ci(staging): deploy docs 64b20667-debug

bootstrap/keycloak-theme/Dockerfile

@@ -0,0 +1,3 @@
+FROM busybox
+
+COPY keycloak-themes/oceanbox /theme

bootstrap/keycloak-theme/keycloak-themes/oceanbox/login/resources/css/oceanbox.css

@@ -0,0 +1,109 @@
+/* Oceanbox Keycloak Login Theme
+ *
+ * Branding aligned with oceanbox.io:
+ *   Primary teal:    #0bb4aa
+ *   Dark teal:       #37746F
+ *   Deep blue:       #031275
+ *   Background:      #f9fafd
+ *   Text:            #101010
+ */
+
+:root {
+    --pf-v5-global--primary-color--100: #0bb4aa;
+    --pf-v5-global--primary-color--200: #099e95;
+    --pf-v5-global--link--Color: #0bb4aa;
+    --pf-v5-global--link--Color--hover: #031275;
+}
+
+.login-pf body {
+    background: #f9fafd url("../img/oceanbox-bg.png") no-repeat center bottom fixed;
+    background-size: cover;
+    height: 100%;
+}
+
+/* Login container layout */
+.pf-v5-c-login__container {
+    grid-template-columns: 34rem;
+    grid-template-areas: "header"
+                         "main";
+}
+
+/* Logo */
+div.kc-logo-text {
+    background-image: url('../img/oceanbox-logo-text.png');
+    height: 80px;
+    width: 360px;
+    background-repeat: no-repeat;
+    background-size: contain;
+    background-position: center;
+    margin: 0 auto;
+}
+
+div.kc-logo-text span {
+    display: none;
+}
+
+/* Header */
+#kc-header-wrapper {
+    font-size: 29px;
+    text-transform: uppercase;
+    letter-spacing: 3px;
+    line-height: 1.2em;
+    white-space: normal;
+    color: #37746F !important;
+    text-align: center;
+}
+
+/* Login card */
+.pf-v5-c-login__main {
+    border-radius: 8px;
+    box-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
+}
+
+/* Primary button */
+.pf-v5-c-button.pf-m-primary {
+    --pf-v5-c-button--m-primary--BackgroundColor: #0bb4aa;
+    --pf-v5-c-button--m-primary--hover--BackgroundColor: #099e95;
+    --pf-v5-c-button--m-primary--active--BackgroundColor: #37746F;
+    --pf-v5-c-button--m-primary--focus--BackgroundColor: #099e95;
+    border-radius: 4px;
+}
+
+/* Links */
+.pf-v5-c-button.pf-m-link {
+    --pf-v5-c-button--m-link--Color: #0bb4aa;
+    --pf-v5-c-button--m-link--hover--Color: #031275;
+}
+
+a {
+    color: #0bb4aa;
+}
+
+a:hover {
+    color: #031275;
+}
+
+/* Form inputs */
+.pf-v5-c-form-control > input,
+.pf-v5-c-form-control > textarea {
+    border-radius: 4px;
+}
+
+#kc-recovery-codes-list {
+    columns: 2;
+}
+
+#certificate_subjectDN {
+    overflow-wrap: break-word;
+}
+
+hr {
+    margin-top: var(--pf-v5-global--spacer--sm);
+    margin-bottom: var(--pf-v5-global--spacer--md);
+}
+
+@media (min-width: 768px) {
+    div.pf-v5-c-login__main-header {
+        grid-template-columns: 70% 30%;
+    }
+}

bootstrap/keycloak-theme/keycloak-themes/oceanbox/login/theme.properties

@@ -0,0 +1,5 @@
+parent=keycloak.v2
+import=common/keycloak
+
+stylesCommon=vendor/patternfly-v5/patternfly.min.css vendor/patternfly-v5/patternfly-addons.css
+styles=css/styles.css css/oceanbox.css

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.48.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.48.0
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.46.5
+  tag: v1.48.0
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.46.5
+version: v1.48.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.46.5"
+appVersion: "v1.48.0"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.46.5
+  tag: v1.48.0
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/docs/templates/httproute.yaml

@@ -1,46 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- $fullName := include "docs.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "docs.labels" . | nindent 4 }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.httpRoute.rules }}
-    - {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      backendRefs:
-        - name: {{ $fullName }}
-          port: {{ $svcPort }}
-    {{- end }}
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-{{ $fullName }}
-  labels:
-    {{- include "docs.labels" . | nindent 4 }}
-spec:
-  endpointSelector:
-    matchLabels:
-      {{- include "docs.selectorLabels" . | nindent 6 }}
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
-{{- end }}

charts/docs/values.yaml

@@ -46,13 +46,8 @@ service:
   type: ClusterIP
   port: 8080
 ingress:
-  enabled: false
+  enabled: true
   className: nginx
-httpRoute:
-  enabled: false
-  parentRefs: []
-  hostnames: []
-  rules: []
 persistence:
   enabled: false
   size: 1G

