02-12 17:26:41 +01:00
mrtz	b12deba899	fix(poseidon): Wrong way	2026-02-12 17:21:33 +01:00
Gitea Actions	83e446568f	ci(prod): deploy codex v1.41.7	2026-02-12 16:21:32 +00:00
Gitea Actions	c222b4dd12	ci(prod): deploy atlantis v1.41.7	2026-02-12 16:21:27 +00:00
Gitea Actions	c8ca2e7fca	ci(prod): deploy sorcerer v1.41.7	2026-02-12 16:20:18 +00:00
Gitea Actions	93484df20d	ci(prod): deploy atlantis v1.41.6	2026-02-12 16:13:51 +00:00
Gitea Actions	a15c24ed00	ci(prod): deploy sorcerer v1.41.6	2026-02-12 16:12:42 +00:00
Gitea Actions	db0918c40a	ci(prod): deploy sorcerer v1.41.5	2026-02-12 16:03:53 +00:00
Gitea Actions	64e37101be	ci(staging): deploy sorcerer 06e2e5b9-debug	2026-02-12 16:02:07 +00:00
mrtz	9de9a27845	fix(atlantis): Remove secret remover	2026-02-12 16:56:32 +01:00
mrtz	5e1d6109db	fix(atlantis): Try again to remove secret	2026-02-12 16:54:18 +01:00
mrtz	a86dec26ae	fix(atlantis): Remove old	2026-02-12 16:52:52 +01:00
mrtz	5ce6701aff	fix(atlantis): Remove secret	2026-02-12 16:52:33 +01:00
mrtz	0fc78f9f01	fix(poseidon): No Autosync	2026-02-12 16:51:06 +01:00
mrtz	53950f1397	fix(sorcerer): Remvoe unused	2026-02-12 16:49:36 +01:00
mrtz	e9db733f06	fix(sorcerer): No autosync	2026-02-12 16:48:25 +01:00
mrtz	966c1bb92c	fix(atlantis): Remove db secret and autosync	2026-02-12 16:47:22 +01:00
mrtz	b72fd6270d	feat(poseidon): Push to beta	2026-02-12 16:36:04 +01:00
mrtz	4e30fbd542	fix(hs): Move makai	2026-02-12 16:22:20 +01:00
mrtz	6da4d37558	fix(makai/docs): Move to hel1	2026-02-12 16:19:28 +01:00
mrtz	4391a3d7cf	fix(hs): Correct ip	2026-02-12 15:58:10 +01:00
mrtz	e397903a6f	fix(hs): Persist hel1 in dc net	2026-02-12 15:46:27 +01:00
mrtz	a935926cf8	fix(hs): Change docs IP	2026-02-12 15:44:03 +01:00
mrtz	0f595fc2dd	fix(atlantis): No super user secret please	2026-02-12 15:41:37 +01:00
mrtz	fadb7ca5a6	fix(docs): No more envs	2026-02-12 15:34:20 +01:00
mrtz	f47fa7d20d	fix(docs): Move to hel1	2026-02-12 15:31:00 +01:00
mrtz	82c56c04ba	fix(atlantis): Remove secrets	2026-02-12 14:14:53 +01:00
mrtz	4fc5b4f7e7	fix(sorcere/atlantis): Naming beta sorcerer *.ekman	2026-02-12 14:11:13 +01:00
mrtz	1904f02d65	fix(sorcerer): Correct store	2026-02-12 13:39:27 +01:00
mrtz	72fd6c638f	fix(sorcerer): Bump redis specs	2026-02-12 13:37:14 +01:00
mrtz	9433bd431e	fix(atlantius): No masters and wrong rabbit	2026-02-12 13:32:40 +01:00
mrtz	2bdaab1bd7	fix(sorcerer): Undo	2026-02-12 13:31:02 +01:00
mrtz	7239c6118b	fix(sorcerer): Naming	2026-02-12 13:29:54 +01:00
mrtz	0229238c0c	fix(sorcerer): Add missing kustomize dirs	2026-02-12 13:28:34 +01:00
mrtz	74ea8d1d05	fix(sorcerer): Switch to rbd	2026-02-12 13:25:59 +01:00
mrtz	01cbc0f588	fix(sorcerer): Beta only	2026-02-12 13:23:21 +01:00
mrtz	0b1d686b4a	feat(sorcerer): Add beta	2026-02-12 13:19:50 +01:00
mrtz	7b0fef382d	fix(atlatnis): Use beta bindings	2026-02-12 12:52:00 +01:00
