Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

fix(cilium): Disable clustermesh again
feat(cilium): Enable clustermesh
2026-03-17 14:57:21 +00:00 · 2026-03-17 13:00:55 +01:00 · 2026-03-17 10:56:43 +01:00 · 2026-03-17 10:14:18 +01:00 · 2026-03-16 15:24:21 +01:00 · 2026-03-16 15:22:40 +01:00
107 changed files with 744 additions and 674 deletions
@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
-watch_file nix/sources.json
-watch_file nix/checks.nix
+watch_file npins/sources.json

 # Load .env file if it exists
 dotenv_if_exists

-# Set npins dir
-export NPINS_DIRECTORY="nix"
-
 # Activate development shell
-use nix
+if type lorri &>/dev/null; then
+    echo "direnv: using lorri from PATH ($(type -p lorri))"
+    eval "$(lorri direnv)"
+else
+    # fall back to using direnv's builtin nix support
+    # to prevent bootstrapping problems.
+    use nix
+fi
@@ -1,4 +1,4 @@
-FROM ghcr.io/helmfile/helmfile:v1.1.9
+FROM ghcr.io/helmfile/helmfile:v1.3.1

 RUN mkdir -p /home/argocd/cmp-server/config/
 COPY plugin.yaml /home/argocd/cmp-server/config/
@@ -0,0 +1,3 @@
+FROM busybox
+
+COPY keycloak-themes/oceanbox /theme
@@ -0,0 +1,109 @@
+/* Oceanbox Keycloak Login Theme
+ *
+ * Branding aligned with oceanbox.io:
+ *   Primary teal:    #0bb4aa
+ *   Dark teal:       #37746F
+ *   Deep blue:       #031275
+ *   Background:      #f9fafd
+ *   Text:            #101010
+ */
+
+:root {
+    --pf-v5-global--primary-color--100: #0bb4aa;
+    --pf-v5-global--primary-color--200: #099e95;
+    --pf-v5-global--link--Color: #0bb4aa;
+    --pf-v5-global--link--Color--hover: #031275;
+}
+
+.login-pf body {
+    background: #f9fafd url("../img/oceanbox-bg.png") no-repeat center bottom fixed;
+    background-size: cover;
+    height: 100%;
+}
+
+/* Login container layout */
+.pf-v5-c-login__container {
+    grid-template-columns: 34rem;
+    grid-template-areas: "header"
+                         "main";
+}
+
+/* Logo */
+div.kc-logo-text {
+    background-image: url('../img/oceanbox-logo-text.png');
+    height: 80px;
+    width: 360px;
+    background-repeat: no-repeat;
+    background-size: contain;
+    background-position: center;
+    margin: 0 auto;
+}
+
+div.kc-logo-text span {
+    display: none;
+}
+
+/* Header */
+#kc-header-wrapper {
+    font-size: 29px;
+    text-transform: uppercase;
+    letter-spacing: 3px;
+    line-height: 1.2em;
+    white-space: normal;
+    color: #37746F !important;
+    text-align: center;
+}
+
+/* Login card */
+.pf-v5-c-login__main {
+    border-radius: 8px;
+    box-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
+}
+
+/* Primary button */
+.pf-v5-c-button.pf-m-primary {
+    --pf-v5-c-button--m-primary--BackgroundColor: #0bb4aa;
+    --pf-v5-c-button--m-primary--hover--BackgroundColor: #099e95;
+    --pf-v5-c-button--m-primary--active--BackgroundColor: #37746F;
+    --pf-v5-c-button--m-primary--focus--BackgroundColor: #099e95;
+    border-radius: 4px;
+}
+
+/* Links */
+.pf-v5-c-button.pf-m-link {
+    --pf-v5-c-button--m-link--Color: #0bb4aa;
+    --pf-v5-c-button--m-link--hover--Color: #031275;
+}
+
+a {
+    color: #0bb4aa;
+}
+
+a:hover {
+    color: #031275;
+}
+
+/* Form inputs */
+.pf-v5-c-form-control > input,
+.pf-v5-c-form-control > textarea {
+    border-radius: 4px;
+}
+
+#kc-recovery-codes-list {
+    columns: 2;
+}
+
+#certificate_subjectDN {
+    overflow-wrap: break-word;
+}
+
+hr {
+    margin-top: var(--pf-v5-global--spacer--sm);
+    margin-bottom: var(--pf-v5-global--spacer--md);
+}
+
+@media (min-width: 768px) {
+    div.pf-v5-c-login__main-header {
+        grid-template-columns: 70% 30%;
+    }
+}
@@ -0,0 +1,5 @@
+parent=keycloak.v2
+import=common/keycloak
+
+stylesCommon=vendor/patternfly-v5/patternfly.min.css vendor/patternfly-v5/patternfly-addons.css
+styles=css/styles.css css/oceanbox.css
@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.2
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.2
+appVersion: v1.46.5
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/atlantis
-  tag: v1.42.2
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: v1.46.5
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.42.2
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.42.2"
+appVersion: "v1.46.5"
@@ -10,7 +10,7 @@ image:
  # This sets the pull policy for images.
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.42.2
+  tag: v1.46.5
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
  - name: gitlab-pull-secret
@@ -8,6 +8,7 @@ data:
    kind: Component
    metadata:
      name: statestore
+      namespace: {{ .Values.statestore.namespace | default "default" }}
    scopes:
      - {{ .Values.statestore.scope }}
    spec:
@@ -17,10 +18,10 @@ data:
        - name: redisUsername
          value: default
        - name: redisPassword
-          value: secret
+          value: {{ .Values.statestore.password | default "secret" }}
        - name: actorStateStore
          value: "true"
        - name: redisDB
-          value: "1"
+          value: "{{ .Values.statestore.redisDB | default "0" }}"
      type: state.redis
      version: v1
@@ -5,6 +5,9 @@
 statestore:
  scope: my-scope
  redis: my-redis
+  namespace: default
+  password: secret
+  redisDB: "0"

 # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
 replicaCount: 1
@@ -42,11 +42,11 @@ spec:
              value: "3"
          livenessProbe:
            httpGet:
-              path: /
+              path: /healthz
              port: http
          readinessProbe:
            httpGet:
-              path: /
+              path: /healthz
              port: http
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
@@ -21,8 +21,8 @@ env:
    valueFrom:
      fieldRef:
        fieldPath: metadata.namespace
-imagePullSecrets:
-  - name: gitea-pull-secret
+# imagePullSecrets:
+  # - name: gitea-pull-secret
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
@@ -8,3 +8,8 @@ version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
 appVersion: v1.6.13
+dependencies:
+  - name: diagrid-dashboard
+    version: "0.1.0"
+    repository: "file://../diagrid-dashboard"
+    condition: diagrid-dashboard.enabled
@@ -90,3 +90,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
+diagrid-dashboard:
+  enabled: false
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.2
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.2
+appVersion: v1.46.5
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,8 +4,8 @@

