Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

https://github.com/cilium/cilium/issues/38559

.gitlab-ci.yml

@@ -1,54 +0,0 @@
-# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
-default:
-  tags:
-    - nix
-
-include:
-  - project: oceanbox/gitlab-ci
-    ref: v4.5
-    file: template/Base.gitlab-ci.yml
-# stages:
-# - release
-
-# image:
-# name: alpine/helm:latest
-# entrypoint: ["/bin/bash", "-c"]
-
-# release:
-# stage: release
-# rules:
-# - if: "$CI_COMMIT_BRANCH =~ /^main/"
-# when: always
-# - when: never
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done
-
-# rebuild:
-# stage: release
-# rules:
-# - when: manual
-# allow_failure: true
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done

bootstrap/helmfile-cmp/deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
+img=git.oceanbox.io/platform/manifests/helmfile-cmp
 tag=${1:-latest}
 
 docker build -t "${img}":"${tag}" .

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.35.2
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.35.2
+appVersion: v1.42.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: registry.gitlab.com/oceanbox/poseidon/atlantis
-  tag: v1.35.2
+  tag: v1.42.2
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -116,6 +116,5 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.35.2
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.35.2"
+appVersion: "v1.42.2"

charts/codex/values.yaml

@@ -6,11 +6,11 @@
 replicaCount: 1
 # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/codex
+  repository: git.oceanbox.io/oceanbox/poseidon/codex
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.35.2
+  tag: v1.42.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/docs/values.yaml

@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository:  registry.gitlab.com/oceanbox/documentation
+  repository: git.oceanbox.io/oceanbox/documentation/docs
   tag: v0.1.0
   pullPolicy: IfNotPresent
 init:

charts/plume/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.6.7
+version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.6.7
+appVersion: v1.6.13

charts/plume/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/plume
-  tag: v1.6.7
+  repository: git.oceanbox.io/oceanbox/plume/plume
+  tag: v1.6.13
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.35.2
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.35.2
+appVersion: v1.42.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: registry.gitlab.com/oceanbox/poseidon/sorcerer
-  tag: v1.35.2
+  tag: v1.42.2
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -108,7 +108,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false
   statestore:

envs/environments.yaml.gotmpl

@@ -20,4 +20,11 @@ environments:
     - ../values/*/env.yaml.gotmpl
     - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
     missingFileHandler: Info
+  beta:
+    values:
+    - ../values/env.yaml
+    - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+    - ../values/*/env.yaml.gotmpl
+    - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+    missingFileHandler: Info
 

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.2
+  version: v1.19.3
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/cilium.yaml.gotmpl

@@ -3,7 +3,8 @@ bases:
 
 repositories:
 - name: cilium
-  url: 'https://helm.cilium.io'
+  oci: true
+  url: 'quay.io/cilium/charts'
 
 commonLabels:
   tier: system
@@ -15,11 +16,11 @@ releases:
 - name: cilium
   namespace: kube-system
   chart: cilium/cilium
-  version: 1.16.2
+  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.18.6{{ else }}1.16.19{{ end }}
   condition: cilium.enabled
   values:
   - ../values/cilium/values/cilium.yaml.gotmpl
-  - ../values/cilium/values/cilium-{{ .Environment.Name }}.yaml.gotmpl
+  - ../values/cilium/values/cilium-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   missingFileHandler: Info
 - name: manifests
   namespace: cilium
@@ -55,4 +56,3 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/cilium/cilium-manifests
     - manifests
-

helmfile.d/docs.yaml.gotmpl

@@ -6,7 +6,7 @@ commonLabels:
 
 releases:
 - name: docs
-  namespace: {{ .Environment.Name }}-docs
+  namespace: docs
   chart: ../charts/docs
   condition: docs.enabled
   values:
@@ -17,7 +17,7 @@ releases:
   - ../values/docs/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: {{ .Environment.Name }}-docs
+  namespace: docs
   chart: manifests
   condition: docs.enabled
   missingFileHandler: Info

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.3.1
+  version: v1.4.0
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.14.1
+  version: 4.14.3
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/makai.yaml.gotmpl

@@ -6,7 +6,7 @@ commonLabels:
 
 releases:
 - name: makai
-  namespace: {{ .Environment.Name }}-makai
+  namespace: makai
   chart: ../charts/makai
   condition: makai.enabled
   values:
@@ -17,7 +17,7 @@ releases:
   - ../values/makai/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: {{ .Environment.Name }}-makai
+  namespace: makai
   chart: manifests
   condition: makai.enabled
   missingFileHandler: Info

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.10.3
+  version: 25.10.4
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.50
+  version: 0.2.54
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.142.1
+  version: 0.145.0
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/postgres-operator.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
   namespace: cnpg
   chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.3.1
+  version: 0.5.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl

shell.nix

@@ -31,6 +31,7 @@ pkgs.mkShellNoCC {
       kubectl-graph
       kubectl-klock
       graphviz
+      hubble
 
       # other tools activate when needed
       # step-cli
@@ -46,7 +47,7 @@ pkgs.mkShellNoCC {
     ++ checks.enabledPackages;
 