mrtz	6d2e053a0b	fix(atlantis): Use beta redis	2026-02-12 12:11:46 +01:00
mrtz	e0682e740c	fix(atlantis): Use dragonfly in beta	2026-02-12 11:11:37 +01:00
mrtz	a34a63089d	fix(atlantis): Beta	2026-02-12 11:00:44 +01:00
mrtz	cf94f5b9b7	fix(cilium+hs): Back to lb for ssh	2026-02-10 12:05:38 +01:00
mrtz	f1eb50fcd5	fix(headscale): Move internal git to cilium	2026-02-10 10:42:20 +01:00
mrtz	0fea3410a2	fix(cilium): Disable hostnetwork https://github.com/cilium/cilium/issues/38559	2026-02-10 10:28:07 +01:00
mrtz	8d63ca97c3	fix(cilium): STRING	2026-02-10 10:19:15 +01:00
mrtz	89c291dcd9	fix(cilium): Force gatewayclass creation	2026-02-10 10:18:09 +01:00
mrtz	deb3769f25	fix(namecheap): Set correct apikey	2026-02-10 09:45:12 +01:00
mrtz	ba5f392e92	fix(cilium): Make argo happy	2026-02-10 09:39:31 +01:00
mrtz	382f8a6de1	fix(cilium): Use DNS cert	2026-02-10 09:38:40 +01:00
mrtz	d4adb6eb7c	fix(cilium): Combine Gateways	2026-02-10 09:33:43 +01:00
mrtz	e527d32697	fix(cilium): Typo	2026-02-10 09:30:15 +01:00
mrtz	124fafcaf7	fix(cilium): Correct hostname	2026-02-10 09:27:54 +01:00
mrtz	8efdf8d4c8	feat(cilium): Enable gateway	2026-02-10 09:24:43 +01:00
mrtz	c39c188020	fix(certmgr): Enable gatewayApi	2026-02-09 16:45:33 +01:00
mrtz	7e5836383c	fix(cilium): Bump patch and set upgradeComp	2026-02-09 16:23:16 +01:00
mrtz	09d5ff9ab0	fix(cilium): Bump version	2026-02-09 16:09:31 +01:00
mrtz	36ed342f53	fix(cilium): Without v?	2026-02-09 16:08:36 +01:00
mrtz	3e811e03aa	fix: Back to without cilium	2026-02-09 16:05:06 +01:00
mrtz	9233a5307e	fix(cilium): Add cilium	2026-02-09 16:03:44 +01:00
mrtz	655679794a	fix(cilium): Oci requires v	2026-02-09 16:02:32 +01:00
mrtz	d802941faa	fix(cilium): Switch to oci chart Why OCI Registries? Storing Helm charts in OCI registries alongside container images offers several advantages: - Signed charts — All charts are signed with cosign for verification - Simpler setup — No repository configuration needed - Digest pinning — Reference exact chart versions by SHA for reproducibility - Unified tooling — Use the same registry infrastructure for images and charts	2026-02-09 16:00:26 +01:00
mrtz	c61617f276	fix(argo): Add cilium and certmgr oci charts	2026-02-09 15:59:04 +01:00
mrtz	e1c78c3703	fix(cilium): Audit mode for now	2026-02-09 15:27:03 +01:00
mrtz	c483dfc18b	fix(cilium): Enable proxy protocol on hel1	2026-02-09 15:22:31 +01:00
mrtz	cb8b035fe0	fix(cilium): Version based on cluster	2026-02-09 15:19:11 +01:00
renovate-bot	03d458be7e	Update twinproduction/gatus Docker tag to v5.34.0	2026-02-09 13:40:04 +00:00
mrtz	305ca06352	fix(cilium): Enable gateway api on hel1	2026-02-09 14:35:21 +01:00
renovate-bot	9d1e04abf4	Update Helm release mariadb-operator to v25.10.4	2026-02-09 13:20:58 +00:00
mrtz	6f60b8c110	fix: Only works in root	2026-02-09 13:34:42 +01:00
mrtz	e71f983a0b	fix: Move archmeister to attic	2026-02-09 13:10:15 +01:00