charts/makai/templates/httproute.yaml

@@ -1,46 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- $fullName := include "makai.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "makai.labels" . | nindent 4 }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.httpRoute.rules }}
-    - {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      backendRefs:
-        - name: {{ $fullName }}
-          port: {{ $svcPort }}
-    {{- end }}
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-{{ $fullName }}
-  labels:
-    {{- include "makai.labels" . | nindent 4 }}
-spec:
-  endpointSelector:
-    matchLabels:
-      {{- include "makai.selectorLabels" . | nindent 6 }}
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
-{{- end }}

charts/makai/values.yaml

@@ -46,13 +46,8 @@ service:
   type: ClusterIP
   port: 8080
 ingress:
-  enabled: false
+  enabled: true
   className: nginx
-httpRoute:
-  enabled: false
-  parentRefs: []
-  hostnames: []
-  rules: []
 persistence:
   enabled: false
   size: 1G

charts/plume/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: diagrid-dashboard
+  repository: file://../diagrid-dashboard
+  version: 0.1.0
+digest: sha256:4fdb3148a2a6439223d7844a3083da2de324dd47e5cb3ac4a5d9c436e6e2c775
+generated: "2026-02-25T16:15:48.608231856+01:00"

charts/plume/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.6.13
+version: v1.7.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.6.13
+appVersion: v1.7.1
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/plume/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/plume/plume
-  tag: v1.6.13
+  tag: v1.7.1
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -90,6 +90,5 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.48.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.48.0
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.46.5
+  tag: v1.48.0
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.4.10
+  version: 9.4.17
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
   namespace: argocd
   chart: argo/argo-rollouts
-  version: 2.40.6
+  version: 2.40.9
   condition: argo.rollouts.enabled
   values:
   - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 0.47.5
+  version: 1.0.7
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.4
+  version: v1.20.1
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/docs.yaml.gotmpl

@@ -11,7 +11,6 @@ releases:
   condition: docs.enabled
   values:
   - ../values/docs/values/values.yaml
-  - ../values/docs/values/values.yaml.gotmpl
   - ../values/docs/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.4.0
+  version: v1.5.0
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/gitea.yaml.gotmpl

@@ -17,7 +17,6 @@ releases:
   condition: gitea.enabled
   values:
   - ../values/gitea/values/values.yaml
-  - ../values/gitea/values/values.yaml.gotmpl
   - ../values/gitea/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.14.3
+  version: 4.15.1
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/keycloak.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
   namespace: keycloak
   chart: bitnami/keycloak
-  version: 24.9.0
+  version: 25.2.0
   condition: keycloak.enabled
   values:
   - ../values/keycloak/values/values.yaml

helmfile.d/kueue.yaml.gotmpl

@@ -8,7 +8,7 @@ releases:
 - name: kueue
   namespace: kueue-system
   chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.15.0
+  version: 0.16.4
   condition: kueue.enabled
   values:
   - ../values/kueue/values/values.yaml

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 6.53.0
+  version: 6.55.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/makai.yaml.gotmpl

@@ -11,7 +11,6 @@ releases:
   condition: makai.enabled
   values:
   - ../values/makai/values/values.yaml
-  - ../values/makai/values/values.yaml.gotmpl
   - ../values/makai/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.10.4
+  version: 26.3.0
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.55
+  version: 0.2.62
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.146.1
+  version: 0.147.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 82.10.1
+  version: 82.15.1
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/slurm-operator.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
   namespace: slinky
   chart: slurm-operator/slurm-operator
-  version: 1.0.2
+  version: 1.0.3
   condition: slurm_operator.enabled
   values:
   - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl

helmfile.d/slurm.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm
   namespace: slurm
   chart: slurm/slurm
-  version: 1.0.2
+  version: 1.0.3
   condition: slurm.enabled
   values:
   - ../values/slurm/values/slurm.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.7.2
+  version: 7.7.11
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 11.4.0
+  version: 12.0.0
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

helmfile.d/x509-exporter.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: x509-exporter
   namespace: x509-exporter
   chart: x509-exporter/x509-certificate-exporter
-  version: 3.19.1
+  version: 3.20.0
   condition: x509_exporter.enabled
   values:
   - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl

nix/kueuectl.nix

@@ -0,0 +1,19 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "kueuectl";
+  version = "0.16.3";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "kueue";
+    rev = "v${version}";
+    hash = "sha256-JbU+ZoQ+YriaiIbbVCe45OTYycxYRanLhmQAdpE+xQ4=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [ "cmd/kueuectl" ];
+}

npins/sources.json

@@ -1,23 +1,10 @@
 {
   "pins": {
-    "git-hooks": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "cachix",
-        "repo": "git-hooks.nix"
-      },
-      "branch": "master",
-      "submodules": false,
-      "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
-      "url": "https://github.com/cachix/git-hooks.nix/archive/a1ef738813b15cf8ec759bdff5761b027e3e1d23.tar.gz",
-      "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U="
-    },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
-      "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre961788.75690239f08f/nixexprs.tar.xz",
+      "hash": "sha256-p0h/nSeqzIkbn/2uFC4keoIPwmqXGHsX0gkCXM7km00="
     },
     "treefmt-nix": {
       "type": "Git",
@@ -28,9 +15,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "337a4fe074be1042a35086f15481d763b8ddc0e7",
-      "url": "https://github.com/numtide/treefmt-nix/archive/337a4fe074be1042a35086f15481d763b8ddc0e7.tar.gz",
-      "hash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk="
+      "revision": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+      "url": "https://github.com/numtide/treefmt-nix/archive/71b125cd05fbfd78cab3e070b73544abe24c5016.tar.gz",
+      "hash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk="
     }
   },
   "version": 7