   # Environment variables
-  ARGOCD_ENV_CLUSTER_NAME = "ekman";
+  ARGOCD_ENV_CLUSTER_NAME = "oceanbox";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
 
   shellHook = builtins.concatStringsSep "\n" [

values/argo/manifests/sys-project.yaml

@@ -95,6 +95,8 @@ spec:
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
+  - https://git.oceanbox.io/platform/manifests.git
+  - https://git.oceanbox.io/platform/manifests
   - https://gitlab.com/oceanbox/manifests.git
   - https://kubernetes.github.io/ingress-nginx
   - https://cloudnative-pg.github.io/charts
@@ -127,6 +129,8 @@ spec:
   - ghcr.io/slinkyproject/charts/slurm-operator
   - ghcr.io/slinkyproject/charts/slurm-operator-crds
   - ghcr.io/spegel-org/helm-charts
+  - quay.io/cilium/charts
+  - quay.io/jetstack/charts
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
   - docker.gitea.com
   - https://operator.mariadb.com/mariadb-enterprise-operator

values/atlantis/env-oceanbox.yaml.gotmpl

@@ -1,3 +1,2 @@
 atlantis:
   enabled: true
-

values/atlantis/env.yaml.gotmpl

@@ -1,5 +1,4 @@
 atlantis:
   enabled: false
-  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
+  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
   env: {{ .Environment.Name }}
-

values/atlantis/kustomize/beta/appsettings.json

@@ -0,0 +1,96 @@
+{
+    "oidc": {
+        "issuer": "https://auth.oceanbox.io/realms/oceanbox",
+        "authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
+        "token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
+        "jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
+        "userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
+        "end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
+        "device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
+        "clientId": "atlantis",
+        "clientSecret": "",
+        "scopes": [
+            "openid",
+            "email",
+            "offline_access",
+            "profile"
+        ],
+        "audiences": [
+            "atlantis",
+            "atlantis_dev",
+            "sorcerer",
+            "sorcerer_dev"
+        ]
+    },
+    "sso": {
+        "cookieDomain": ".oceanbox.io",
+        "cookieName": ".obx.beta",
+        "ttl": 12.0,
+        "signedOutRedirectUri": "https://maps.beta.oceanbox.io",
+        "realm": "atlantis",
+        "environment": "prod",
+        "keyStore": {
+            "kind": "azure",
+            "uri": "https://atlantis.blob.core.windows.net",
+            "key": "dataprotection-keys"
+        },
+        "keyVault": {
+            "kind": "azure",
+            "uri": "https://atlantisvault.vault.azure.net",
+            "key": "dataencryption-keys"
+        }
+    },
+    "fga": {
+      "apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
+      "apiKey": "",
+      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
+      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
+    },
+    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "plainAuthUsers": [
+        {
+            "username": "admin",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "sorcerer",
+            "password": "fire tre to en",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "archivist",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        }
+    ],
+    "plume": "plume.data.oceanbox.io",
+    "redis": "beta-atlantis-redis:6379",
+    "objectStore": "https://atlantis.blob.core.windows.net",
+    "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
+    "sorcerer" : "https://sorcerer.beta.ekman.oceanbox.io",
+    "allowedOrigins": [
+        "https://maps.beta.oceanbox.io"
+    ],
+    "appName": "atlantis",
+    "appEnv": "prod",
+    "appNamespace": "atlantis",
+    "appVersion": "2.95.1",
+    "otelCollector": "http://opentelemetry-collector.otel.svc:4317",
+    "pubsubName": "pubsub",
+    "pubsubTopic": "hipster-atlantis",
+    "slurm": {
+        "baseUrl": "https://slurmrestd.ekman.oceanbox.io/",
+        "slurmApi": "slurm/v0.0.42/",
+        "dbdApi": "slurmdbd/v0.0.42/",
+        "accessToken": ""
+    },
+    "amqp": {
+        "auth": "user:hunny-bunny",
+        "host": "10.255.241.201:30673"
+    },
+    "fenceRadius": 1250.0
+}

values/atlantis/kustomize/beta/bindings.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: slurm-events
+spec:
+  type: bindings.rabbitmq
+  version: v1
+  metadata:
+  - name: host
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  connString
+  - name: queueName
+    value: beta-slurm-job-events
+  - name: durable
+    value: true
+  - name: contentType
+    value: "application/json"
+  - name: route
+    value: /events/slurm
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/configurations.yaml

@@ -0,0 +1,20 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: configstore
+spec:
+  type: configuration.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-atlantis-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-atlantis-redis
+      key:  redis-password
+  - name: redisDB
+    value: "1"
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/default.env