mrtz	01b154ba8b	fix(plume): Use new git repo	2026-02-09 13:05:36 +01:00
mrtz	7639eee45b	ci: Remove gitlab-ci	2026-02-09 13:03:36 +01:00
renovate-bot	bb33b5ec60	Update cert-manager Docker tag to v1.19.3	2026-02-09 11:59:35 +00:00
Gitea Actions	67675d0146	ci(staging): deploy docs 5c4cda2e-debug	2026-02-06 18:15:53 +00:00
Gitea Actions	1f1639aeaf	ci(staging): deploy plume f8f5e004-debug	2026-02-06 18:04:29 +00:00
Gitea Actions	80f5cba2e9	ci(staging): deploy plume cdc4dda5-debug	2026-02-06 17:59:12 +00:00
mrtz	2f7218bc99	fix(hs): Readd so whitelist in gitea works	2026-02-06 18:56:30 +01:00
mrtz	ffbdde94f7	fix(hs): Persist values	2026-02-06 18:47:04 +01:00
mrtz	d8883a4ec8	fix(hs): Remove Magic DNS for gitea	2026-02-06 18:46:21 +01:00
Gitea Actions	562b21e4b2	ci(staging): deploy plume ff19f1a6-debug	2026-02-06 17:39:18 +00:00
Gitea Actions	7250ad80b2	ci(staging): deploy plume 2a7a94fe-debug	2026-02-06 17:32:47 +00:00
mrtz	30b3103cd3	Release staging atlantis/sorcerer	2026-02-05 17:58:26 +01:00
mrtz	05f067e691	chore(docs): Bump again	2026-02-05 10:28:50 +01:00
mrtz	dc93f45e32	chore: Bump docs	2026-02-05 10:28:21 +01:00
mrtz	feefc87ea7	fix(attic): Remove	2026-02-03 17:13:14 +01:00
mrtz	513361728e	fix(headscale): Remove spacing	2026-02-03 13:24:07 +01:00
mrtz	166ba8ae58	fix(argo): Switch to gitea for oceanbox cluster	2026-02-03 13:10:01 +01:00
mrtz	faabcea369	fix(gatus): Disable vtn sorcerer	2026-02-03 12:37:16 +01:00
mrtz	8fc175b209	fix: Switch hel1 to gitea	2026-02-03 12:10:49 +01:00
mrtz	9bd7adb057	fix(argo): Add new url to sys	2026-02-03 11:03:10 +01:00
mrtz	b41171d8d1	feat(ekman): Move to git.oceanbox.io	2026-02-03 11:00:39 +01:00
mrtz	8c14fb7034	chore(nginx): Bump to fix CVE	2026-02-03 10:15:11 +01:00
juselius	fceba8ccea	fix: add eli and hansi to ocenographers acl	2026-02-02 15:37:19 +01:00
juselius	bfb16288b9	Merge branch 'main' of gitlab.com:oceanbox/manifests	2026-02-02 12:31:00 +01:00
juselius	d90f43411f	fix: migrate rossby manifests to gitea	2026-02-02 12:28:36 +01:00
mrtz	a30a5f28fb	fix: Use working env	2026-02-01 22:46:56 +01:00
mrtz	e4cb8b36df	fix(gitea/pf): Add mail	2026-02-01 22:40:08 +01:00
juselius	ff956948bf	fix: add hel1 lb to whitelist	2026-02-01 15:18:36 +01:00
juselius	18e3815e03	fix: change attic source to git.oceanbox.io	2026-02-01 15:12:28 +01:00
juselius	2dfca9bcbc	fix: add port 22 to hel1 for oceanographers	2026-02-01 14:56:52 +01:00
mrtz	5a013b42ba	fix: Add gitea to sys-proj and whitelist	2026-02-01 11:56:37 +01:00
mrtz	5cb695e096	fix(gitea): Don't use azure scopes	2026-02-01 11:19:12 +01:00
mrtz	3b7582edd0	fix(gitea): TRy new claim	2026-02-01 11:04:04 +01:00
mrtz	49321a0fa0	fix(gitea): Set admins	2026-02-01 10:52:15 +01:00
mrtz	9b55685967	fix(gitea): Add ekman/oceanbox to whitelist	2026-02-01 10:34:41 +01:00
mrtz	d257651195	fix(gitea): Only link on login	2026-02-01 10:33:35 +01:00
mrtz	63b6d99955	chore: Bump makai	2026-01-29 19:06:09 +01:00