 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/sorcerer
-  tag: v1.42.2
+  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
+  tag: v1.46.5
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -15,7 +15,7 @@ releases:
 - name: argocd
  namespace: argocd
  chart: argo/argo-cd
-  version: 7.9.1
+  version: 9.4.10
  condition: argo.enabled
  values:
  - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
  namespace: argocd
  chart: argo/argo-rollouts
-  version: 2.40.5
+  version: 2.40.6
  condition: argo.rollouts.enabled
  values:
  - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
  namespace: argocd
  chart: argo/argo-workflows
-  version: 0.45.27
+  version: 0.47.5
  condition: argo.workflows.enabled
  missingFileHandler: Info
 - name: manifests
@@ -66,4 +66,3 @@ releases:
    - '{{`{{ .Environment.Name }}`}}'
    - ../values/argo/manifests
    - _argo
-
@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
  namespace: cert-manager
  chart: cert-manager/cert-manager
-  version: v1.19.3
+  version: v1.19.4
  condition: cert_manager.enabled
  values:
  - ../values/cert-manager/values/cert-manager.yaml.gotmpl
@@ -16,7 +16,7 @@ releases:
 - name: cilium
  namespace: kube-system
  chart: cilium/cilium
-  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.18.6{{ else }}1.16.19{{ end }}
+  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.19.1{{ else if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "ekman" }}1.19.1{{ else }}1.16.19{{ end }}
  condition: cilium.enabled
  values:
  - ../values/cilium/values/cilium.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: gatus
  namespace: uptime
  chart: gatus/gatus
-  version: 1.4.5
+  version: 1.5.0
  condition: gatus.enabled
  values:
  - ../values/gatus/values/values.yaml
@@ -0,0 +1,41 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: jobset
+  oci: true
+  url: registry.k8s.io/jobset/charts
+
+releases:
+- name: jobset
+  namespace: jobset-system
+  chart: jobset/jobset
+  version: 0.11.1
+  condition: jobset.enabled
+  values:
+  - ../values/jobset/values/jobset.yaml.gotmpl
+  - ../values/jobset/values/jobset-{{ .Environment.Name }}.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/jobset/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: jobset-system
+  chart: manifests
+  condition: jobset.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/jobset/env.yaml.gotmpl
+  - ../values/jobset/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/jobset/manifests
+    - manifests
@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
  namespace: keycloak
  chart: bitnami/keycloak
-  version: 24.0.2
+  version: 25.2.0
  condition: keycloak.enabled
  values:
  - ../values/keycloak/values/values.yaml
@@ -8,7 +8,7 @@ releases:
 - name: kueue
  namespace: kueue-system
  chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.15.0
+  version: 0.16.2
  condition: kueue.enabled
  values:
  - ../values/kueue/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: kyverno
  namespace: kyverno
  chart: kyverno/kyverno
-  version: 3.6.1
+  version: 3.7.1
  condition: kyverno.enabled
  values:
  - ../values/kyverno/values/kyverno.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: loki
  namespace: loki
  chart: loki/loki
-  version: 6.42.0
+  version: 6.53.0
  condition: loki.enabled
  values:
  - ../values/loki/values/loki.yaml.gotmpl
@@ -16,7 +16,7 @@ releases:
  namespace: {{ .Environment.Name }}-openfga
  {{- end }}
  chart: openfga/openfga
-  version: 0.2.54
+  version: 0.2.56
  condition: openfga.enabled
  values:
  - ../values/openfga/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
  namespace: otel
  chart: open-telemetry/opentelemetry-collector
-  version: 0.145.0
+  version: 0.146.1
  condition: otel.enabled
  values:
  - ../values/opentelemetry-collector/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: prometheus
  namespace: prometheus
  chart: prometheus/kube-prometheus-stack
-  version: 72.7.0
+  version: 82.10.3
  condition: prometheus.enabled
  values:
  - ../values/prometheus/values/prometheus.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
  namespace: slinky
  chart: slurm-operator/slurm-operator
-  version: 0.4.1
+  version: 1.0.2
  condition: slurm_operator.enabled
  values:
  - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: slurm
  namespace: slurm
  chart: slurm/slurm
-  version: 0.4.1
+  version: 1.0.2
  condition: slurm.enabled
  values:
  - ../values/slurm/values/slurm.yaml.gotmpl
@@ -14,7 +14,7 @@ releases:
 - name: umami
  namespace: analytics
  chart: umami/umami
-  version: 6.0.1
+  version: 7.7.3
  condition: umami.enabled
  values:
  - ../values/umami/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: velero
  namespace: velero
  chart: velero/velero
-  version: 11.3.2
+  version: 12.0.0
  condition: velero.enabled
  values:
  - ../values/velero/values/velero.yaml.gotmpl
@@ -0,0 +1,19 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "kueuectl";
+  version = "0.16.3";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "kueue";
+    rev = "v${version}";
+    hash = "sha256-JbU+ZoQ+YriaiIbbVCe45OTYycxYRanLhmQAdpE+xQ4=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [ "cmd/kueuectl" ];
+}
@@ -1,24 +0,0 @@
-{
-  "pins": {
-    "git-hooks": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "cachix",
-        "repo": "git-hooks.nix"
-      },
-      "branch": "master",
-      "submodules": false,
-      "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
-      "url": "https://github.com/cachix/git-hooks.nix/archive/a1ef738813b15cf8ec759bdff5761b027e3e1d23.tar.gz",
-      "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U="
-    },
-    "nixpkgs": {
-      "type": "Channel",
-      "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
-      "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
-    }
-  },
-  "version": 7
-}
@@ -0,0 +1,71 @@
+{
+  sources ? import ../npins,
+  pkgs ? import sources.nixpkgs { },
+  treefmt ? import sources.treefmt-nix,
+}:
+let
+  globalExcludes = [
+    "npins/default.nix"
+    "attic"
+    "vcluster"
+    ".*vendor"
+    ".*chart/.*"
+    ".*schema.json"
+  ];
+in
+treefmt.evalModule pkgs {
+  projectRootFile = ".git/config";
+
+  settings = {
+    excludes = globalExcludes;
+  };
+
+  programs = {
+
+    # --- Nix formatting ---
+    nixfmt = {
+      enable = true;
+      package = pkgs.nixfmt-rfc-style;
+    };
+    statix.enable = true;
+    deadnix.enable = true;
+
+    # --- Shell ---
+    shellcheck = {
+      enable = true;
+      excludes = [
+        "vcluster/"
+        "attic/"
+      ];
+    };
+
+    shfmt.enable = true;
+
+    # --- YAML ---
+    yamllint = {
+      enable = true;
+      excludes = [
+        "attic/"
+        "charts/templates/"
+        "charts/"
+        "values/"
+        "vcluster/"
+      ];
+      settings = {
+        extends = "default";
+        rules = {
+          document-start = "disable";
+          line-length = {
+            max = 300;
+          };
+        };
+      };
+    };
+
+    # --- JSON ---
+    jsonfmt.enable = true;
+
+    # Optional: keep JSON sorted
+    # prettier.enable = true;
+  };
+}
@@ -0,0 +1,24 @@
+{
+  "pins": {
+    "nixpkgs": {
+      "type": "Channel",
+      "name": "nixpkgs-unstable",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre961788.75690239f08f/nixexprs.tar.xz",
+      "hash": "sha256-p0h/nSeqzIkbn/2uFC4keoIPwmqXGHsX0gkCXM7km00="
+    },
+    "treefmt-nix": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "numtide",
+        "repo": "treefmt-nix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+      "url": "https://github.com/numtide/treefmt-nix/archive/71b125cd05fbfd78cab3e070b73544abe24c5016.tar.gz",
+      "hash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk="
+    }
+  },
+  "version": 7
+}
@@ -1,58 +1,51 @@
 let
-  sources = import ./nix;
+  sources = import ./npins;
  system = builtins.currentSystem;
  pkgs = import sources.nixpkgs {
    inherit system;
    config = { };
    overlays = [ ];
  };
-  checks = import ./nix/checks.nix;
+  treefmt = import ./nix/treefmt.nix { };
+  kueuectl = pkgs.callPackage ./nix/kueuectl.nix { };
 in
 pkgs.mkShellNoCC {
-  name = "clstr";
+  packages = [
+    # dev tools
+    pkgs.just
+    pkgs.npins
+    treefmt.config.build.wrapper