@@ -0,0 +1 @@
+OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm

values/atlantis/kustomize/beta/deployment_patch.yaml

@@ -0,0 +1,10 @@
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: azure-keyvault
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: prod-atlantis-env

values/atlantis/kustomize/beta/keyvault.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: azure-keyvault
+spec:
+  type: secretstores.azure.keyvault
+  version: v1
+  metadata:
+  - name: vaultName
+    value: atlantisvault
+  - name: azureTenantId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_TENANT_ID
+  - name: azureClientId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_ID
+  - name: azureClientSecret
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_SECRET

values/atlantis/kustomize/beta/kustomization.yaml

@@ -0,0 +1,24 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: beta-atlantis-appsettings
+  files:
+    - appsettings.json
+patches:
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+    path: deployment_patch.yaml
+
+resources:
+  - ../base
+  - rbac.yaml
+  - tracing.yaml
+  - bindings.yaml
+  - pubsub.yaml
+  - statestore.yaml
+  - subscriptions.yaml
+  - configurations.yaml
+  - secretstore.yaml
+  - keyvault.yaml

values/atlantis/kustomize/beta/pubsub.yaml

@@ -0,0 +1,52 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: pubsub
+spec:
+  version: v1
+  type: pubsub.rabbitmq
+  metadata:
+  - name: hostname
+    value: prod-rabbitmq.rabbitmq
+  - name: username
+    value: user
+  - name: password
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  rabbitmq-password
+  - name: protocol
+    value: amqp
+  - name: durable
+    value: true
+  - name: deletedWhenUnused
+    value: false
+  - name: autoAck
+    value: false
+  - name: deliveryMode
+    value: 1
+  - name: requeueInFailure
+    value: false
+  - name: prefetchCount
+    value: 0
+  - name: reconnectWait
+    value: 0
+  - name: concurrencyMode
+    value: parallel
+  - name: publisherConfirm
+    value: false
+  - name: backOffPolicy
+    value: exponential
+  - name: backOffInitialInterval
+    value: 100
+  - name: backOffMaxRetries
+    value: 16
+  - name: enableDeadLetter # Optional enable dead Letter or not
+    value: true
+  - name: maxLen # Optional max message count in a queue
+    value: 3000
+  - name: maxLenBytes # Optional maximum length in bytes of a queue.
+    value: 10485760
+  - name: exchangeKind
+    value: fanout
+  - name: clientName
+    value: "{appID}"

values/atlantis/kustomize/beta/rbac.yaml

@@ -0,0 +1,40 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: beta-atlantis
+  namespace: beta-atlantis
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - beta-atlantis-appsettings
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - azure-keyvault
+  - beta-atlantis-redis
+  - slurm-access-token
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: beta-atlantis
+  namespace: beta-atlantis
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: beta-atlantis
+subjects:
+- kind: ServiceAccount
+  name: beta-atlantis
+  namespace: beta-atlantis

values/atlantis/kustomize/beta/secretstore.yaml

@@ -0,0 +1,10 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: secretstore
+spec:
+  type: secretstores.kubernetes
+  version: v1
+  metadata:
+   - name: defaultNamespace
+     value: beta-atlantis

values/atlantis/kustomize/beta/statestore.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: statestore
+spec:
+  type: state.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-atlantis-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-atlantis-redis
+      key:  redis-password
+  - name: actorStateStore
+    value: "true"
+  - name: redisDB
+    value: "0"
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/subscriptions.yaml

@@ -0,0 +1,27 @@
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: hipster-events
+spec:
+  topic: hipster
+  routes:
+    default: /events/hipster
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- beta-atlantis
+---
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: inbox-events
+spec:
+  topic: inbox
+  routes:
+    default: /events/inbox
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- beta-atlantis

values/atlantis/kustomize/beta/tracing.yaml

@@ -0,0 +1,11 @@
+apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: tracing
+spec:
+  tracing:
+    samplingRate: "1"
+    otel:
+      endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
+      protocol: grpc
+      isSecure: false

values/atlantis/manifests/atlantis.yaml

@@ -27,16 +27,24 @@ spec:
         value: {{ .Values.atlantis.env }}
       - name: HELMFILE_FILE_PATH
         value: atlantis.yaml.gotmpl
+  {{- if ne .Values.atlantis.env "beta" }}
   - repoURL: https://charts.bitnami.com/bitnami
     targetRevision: 20.1.7
     chart: redis
     helm:
       valueFiles:
       - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
+  {{- end }}
   - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: main
     ref: values
   ignoreDifferences:
+    - kind: Secret
+      name: beta-atlantis-db-superuser
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
     - kind: Secret
       name: azure-keyvault
       jqPathExpressions:
@@ -67,6 +75,12 @@ spec:
         - '.data'
         - '.metadata.labels'
         - '.metadata.annotations'
+    - kind: Secret
+      name: slurm-access-token
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
   syncPolicy:
     syncOptions:
       - CreateNamespace=true

values/atlantis/values/sec.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  redis-password: N2drUGlEN0ZMNA==
+kind: Secret
+metadata:
+  name: beta-sorcerer-redis
+  namespace: beta-sorcerer
+type: Opaque