shell.nix

@@ -7,6 +7,7 @@ let
     overlays = [ ];
   };
   treefmt = import ./nix/treefmt.nix { };
+  kueuectl = pkgs.callPackage ./nix/kueuectl.nix { };
 in
 pkgs.mkShellNoCC {
   packages = [
@@ -27,6 +28,7 @@ pkgs.mkShellNoCC {
     pkgs.kubectl-rook-ceph
 
     # other tools activate when needed
+    kueuectl
     # pkgs.step-cli
     # pkgs.linkerd
     # pkgs.cmctl
@@ -35,12 +37,15 @@ pkgs.mkShellNoCC {
     # pkgs.renovate
     # pkgs.graphviz
     # pkgs.hubble
-    # pkgs.dapr-cli
+    pkgs.cilium-cli
+    pkgs.dapr-cli
   ];
 
   # Environment variables
   ARGOCD_ENV_CLUSTER_NAME = "ekman";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
+  API_SERVER_IP = "localhost";
+  API_SERVER_PORT = "7445";
 
   # Alternative shells
   passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {

values/argo/manifests/argo.yaml

@@ -28,7 +28,6 @@ spec:
     managedNamespaceMetadata:
       labels:
         component: sys
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/argo/manifests/httproute.yaml

@@ -1,40 +0,0 @@
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argocd-server
-  namespace: argocd
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - argocd.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: argocd-server
-      port: 80
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-argocd
-  namespace: argocd
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-server
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": argocd
-{{- end }}

values/argo/manifests/sys-project.yaml

@@ -94,6 +94,8 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: jobset-system
     server: https://kubernetes.default.svc
+  - namespace: dex
+    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
@@ -140,3 +142,4 @@ spec:
   - https://operator.mariadb.com
   - https://ot-container-kit.github.io/helm-charts
   - https://twin.github.io/helm-charts
+  - https://charts.dexidp.io

values/argo/values/argocd.yaml.gotmpl

@@ -4,16 +4,13 @@ global:
 ## Ref: https://github.com/argoproj/argo-cd
 ##
 configs:
+  {{- if .Values.argocd.anyNamespaces.enabled }}
   params:
-    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
-    server.insecure: "true"
-    {{- end }}
-    {{- if .Values.argocd.anyNamespaces.enabled }}
     applicationsetcontroller.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
     # TODO(kai): anyapp will disable PR review apps. Look into anyapp settings to fix it
     applicationsetcontroller.enable.scm.providers: "false"
     application.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
-    {{- end }}
+  {{- end }}
   cm:
     application.resourceTrackingMethod: annotation+label
     application.instanceLabelKey: app.kubernetes.io/instance
@@ -241,9 +238,6 @@ server:
     serviceMonitor:
       enabled: true
   ingress:
-    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
-    enabled: false
-    {{- else }}
     enabled: true
     ingressClassName: nginx
     annotations:
@@ -260,7 +254,6 @@ server:
       - secretName: argocd-tls
         hosts:
           - "argocd.{{ .Values.clusterConfig.domain }}"
-    {{- end }}
 applicationSet:
   metrics:
     enabled: true

values/atlantis/kustomize/beta/actor-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: beta-atlantis-actor-config
+data:
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.6"
+  XTRACT_QUEUE: "prod-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.7"
+  PLUME_QUEUE: "prod-queue"

values/atlantis/kustomize/beta/deployment_patch.yaml

@@ -7,4 +7,9 @@
   path: /spec/template/spec/containers/0/envFrom/-
   value:
     secretRef:
-      name: prod-atlantis-env
+      name: prod-atlantis-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: beta-atlantis-actor-config

values/atlantis/kustomize/beta/kustomization.yaml

@@ -14,6 +14,7 @@ patches:
 resources:
   - ../base
   - rbac.yaml
+  - actor-config.yaml
   - tracing.yaml
   - bindings.yaml
   - pubsub.yaml

values/atlantis/kustomize/beta/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - beta-atlantis-appsettings
+  - beta-atlantis-actor-config
   resources:
   - configmaps
   verbs:

values/atlantis/kustomize/prod/actor-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: prod-atlantis-actor-config
+data:
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.6"
+  XTRACT_QUEUE: "prod-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.7"
+  PLUME_QUEUE: "prod-queue"

values/atlantis/kustomize/prod/deployment_patch.yaml

@@ -7,4 +7,9 @@
   path: /spec/template/spec/containers/0/envFrom/-
   value:
     secretRef:
-      name: prod-atlantis-env
+      name: prod-atlantis-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: prod-atlantis-actor-config