-  packages =
-    with pkgs;
-    [
-      # dev tools
-      just
-      npins
+    # helm
+    pkgs.helmfile
+    pkgs.kubernetes-helm

-      # helm
-      helmfile
-      kubernetes-helm
+    # kubectl tools
+    pkgs.kubectl-cnpg
+    pkgs.kubectl-neat
+    pkgs.kubectl-graph
+    pkgs.kubectl-klock
+    pkgs.kubectl-rook-ceph

-      # kubectl tools
-      kubectl-cnpg
-      kubectl-neat
-      kubelogin
-      kubelogin-oidc
-      kubectl-rook-ceph
-      kubectl-graph
-      kubectl-klock
-      graphviz
-      hubble
-
-      # other tools activate when needed
-      # step-cli
-      # linkerd
-      # cmctl
-      # rclone
-      # velero
-      renovate
-
-      # dapr
-      dapr-cli
-    ]
-    ++ checks.enabledPackages;
+    # other tools activate when needed
+    kueuectl
+    # pkgs.step-cli
+    # pkgs.linkerd
+    # pkgs.cmctl
+    # pkgs.rclone
+    # pkgs.velero
+    # pkgs.renovate
+    # pkgs.graphviz
+    # pkgs.hubble
+    pkgs.cilium-cli
+    pkgs.dapr-cli
+  ];

  # Environment variables
-  ARGOCD_ENV_CLUSTER_NAME = "oceanbox";
+  ARGOCD_ENV_CLUSTER_NAME = "ekman";
  HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
-
-  shellHook = builtins.concatStringsSep "\n" [
-    checks.shellHook
-  ];
+  API_SERVER_IP = "localhost";
+  API_SERVER_PORT = "7445";

  # Alternative shells
  passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {
@@ -60,9 +53,6 @@ pkgs.mkShellNoCC {
      packages = [
        pkgs.npins
      ];
-      shellHook = ''
-        export NPINS_DIRECTORY="nix"
-      '';
    };
  };
 }
@@ -24,11 +24,7 @@ argocd:
      cpu: 250m
  repoServers:
  - name: "helmfile-cmp"
-    image: "registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest"
-    imagePullSecrets:
-      - gitlab-pull-secret
-  - name: "kustomize-helm-with-rewrite"
-    image: "registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest"
+    image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
    imagePullSecrets:
      - gitlab-pull-secret
  additional_rbac_settings:
@@ -92,6 +92,10 @@ spec:
    server: https://kubernetes.default.svc
  - namespace: postfix
    server: https://kubernetes.default.svc
+  - namespace: jobset-system
+    server: https://kubernetes.default.svc
+  - namespace: dex
+    server: https://kubernetes.default.svc
  sourceRepos:
  - https://argoproj.github.io/argo-helm
  - https://kubernetes-sigs.github.io/metrics-server/
@@ -131,9 +135,11 @@ spec:
  - ghcr.io/spegel-org/helm-charts
  - quay.io/cilium/charts
  - quay.io/jetstack/charts
+  - registry.k8s.io/jobset/charts/jobset
  - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
  - docker.gitea.com
  - https://operator.mariadb.com/mariadb-enterprise-operator
  - https://operator.mariadb.com
  - https://ot-container-kit.github.io/helm-charts
  - https://twin.github.io/helm-charts
+  - https://charts.dexidp.io
@@ -15,7 +15,7 @@ configs:
    application.resourceTrackingMethod: annotation+label
    application.instanceLabelKey: app.kubernetes.io/instance
    create: true
-    # NOTE(kai): callback URL for dex
+    # NOTE: callback URL for dex
    url: "https://argocd.{{ .Values.clusterConfig.domain }}"
    resource.compareoptions: |
      ignoreAggregatedRoles: true
@@ -81,6 +81,7 @@ configs:
      p, role:org-admin, applications, *, */*, allow
      p, role:org-admin, projects, *, *, allow
      p, role:org-admin, logs, get, *, allow
+      p, role:org-admin, logs, get, */*, allow
      p, role:org-admin, clusters, get, *, allow
      p, role:org-admin, clusters, update, *, allow
      p, role:org-admin, repositories, get, *, allow
@@ -167,7 +168,7 @@ repoServer:
  extraContainers:
  - command:
    - /var/run/argocd/argocd-cmp-server
-    image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
+    image: {{ .image }}
    env:
    - name: HELM_GIT_ACCESS_TOKEN
      valueFrom:
@@ -176,25 +177,6 @@ repoServer:
          name: oceanbox-gitops-repo
          optional: false
    imagePullPolicy: Always
-    name: helmfile-cmp
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 999
-    terminationMessagePath: /dev/termination-log
-    terminationMessagePolicy: File
-    volumeMounts:
-    - mountPath: /var/run/argocd
-      name: var-files
-    - mountPath: /home/argocd/cmp-server/plugins
-      name: plugins
-    - mountPath: /tmp
-      name: cmp-tmp
-    - mountPath: /helm-working-dir
-      name: helm-working-dir
-  - command:
-    - /var/run/argocd/argocd-cmp-server
-    image: {{ .image }}
-    imagePullPolicy: Always
    name: {{ .name }}
    securityContext:
      runAsNonRoot: true
@@ -208,6 +190,8 @@ repoServer:
      name: plugins
    - mountPath: /tmp
      name: cmp-tmp
+    - mountPath: /helm-working-dir
+      name: helm-working-dir
  volumes:
  - name: cmp-tmp
    emptyDir: {}
@@ -283,10 +267,6 @@ applicationSet:
    ingressClassName: nginx
    annotations:
      cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
-      # {{- with .Values.clusterConfig.ingress_whitelist}}
-      # NOTE(kai): include gitlab and github webhook ranges
-      # nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }},192.30.252.0/22,140.82.112.0/20,34.74.226.27/28,34.74.226.0/24
-      # {{- end }}
    hostname: "argocd-applicationset.{{ .Values.clusterConfig.domain }}"
    tls:
      - secretName: argocd-applicationset-tls
@@ -73,7 +73,8 @@
    "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
    "sorcerer" : "https://sorcerer.data.oceanbox.io",
    "allowedOrigins": [
-        "https://maps.oceanbox.io"
+        "https://maps.oceanbox.io",
+        "https://codex.adm.oceanbox.io"
    ],
    "appName": "atlantis",
    "appEnv": "prod",
@@ -26,7 +26,7 @@
        "cookieDomain": ".oceanbox.io",
        "cookieName": ".obx.staging",
        "ttl": 12.0,
-        "signedOutRedirectUri": "https://atlantis.beta.oceanbox.io",
+        "signedOutRedirectUri": "https://maps.dev.oceanbox.io",
        "realm": "atlantis",
        "environment": "staging",
        "keyStore": {
@@ -76,7 +76,8 @@
        "https://atlantis.beta.oceanbox.io",
        "https://atlantis.dev.oceanbox.io",
        "https://atlantis.local.oceanbox.io:8080",
-        "https://maps.dev.oceanbox.io"
+        "https://maps.dev.oceanbox.io",
+        "https://codex.dev.oceanbox.io"
    ],
    "appName": "atlantis",
    "appEnv": "staging",
@@ -35,7 +35,7 @@ spec:
      valueFiles:
      - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
  {{- end }}
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+  - repoURL: https://git.oceanbox.io/platform/manifests.git
    targetRevision: main
    ref: values
  ignoreDifferences:
@@ -2,6 +2,14 @@ architecture: replication