values/atlantis/values/values-beta.yaml.gotmpl

@@ -0,0 +1,103 @@
+replicaCount: 1
+
+image:
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: v1.42.2
+
+podAnnotations:
+  dapr.io/app-id: "beta-atlantis"
+
+env:
+  - name: APP_NAMESPACE
+    value: beta-atlantis
+  - name: APP_VERSION
+    value: "2.97.4-beta"
+  - name: LOG_LEVEL
+    value: "1"
+  - name: ANALYTICS_WEB_ID
+    value: "16e7d807-4db5-45fd-92a9-27393445a153"
+  - name: REDIS_USER
+    value: default
+  - name: REDIS_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: beta-atlantis-redis
+        key: redis-password
+  # Share production database
+  - name: DB_HOST
+    value: prod-atlantis-db-rw.prod-atlantis
+  - name: DB_PORT
+    value: "5432"
+  - name: DB_USER
+    valueFrom:
+      secretKeyRef:
+        name: prod-atlantis-db-superuser
+        key: username
+  - name: DB_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: prod-atlantis-db-superuser
+        key: password
+  - name: DAPR_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: dapr-api-token
+        key: token
+
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+  hosts:
+    - host: maps.beta.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+       - maps.beta.oceanbox.io
+      secretName: beta-atlantis-tls
+
+cluster:
+  enabled: false
+  bootstrap: false
+
+redis:
+  enabled: true
+  size: 2Gi
+  secret:
+    name: beta-atlantis-redis
+    key: redis-password
+  backup:
+    enabled: true
+  resources:
+    cpu: 150m
+    memory: 256Mi
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 250m
+    memory: 512Mi
+
+diagrid-dashboard:
+  enabled: false
+  statestore:
+    scope: beta-atlantis
+    redis: beta-atlantis-redis

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,6 +1,7 @@
 replicaCount: 1
 image:
-  tag: 8e824d4a-debug
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: bc9dccaa-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/attic/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,2 @@
 attic:
-  enabled: true
+  enabled: false

values/attic/manifests/attic.yaml

@@ -4,15 +4,15 @@ metadata:
   name: attic
   namespace: argocd
   finalizers:
-  - resources-finalizer.argocd.argoproj.io
+    - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
     namespace: attic
-    server: 'https://kubernetes.default.svc'
+    server: "https://kubernetes.default.svc"
   sources:
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: HEAD
-    path: values/attic/manifests
+    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
+      targetRevision: HEAD
+      path: values/attic/manifests
   project: aux
   syncPolicy:
     managedNamespaceMetadata:

values/cert-manager/env-hel1.yaml.gotmpl

@@ -0,0 +1,5 @@
+cert_manager:
+ enabled: true
+ autosync: true
+ gatewayApi:
+  enabled: true

values/cert-manager/env.yaml.gotmpl

@@ -1,3 +1,5 @@
 cert_manager:
  enabled: true
  autosync: true
+ gatewayApi:
+  enabled: false

values/cert-manager/values/cert-manager.yaml.gotmpl

@@ -3,3 +3,9 @@ enableCertificateOwnerRef: true
 startupapicheck:
   podAnnotations:
     linkerd.io/inject: disabled
+{{- if .Values.cert_manager.gatewayApi.enabled }}
+config:
+  apiVersion: controller.config.cert-manager.io/v1alpha1
+  enableGatewayAPI: true
+  kind: ControllerConfiguration
+{{- end }}

values/cilium/cilium-manifests/gateway.yaml

@@ -0,0 +1,68 @@
+{{- if eq .Values.cilium.cluster "hel1" }}
+# TODO: Move to ListernerSets when those get Promoted to GA
+# Resources:
+# - https://gateway-api.sigs.k8s.io/geps/gep-1713/
+# - https://github.com/kubernetes-sigs/gateway-api/issues/1713
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: shared-gateway
+  namespace: kube-system
+spec:
+  infrastructure:
+    annotations:
+      load-balancer.hetzner.cloud/location: hel1
+      load-balancer.hetzner.cloud/type: lb11
+      load-balancer.hetzner.cloud/name: load-balancer-2
+      load-balancer.hetzner.cloud/use-private-ip: "true"
+      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+      load-balancer.hetzner.cloud/http-redirect-https: "false"
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-oceanbox-io
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: ssh
+      protocol: TCP
+      port: 22
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-oceanbox-io
+spec:
+  secretName: wildcard-oceanbox-io
+  commonName: oceanbox.io
+  dnsNames:
+    - oceanbox.io
+    - "*.oceanbox.io"
+  issuerRef:
+    name: letsencrypt-prod-dns01
+    kind: ClusterIssuer
+{{- end}}

values/cilium/cilium-manifests/policies/allow-ingress-to-cluster.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: "cilium.io/v2"
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ingress-to-cluster
+  namespace: default
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: reserved:ingress
+        operator: Exists
+  egress:
+    - toEntities:
+        - cluster
+  ingress:
+    - fromEntities:
+        - world
+        - cluster
+{{- end }}

values/cilium/env-hel1.yaml.gotmpl

@@ -0,0 +1,12 @@
+cilium:
+  enabled: true
+  nodePort:
+    enabled: true
+  l2announcement:
+    enabled: true
+  gatewayAPI:
+    enabled: true
+  gatewayTest:
+    enabled: true
+  policyAuditMode: true
+  upgradeCompatability: 1.18