mrtz	a48077f9b3	fifix(gitea): Enable registrations for nickname and email	2026-01-29 17:40:34 +01:00
Radovan Bast	9c60baeff9	ci: docs	2026-01-29 09:57:25 +00:00
mrtz	d30515ab76	ci: docs	2026-01-29 09:41:42 +00:00
mrtz	85117976c3	ci: docs	2026-01-29 09:32:30 +00:00
mrtz	2ec369f428	ci: docs	2026-01-29 09:29:39 +00:00
mrtz	aadf8995e6	ci: docs	2026-01-29 09:27:09 +00:00
mrtz	53776f68dd	ci: docs	2026-01-29 09:18:51 +00:00
mrtz	d4a56867e5	fix: Add docs to headscale	2026-01-29 10:00:56 +01:00
mrtz	8ae4f2c854	fix: Set registry path	2026-01-29 09:43:47 +01:00
mrtz	ee21078412	fix: docs	2026-01-29 09:40:34 +01:00
mrtz	a0e69a053d	ci: docs	2026-01-29 08:38:15 +00:00
mrtz	3bae9f5065	fix: makai -> docs	2026-01-29 09:29:01 +01:00
mrtz	cf816e621b	feat: Add docs	2026-01-29 09:26:53 +01:00
Radovan Bast	b71da56da7	ci: makai	2026-01-28 12:35:09 +00:00
simkir	3b6ed8e544	ci: makai	2026-01-28 11:48:46 +00:00
mrtz	9cbb16ae08	fix(gitea): Increase session lifetime	2026-01-27 21:04:23 +01:00
mrtz	708a44fa9b	fix(gitea): Typo	2026-01-26 17:39:33 +01:00
mrtz	f4a53934c2	fix(gitea): remove unused	2026-01-26 17:30:44 +01:00
mrtz	79ad206db3	fix(gitea): Reset	2026-01-26 17:28:56 +01:00
mrtz	6c850b312c	fix(gitae):...	2026-01-26 17:27:36 +01:00
mrtz	d1c4b25499	fix(gitea): More secrets	2026-01-26 17:25:11 +01:00
mrtz	265c370787	fix(gitea): Also for attachements	2026-01-26 17:23:27 +01:00
mrtz	ed017894b5	fix(gitea): Dup	2026-01-26 17:21:33 +01:00
mrtz	9f0503bbf3	fix(gitea): Use env	2026-01-26 17:18:29 +01:00
mrtz	5aa937acb3	fix(gitea): All in buckets	2026-01-26 17:16:08 +01:00
mrtz	548c942b42	fix(hs): Add new gitea	2026-01-26 09:42:38 +01:00
mrtz	b49f8dc005	fix(gitea): Change to public DNS with private IP	2026-01-26 08:55:16 +01:00
mrtz	955424cc70	Merge branch 'renovate/gatus-1.x' into 'main' Update Helm release gatus to v1.4.5 See merge request oceanbox/manifests!71	2026-01-25 21:08:35 +01:00
mrtz	6e7fa3a642	fix(gitea): Cleanup	2026-01-25 20:38:43 +01:00
mrtz	f6d6282aea	chore(gitea): Bump	2026-01-25 11:45:13 +01:00
Renovate Bot	f20375c7ca	Update Helm release gatus to v1.4.5	2026-01-25 08:58:18 +00:00
mrtz	127722c4b4	fix(argo): Add postfix	2026-01-24 16:51:12 +01:00
mrtz	d345172d8a	fix(postfix): Move into manifests	2026-01-24 16:49:33 +01:00
mrtz	e55212a859	fix(postfix): Plain	2026-01-24 16:47:38 +01:00
mrtz	8a39fb8afc	Intiall Postfix setup :/	2026-01-24 15:52:10 +01:00
mrtz	212739ae94	Merge branch 'automated/npins-update-20260123' into 'main' chore: update npins dependencies See merge request oceanbox/manifests!70	2026-01-24 08:29:11 +01:00
mrtz	a940a2fedf	fix(gitea): More metrics and NodePort	2026-01-23 20:03:56 +01:00
mrtz	38264b4879	fix(gitea): LB	2026-01-23 19:43:51 +01:00
mrtz	941e98abb8	fix(gitea): Add push to create and lb	2026-01-23 19:42:51 +01:00