 replica:
  replicaCount: 2
+  resources:
+    limits:
+      ephemeral-storage: 1024Mi
+      memory: 192Mi
+    requests:
+      cpu: 150m
+      ephemeral-storage: 50Mi
+      memory: 128Mi

 auth:
  enabled: true
@@ -20,4 +28,3 @@ master:
      cpu: 150m
      ephemeral-storage: 50Mi
      memory: 128Mi
-
@@ -2,7 +2,7 @@ replicaCount: 1

 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.42.2
+  tag: v1.46.2

 podAnnotations:
  dapr.io/app-id: "beta-atlantis"
@@ -73,9 +73,6 @@ cluster:
    enabled: false

 resources:
-  limits:
-    cpu: 1
-    memory: 1Gi
  requests:
    cpu: 500m
    memory: 1Gi
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: bc9dccaa-debug
+  tag: 23006866-debug
 podAnnotations:
  dapr.io/app-id: "staging-atlantis"
 env:
@@ -50,23 +50,6 @@ ingress:
    # nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
    # oceanbox.io/expose: internal
  hosts:
-    - host: atlantis.beta.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-      internal:
-        - path: /internal
-          pathType: ImplementationSpecific
-        - path: /dapr
-          pathType: ImplementationSpecific
-        - path: /actors
-          pathType: ImplementationSpecific
-        - path: /job
-          pathType: ImplementationSpecific
-        - path: /events
-          pathType: ImplementationSpecific
-        - path: /metrics
-          pathType: ImplementationSpecific
    - host: maps.dev.oceanbox.io
      paths:
        - path: /
@@ -84,27 +67,8 @@ ingress:
          pathType: ImplementationSpecific
        - path: /metrics
          pathType: ImplementationSpecific
-    - host: atlas.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-      internal:
-        - path: /internal
-          pathType: ImplementationSpecific
-        - path: /dapr
-          pathType: ImplementationSpecific
-        - path: /actors
-          pathType: ImplementationSpecific
-        - path: /job
-          pathType: ImplementationSpecific
-        - path: /events
-          pathType: ImplementationSpecific
-        - path: /metrics
-          pathType: ImplementationSpecific
  tls:
    - hosts:
-        - atlantis.beta.oceanbox.io
-        - atlas.oceanbox.io
        - maps.dev.oceanbox.io
      secretName: staging-atlantis-tls
 cluster:
@@ -0,0 +1,22 @@
+cilium:
+  enabled: true
+  clustermesh:
+    enabled: false
+    clusterId: 2
+    # NodePort until L2LB is available (kubeproxyless)
+    apiserverServiceType: NodePort
+  # TODO: WireGuard blocks all traffic on ekman -- disable until root cause is found.
+  encryption:
+    enabled: false
+  envoy:
+    enabled: true
+  # kube-proxy stays running during migration; disable replacement until done.
+  # TODO: set to true after migration
+  kubeProxyReplacement: false
+  # Direct apiserver connection -- do not rely on the kubernetes service IP
+  # during migration since we are touching the CNI layer.
+  # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
+  k8sServiceHost: 10.255.241.99
+  k8sServicePort: 6443
+  policyAuditMode: true
+  upgradeCompatability: 1.18
@@ -1,5 +1,7 @@
 cilium:
  enabled: true
+  envoy:
+    enabled: true
  nodePort:
    enabled: true
  l2announcement:
@@ -1,5 +1,8 @@
 cilium:
  enabled: true
+  clustermesh:
+    enabled: false
+    clusterId: 1
  nodePort:
    enabled: true
  l2announcement:
@@ -0,0 +1,10 @@
+cilium:
+  enabled: true
+  nodePort:
+    enabled: true
+  l2announcement:
+    enabled: true
+  loadbalancerPool:
+    enabled: false
+    cidr:
+     - 10.255.241.11/32
@@ -30,4 +30,8 @@ cilium:
  loadbalancerPool:
    enabled: false
    cidr: []
+  clustermesh:
+    enabled: false
+    clusterId: 0
+    apiserverServiceType: LoadBalancer
  cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
@@ -0,0 +1,33 @@
+# Installs Cilium without writing the CNI config file.
+# Flannel keeps serving pods on unmigrated nodes.
+# TODO: Remove after migration
+#cni:
+  #customConf: false
+
+# Routes cross-CNI traffic via the host network stack so Flannel pods
+# and Cilium pods can reach each other during the transition.
+# TODO: Remove after migration
+#bpf:
+  #hostLegacyRouting: false
+
+# NOTE: Use Geneve so Cilium's overlay is distinct from Flannel's VXLAN.
+# This is required for cross-CNI pod connectivity during migration.
+routingMode: tunnel
+tunnelProtocol: geneve
+
+# New pod CIDR exclusively for Cilium (must not overlap):
+# Flannel pod CIDR: 10.100.0.0/16  (clusterCidr in k8s config)
+# Service CIDR:     10.0.0.0/22
+# Node networks:    10.255.241.0/24, 10.255.242.0/24, 10.255.243.0/24, 10.255.244.0/24
+# TODO: after migration switch ipam.mode to kubernetes
+ipam:
+  mode: cluster-pool
+  operator:
+    clusterPoolIPv4PodCIDRList:
+      - "10.100.0.0/16"
+    clusterPoolIPv4MaskSize: 24
+
+# NOTE: Rate limit Cilium's k8s API client ekman has ~30 nodes.
+k8sClientRateLimit:
+  qps: 5
+  burst: 10
@@ -1,3 +1,16 @@
+cluster:
+  name: {{ .Values.cilium.cluster }}
+  id: {{ .Values.cilium.clustermesh.clusterId }}
+{{- if .Values.cilium.clustermesh.enabled }}
+clustermesh:
+  useAPIServer: true
+  apiserver:
+    service:
+      type: {{ .Values.cilium.clustermesh.apiserverServiceType }}
+    tls:
+      auto:
+        method: helm
+{{- end }}
 authentication:
  mutual:
    spire:
@@ -15,6 +28,14 @@ encryption:
  type: {{ .Values.cilium.encryption.type}}
 envoy:
  enabled: {{ .Values.cilium.envoy.enabled }}
+  securityContext:
+    capabilities:
+      keepCapNetBindService: true
+      envoy:
+        - SYS_ADMIN
+        - NET_ADMIN
+        - BPF
+        - NET_BIND_SERVICE
  prometheus:
    serviceMonitor:
      enabled: {{ .Values.cilium.envoy.enabled }}
@@ -70,15 +91,6 @@ gatewayAPI:
    nodes:
      matchLabels:
        ingresshost: "cilium"
-envoy:
-  enabled: true
-  securityContext:
-    capabilities:
-      keepCapNetBindService: true
-      envoy:
-        - NET_ADMIN
-        - BPF
-        - NET_BIND_SERVICE
 {{- end}}
 ingressController:
  enabled: {{ .Values.cilium.ingressController.enabled }}
@@ -91,7 +103,7 @@ operator:
  prometheus:
    enabled: true
    port: 12301
-    serviceMointor:
+    serviceMonitor:
      enabled: true
      port: 12302
  rollOutPods: true
@@ -41,7 +41,7 @@
        "cookieDomain": ".oceanbox.io",
        "cookieName": ".obx.prod",
        "ttl": 12.0,
-        "signedOutRedirectUri": "https://maps.oceanbox.io/",
+        "signedOutRedirectUri": "https://codex.adm.oceanbox.io/",
        "realm": "atlantis",
        "environment": "prod",
        "keyStore": {
@@ -55,13 +55,14 @@
            "key": "dataencryption-keys"
        }
    },
-    "plainAuthUsers": [
+    "PlainAuthUsers": [
        {
            "username": "admin",
            "password": "en-to-tre-fire",
            "groups": [ "/oceanbox" ],
            "roles": [ "admin" ]
        }
-    ]
+    ],
+    "ArchiveSvc": "https://maps.oceanbox.io"
 }