values/cilium/env.yaml.gotmpl

@@ -30,3 +30,4 @@ cilium:
   loadbalancerPool:
     enabled: false
     cidr: []
+  cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}

values/cilium/values/cilium.yaml.gotmpl

@@ -61,6 +61,25 @@ nodePort:
   enabled: {{ .Values.cilium.nodePort.enabled }}
 gatewayAPI:
   enabled: {{ .Values.cilium.gatewayAPI.enabled }}
+{{- if eq .Values.cilium.cluster "hel1"}}
+  gatewayClass:
+    create: 'true'
+  enableProxyProtocol: true
+  hostNetwork:
+    enabled: false
+    nodes:
+      matchLabels:
+        ingresshost: "cilium"
+envoy:
+  enabled: true
+  securityContext:
+    capabilities:
+      keepCapNetBindService: true
+      envoy:
+        - NET_ADMIN
+        - BPF
+        - NET_BIND_SERVICE
+{{- end}}
 ingressController:
   enabled: {{ .Values.cilium.ingressController.enabled }}
   default: {{ .Values.cilium.ingressController.defaultClass }}

values/codex/values/values-staging.yaml

@@ -31,4 +31,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: 2e1165d9-debug
+  tag: d34652dd-debug

values/docs/env-hel1.yaml.gotmpl

@@ -0,0 +1,2 @@
+docs:
+  enabled: true

values/docs/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,2 @@
 docs:
-  enabled: true
+  enabled: false

values/docs/manifests/docs.yaml

@@ -2,7 +2,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: {{ .Values.docs.env }}-docs
+  name: docs
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -11,7 +11,7 @@ metadata:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: {{ .Values.docs.env }}-docs
+    namespace: docs
     server: https://kubernetes.default.svc
   project: default
   sources:
@@ -24,7 +24,7 @@ spec:
       - name: CLUSTER_NAME
         value: {{ .Values.clusterConfig.cluster }}
       - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.docs.env }}
+        value: default
       - name: HELMFILE_FILE_PATH
         value: docs.yaml.gotmpl
   syncPolicy:

values/docs/values/values-staging.yaml

@@ -1,27 +0,0 @@
-replicaCount: 1
-image:
-  tag: "c172ad11-debug"
-env:
-  - name: APP_VERSION
-    value: "0.0.0-staging"
-  - name: LOG_LEVEL
-    value: "1"
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: docs.dev.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - docs.dev.oceanbox.io
-      secretName: staging-docs-tls

values/docs/values/values.yaml

@@ -1,9 +1,11 @@
 replicaCount: 1
+image:
+  tag: "5c4cda2e-debug"
 env:
   - name: APP_VERSION
-    value: "1.5.0"
+    value: "0.0.0"
   - name: LOG_LEVEL
-    value: "2"
+    value: "1"
 ingress:
   enabled: true
   className: "nginx"

values/env-ekman.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
   cilium:
     enabled: false
   env: "prod"

values/env-hel1.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
   env: "prod"
   distro: "talos"
   domain: "adm.hel1.obx"

values/env-oceanbox.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
   env: "prod"
   distro: "talos"
   domain: "adm.oceanbox.io"

values/env-rossby.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/oceanbox/manifests.git
   cilium:
     enabled: false
   env: "prod"

values/gatus/values/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: twinproduction/gatus
-  tag: v5.32.0
+  tag: v5.34.0
 
 # Does envFrom secret named gatus
 secrets: true
@@ -62,21 +62,21 @@ config:
     <<: *defaults
     conditions:
       - "[STATUS] == 200"
-      - "[RESPONSE_TIME] <= 1000"
+      - "[RESPONSE_TIME] <= 2000"
       - "[CERTIFICATE_EXPIRATION] > 168h" # 7 days
 
   .tls-endpoint: &tls-endpoint
     <<: *defaults
     conditions:
       - "[CONNECTED] == true"
-      - "[RESPONSE_TIME] <= 1000"
+      - "[RESPONSE_TIME] <= 2000"
       - "[CERTIFICATE_EXPIRATION] > 168h" # 7 days
 
   .tcp-endpoint: &tcp-endpoint
     <<: *defaults
     conditions:
       - "[CONNECTED] == true"
-      - "[RESPONSE_TIME] <= 1000"
+      - "[RESPONSE_TIME] <= 2000"
 
   endpoints:
     - name: Atlantis TOS
@@ -93,12 +93,13 @@ config:
       alerts:
         - type: custom
 
-    - name: Sorcerer VTN
-      <<: *https-endpoint
-      group: "Primary Services"
-      url: https://sorcerer.vtn.oceanbox.io/healthz
-      # alerts:
-      # - type: custom
+    # NOTE: Ingress is down
+    # - name: Sorcerer VTN
+    #   <<: *https-endpoint
+    #   group: "Primary Services"
+    #   url: https://sorcerer.vtn.oceanbox.io/healthz
+    # alerts:
+    # - type: custom
 