mrtz	09b8030d03	chore: update npins dependencies Automated update of Nix dependencies via npins. Updated packages: + "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23", + "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=" + "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="	2026-01-23 15:01:05 +00:00
mrtz	e7ba9bf363	fix(gitea): Via proxy protocol	2026-01-22 17:36:52 +01:00
mrtz	3a188746de	fix(gitea): Secure cookie	2026-01-22 17:32:46 +01:00
mrtz	f315c5019b	fix(gitea): Rootless-Rootless	2026-01-22 16:31:00 +01:00
mrtz	6213f4ce2e	fix(gitea): Rootless	2026-01-22 16:28:01 +01:00
mrtz	6d61ba9243	chore(gitea): Bump	2026-01-22 16:23:26 +01:00
mrtz	ead05c101d	fix(gitea\|hs): Cool git domain	2026-01-22 16:16:38 +01:00
mrtz	44a93f15a6	fix(hs): New LB for git	2026-01-22 16:15:51 +01:00
mrtz	97d21660b1	fix(gitea): Back to svc for now	2026-01-22 15:46:31 +01:00
mrtz	9ff1f8aafc	fix(gitea): Nodeport	2026-01-22 15:41:49 +01:00
mrtz	f9cf9ad9b1	fix(gitea): Don't overwrite http LB	2026-01-22 15:28:16 +01:00
mrtz	807d9bca35	fix(gitea): Enabled by default	2026-01-22 15:26:28 +01:00
mrtz	bf15426393	fix(gitea): LB take two	2026-01-22 15:25:14 +01:00
mrtz	21c57dac36	fix(gitea): Add LB	2026-01-22 15:24:05 +01:00
mrtz	1fd177b73a	fix(gitea): Type again	2026-01-22 15:01:45 +01:00
mrtz	9d5b144d2d	fix(gitea): Set nodePort	2026-01-22 14:59:01 +01:00
mrtz	24dfb63714	fix(gitea): Bump nodeport	2026-01-22 14:52:47 +01:00
mrtz	e467799bd6	fix(gitea): Add admin secret and nodeport	2026-01-22 14:50:07 +01:00
mrtz	ad258bf3fe	feat: Add Gitea	2026-01-22 12:31:52 +01:00
mrtz	0801c0c6c7	fix: Remove attic reference	2026-01-22 09:57:37 +01:00
mrtz	924c7c74a4	fix(rabbitmq): Bump memroy	2026-01-22 08:42:42 +01:00
mrtz	1b766341cb	ci: atlantis	2026-01-21 12:53:15 +00:00
mrtz	b8c199718a	fix(forgejo): Increase caching and don't send confirmation emails	2026-01-21 13:48:38 +01:00
mrtz	b77b968420	fix(forgejo): Add metrics	2026-01-21 13:39:03 +01:00
mrtz	449a0f0e60	ci: atlantis	2026-01-21 09:42:26 +00:00
mrtz	b1584703d1	fix: Remove nexus helmfile	2026-01-21 09:37:24 +01:00
mrtz	d3ecef770f	fix: Remove unused values	2026-01-21 09:36:29 +01:00
mrtz	f43588cb93	fix(cilium): Autosync of by default	2026-01-21 09:03:41 +01:00
mrtz	be985a1ac4	Merge branch 'renovate/forgejo-16.x' into 'main' Update forgejo Docker tag to v16.0.1 See merge request oceanbox/manifests!68	2026-01-20 19:09:10 +01:00
mrtz	6a3e3855df	Merge branch 'renovate/argocd-apps-2.x' into 'main' Update Helm release argocd-apps to v2.0.4 See merge request oceanbox/manifests!69	2026-01-20 19:08:50 +01:00
Renovate Bot	da5a2ea142	Update Helm release argocd-apps to v2.0.4	2026-01-20 18:04:14 +00:00
Renovate Bot	d3db1db7c5	Update forgejo Docker tag to v16.0.1	2026-01-20 18:04:09 +00:00
mrtz	411550cc23	devel: Remove vCluster Now available on the `vcluster` branch	2026-01-20 18:53:17 +01:00
mrtz	1e8584281a	devel: Remove attic It's now available on the attic branch.	2026-01-20 18:50:22 +01:00