@@ -64,3 +64,8 @@
        secretKeyRef:
          name: prod-openfga-db-app
          key: password
+    - name: DAPR_API_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: dapr-api-token
+          key: token
@@ -41,7 +41,7 @@
        "cookieDomain": ".oceanbox.io",
        "cookieName": ".obx.staging",
        "ttl": 12.0,
-        "signedOutRedirectUri": "https://atlantis.dev.oceanbox.io/",
+        "signedOutRedirectUri": "https://codex.dev.oceanbox.io/",
        "realm": "atlantis",
        "environment": "staging",
        "keyStore": {
@@ -55,12 +55,13 @@
            "key": "dataencryption-keys"
        }
    },
-    "plainAuthUsers": [
+    "PlainAuthUsers": [
        {
            "username": "admin",
            "password": "en-to-tre-fire",
            "groups": [ "/oceanbox" ],
            "roles": [ "admin" ]
        }
-    ]
+    ],
+    "ArchiveSvc": "https://maps.dev.oceanbox.io"
 }
@@ -62,3 +62,8 @@
        secretKeyRef:
          name: staging-openfga-db-app
          key: password
+    - name: DAPR_API_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: dapr-api-token
+          key: token
@@ -27,7 +27,7 @@ spec:
        value: {{ .Values.codex.env }}
      - name: HELMFILE_FILE_PATH
        value: codex.yaml.gotmpl
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+  - repoURL: https://git.oceanbox.io/platform/manifests.git
    targetRevision: main
    ref: values
  syncPolicy:
@@ -40,4 +40,3 @@ spec:
      selfHeal: false
    {{- end }}
 {{- end }}
-
@@ -1,4 +1,11 @@
 replicaCount: 1
+podAnnotations:
+  dapr.io/enabled: "true"
+  dapr.io/app-id: "prod-codex"
+  dapr.io/app-port: "8085"
+  dapr.io/api-token-secret: "dapr-api-token"
+  dapr.io/config: "tracing"
+  dapr.io/app-protocol: "http"
 ingress:
  enabled: true
  className: "nginx"
@@ -1,4 +1,11 @@
 replicaCount: 1
+podAnnotations:
+  dapr.io/enabled: "true"
+  dapr.io/app-id: "staging-codex"
+  dapr.io/app-port: "8085"
+  dapr.io/api-token-secret: "dapr-api-token"
+  dapr.io/config: "tracing"
+  dapr.io/app-protocol: "http"
 ingress:
  enabled: true
  className: "nginx"
@@ -31,4 +38,4 @@ volumeMounts:
    readOnly: true
    subPath: appsettings.json
 image:
-  tag: d34652dd-debug
+  tag: 38eeb4cc-debug
@@ -27,8 +27,7 @@ spec:
      - name: HELMFILE_FILE_PATH
        value: dapr.yaml.gotmpl
  - repoURL: https://dapr.github.io/helm-charts
-    # NOTE: DONT BUMP EKMAN TO 1.15 it is broken
-    targetRevision: {{- if eq .Values.dapr.cluster "ekman" }} 1.16.1 {{- else }} 1.16.0 {{- end }}
+    targetRevision: 1.16.9
    chart: dapr
    helm:
      valueFiles:
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "5c4cda2e-debug"
+  tag: "0d279bb9-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -1,7 +1,7 @@
 clusterConfig:
  manifests: https://git.oceanbox.io/platform/manifests.git
  cilium:
-    enabled: false
+    enabled: true
  env: "prod"
  distro: "nixos"
  domain: "ekman.oceanbox.io"
@@ -27,3 +27,5 @@ clusterConfig:
    - 192.168.0.0/16
    - 172.19.255.0/24
    - 100.64.0.0/12
+    # hel1
+    - 37.27.203.38/28
@@ -1,6 +1,6 @@
 image:
  repository: twinproduction/gatus
-  tag: v5.34.0
+  tag: v5.35.0

 # Does envFrom secret named gatus
 secrets: true
@@ -93,6 +93,13 @@ config:
      alerts:
        - type: custom

+    - name: Atlantis Beta TOS
+      <<: *https-endpoint
+      group: "Primary Services"
+      url: https://maps.beta.oceanbox.io/healthz
+      alerts:
+        - type: custom
+
    # NOTE: Ingress is down
    # - name: Sorcerer VTN
    #   <<: *https-endpoint
@@ -115,16 +122,16 @@ config:
      alerts:
        - type: custom

-    - name: Atlantis Beta
+    - name: Atlantis Dev TOS
      <<: *https-endpoint
      group: "Experimental Services"
-      url: https://atlantis.beta.oceanbox.io/healthz
+      url: https://maps.dev.oceanbox.io/healthz
      extra-labels:
        environment: staging
      alerts:
        - type: custom

-    - name: Sorcerer Beta
+    - name: Sorcerer Dev TOS
      <<: *https-endpoint
      group: "Experimental Services"
      url: https://sorcerer.ekman.oceanbox.io/healthz
@@ -133,7 +140,7 @@ config:
      alerts:
        - type: custom

-    - name: Plume Beta
+    - name: Plume Dev TOS
      <<: *https-endpoint
      group: "Experimental Services"
      url: https://plume.ekman.oceanbox.io/healthz
@@ -3,7 +3,7 @@ replicaCount: 1
 image:
  registry: "docker.gitea.com"
  repository: gitea
-  tag: "1.25.4"
+  tag: "1.25.5"

 resources:
  requests:
@@ -49,11 +49,9 @@ spec:
        image: grafana/pdc-agent:latest
        imagePullPolicy: Always
        resources:
-          limits:
-            memory: 1Gi
          requests:
-            cpu: 1
-            memory: 1Gi
+            cpu: 200m
+            memory: 250Mi
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
@@ -1,164 +0,0 @@
-apiVersion: v1
-data:
-  policy: |
-    {
-      // groups are collections of users having a common scope. A user can be in multiple groups
-      // groups cannot be composed of groups
-      "groups": {
-        "group:admin": [
-          "jonas.juselius@oceanbox.io",
-          "Moritz.Jorg@oceanbox.io",
-          "simen.kirkvik@oceanbox.io",
-          "stig.r.jensen@oceanbox.io",
-          "system-tos",
-        ],
-        "group:devops": [
-          "jonas.juselius@oceanbox.io",
-          "Moritz.Jorg@oceanbox.io",
-          "stig.r.jensen@oceanbox.io",
-          "radovan.bast@oceanbox.io",
-          "simen.kirkvik@oceanbox.io",
-          "Ole.Tytlandsvik@tromso.serit.no",
-        ],
-        "group:oceanographer": [
-          "frank.gaardsted@oceanbox.io",
-          "ole.anders.nost@oceanbox.io",
-          "helge.avlesen@oceanbox.io",
-          "isa.rosso@oceanbox.io",
-          "jonathan.lilly@oceanbox.io",
-        ],
-        "group:manager": [
-          "svenn.hanssen@oceanbox.io",
-          "hilde.iversen@oceanbox.io",
-        ],
-        "group:dev": [],
-        "group:intern": [],
-      },
-      // tagOwners in tailscale is an association between a TAG and the people allowed to set this TAG on a server.
-      // This is documented [here](https://tailscale.com/kb/1068/acl-tags#defining-a-tag)
-      // and explained [here](https://tailscale.com/blog/rbac-like-it-was-meant-to-be/)
-      "tagOwners": {
-        "tag:k8s": [ "group:admin" ],
-        "tag:hpc": [ "group:admin" ],
-      },
-      // hosts should be defined using its IP addresses and a subnet mask.
-      // to define a single host, use a /32 mask. You cannot use DNS entries here,
-      // as they're prone to be hijacked by replacing their IP addresses.
-      // see https://github.com/tailscale/tailscale/issues/3800 for more information.
-      "hosts": {
-        "ingress.ekman.tos": "10.255.241.99/32",
-        "ingress.ceph.tos": "10.255.241.10/32",
-        "ingress.ceph.vtn": "172.16.239.50/32",
-        "ingress.adm.ceph.vtn": "172.16.239.51/32",
-        "ingress.oceanbox.tos": "10.255.241.11/32",
-        "manage.ekman.tos": "10.255.241.99/32",
-        "k8s.oceanbox.tos": "10.255.241.200/32",
-        "k8s.ekman.tos": "10.255.241.99/32",
-        "k8s.ceph.tos": "10.255.241.29/32",
-        "printer.office.tos": "10.132.46.108/32",
-        "net.office.tos": "10.132.46.0/24",
-        "net.dc.tos": "10.255.241.0/24",
-        "net.100gbe.tos": "10.255.244.0/24",
-        "net.mgmt.tos": "10.255.240.0/24",
-        "net.dc.vtn": "172.16.239.0/24",
-        "net.mgmt.vtn": "172.16.238.0/24",
-      },
-      "acls": [
-        {
-          "action": "accept",
-          "src": [
-            "group:admin",
-            "group:devops",
-            "group:oceanographer",
-            "group:manager",
-            "group:dev",
-          ],
-          "dst": [
-            "100.64.0.0/24:0",
-            "100.64.0.0/24:22",
-          ]
-        },
-        {
-          "action": "accept",
-          "src": [ "ekman", "net.dc.tos" ],
-          "dst": [
-            "net.dc.vtn:*",
-            "100.64.0.0/24:0",
-            "100.64.0.0/24:22",
-          ]
-        },
-        {
-          "action": "accept",
-          "src": [ "rossby", "net.dc.vtn" ],
-          "dst": [
-            "net.dc.tos:*",
-            "100.64.0.0/24:0",
-            "100.64.0.0/24:22",
-          ]
-        },
-        {
-          "action": "accept",
-          "src": [ "group:admin" ],
-          "dst": [
-             "net.dc.tos:*",
-             "net.mgmt.tos:*",
-             "net.100gbe.tos:*",
-             "net.office.tos:*",
-             "net.dc.vtn:*",
-             "net.mgmt.vtn:*",
-          ]
-        },
-        {
-          "action": "accept",
-          "src": [ "group:devops" ],
-          "dst": [
-             "k8s.oceanbox.tos:6443",
-             "k8s.ekman.tos:4443",
-          ]
-        },
-        {
-          "action": "accept",
-          "src": [
-              "group:admin",
-              "group:devops",
-              "group:oceanographer",
-              "group:manager",
-              "group:dev",
-          ],
-          "dst": [
-             "ingress.oceanbox.tos:443",
-             "ingress.ekman.tos:443",
-             "printer.office.tos:631",
-             "10.255.241.99/32:22",
-             "10.255.241.100/32:22",
-          ]
-        },
-        {
-          "action": "accept",
-          "src": [
-              "group:admin",
-              "group:devops",
-              "group:oceanographer",
-              "group:manager",
-              "group:dev",
-          ],
-          "dst": [
-             "100.64.0.0/24:*",
-             "autogroup:internet:*",
-          ]
-        },
-      ]
-    }
-kind: ConfigMap
-metadata:
-  annotations:
-    argocd.argoproj.io/tracking-id: headscale:/ConfigMap:headscale/headscale-acl
-  labels:
-    app.kubernetes.io/instance: headscale
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: headscale
-    app.kubernetes.io/version: v0.25.0
-    helm.sh/chart: headscale-0.16.0
-  name: headscale-acl
-  namespace: headscale
-
@@ -253,6 +253,8 @@ configMaps:
            { "action": "accept", "src": [ "hilde.iversen@oceanbox.io" ], "dst": [ "hilde.iversen@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "pal.herstad@oceanbox.io" ], "dst": [ "pal.herstad@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "faith.iha@oceanbox.io" ], "dst": [ "faith.iha@oceanbox.io:*" ] },
+            { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
+            { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
            // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
          ]
        }
@@ -264,7 +266,6 @@ configMaps:
           { "name": "maps.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "maps.beta.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
-           { "name": "atlantis.beta.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "codex.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },

@@ -352,6 +353,7 @@ configMaps:
           { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
           { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "mrtz-diadash.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
@@ -1,3 +1,3 @@
-kueue:
+jobset:
  enabled: true
  autosync: false
@@ -0,0 +1,3 @@
+jobset:
+  enabled: false
+  autosync: false
@@ -0,0 +1,44 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: jobset
+  namespace: argocd
+spec:
+  destination:
+    namespace: jobset-system
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: jobset.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+    {{- if .Values.jobset.autosync }}
+    automated:
+      prune: true
+    {{- end }}
+  ignoreDifferences:
+   - group: ""
+     kind: Secret
+     name: jobset-webhook-server-cert
+     namespace: jobset-system
+     jsonPointers:
+       - /data
+{{- end }}
@@ -0,0 +1,4 @@
+prometheus:
+  enable: false
+certManager:
+  enable: false
@@ -8,6 +8,7 @@ kubectl cp -n keycloak oceanbox-realm.json prod-keycloak-0:/tmp/backup/oceanbox-
 kubectl cp -n keycloak oceanbox-users-0.json prod-keycloak-0:/tmp/backup/oceanbox-users-0.json
 kc.sh -Djgroups.bind.port=7801 import --dir /tmp/backup
 ```
+
 ## Theme

-Our keycloak theme is inserted using the image provided [here](https://gitlab.com/oceanbox/keycloak-theme)
+The keycloak theme is maintained at [git.oceanbox.io/platform/keycloak-theme](https://git.oceanbox.io/platform/keycloak-theme) and is deployed via an init container using the `git.oceanbox.io/platform/keycloak-theme` image.
@@ -33,10 +33,8 @@ spec:
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
    {{- if .Values.keycloak.autosync }}
    automated:
      prune: true
-      # selfHeal: false
    {{- end }}
 {{- end }}
@@ -1,26 +1,14 @@
 replicaCount: 2

-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxy: edge
-
 auth:
  adminPassword: en to tre fire
-  adminUser: admin
  existingSecret: ""
  managementPassword: ""
-  managementUser: manager

 postgresql:
  enabled: false

+resourcesPreset: "none"
 resources:
  limits:
    cpu: 750m
@@ -48,37 +36,7 @@ extraVolumes:
  name: theme

 ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
  hostname: auth.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-adminIngress:
-  enabled: false
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hostname: keycloak.adm.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true

 keycloakConfigCli:
  enabled: false
@@ -93,8 +51,8 @@ keycloakConfigCli:

 initContainers: |
  - name: keycloak-theme-provider
-    image: docker.io/juselius/oceanbox-theme:1.2
-    imagePullPolicy: Always
+    image: git.oceanbox.io/platform/keycloak-theme:latest
+    imagePullPolicy: IfNotPresent
    command:
      - sh
    args:
@@ -1,22 +1,7 @@
 replicaCount: 1

-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxy: edge
-
 auth:
  adminPassword: en to tre fire
-  adminUser: admin
-  existingSecret: ""
-  managementPassword: ""
-  managementUser: manager

 postgresql:
  enabled: true
@@ -24,58 +9,5 @@ postgresql:
    postgresPassword: "avatar mustiness economic"
    password: "punctured abstain facility"

-extraVolumeMounts:
- mountPath: /opt/bitnami/keycloak/themes/oceanbox
-  name: theme
-
-extraVolumes:
- emptyDir: {}
-  name: theme
-
 ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
  hostname: auth.srv.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-adminIngress:
-  enabled: false
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hostname: auth.adm.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-initContainers: |
-  - name: keycloak-theme-provider
-    image: docker.io/juselius/oceanbox-theme:1.2
-    imagePullPolicy: Always
-    command:
-      - sh
-    args:
-      - -c
-      - |
-        echo "Copying theme..."
-        cp -R /theme/* /keycloak/themes/oceanbox
-    volumeMounts:
-      - name: theme
-        mountPath: /keycloak/themes/oceanbox
@@ -0,0 +1,29 @@
+# NOTE(mrtz): Hack for working with bitnami legacy registry
+global:
+  security:
+    allowInsecureImages: true
+image:
+    repository: bitnamilegacy/keycloak
+
+production: true
+
+proxyHeaders: xforwarded
+
+auth:
+  adminUser: admin
+  managementUser: manager
+
+ingress:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  enabled: true
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true
@@ -1,51 +1,68 @@
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: ResourceFlavor
 metadata:
- name: compute # Just needs to exist, can be managed with tains/tolerations
+  name: compute # Just needs to exist, can be managed with tains/tolerations
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  nodeLabels:
+    node-role.kubernetes.io/compute: compute
+    topology.kubernetes.io/group: c1 # Only run on C1 for now
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: ClusterQueue
 metadata:
-   name: jobs
+   name: cluster-queue
+   annotations:
+     argocd.argoproj.io/sync-wave: "2"
 spec:
-  cohort: general
  namespaceSelector: {} # Accept workloads from any namespace
-  preemption:
-    withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
+  queueingStrategy: BestEffortFIFO
+  # preemption:
+    # withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
  resourceGroups:
   - coveredResources: ["cpu", "memory"] # Cover both memory and cpu resources
     flavors:
       - name: compute
         resources:
           - name: "cpu"
-             nominalQuota: '4'
+             nominalQuota: '32'
           - name: "memory"
-             nominalQuota: 8Gi
+             nominalQuota: 64Gi
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: LocalQueue
+# metadata:
+#   name: prod-queue
+#   namespace: prod-queue
+# spec:
+#   clusterQueue: cluster-queue
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
-kind: LocalQueue
+apiVersion: v1
+kind: Namespace
 metadata:
-  name: prod-queue
-  namespace: prod-sorcerer
-spec:
-  clusterQueue: jobs
+  name: dev-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: LocalQueue
 metadata:
  name: staging-queue
-  namespace: staging-sorcerer
+  namespace: dev-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
-  clusterQueue: jobs
---
-apiVersion: kueue.x-k8s.io/v1beta1
-kind: WorkloadPriorityClass
-metadata:
-  name: "normal"
-value: 100
---
-apiVersion: kueue.x-k8s.io/v1beta1
-kind: WorkloadPriorityClass
-metadata:
-  name: "high"
-value: 200 # Higher value = higher priority
+  clusterQueue: cluster-queue
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: WorkloadPriorityClass
+# metadata:
+#   name: "normal"
+# value: 100
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: WorkloadPriorityClass
+# metadata:
+#   name: "high"
+# value: 200 # Higher value = higher priority
@@ -1,89 +0,0 @@
-{{- if eq .Values.clusterConfig.cluster "ekman"}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kueueviz-ingress
-  namespace: kueue-system
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
-spec:
-  rules:
-    - host: kueue.dev.tos.obx
-      http:
-        paths:
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /api(/|$)(.*)
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-frontend
-                port:
-                  number: 8080
-  tls:
-    - hosts:
-        - kueue.dev.tos.obx
-      secretName: kueueviz-tls
-{{- end}}
---
-{{- if eq .Values.clusterConfig.cluster "rossby"}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kueueviz-ingress
-  namespace: kueue-system
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-spec:
-  rules:
-    - host: kueue.dev.vtn.obx
-      http:
-        paths:
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /api(/|$)(.*)
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-frontend
-                port:
-                  number: 8080
-  tls:
-    - hosts:
-        - kueue.dev.vtn.obx
-      secretName: kueueviz-tls
-{{- end}}
@@ -5,6 +5,7 @@ metadata:
  name: kueue
  namespace: argocd
  annotations:
+    argocd.argoproj.io/sync-wave: "1"
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
    argocd.argoproj.io/compare-options: ServerSideDiff=true
  finalizers:
@@ -27,7 +28,7 @@ spec:
        value: {{ .Values.kueue.env }}
      - name: HELMFILE_FILE_PATH
        value: kueue.yaml.gotmpl
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+  - repoURL: {{ .Values.clusterConfig.manifests }}
    targetRevision: main
    ref: values
  syncPolicy:
@@ -41,4 +42,3 @@ spec:
      selfHeal: false
    {{- end }}
 {{- end }}
-
@@ -1,9 +0,0 @@
-kueueViz:
-  backend:
-    env:
-      - name: KUEUEVIZ_ALLOWED_ORIGINS
-        value: "https://kueue.dev.tos.obx"
-  frontend:
-    env:
-      - name: REACT_APP_WEBSOCKET_URL
-        value: "wss://kueue.dev.tos.obx"
@@ -1,9 +0,0 @@
-kueueViz:
-  backend:
-    env:
-      - name: KUEUEVIZ_ALLOWED_ORIGINS
-        value: "https://kueue.dev.vtn.obx"
-  frontend:
-    env:
-      - name: REACT_APP_WEBSOCKET_URL
-        value: "wss://kueue.dev.vtn.obx"
@@ -1,21 +1,14 @@
-controllerManager:
-  featureGates:
-    - name: TopologyAwareScheduling
-      enabled: true
-    - name: LocalQueueMetrics
-      enabled: true
-  managerConfig:
-    controllerManagerConfigYaml: |
-      apiVersion: config.kueue.x-k8s.io/v1beta1
-      kind: Configuration
-      integrations:
-        frameworks:
-          - batch/job
-          - jobset.x-k8s.io/jobset
-      internalCertManagement:
-        enable: false
-enableCertManager: false
+managerConfig:
+  controllerManagerConfigYaml: |
+    apiVersion: config.kueue.x-k8s.io/v1beta2
+    kind: Configuration
+    integrations:
+      frameworks:
+        - batch/job
+        - jobset.x-k8s.io/jobset
+    internalCertManagement:
+      enable: false
+enableCertManager: true
 enablePrometheus: true
 metrics:
  prometheusNamespace: prometheus
-enableKueueViz: true
@@ -36,6 +36,13 @@ spec:
      # selfHeal: false
    {{- end }}
  ignoreDifferences:
+  - group: apiextensions.k8s.io
+    kind: CustomResourceDefinition
+    jsonPointers:
+      - /metadata/managedFields
+      - /metadata/generation
+      - /metadata/annotations
+      - /metadata/labels
  - group: batch
    kind: CronJob
    jqPathExpressions:
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "436608af-debug"
+  tag: "d5e61949-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -1,5 +1,5 @@
 {
-    "archmaesterUrl": "https://atlantis.beta.oceanbox.io",
+    "archmaesterUrl": "https://maps.dev.oceanbox.io",
    "appName": "plume",
    "appEnv": "staging",
    "appNamespace": "staging-plume",
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: "git.oceanbox.io/oceanbox/plume/plume"
-  tag: 9d99f7cf-debug
+  tag: v1.6.13
 podAnnotations:
  dapr.io/enabled: "true"
  dapr.io/app-id: "staging-plume"
@@ -1,3 +1,2 @@
 prometheus:
  snitchUrl: "https://nosnch.in/bceb803932"
-
@@ -14,6 +14,7 @@ prometheus:
    - marcusolsson-static-datasource
    - marcusolsson-calendar-panel
    - grafana-clock-panel
+    - redis-datasource
  thanos:
    enabled: true
  coredns:
@@ -36,4 +36,5 @@ prometheus:
  thanos:
    enabled: false
    datasource:
-      enabled: false
+      enabled: false
+  cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
@@ -68,7 +68,7 @@ spec:
    server: 'https://kubernetes.default.svc'
  source:
    repoURL: 'https://prometheus-community.github.io/helm-charts'
-    targetRevision: '14.0.0'
+    targetRevision: '27.0.0'
    chart: prometheus-operator-crds
  project: sys
  syncPolicy:
@@ -485,6 +485,30 @@ prometheus:

  prometheusSpec:
    enableRemoteWriteReceiver: true
+    enableOTLPReceiver: true
+    otlp:
+      promoteResourceAttributes:
+        - service.instance.id
+        - service.name
+        - service.namespace
+        - cloud.availability_zone
+        - cloud.region
+        - container.name
+        - deployment.environment.name
+        - k8s.cluster.name
+        - k8s.container.name
+        - k8s.cronjob.name
+        - k8s.daemonset.name
+        - k8s.deployment.name
+        - k8s.job.name
+        - k8s.namespace.name
+        - k8s.pod.name
+        - k8s.replicaset.name
+        - k8s.statefulset.name
+      translationStrategy: NoUTF8EscapingWithSuffixes
+      keepIdentifyingResourceAttributes: true
+    tsdb:
+      outOfOrderTimeWindow: 30m

    tolerations: []
      # - key: unschedulable
@@ -7,12 +7,20 @@ global:
  security:
    allowInsecureImages: true
 image:
-    repository: bitnamilegacy/redis
+  repository: bitnamilegacy/redis

 architecture: replication

 replica:
  replicaCount: 2
+  resources:
+    limits:
+      ephemeral-storage: 1024Mi
+      memory: 192Mi
+    requests:
+      cpu: 150m
+      ephemeral-storage: 50Mi
+      memory: 128Mi
  # command:
  #   - "/opt/redis-stack/bin/redis-server"
  #   - "--loadmodule"
--- a/Show More
+++ b/Show More