     - name: Plume TOS
       <<: *https-endpoint

values/gitea/manifests/gateway-routes.yaml

@@ -0,0 +1,35 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: gitea-http
+  namespace: gitea
+spec:
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+  hostnames:
+  - git.oceanbox.io
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: "/"
+    backendRefs:
+    - name: gitea-http
+      port: 3000
+
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  parentRefs:
+  - name: shared-gateway
+    namespace: kube-system
+    sectionName: ssh
+  rules:
+  - backendRefs:
+    - name: gitea-ssh
+      port: 22

values/gitea/manifests/gitea.yaml

@@ -30,6 +30,7 @@ spec:
     managedNamespaceMetadata:
       labels:
         component: sys
+        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/gitea/values/values.yaml

@@ -71,16 +71,14 @@ gitea:
     oauth2_client:
       REGISTER_EMAIL_CONFIRM: false
       ENABLE_AUTO_REGISTRATION: true
-      UPDATE_AVATAR: true
-      ACCOUNT_LINKING: auto
-    # mailer:
-    # ENABLED: true
-    # FROM: "noreply@oceanbox.io"
-    # PROTOCOL: "smtp+startls"
-    # SMTP_ADDR: "smtp.office365.com"
-    # SMTP_PORT: 587
-    # USER: "noreply@oceanbox.io"
-    # PASSWD:
+      ACCOUNT_LINKING: "login"
+      USERNAME: "nickname"
+    mailer:
+      ENABLED: true
+      FROM: "gitea@oceanbox.io"
+      PROTOCOL: "smtp"
+      SMTP_ADDR: "postfix-mail.postfix.svc.cluster.local"
+      SMTP_PORT: 587
     database:
       DB_TYPE: postgres
       MAX_OPEN_CONNS: 90
@@ -93,9 +91,6 @@ gitea:
       existingSecret: gitea-oauth-oceanbox
       autoDiscoverUrl: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/.well-known/openid-configuration"
       scopes: "openid profile email groups"
-      groupClaimName: "groups"
-      adminGroup: "/oceanbox/devel"
-      restrictedGroup: ""
   additionalConfigFromEnvs:
     - name: GITEA__STORAGE__MINIO_ACCESS_KEY_ID
       valueFrom:
@@ -148,7 +143,7 @@ ingress:
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
   hosts:
     - host: git.oceanbox.io
       paths:

values/headscale-router/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 
 args: [ "serve" ]
 

values/headscale/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 
 args: ["serve"]
 
@@ -115,6 +115,9 @@ configMaps:
               "isa.rosso@oceanbox.io",
               "jonathan.lilly@oceanbox.io",
               "faith.iha@oceanbox.io",
+              "elianne.ersdal@oceanbox.io",
+              "hanskristian.djuve@oceanbox.io",
+              "erlend.mundal@oceanbox.io",
             ],
             "group:manager": [
               "svenn.hanssen@oceanbox.io",
@@ -188,6 +191,7 @@ configMaps:
               "dst": [
                 "tag:hpc:22",
                 "tag:mumindalen:22",
+                "dc.hel1.net:*",
                 "100.64.0.0/10:22",
               ]
             },
@@ -213,9 +217,10 @@ configMaps:
               ],
               "dst": [
                  "tag:mumindalen:*",
+                 "tag:hel1:*",
                  "tag:hpc:22,80,443",
                  "dc.tos.net:22,80,443",
-                 "dc.hel1.net:443",
+                 "dc.hel1.net:22,443",
               ]
             },
             {
@@ -264,7 +269,6 @@ configMaps:
            { "name": "codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
 
            { "name": "auth.oceanbox.io", "type": "A", "value": "10.255.241.11" },
-           { "name": "docs.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "auth.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "keycloak.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "grafana.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
@@ -299,9 +303,10 @@ configMaps:
 
            { "name": "git.obx", "type": "A", "value": "10.0.1.9" },
            { "name": "git.oceanbox.io", "type": "A", "value": "10.0.1.3" },
+           { "name": "makai.oceanbox.io", "type": "A", "value": "10.0.1.3" },
+           { "name": "docs.oceanbox.io", "type": "A", "value": "10.0.1.3" },
 
            { "name": "kueue.dev.tos.obx", "type": "A", "value": "10.255.241.99" },
-
            { "name": "slurm-agent.rossby.oceanbox.io", "type": "A", "value": "172.16.239.222" },
 