values/atlantis/kustomize/prod/kustomization.yaml

@@ -13,6 +13,7 @@ patches:
 resources:
   - ../base
   - secrets.yaml
+  - actor-config.yaml
   - rbac.yaml
   - tracing.yaml
   - bindings.yaml

values/atlantis/kustomize/prod/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - prod-atlantis-appsettings
+  - prod-atlantis-actor-config
   resources:
   - configmaps
   verbs:

values/atlantis/kustomize/staging/actor-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: staging-atlantis-actor-config
+data:
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.6"
+  XTRACT_QUEUE: "dev-queue"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.7"
+  PLUME_QUEUE: "dev-queue"

values/atlantis/kustomize/staging/deployment_patch.yaml

@@ -7,4 +7,9 @@
   path: /spec/template/spec/containers/0/envFrom/-
   value:
     secretRef:
-      name: staging-atlantis-env
+      name: staging-atlantis-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: staging-atlantis-actor-config

values/atlantis/kustomize/staging/kustomization.yaml

@@ -14,6 +14,7 @@ resources:
   - ../base
   - rbac.yaml
   - secrets.yaml
+  - actor-config.yaml
   - tracing.yaml
   - bindings.yaml
   - pubsub.yaml
@@ -21,4 +22,4 @@ resources:
   - subscriptions.yaml
   - configurations.yaml
   - secretstore.yaml
-  - keyvault.yaml
+  - keyvault.yaml

values/atlantis/kustomize/staging/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - staging-atlantis-appsettings
+  - staging-atlantis-actor-config
   resources:
   - configmaps
   verbs:

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: 23006866-debug
+  tag: 74ed3e11-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/cilium/cilium-manifests/gateway.yaml

@@ -13,7 +13,7 @@ spec:
     annotations:
       load-balancer.hetzner.cloud/location: hel1
       load-balancer.hetzner.cloud/type: lb11
-      load-balancer.hetzner.cloud/name: load-balancer-1
+      load-balancer.hetzner.cloud/name: load-balancer-2
       load-balancer.hetzner.cloud/use-private-ip: "true"
       load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
       load-balancer.hetzner.cloud/http-redirect-https: "false"
@@ -42,36 +42,6 @@ spec:
           selector:
             matchLabels:
               shared-gateway-access: "true"
-    - name: https-hel1
-      protocol: HTTPS
-      port: 443
-      hostname: "*.hel1.oceanbox.io"
-      tls:
-        certificateRefs:
-          - group: ''
-            kind: Secret
-            name: wildcard-hel1-oceanbox-io
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
-    - name: https-internal
-      protocol: HTTPS
-      port: 443
-      hostname: "*.adm.hel1.obx"
-      tls:
-        certificateRefs:
-          - group: ''
-            kind: Secret
-            name: wildcard-adm-hel1-obx
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
     - name: ssh
       protocol: TCP
       port: 22
@@ -95,28 +65,4 @@ spec:
   issuerRef:
     name: letsencrypt-prod-dns01
     kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-hel1-oceanbox-io
-spec:
-  secretName: wildcard-hel1-oceanbox-io
-  dnsNames:
-    - "*.hel1.oceanbox.io"
-  issuerRef:
-    name: letsencrypt-prod-dns01
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-adm-hel1-obx
-spec:
-  secretName: wildcard-adm-hel1-obx
-  dnsNames:
-    - "*.adm.hel1.obx"
-  issuerRef:
-    name: ca-issuer
-    kind: ClusterIssuer
 {{- end}}

values/cilium/env-ekman.yaml.gotmpl

@@ -1,8 +1,11 @@
 cilium:
   enabled: true
-  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
-  # keys so encrypted traffic is unreadable by them.
-  # TODO: re-enable after migration
+  clustermesh:
+    enabled: false
+    clusterId: 2
+    # NodePort until L2LB is available (kubeproxyless)
+    apiserverServiceType: NodePort
+  # TODO: WireGuard blocks all traffic on ekman -- disable until root cause is found.
   encryption:
     enabled: false
   envoy:

values/cilium/env-oceanbox.yaml.gotmpl

@@ -1,5 +1,8 @@
 cilium:
   enabled: true
+  clustermesh:
+    enabled: false
+    clusterId: 1
   nodePort:
     enabled: true
   l2announcement:

values/cilium/env.yaml.gotmpl

@@ -30,4 +30,8 @@ cilium:
   loadbalancerPool:
     enabled: false
     cidr: []
+  clustermesh:
+    enabled: false
+    clusterId: 0
+    apiserverServiceType: LoadBalancer
   cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}

values/cilium/values/cilium.yaml.gotmpl

@@ -1,3 +1,16 @@
+cluster:
+  name: {{ .Values.cilium.cluster }}
+  id: {{ .Values.cilium.clustermesh.clusterId }}
+{{- if .Values.cilium.clustermesh.enabled }}
+clustermesh:
+  useAPIServer: true
+  apiserver:
+    service:
+      type: {{ .Values.cilium.clustermesh.apiserverServiceType }}
+    tls:
+      auto:
+        method: helm
+{{- end }}
 authentication:
   mutual:
     spire:
@@ -90,7 +103,7 @@ operator:
   prometheus:
     enabled: true
     port: 12301
-    serviceMointor:
+    serviceMonitor:
       enabled: true
       port: 12302
   rollOutPods: true

values/codex/values/values-staging.yaml

@@ -38,4 +38,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: 38eeb4cc-debug
+  tag: 74ed3e11-debug

values/docs/manifests/docs.yaml

@@ -28,9 +28,6 @@ spec:
       - name: HELMFILE_FILE_PATH
         value: docs.yaml.gotmpl
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/docs/manifests/gateway-routes.yaml

@@ -1 +0,0 @@
-{{- /* HTTPRoute and CiliumNetworkPolicy are managed by the docs chart template */ -}}

values/docs/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "e9fd3fc6-debug"
+  tag: "64b20667-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/docs/values/values.yaml.gotmpl

@@ -1,46 +0,0 @@
-replicaCount: 1
-image:
-  tag: "e9fd3fc6-debug"
-env:
-  - name: APP_VERSION
-    value: "0.0.0"
-  - name: LOG_LEVEL
-    value: "1"
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-ingress:
-  enabled: false
-  className: "nginx"
-httpRoute:
-  enabled: true
-  parentRefs:
-    - name: shared-gateway
-      namespace: kube-system
-      sectionName: https
-  hostnames:
-    - docs.oceanbox.io
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/"
-{{- else }}
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: docs.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - docs.oceanbox.io
-      secretName: docs-tls
-{{- end }}

values/drupal/manifests/ingress.yaml

@@ -1,38 +1,32 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12
+  labels:
+    app.kubernetes.io/component: drupal
   name: drupal
   namespace: fornix
 spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-hel1
-  hostnames:
-  - drupal.hel1.oceanbox.io
+  ingressClassName: nginx
   rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: drupal
-      port: 80
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-drupal
-  namespace: fornix
-spec:
-  endpointSelector:
-    matchLabels:
-      app: drupal
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": fornix
+    - host: drupal.hel1.oceanbox.io
+      http:
+        paths:
+          - backend:
+              service:
+                name: drupal
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - drupal.hel1.oceanbox.io
+      secretName: drupal-tls

values/env-hel1.yaml

@@ -20,8 +20,6 @@ clusterConfig:
     patterns: []
     cidr: []
   nodes: []
-  gatewayAPI:
-    enabled: true
   ingress_whitelist:
     - 10.0.0.0/8
     - 172.16.0.0/12

values/env.yaml

@@ -20,8 +20,6 @@ clusterConfig:
     - 192.168.0.0/16
     - 172.19.255.0/24
     - 100.64.0.0/12 # tailnet
-  gatewayAPI:
-    enabled: false
   ingress_hostnetwork: false
   ingress_hostport: false
   ingress_nodeport: true

values/fornix/manifests/fornix.yaml

@@ -31,9 +31,6 @@ spec:
     targetRevision: main
     ref: values
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/fornix/manifests/gateway-routes.yaml

@@ -1,38 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: fornix
-  namespace: fornix
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-hel1
-  hostnames:
-  - fornix.hel1.oceanbox.io
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: fornix
-      port: 8085
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-fornix
-  namespace: fornix
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: fornix
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": fornix

values/fornix/values/values.yaml

@@ -3,7 +3,7 @@ drupalUrl: http://drupal
 
 replicaCount: 1
 ingress:
-  enabled: false
+  enabled: true
   className: "nginx"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production

values/gatus/manifests/gatus.yaml

@@ -26,7 +26,6 @@ spec:
     managedNamespaceMetadata:
       labels:
         component: sys
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/gatus/manifests/ingress.yaml

@@ -1,48 +1,8 @@
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: gatus
-  namespace: uptime
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - uptime.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: gatus
-      port: 80
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-gatus
-  namespace: uptime
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gatus
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": uptime
-{{- else }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
+    cert-manager.io/cluster-issuer: ca-issuer
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, x-gatus-cache
     nginx.ingress.kubernetes.io/enable-cors: "true"
@@ -55,7 +15,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: uptime.{{ .Values.clusterConfig.domain }}
+    - host: uptime.adm.hel1.obx
       http:
         paths:
           - backend:
@@ -67,6 +27,5 @@ spec:
             pathType: ImplementationSpecific
   tls:
     - hosts:
-        - uptime.{{ .Values.clusterConfig.domain }}
+        - uptime.adm.hel1.obx
       secretName: gatus-tls
-{{- end }}

values/gatus/values/values.yaml

@@ -139,12 +139,3 @@ config:
         environment: staging
       alerts:
         - type: custom
-
-    - name: Plume Dev TOS
-      <<: *https-endpoint
-      group: "Experimental Services"
-      url: https://plume.ekman.oceanbox.io/healthz
-      extra-labels:
-        environment: staging
-      alerts:
-        - type: custom

values/gitea/manifests/gateway-routes.yaml

@@ -14,36 +14,11 @@ spec:
     - path:
         type: PathPrefix
         value: "/"
-    timeouts:
-      request: 600s
-      backendRequest: 600s
     backendRefs:
     - name: gitea-http
       port: 3000
 
 ---
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-gitea
-  namespace: gitea
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gitea
-  ingress:
-  - fromCIDRSet:
-    - cidr: 10.0.0.0/8
-    - cidr: 172.16.0.0/12
-    - cidr: 192.168.0.0/16
-    - cidr: 172.19.255.0/24
-    - cidr: 100.64.0.0/12
-    - cidr: 185.125.160.4/32
-    - cidr: 37.27.203.38/32
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": gitea
----
 apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: TCPRoute
 metadata:

values/gitea/values/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 image:
   registry: "docker.gitea.com"
   repository: gitea
-  tag: "1.25.4"
+  tag: "1.25.5"
 
 resources:
   requests:

values/gitea/values/values.yaml.gotmpl

@@ -1,8 +0,0 @@
-{{- /* Gateway API: disable ingress when cilium gateway is enabled (HTTPRoute is in manifests/gateway-routes.yaml) */ -}}
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-ingress:
-  enabled: false
-{{- else }}
-ingress:
-  enabled: true
-{{- end }}

values/headscale/values/values.yaml

@@ -255,6 +255,7 @@ configMaps:
             { "action": "accept", "src": [ "faith.iha@oceanbox.io" ], "dst": [ "faith.iha@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
+            { "action": "accept", "src": [ "erlend.mundal@oceanbox.io" ], "dst": [ "erlend.mundal@oceanbox.io:*" ] },
             // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
           ]
         }
@@ -353,7 +354,7 @@ configMaps:
            { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
            { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-diadash.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "mrtz-diadash.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },

values/jobset/manifests/jobset.yaml

@@ -38,7 +38,7 @@ spec:
    - group: ""
      kind: Secret
      name: jobset-webhook-server-cert
-     namespace: default
+     namespace: jobset-system
      jsonPointers:
        - /data
 {{- end }}

values/keycloak/README.md

@@ -8,6 +8,7 @@ kubectl cp -n keycloak oceanbox-realm.json prod-keycloak-0:/tmp/backup/oceanbox-
 kubectl cp -n keycloak oceanbox-users-0.json prod-keycloak-0:/tmp/backup/oceanbox-users-0.json
 kc.sh -Djgroups.bind.port=7801 import --dir /tmp/backup
 ```
+
 ## Theme
 
-Our keycloak theme is inserted using the image provided [here](https://gitlab.com/oceanbox/keycloak-theme)
+The keycloak theme is maintained at [git.oceanbox.io/platform/keycloak-theme](https://git.oceanbox.io/platform/keycloak-theme) and is deployed via an init container using the `git.oceanbox.io/platform/keycloak-theme` image.

values/keycloak/manifests/keycloak.yaml

@@ -33,10 +33,8 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
     {{- if .Values.keycloak.autosync }}
     automated:
       prune: true
-      # selfHeal: false
     {{- end }}
 {{- end }}

values/keycloak/values/values-prod.yaml

@@ -1,26 +1,14 @@
 replicaCount: 2
 
-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxy: edge
-
 auth:
   adminPassword: en to tre fire
-  adminUser: admin
   existingSecret: ""
   managementPassword: ""
-  managementUser: manager
 
 postgresql:
   enabled: false
 
+resourcesPreset: "none"
 resources:
   limits:
     cpu: 750m
@@ -48,37 +36,7 @@ extraVolumes:
   name: theme
 
 ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
   hostname: auth.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-adminIngress:
-  enabled: false
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hostname: keycloak.adm.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
 
 keycloakConfigCli:
   enabled: false
@@ -93,8 +51,8 @@ keycloakConfigCli:
 
 initContainers: |
   - name: keycloak-theme-provider
-    image: docker.io/juselius/oceanbox-theme:1.2
-    imagePullPolicy: Always
+    image: git.oceanbox.io/platform/keycloak-theme:latest
+    imagePullPolicy: IfNotPresent
     command:
       - sh
     args:

values/keycloak/values/values-staging.yaml

@@ -1,22 +1,7 @@
 replicaCount: 1
 
-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxy: edge
-
 auth:
   adminPassword: en to tre fire
-  adminUser: admin
-  existingSecret: ""
-  managementPassword: ""
-  managementUser: manager
 
 postgresql:
   enabled: true
@@ -24,58 +9,5 @@ postgresql:
     postgresPassword: "avatar mustiness economic"
     password: "punctured abstain facility"
 
-extraVolumeMounts:
-- mountPath: /opt/bitnami/keycloak/themes/oceanbox
-  name: theme
-
-extraVolumes:
-- emptyDir: {}
-  name: theme
-
 ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
   hostname: auth.srv.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-adminIngress:
-  enabled: false
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hostname: auth.adm.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-initContainers: |
-  - name: keycloak-theme-provider
-    image: docker.io/juselius/oceanbox-theme:1.2
-    imagePullPolicy: Always
-    command:
-      - sh
-    args:
-      - -c
-      - |
-        echo "Copying theme..."
-        cp -R /theme/* /keycloak/themes/oceanbox
-    volumeMounts:
-      - name: theme
-        mountPath: /keycloak/themes/oceanbox

values/keycloak/values/values.yaml

@@ -0,0 +1,29 @@
+# NOTE(mrtz): Hack for working with bitnami legacy registry
+global:
+  security:
+    allowInsecureImages: true
+image:
+    repository: bitnamilegacy/keycloak
+
+production: true
+
+proxyHeaders: xforwarded
+
+auth:
+  adminUser: admin
+  managementUser: manager
+
+ingress:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  enabled: true
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true

values/kueue/env-rossby.yaml.gotmpl

@@ -1,3 +0,0 @@
-kueue:
-  enabled: true
-  autosync: false

values/kueue/manifests/clusterQueue.yaml

@@ -1,51 +1,85 @@
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: ResourceFlavor
 metadata:
- name: compute # Just needs to exist, can be managed with tains/tolerations
+  name: compute # Just needs to exist, can be managed with tains/tolerations
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  nodeLabels:
+    node-role.kubernetes.io/compute: compute
+    topology.kubernetes.io/group: c1 # Only run on C1 for now
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: ClusterQueue
 metadata:
-   name: jobs
+   name: cluster-queue
+   annotations:
+     argocd.argoproj.io/sync-wave: "2"
 spec:
-  cohort: general
   namespaceSelector: {} # Accept workloads from any namespace
-  preemption:
-    withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
+  queueingStrategy: BestEffortFIFO
+  # preemption:
+    # withinClusterQueue: "LowerPriority" # Allow higher priority to preempt lower
   resourceGroups:
    - coveredResources: ["cpu", "memory"] # Cover both memory and cpu resources
      flavors:
        - name: compute
          resources:
            - name: "cpu"
-             nominalQuota: '4'
+             nominalQuota: '32'
            - name: "memory"
-             nominalQuota: 8Gi
+             nominalQuota: 64Gi
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: LocalQueue
+# metadata:
+#   name: prod-queue
+#   namespace: prod-queue
+# spec:
+#   clusterQueue: cluster-queue
 ---
-apiVersion: kueue.x-k8s.io/v1beta1
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: LocalQueue
+metadata:
+  name: dev-queue
+  namespace: dev-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  clusterQueue: cluster-queue
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prod-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+---
+apiVersion: kueue.x-k8s.io/v1beta2
 kind: LocalQueue
 metadata:
   name: prod-queue
-  namespace: prod-sorcerer
+  namespace: prod-queue
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
-  clusterQueue: jobs
----
-apiVersion: kueue.x-k8s.io/v1beta1
-kind: LocalQueue
-metadata:
-  name: staging-queue
-  namespace: staging-sorcerer
-spec:
-  clusterQueue: jobs
----
-apiVersion: kueue.x-k8s.io/v1beta1
-kind: WorkloadPriorityClass
-metadata:
-  name: "normal"
-value: 100
----
-apiVersion: kueue.x-k8s.io/v1beta1
-kind: WorkloadPriorityClass
-metadata:
-  name: "high"
-value: 200 # Higher value = higher priority
+  clusterQueue: cluster-queue
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: WorkloadPriorityClass
+# metadata:
+#   name: "normal"
+# value: 100
+# ---
+# apiVersion: kueue.x-k8s.io/v1beta2
+# kind: WorkloadPriorityClass
+# metadata:
+#   name: "high"
+# value: 200 # Higher value = higher priority

values/kueue/manifests/ing.yaml

@@ -1,89 +0,0 @@
-{{- if eq .Values.clusterConfig.cluster "ekman"}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kueueviz-ingress
-  namespace: kueue-system
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
-spec:
-  rules:
-    - host: kueue.dev.tos.obx
-      http:
-        paths:
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /api(/|$)(.*)
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-frontend
-                port:
-                  number: 8080
-  tls:
-    - hosts:
-        - kueue.dev.tos.obx
-      secretName: kueueviz-tls
-{{- end}}
----
-{{- if eq .Values.clusterConfig.cluster "rossby"}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kueueviz-ingress
-  namespace: kueue-system
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/websocket-services: kueue-kueueviz-backend
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-spec:
-  rules:
-    - host: kueue.dev.vtn.obx
-      http:
-        paths:
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /api(/|$)(.*)
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-backend
-                port:
-                  number: 8080
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: kueue-kueueviz-frontend
-                port:
-                  number: 8080
-  tls:
-    - hosts:
-        - kueue.dev.vtn.obx
-      secretName: kueueviz-tls
-{{- end}}

values/kueue/manifests/kueue.yaml

@@ -5,6 +5,7 @@ metadata:
   name: kueue
   namespace: argocd
   annotations:
+    argocd.argoproj.io/sync-wave: "1"
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/compare-options: ServerSideDiff=true
   finalizers:
@@ -27,7 +28,7 @@ spec:
         value: {{ .Values.kueue.env }}
       - name: HELMFILE_FILE_PATH
         value: kueue.yaml.gotmpl
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+  - repoURL: {{ .Values.clusterConfig.manifests }}
     targetRevision: main
     ref: values
   syncPolicy:
@@ -41,4 +42,3 @@ spec:
       selfHeal: false
     {{- end }}
 {{- end }}
-

values/kueue/manifests/sorcerer-queue-access.yaml

@@ -0,0 +1,117 @@
+# Cross-namespace RBAC: allow sorcerer ServiceAccounts to manage JobSets in dev-queue
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: beta-sorcerer-prod-queue
+  namespace: prod-queue
+rules:
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: beta-sorcerer-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: beta-sorcerer-prod-queue
+subjects:
+- kind: ServiceAccount
+  name: beta-sorcerer
+  namespace: beta-sorcerer
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: prod-sorcerer-prod-queue
+  namespace: prod-queue
+rules:
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prod-sorcerer-prod-queue
+  namespace: prod-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prod-sorcerer-prod-queue
+subjects:
+- kind: ServiceAccount
+  name: prod-sorcerer
+  namespace: prod-sorcerer
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: staging-sorcerer-dev-queue
+  namespace: dev-queue
+rules:
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: staging-sorcerer-dev-queue
+  namespace: dev-queue
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: staging-sorcerer-dev-queue
+subjects:
+- kind: ServiceAccount
+  name: staging-sorcerer
+  namespace: staging-sorcerer

values/kueue/values/values-ekman.yaml

@@ -1,9 +0,0 @@
-kueueViz:
-  backend:
-    env:
-      - name: KUEUEVIZ_ALLOWED_ORIGINS
-        value: "https://kueue.dev.tos.obx"
-  frontend:
-    env:
-      - name: REACT_APP_WEBSOCKET_URL
-        value: "wss://kueue.dev.tos.obx"

values/kueue/values/values-rossby.yaml

@@ -1,9 +0,0 @@
-kueueViz:
-  backend:
-    env:
-      - name: KUEUEVIZ_ALLOWED_ORIGINS
-        value: "https://kueue.dev.vtn.obx"
-  frontend:
-    env:
-      - name: REACT_APP_WEBSOCKET_URL
-        value: "wss://kueue.dev.vtn.obx"

values/kueue/values/values.yaml

@@ -1,21 +1,14 @@
-controllerManager:
-  featureGates:
-    - name: TopologyAwareScheduling
-      enabled: true
-    - name: LocalQueueMetrics
-      enabled: true
-  managerConfig:
-    controllerManagerConfigYaml: |
-      apiVersion: config.kueue.x-k8s.io/v1beta1
-      kind: Configuration
-      integrations:
-        frameworks:
-          - batch/job
-          - jobset.x-k8s.io/jobset
-      internalCertManagement:
-        enable: false
-enableCertManager: false
+managerConfig:
+  controllerManagerConfigYaml: |
+    apiVersion: config.kueue.x-k8s.io/v1beta2
+    kind: Configuration
+    integrations:
+      frameworks:
+        - batch/job
+        - jobset.x-k8s.io/jobset
+    internalCertManagement:
+      enable: false
+enableCertManager: true
 enablePrometheus: true
 metrics:
   prometheusNamespace: prometheus
-enableKueueViz: true

values/makai/manifests/gateway-routes.yaml

@@ -1 +0,0 @@
-{{- /* HTTPRoute and CiliumNetworkPolicy are managed by the makai chart template */ -}}

values/makai/manifests/makai.yaml

@@ -28,9 +28,6 @@ spec:
       - name: HELMFILE_FILE_PATH
         value: makai.yaml.gotmpl
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "d5e61949-debug"
+  tag: "da02dd2c-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/makai/values/values.yaml.gotmpl

@@ -1,46 +0,0 @@
-replicaCount: 1
-image:
-  tag: "d5e61949-debug"
-env:
-  - name: APP_VERSION
-    value: "0.0.0"
-  - name: LOG_LEVEL
-    value: "1"
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-ingress:
-  enabled: false
-  className: "nginx"
-httpRoute:
-  enabled: true
-  parentRefs:
-    - name: shared-gateway
-      namespace: kube-system
-      sectionName: https
-  hostnames:
-    - makai.oceanbox.io
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/"
-{{- else }}
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: makai.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - makai.oceanbox.io
-      secretName: makai-tls
-{{- end }}

values/plume/values/values-staging.yaml

@@ -1,7 +1,7 @@
-replicaCount: 1
+replicaCount: 0
 image:
   repository: "git.oceanbox.io/oceanbox/plume/plume"
-  tag: v1.6.13
+  tag: 0095aa5a-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-plume"

values/prometheus/manifests/httproutes.yaml

@@ -1,118 +0,0 @@
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: prometheus
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - grafana.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: prometheus-grafana
-      port: 80
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: alertmanager
-  namespace: prometheus
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - alertmanager.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: prometheus-kube-prometheus-alertmanager
-      port: 9093
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prometheus
-  namespace: prometheus
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - prometheus.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: prometheus-kube-prometheus-prometheus
-      port: 9090
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-grafana
-  namespace: prometheus
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: grafana
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": prometheus
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-alertmanager
-  namespace: prometheus
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: alertmanager
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": prometheus
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-prometheus
-  namespace: prometheus
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": prometheus
-{{- end }}