            { "name": "argocd.adm.vtn.obx", "type": "A", "value": "172.16.239.221" },

values/makai/env-hel1.yaml.gotmpl

@@ -0,0 +1,2 @@
+makai:
+  enabled: true

values/makai/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,2 @@
 makai:
-  enabled: true
+  enabled: false

values/makai/manifests/makai.yaml

@@ -2,7 +2,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: {{ .Values.makai.env }}-makai
+  name: makai
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -11,7 +11,7 @@ metadata:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: {{ .Values.makai.env }}-makai
+    namespace: makai
     server: https://kubernetes.default.svc
   project: default
   sources:
@@ -24,7 +24,7 @@ spec:
       - name: CLUSTER_NAME
         value: {{ .Values.clusterConfig.cluster }}
       - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.makai.env }}
+        value: default
       - name: HELMFILE_FILE_PATH
         value: makai.yaml.gotmpl
   syncPolicy:

values/makai/values/values-staging.yaml

@@ -1,27 +0,0 @@
-replicaCount: 1
-image:
-  tag: "436608af-debug"
-env:
-  - name: APP_VERSION
-    value: "0.0.0-staging"
-  - name: LOG_LEVEL
-    value: "1"
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: makai.dev.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - makai.dev.oceanbox.io
-      secretName: staging-makai-tls

values/makai/values/values.yaml

@@ -1,9 +1,11 @@
 replicaCount: 1
+image:
+  tag: "436608af-debug"
 env:
   - name: APP_VERSION
-    value: "1.5.0"
+    value: "0.0.0"
   - name: LOG_LEVEL
-    value: "2"
+    value: "1"
 ingress:
   enabled: true
   className: "nginx"
@@ -15,11 +17,11 @@ ingress:
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     oceanbox.io/expose: internal
   hosts:
-    - host: makai.srv.oceanbox.io
+    - host: makai.oceanbox.io
       paths:
         - path: /
           pathType: ImplementationSpecific
   tls:
     - hosts:
-        - makai.srv.oceanbox.io
+        - makai.oceanbox.io
       secretName: makai-tls

values/namecheap-webhook/manifests/clusterissuer.yaml

@@ -16,10 +16,10 @@ spec:
           solverName: namecheap
           config:
             apiKeySecretRef:
-              name: {{ .Values.clusterConfig.dns01 }}
+              name: {{ .Values.clusterConfig.acme.dns01 }}
               key: apiKey
             apiUserSecretRef:
-              name: {{ .Values.clusterConfig.dns01 }}
+              name: {{ .Values.clusterConfig.acme.dns01 }}
               key: apiUser
 ---
 apiVersion: cert-manager.io/v1
@@ -39,9 +39,9 @@ spec:
           solverName: namecheap
           config:
             apiKeySecretRef:
-              name: {{ .Values.clusterConfig.dns01 }}
+              name: {{ .Values.clusterConfig.acme.dns01 }}
               key: apiKey
             apiUserSecretRef:
-              name: {{ .Values.clusterConfig.dns01 }}
+              name: {{ .Values.clusterConfig.acme.dns01 }}
               key: apiUser
 {{- end }}

values/plume/values/values-staging.yaml

@@ -1,6 +1,7 @@
 replicaCount: 1
 image:
-  tag: e5015d5d-debug
+  repository: "git.oceanbox.io/oceanbox/plume/plume"
+  tag: 9d99f7cf-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-plume"

values/postfix/values/values.yaml

@@ -27,16 +27,17 @@ config:
     LOG_FORMAT: "json"
     ALLOW_EMPTY_SENDER_DOMAINS: "true"
     ALLOWED_SENDER_DOMAINS: "oceanbox.io"
-    RELAYHOST: "smtp.office365.com:587"
-    RELAYHOST_USERNAME: "noreply@oceanbox.io"
-    RELAYHOST_PASSWORD: "00c73c4a-1ad5-477d-b773-d5d63986061e"
+    RELAYHOST: "[smtp.office365.com]:587"
+    RELAYHOST_USERNAME: "gitea@oceanbox.io"
+    XOAUTH2_CLIENT_ID: "00c73c4a-1ad5-477d-b773-d5d63986061e"
+    XOAUTH2_SECRET: "3E18Q~ONNftFcCmHIHZmPbLtVqwLDBSCwI9hGagV"
+    XOAUTH2_TOKEN_ENDPOINT: https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/oauth2/v2.0/token
+    # XOAUTH2_INITIAL_ACCESS_TOKEN: ""
+    # XOAUTH2_INITIAL_REFRESH_TOKEN: ""
+    XOAUTH2_SYSLOG_ON_FAILURE: "no"
+    XOAUTH2_FULL_TRACE: "no"
   postfix:
-    myhostname: "oceanbox.io"
-    # mynetworks: "127.0.0.0/8, 10.1.0.0/24"
-    smtp_tls_security_level: "may"
-    # To reduce log noise, only try authentication mechanisms supported by Zoho.com
-    smtpd_sasl_auth_enable: "no"
-    smtp_sasl_mechanism_filter: "plain, login"
+    smtp_tls_security_level: "encrypt"
 
 resources:
   limits:

values/sorcerer/env.yaml.gotmpl

@@ -1,5 +1,4 @@
 sorcerer:
-  enabled: true # for now
-  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
+  enabled: true
+  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
   env: {{ .Environment.Name }}
-

values/sorcerer/kustomize/beta-ekman/appsettings.json

@@ -0,0 +1,77 @@
+{
+    "oidc": {
+        "issuer": "https://auth.oceanbox.io/realms/oceanbox",
+        "authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
+        "token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
+        "jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
+        "userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
+        "end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
+        "device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
+        "clientId": "sorcerer",
+        "clientSecret": "",
+        "scopes": [
+            "openid",
+            "email",
+            "offline_access",
+            "profile"
+        ],
+        "audiences": [
+            "atlantis",
+            "atlantis_dev",
+            "sorcerer",
+            "sorcerer_dev"
+        ]
+    },
+    "sso": {
+        "cookieDomain": ".oceanbox.io",
+        "cookieName": ".obx.beta",
+        "ttl": 12.0,
+        "signedOutRedirectUri": "https://maps.beta.oceanbox.io",
+        "realm": "atlantis",
+        "environment": "prod",
+        "keyStore": {
+            "kind": "azure",
+            "uri": "https://atlantis.blob.core.windows.net",
+            "key": "dataprotection-keys"
+        },
+        "keyVault": {
+            "kind": "azure",
+            "uri": "https://atlantisvault.vault.azure.net",
+            "key": "dataencryption-keys"
+        }
+    },
+    "plainAuthUsers": [],
+    "fga": {
+      "apiUrl": "https://openfga.srv.oceanbox.io",
+      "apiKey": "",
+      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
+      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
+    },
+    "sentryUrl": "https://5e6e3584098dc006de18038cf85d2cbe@o4509530141622272.ingest.de.sentry.io/4509547350065232",
+    "redis": "localhost:6379,user=default,password=secret",
+    "allowedOrigins": [
+        "http://localhost:8085",
+        "http://localhost:8080",
+        "https://localhost:8080",
+        "https://sorcerer.data.oceanbox.io",
+        "https://sorcerer.beta.ekman.oceanbox.io",
+        "https://sorcerer.ekman.oceanbox.io",
+        "https://sorcerer.local.oceanbox.io:8080",
+        "https://atlantis.local.oceanbox.io:8080",
+        "https://maps.oceanbox.io",
+        "https://maps.beta.oceanbox.io",
+        "https://atlantis.beta.oceanbox.io",
+        "https://jonas-atlantis.dev.oceanbox.io",
+        "https://stig-atlantis.dev.oceanbox.io",
+        "https://prod-sorcerer.ekman.oceanbox.io",
+        "http://prod-sorcerer.ekman.oceanbox.io"
+    ],
+    "appName": "sorcerer",
+    "appEnv": "prod",
+    "appNamespace": "beta-sorcerer",
+    "appVersion": "0.0.0",
+    "otelCollector": "http://10.255.241.12:4317",
+    "archiveSvc": "https://maps.beta.oceanbox.io",
+    "dataDir": "/data/archives",
+    "cacheDir": "/data/archives/cache/prod"
+}

values/sorcerer/kustomize/beta-ekman/configurations.yaml

@@ -0,0 +1,20 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: configstore
+spec:
+  type: configuration.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-sorcerer-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-sorcerer-redis
+      key:  redis-password
+  - name: redisDB
+    value: "1"
+scopes:
+  - beta-sorcerer

values/sorcerer/kustomize/beta-ekman/deployment_patch.yaml

@@ -0,0 +1,14 @@
+# - op: replace
+#   path: /spec/template/spec/containers/0/volumeMounts/0/mountPath
+#   value: /data
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: azure-keyvault
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: prod-sorcerer-env
+

values/sorcerer/kustomize/beta-ekman/keyvault.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: azure-keyvault
+spec:
+  type: secretstores.azure.keyvault
+  version: v1
+  metadata:
+  - name: vaultName
+    value: atlantisvault
+  - name: azureTenantId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_TENANT_ID
+  - name: azureClientId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_ID
+  - name: azureClientSecret
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_SECRET

values/sorcerer/kustomize/beta-ekman/kustomization.yaml

@@ -0,0 +1,23 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: beta-sorcerer-appsettings
+  files:
+    - appsettings.json
+patches:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+  path: deployment_patch.yaml
+resources:
+- ../base
+- pv.yaml
+- pvc.yaml
+- secrets.yaml
+- configurations.yaml
+- keyvault.yaml
+- rbac.yaml
+- secretstore.yaml
+- statestore.yaml
+- tracing.yaml

values/sorcerer/kustomize/beta-ekman/pv.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-beta-sorcerer-ceph-archives
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-beta-sorcerer-ceph-archives
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem

values/sorcerer/kustomize/beta-ekman/pvc.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: beta-sorcerer-ceph-archives
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-beta-sorcerer-ceph-archives
+status:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi

values/sorcerer/kustomize/beta-ekman/rbac.yaml

@@ -0,0 +1,39 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: beta-sorcerer
+  namespace: beta-sorcerer
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - beta-sorcerer-appsettings
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - azure-keyvault
+  - beta-sorcerer-redis
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: beta-sorcerer
+  namespace: beta-sorcerer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: beta-sorcerer
+subjects:
+- kind: ServiceAccount
+  name: beta-sorcerer
+  namespace: beta-sorcerer

values/sorcerer/kustomize/beta-ekman/secrets.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: beta-sorcerer-env
+type: Opaque
+data:
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kyverno/clone: "true"
+  name: azure-keyvault
+type: Opaque
+data: