Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

.envrc

@@ -1,16 +1,13 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
-watch_file npins/sources.json
+watch_file nix/sources.json
+watch_file nix/checks.nix
 
 # Load .env file if it exists
 dotenv_if_exists
 
+# Set npins dir
+export NPINS_DIRECTORY="nix"
+
 # Activate development shell
-if type lorri &>/dev/null; then
+use nix
-    echo "direnv: using lorri from PATH ($(type -p lorri))"
-    eval "$(lorri direnv)"
-else
-    # fall back to using direnv's builtin nix support
-    # to prevent bootstrapping problems.
-    use nix
-fi

bootstrap/helmfile-cmp/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/helmfile/helmfile:v1.3.1
+FROM ghcr.io/helmfile/helmfile:v1.1.9
 
 RUN mkdir -p /home/argocd/cmp-server/config/
 COPY plugin.yaml /home/argocd/cmp-server/config/

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.42.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  repository: registry.gitlab.com/oceanbox/poseidon/atlantis
-  tag: v1.46.5
+  tag: v1.42.2
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.46.5
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.46.5"
+appVersion: "v1.42.2"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.46.5
+  tag: v1.42.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/diagrid-dashboard/templates/statestore.yaml

@@ -8,7 +8,6 @@ data:
     kind: Component
     metadata:
       name: statestore
-      namespace: {{ .Values.statestore.namespace | default "default" }}
     scopes:
       - {{ .Values.statestore.scope }}
     spec:
@@ -18,10 +17,10 @@ data:
         - name: redisUsername
           value: default
         - name: redisPassword
-          value: {{ .Values.statestore.password | default "secret" }}
+          value: secret
         - name: actorStateStore
           value: "true"
         - name: redisDB
-          value: "{{ .Values.statestore.redisDB | default "0" }}"
+          value: "1"
       type: state.redis
       version: v1

charts/diagrid-dashboard/values.yaml

@@ -5,9 +5,6 @@
 statestore:
   scope: my-scope
   redis: my-redis
-  namespace: default
-  password: secret
-  redisDB: "0"
 
 # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
 replicaCount: 1

charts/docs/templates/deployment.yaml

@@ -42,11 +42,11 @@ spec:
               value: "3"
           livenessProbe:
             httpGet:
-              path: /healthz
+              path: /
               port: http
           readinessProbe:
             httpGet:
-              path: /healthz
+              path: /
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

charts/docs/templates/httproute.yaml

@@ -1,46 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- $fullName := include "docs.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "docs.labels" . | nindent 4 }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.httpRoute.rules }}
-    - {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      backendRefs:
-        - name: {{ $fullName }}
-          port: {{ $svcPort }}
-    {{- end }}
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-{{ $fullName }}
-  labels:
-    {{- include "docs.labels" . | nindent 4 }}
-spec:
-  endpointSelector:
-    matchLabels:
-      {{- include "docs.selectorLabels" . | nindent 6 }}
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
-{{- end }}

charts/docs/values.yaml

@@ -21,8 +21,8 @@ env:
     valueFrom:
       fieldRef:
         fieldPath: metadata.namespace
-# imagePullSecrets:
+imagePullSecrets:
-  # - name: gitea-pull-secret
+  - name: gitea-pull-secret
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
@@ -46,13 +46,8 @@ service:
   type: ClusterIP
   port: 8080
 ingress:
-  enabled: false
+  enabled: true
   className: nginx
-httpRoute:
-  enabled: false
-  parentRefs: []
-  hostnames: []
-  rules: []
 persistence:
   enabled: false
   size: 1G

charts/makai/templates/httproute.yaml

@@ -1,46 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- $fullName := include "makai.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "makai.labels" . | nindent 4 }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.httpRoute.rules }}
-    - {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      backendRefs:
-        - name: {{ $fullName }}
-          port: {{ $svcPort }}
-    {{- end }}
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-{{ $fullName }}
-  labels:
-    {{- include "makai.labels" . | nindent 4 }}
-spec:
-  endpointSelector:
-    matchLabels:
-      {{- include "makai.selectorLabels" . | nindent 6 }}
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": {{ .Release.Namespace }}
-{{- end }}

charts/makai/values.yaml

@@ -46,13 +46,8 @@ service:
   type: ClusterIP
   port: 8080
 ingress:
-  enabled: false
+  enabled: true
   className: nginx
-httpRoute:
-  enabled: false
-  parentRefs: []
-  hostnames: []
-  rules: []
 persistence:
   enabled: false
   size: 1G

charts/plume/Chart.yaml

@@ -8,8 +8,3 @@ version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
 appVersion: v1.6.13
-dependencies:
-  - name: diagrid-dashboard
-    version: "0.1.0"
-    repository: "file://../diagrid-dashboard"
-    condition: diagrid-dashboard.enabled

charts/plume/values.yaml

@@ -90,6 +90,3 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
-diagrid-dashboard:
-  enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.46.5
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.46.5
+appVersion: v1.42.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -4,8 +4,8 @@
 
 replicaCount: 1
 image:
-  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
+  repository: registry.gitlab.com/oceanbox/poseidon/sorcerer
-  tag: v1.46.5
+  tag: v1.42.2
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.4.10
+  version: 7.9.1
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
   namespace: argocd
   chart: argo/argo-rollouts
-  version: 2.40.6
+  version: 2.40.5
   condition: argo.rollouts.enabled
   values:
   - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 0.47.5
+  version: 0.45.27
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests
@@ -66,3 +66,4 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/argo/manifests
     - _argo
+

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.4
+  version: v1.19.3
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/cilium.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
 - name: cilium
   namespace: kube-system
   chart: cilium/cilium
-  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.19.1{{ else if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "ekman" }}1.19.1{{ else }}1.16.19{{ end }}
+  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.18.6{{ else }}1.16.19{{ end }}
   condition: cilium.enabled
   values:
   - ../values/cilium/values/cilium.yaml.gotmpl

helmfile.d/docs.yaml.gotmpl

@@ -11,7 +11,6 @@ releases:
   condition: docs.enabled
   values:
   - ../values/docs/values/values.yaml
-  - ../values/docs/values/values.yaml.gotmpl
   - ../values/docs/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/gatus.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: gatus
   namespace: uptime
   chart: gatus/gatus
-  version: 1.5.0
+  version: 1.4.5
   condition: gatus.enabled
   values:
   - ../values/gatus/values/values.yaml

helmfile.d/gitea.yaml.gotmpl

@@ -17,7 +17,6 @@ releases:
   condition: gitea.enabled
   values:
   - ../values/gitea/values/values.yaml
-  - ../values/gitea/values/values.yaml.gotmpl
   - ../values/gitea/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/jobset.yaml.gotmpl

@@ -1,41 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
-- name: jobset
-  oci: true
-  url: registry.k8s.io/jobset/charts
-
-releases:
-- name: jobset
-  namespace: jobset-system
-  chart: jobset/jobset
-  version: 0.11.1
-  condition: jobset.enabled
-  values:
-  - ../values/jobset/values/jobset.yaml.gotmpl
-  - ../values/jobset/values/jobset-{{ .Environment.Name }}.yaml.gotmpl
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/jobset/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: jobset-system
-  chart: manifests
-  condition: jobset.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/jobset/env.yaml.gotmpl
-  - ../values/jobset/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/jobset/manifests
-    - manifests

helmfile.d/keycloak.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
   namespace: keycloak
   chart: bitnami/keycloak
-  version: 24.9.0
+  version: 24.0.2
   condition: keycloak.enabled
   values:
   - ../values/keycloak/values/values.yaml

helmfile.d/kyverno.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: kyverno
   namespace: kyverno
   chart: kyverno/kyverno
-  version: 3.7.1
+  version: 3.6.1
   condition: kyverno.enabled
   values:
   - ../values/kyverno/values/kyverno.yaml.gotmpl

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 6.53.0
+  version: 6.42.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/makai.yaml.gotmpl

@@ -11,7 +11,6 @@ releases:
   condition: makai.enabled
   values:
   - ../values/makai/values/values.yaml
-  - ../values/makai/values/values.yaml.gotmpl
   - ../values/makai/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.55
+  version: 0.2.54
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.146.1
+  version: 0.145.0
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 82.10.1
+  version: 72.7.0
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/slurm-operator.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
   namespace: slinky
   chart: slurm-operator/slurm-operator
-  version: 1.0.2
+  version: 0.4.1
   condition: slurm_operator.enabled
   values:
   - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl

helmfile.d/slurm.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: slurm
   namespace: slurm
   chart: slurm/slurm
-  version: 1.0.2
+  version: 0.4.1
   condition: slurm.enabled
   values:
   - ../values/slurm/values/slurm.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.7.2
+  version: 6.0.1
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 11.4.0
+  version: 11.3.2
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

nix/sources.json

@@ -18,19 +18,6 @@
       "name": "nixpkgs-unstable",
       "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
       "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
-    },
-    "treefmt-nix": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "numtide",
-        "repo": "treefmt-nix"
-      },
-      "branch": "main",
-      "submodules": false,
-      "revision": "337a4fe074be1042a35086f15481d763b8ddc0e7",
-      "url": "https://github.com/numtide/treefmt-nix/archive/337a4fe074be1042a35086f15481d763b8ddc0e7.tar.gz",
-      "hash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk="
     }
   },
   "version": 7

nix/treefmt.nix

@@ -1,71 +0,0 @@
-{
-  sources ? import ../npins,
-  pkgs ? import sources.nixpkgs { },
-  treefmt ? import sources.treefmt-nix,
-}:
-let
-  globalExcludes = [
-    "npins/default.nix"
-    "attic"
-    "vcluster"
-    ".*vendor"
-    ".*chart/.*"
-    ".*schema.json"
-  ];
-in
-treefmt.evalModule pkgs {
-  projectRootFile = ".git/config";
-
-  settings = {
-    excludes = globalExcludes;
-  };
-
-  programs = {
-
-    # --- Nix formatting ---
-    nixfmt = {
-      enable = true;
-      package = pkgs.nixfmt-rfc-style;
-    };
-    statix.enable = true;
-    deadnix.enable = true;
-
-    # --- Shell ---
-    shellcheck = {
-      enable = true;
-      excludes = [
-        "vcluster/"
-        "attic/"
-      ];
-    };
-
-    shfmt.enable = true;
-
-    # --- YAML ---
-    yamllint = {
-      enable = true;
-      excludes = [
-        "attic/"
-        "charts/templates/"
-        "charts/"
-        "values/"
-        "vcluster/"
-      ];
-      settings = {
-        extends = "default";
-        rules = {
-          document-start = "disable";
-          line-length = {
-            max = 300;
-          };
-        };
-      };
-    };
-
-    # --- JSON ---
-    jsonfmt.enable = true;
-
-    # Optional: keep JSON sorted
-    # prettier.enable = true;
-  };
-}

shell.nix

@@ -1,53 +1,68 @@
 let
-  sources = import ./npins;
+  sources = import ./nix;
   system = builtins.currentSystem;
   pkgs = import sources.nixpkgs {
     inherit system;
     config = { };
     overlays = [ ];
   };
-  treefmt = import ./nix/treefmt.nix { };
+  checks = import ./nix/checks.nix;
 in
 pkgs.mkShellNoCC {
-  packages = [
+  name = "clstr";
-    # dev tools
-    pkgs.just
-    pkgs.npins
-    treefmt.config.build.wrapper
 
-    # helm
+  packages =
-    pkgs.helmfile
+    with pkgs;
-    pkgs.kubernetes-helm
+    [
+      # dev tools
+      just
+      npins
 
-    # kubectl tools
+      # helm
-    pkgs.kubectl-cnpg
+      helmfile
-    pkgs.kubectl-neat
+      kubernetes-helm
-    pkgs.kubectl-graph
-    pkgs.kubectl-klock
-    pkgs.kubectl-rook-ceph
 
-    # other tools activate when needed
+      # kubectl tools
-    # pkgs.step-cli
+      kubectl-cnpg
-    # pkgs.linkerd
+      kubectl-neat
-    # pkgs.cmctl
+      kubelogin
-    # pkgs.rclone
+      kubelogin-oidc
-    # pkgs.velero
+      kubectl-rook-ceph
-    # pkgs.renovate
+      kubectl-graph
-    # pkgs.graphviz
+      kubectl-klock
-    # pkgs.hubble
+      graphviz
-    # pkgs.dapr-cli
+      hubble
-  ];
+
+      # other tools activate when needed
+      # step-cli
+      # linkerd
+      # cmctl
+      # rclone
+      # velero
+      renovate
+
+      # dapr
+      dapr-cli
+    ]
+    ++ checks.enabledPackages;
 
   # Environment variables
-  ARGOCD_ENV_CLUSTER_NAME = "ekman";
+  ARGOCD_ENV_CLUSTER_NAME = "oceanbox";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
 
+  shellHook = builtins.concatStringsSep "\n" [
+    checks.shellHook
+  ];
+
   # Alternative shells
   passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {
     ci-shell = {
       packages = [
         pkgs.npins
       ];
+      shellHook = ''
+        export NPINS_DIRECTORY="nix"
+      '';
     };
   };
 }

values/argo/env.yaml.gotmpl

@@ -24,7 +24,11 @@ argocd:
       cpu: 250m
   repoServers:
   - name: "helmfile-cmp"
-    image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
+    image: "registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest"
+    imagePullSecrets:
+      - gitlab-pull-secret
+  - name: "kustomize-helm-with-rewrite"
+    image: "registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite:latest"
     imagePullSecrets:
       - gitlab-pull-secret
   additional_rbac_settings:

values/argo/manifests/argo.yaml

@@ -28,7 +28,6 @@ spec:
     managedNamespaceMetadata:
       labels:
         component: sys
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/argo/manifests/httproute.yaml

@@ -1,40 +0,0 @@
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argocd-server
-  namespace: argocd
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - argocd.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: argocd-server
-      port: 80
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-argocd
-  namespace: argocd
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-server
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": argocd
-{{- end }}

values/argo/manifests/sys-project.yaml

@@ -92,8 +92,6 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: postfix
     server: https://kubernetes.default.svc
-  - namespace: jobset-system
-    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
@@ -133,7 +131,6 @@ spec:
   - ghcr.io/spegel-org/helm-charts
   - quay.io/cilium/charts
   - quay.io/jetstack/charts
-  - registry.k8s.io/jobset/charts/jobset
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
   - docker.gitea.com
   - https://operator.mariadb.com/mariadb-enterprise-operator

values/argo/values/argocd.yaml.gotmpl

@@ -4,21 +4,18 @@ global:
 ## Ref: https://github.com/argoproj/argo-cd
 ##
 configs:
+  {{- if .Values.argocd.anyNamespaces.enabled }}
   params:
-    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
-    server.insecure: "true"
-    {{- end }}
-    {{- if .Values.argocd.anyNamespaces.enabled }}
     applicationsetcontroller.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
     # TODO(kai): anyapp will disable PR review apps. Look into anyapp settings to fix it
     applicationsetcontroller.enable.scm.providers: "false"
     application.namespaces: "{{ .Values.argocd.anyNamespaces.glob }}"
-    {{- end }}
+  {{- end }}
   cm:
     application.resourceTrackingMethod: annotation+label
     application.instanceLabelKey: app.kubernetes.io/instance
     create: true
-    # NOTE: callback URL for dex
+    # NOTE(kai): callback URL for dex
     url: "https://argocd.{{ .Values.clusterConfig.domain }}"
     resource.compareoptions: |
       ignoreAggregatedRoles: true
@@ -84,7 +81,6 @@ configs:
       p, role:org-admin, applications, *, */*, allow
       p, role:org-admin, projects, *, *, allow
       p, role:org-admin, logs, get, *, allow
-      p, role:org-admin, logs, get, */*, allow
       p, role:org-admin, clusters, get, *, allow
       p, role:org-admin, clusters, update, *, allow
       p, role:org-admin, repositories, get, *, allow
@@ -171,7 +167,7 @@ repoServer:
   extraContainers:
   - command:
     - /var/run/argocd/argocd-cmp-server
-    image: {{ .image }}
+    image: registry.gitlab.com/oceanbox/manifests/helmfile-cmp:latest
     env:
     - name: HELM_GIT_ACCESS_TOKEN
       valueFrom:
@@ -180,7 +176,7 @@ repoServer:
           name: oceanbox-gitops-repo
           optional: false
     imagePullPolicy: Always
-    name: {{ .name }}
+    name: helmfile-cmp
     securityContext:
       runAsNonRoot: true
       runAsUser: 999
@@ -195,6 +191,23 @@ repoServer:
       name: cmp-tmp
     - mountPath: /helm-working-dir
       name: helm-working-dir
+  - command:
+    - /var/run/argocd/argocd-cmp-server
+    image: {{ .image }}
+    imagePullPolicy: Always
+    name: {{ .name }}
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 999
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    volumeMounts:
+    - mountPath: /var/run/argocd
+      name: var-files
+    - mountPath: /home/argocd/cmp-server/plugins
+      name: plugins
+    - mountPath: /tmp
+      name: cmp-tmp
   volumes:
   - name: cmp-tmp
     emptyDir: {}
@@ -241,9 +254,6 @@ server:
     serviceMonitor:
       enabled: true
   ingress:
-    {{- if .Values.clusterConfig.gatewayAPI.enabled }}
-    enabled: false
-    {{- else }}
     enabled: true
     ingressClassName: nginx
     annotations:
@@ -260,7 +270,6 @@ server:
       - secretName: argocd-tls
         hosts:
           - "argocd.{{ .Values.clusterConfig.domain }}"
-    {{- end }}
 applicationSet:
   metrics:
     enabled: true
@@ -274,6 +283,10 @@ applicationSet:
     ingressClassName: nginx
     annotations:
       cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
+      # {{- with .Values.clusterConfig.ingress_whitelist}}
+      # NOTE(kai): include gitlab and github webhook ranges
+      # nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }},192.30.252.0/22,140.82.112.0/20,34.74.226.27/28,34.74.226.0/24
+      # {{- end }}
     hostname: "argocd-applicationset.{{ .Values.clusterConfig.domain }}"
     tls:
       - secretName: argocd-applicationset-tls

values/atlantis/kustomize/prod/appsettings.json

@@ -73,8 +73,7 @@
     "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
     "sorcerer" : "https://sorcerer.data.oceanbox.io",
     "allowedOrigins": [
-        "https://maps.oceanbox.io",
+        "https://maps.oceanbox.io"
-        "https://codex.adm.oceanbox.io"
     ],
     "appName": "atlantis",
     "appEnv": "prod",

values/atlantis/kustomize/staging/appsettings.json

@@ -26,7 +26,7 @@
         "cookieDomain": ".oceanbox.io",
         "cookieName": ".obx.staging",
         "ttl": 12.0,
-        "signedOutRedirectUri": "https://maps.dev.oceanbox.io",
+        "signedOutRedirectUri": "https://atlantis.beta.oceanbox.io",
         "realm": "atlantis",
         "environment": "staging",
         "keyStore": {
@@ -76,8 +76,7 @@
         "https://atlantis.beta.oceanbox.io",
         "https://atlantis.dev.oceanbox.io",
         "https://atlantis.local.oceanbox.io:8080",
-        "https://maps.dev.oceanbox.io",
+        "https://maps.dev.oceanbox.io"
-        "https://codex.dev.oceanbox.io"
     ],
     "appName": "atlantis",
     "appEnv": "staging",

values/atlantis/manifests/atlantis.yaml

@@ -35,7 +35,7 @@ spec:
       valueFiles:
       - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
   {{- end }}
-  - repoURL: https://git.oceanbox.io/platform/manifests.git
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: main
     ref: values
   ignoreDifferences:

values/atlantis/values/redis-prod.yaml

@@ -2,14 +2,6 @@ architecture: replication
 
 replica:
   replicaCount: 2
-  resources:
-    limits:
-      ephemeral-storage: 1024Mi
-      memory: 192Mi
-    requests:
-      cpu: 150m
-      ephemeral-storage: 50Mi
-      memory: 128Mi
 
 auth:
   enabled: true
@@ -28,3 +20,4 @@ master:
       cpu: 150m
       ephemeral-storage: 50Mi
       memory: 128Mi
+

values/atlantis/values/values-beta.yaml.gotmpl

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.46.2
+  tag: v1.42.2
 
 podAnnotations:
   dapr.io/app-id: "beta-atlantis"

values/atlantis/values/values-prod.yaml.gotmpl

@@ -73,6 +73,9 @@ cluster:
     enabled: false
 
 resources:
+  limits:
+    cpu: 1
+    memory: 1Gi
   requests:
     cpu: 500m
     memory: 1Gi

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: 23006866-debug
+  tag: bc9dccaa-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:
@@ -50,6 +50,23 @@ ingress:
     # nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
     # oceanbox.io/expose: internal
   hosts:
+    - host: atlantis.beta.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
     - host: maps.dev.oceanbox.io
       paths:
         - path: /
@@ -67,8 +84,27 @@ ingress:
           pathType: ImplementationSpecific
         - path: /metrics
           pathType: ImplementationSpecific
+    - host: atlas.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
   tls:
     - hosts:
+        - atlantis.beta.oceanbox.io
+        - atlas.oceanbox.io
         - maps.dev.oceanbox.io
       secretName: staging-atlantis-tls
 cluster:

values/cilium/cilium-manifests/gateway.yaml

@@ -13,7 +13,7 @@ spec:
     annotations:
       load-balancer.hetzner.cloud/location: hel1
       load-balancer.hetzner.cloud/type: lb11
-      load-balancer.hetzner.cloud/name: load-balancer-1
+      load-balancer.hetzner.cloud/name: load-balancer-2
       load-balancer.hetzner.cloud/use-private-ip: "true"
       load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
       load-balancer.hetzner.cloud/http-redirect-https: "false"
@@ -42,36 +42,6 @@ spec:
           selector:
             matchLabels:
               shared-gateway-access: "true"
-    - name: https-hel1
-      protocol: HTTPS
-      port: 443
-      hostname: "*.hel1.oceanbox.io"
-      tls:
-        certificateRefs:
-          - group: ''
-            kind: Secret
-            name: wildcard-hel1-oceanbox-io
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
-    - name: https-internal
-      protocol: HTTPS
-      port: 443
-      hostname: "*.adm.hel1.obx"
-      tls:
-        certificateRefs:
-          - group: ''
-            kind: Secret
-            name: wildcard-adm-hel1-obx
-      allowedRoutes:
-        namespaces:
-          from: Selector
-          selector:
-            matchLabels:
-              shared-gateway-access: "true"
     - name: ssh
       protocol: TCP
       port: 22
@@ -95,28 +65,4 @@ spec:
   issuerRef:
     name: letsencrypt-prod-dns01
     kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-hel1-oceanbox-io
-spec:
-  secretName: wildcard-hel1-oceanbox-io
-  dnsNames:
-    - "*.hel1.oceanbox.io"
-  issuerRef:
-    name: letsencrypt-prod-dns01
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-adm-hel1-obx
-spec:
-  secretName: wildcard-adm-hel1-obx
-  dnsNames:
-    - "*.adm.hel1.obx"
-  issuerRef:
-    name: ca-issuer
-    kind: ClusterIssuer
 {{- end}}

values/cilium/env-ekman.yaml.gotmpl

@@ -1,19 +0,0 @@
-cilium:
-  enabled: true
-  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
-  # keys so encrypted traffic is unreadable by them.
-  # TODO: re-enable after migration
-  encryption:
-    enabled: false
-  envoy:
-    enabled: true
-  # kube-proxy stays running during migration; disable replacement until done.
-  # TODO: set to true after migration
-  kubeProxyReplacement: false
-  # Direct apiserver connection -- do not rely on the kubernetes service IP
-  # during migration since we are touching the CNI layer.
-  # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
-  k8sServiceHost: 10.255.241.99
-  k8sServicePort: 6443
-  policyAuditMode: true
-  upgradeCompatability: 1.18

values/cilium/env-hel1.yaml.gotmpl

@@ -1,7 +1,5 @@
 cilium:
   enabled: true
-  envoy:
-    enabled: true
   nodePort:
     enabled: true
   l2announcement:

values/cilium/env-rossby.yaml.gotmpl

@@ -1,10 +0,0 @@
-cilium:
-  enabled: true
-  nodePort:
-    enabled: true
-  l2announcement:
-    enabled: true
-  loadbalancerPool:
-    enabled: false
-    cidr:
-     - 10.255.241.11/32

values/cilium/values/cilium-ekman.yaml.gotmpl

@@ -1,33 +0,0 @@
-# Installs Cilium without writing the CNI config file.
-# Flannel keeps serving pods on unmigrated nodes.
-# TODO: Remove after migration
-#cni:
-  #customConf: false
-
-# Routes cross-CNI traffic via the host network stack so Flannel pods
-# and Cilium pods can reach each other during the transition.
-# TODO: Remove after migration
-#bpf:
-  #hostLegacyRouting: false
-
-# NOTE: Use Geneve so Cilium's overlay is distinct from Flannel's VXLAN.
-# This is required for cross-CNI pod connectivity during migration.
-routingMode: tunnel
-tunnelProtocol: geneve
-
-# New pod CIDR exclusively for Cilium (must not overlap):
-# Flannel pod CIDR: 10.100.0.0/16  (clusterCidr in k8s config)
-# Service CIDR:     10.0.0.0/22
-# Node networks:    10.255.241.0/24, 10.255.242.0/24, 10.255.243.0/24, 10.255.244.0/24
-# TODO: after migration switch ipam.mode to kubernetes
-ipam:
-  mode: cluster-pool
-  operator:
-    clusterPoolIPv4PodCIDRList:
-      - "10.100.0.0/16"
-    clusterPoolIPv4MaskSize: 24
-
-# NOTE: Rate limit Cilium's k8s API client ekman has ~30 nodes.
-k8sClientRateLimit:
-  qps: 5
-  burst: 10

values/cilium/values/cilium.yaml.gotmpl

@@ -15,14 +15,6 @@ encryption:
   type: {{ .Values.cilium.encryption.type}}
 envoy:
   enabled: {{ .Values.cilium.envoy.enabled }}
-  securityContext:
-    capabilities:
-      keepCapNetBindService: true
-      envoy:
-        - SYS_ADMIN
-        - NET_ADMIN
-        - BPF
-        - NET_BIND_SERVICE
   prometheus:
     serviceMonitor:
       enabled: {{ .Values.cilium.envoy.enabled }}
@@ -78,6 +70,15 @@ gatewayAPI:
     nodes:
       matchLabels:
         ingresshost: "cilium"
+envoy:
+  enabled: true
+  securityContext:
+    capabilities:
+      keepCapNetBindService: true
+      envoy:
+        - NET_ADMIN
+        - BPF
+        - NET_BIND_SERVICE
 {{- end}}
 ingressController:
   enabled: {{ .Values.cilium.ingressController.enabled }}

values/codex/kustomize/prod/appsettings.json

@@ -41,7 +41,7 @@
         "cookieDomain": ".oceanbox.io",
         "cookieName": ".obx.prod",
         "ttl": 12.0,
-        "signedOutRedirectUri": "https://codex.adm.oceanbox.io/",
+        "signedOutRedirectUri": "https://maps.oceanbox.io/",
         "realm": "atlantis",
         "environment": "prod",
         "keyStore": {
@@ -55,14 +55,13 @@
             "key": "dataencryption-keys"
         }
     },
-    "PlainAuthUsers": [
+    "plainAuthUsers": [
         {
             "username": "admin",
             "password": "en-to-tre-fire",
             "groups": [ "/oceanbox" ],
             "roles": [ "admin" ]
         }
-    ],
+    ]
-    "ArchiveSvc": "https://maps.oceanbox.io"
 }
 

values/codex/kustomize/prod/deployment_patch.yaml

@@ -64,8 +64,3 @@
         secretKeyRef:
           name: prod-openfga-db-app
           key: password
-    - name: DAPR_API_TOKEN
-      valueFrom:
-        secretKeyRef:
-          name: dapr-api-token
-          key: token

values/codex/kustomize/staging/appsettings.json

@@ -41,7 +41,7 @@
         "cookieDomain": ".oceanbox.io",
         "cookieName": ".obx.staging",
         "ttl": 12.0,
-        "signedOutRedirectUri": "https://codex.dev.oceanbox.io/",
+        "signedOutRedirectUri": "https://atlantis.dev.oceanbox.io/",
         "realm": "atlantis",
         "environment": "staging",
         "keyStore": {
@@ -55,13 +55,12 @@
             "key": "dataencryption-keys"
         }
     },
-    "PlainAuthUsers": [
+    "plainAuthUsers": [
         {
             "username": "admin",
             "password": "en-to-tre-fire",
             "groups": [ "/oceanbox" ],
             "roles": [ "admin" ]
         }
-    ],
+    ]
-    "ArchiveSvc": "https://maps.dev.oceanbox.io"
 }

values/codex/kustomize/staging/deployment_patch.yaml

@@ -62,8 +62,3 @@
         secretKeyRef:
           name: staging-openfga-db-app
           key: password
-    - name: DAPR_API_TOKEN
-      valueFrom:
-        secretKeyRef:
-          name: dapr-api-token
-          key: token

values/codex/manifests/codex.yaml

@@ -27,7 +27,7 @@ spec:
         value: {{ .Values.codex.env }}
       - name: HELMFILE_FILE_PATH
         value: codex.yaml.gotmpl
-  - repoURL: https://git.oceanbox.io/platform/manifests.git
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: main
     ref: values
   syncPolicy:
@@ -40,3 +40,4 @@ spec:
       selfHeal: false
     {{- end }}
 {{- end }}
+

values/codex/values/values-prod.yaml

@@ -1,11 +1,4 @@
 replicaCount: 1
-podAnnotations:
-  dapr.io/enabled: "true"
-  dapr.io/app-id: "prod-codex"
-  dapr.io/app-port: "8085"
-  dapr.io/api-token-secret: "dapr-api-token"
-  dapr.io/config: "tracing"
-  dapr.io/app-protocol: "http"
 ingress:
   enabled: true
   className: "nginx"

values/codex/values/values-staging.yaml

@@ -1,11 +1,4 @@
 replicaCount: 1
-podAnnotations:
-  dapr.io/enabled: "true"
-  dapr.io/app-id: "staging-codex"
-  dapr.io/app-port: "8085"
-  dapr.io/api-token-secret: "dapr-api-token"
-  dapr.io/config: "tracing"
-  dapr.io/app-protocol: "http"
 ingress:
   enabled: true
   className: "nginx"
@@ -38,4 +31,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: 38eeb4cc-debug
+  tag: d34652dd-debug

values/dapr/manifests/dapr.yaml

@@ -27,7 +27,8 @@ spec:
       - name: HELMFILE_FILE_PATH
         value: dapr.yaml.gotmpl
   - repoURL: https://dapr.github.io/helm-charts
-    targetRevision: 1.16.9
+    # NOTE: DONT BUMP EKMAN TO 1.15 it is broken
+    targetRevision: {{- if eq .Values.dapr.cluster "ekman" }} 1.16.1 {{- else }} 1.16.0 {{- end }}
     chart: dapr
     helm:
       valueFiles:

values/docs/manifests/docs.yaml

@@ -28,9 +28,6 @@ spec:
       - name: HELMFILE_FILE_PATH
         value: docs.yaml.gotmpl
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/docs/manifests/gateway-routes.yaml

@@ -1 +0,0 @@
-{{- /* HTTPRoute and CiliumNetworkPolicy are managed by the docs chart template */ -}}

values/docs/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "e9fd3fc6-debug"
+  tag: "5c4cda2e-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/docs/values/values.yaml.gotmpl

@@ -1,46 +0,0 @@
-replicaCount: 1
-image:
-  tag: "e9fd3fc6-debug"
-env:
-  - name: APP_VERSION
-    value: "0.0.0"
-  - name: LOG_LEVEL
-    value: "1"
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-ingress:
-  enabled: false
-  className: "nginx"
-httpRoute:
-  enabled: true
-  parentRefs:
-    - name: shared-gateway
-      namespace: kube-system
-      sectionName: https
-  hostnames:
-    - docs.oceanbox.io
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/"
-{{- else }}
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: docs.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - docs.oceanbox.io
-      secretName: docs-tls
-{{- end }}

values/drupal/manifests/ingress.yaml

@@ -1,38 +1,32 @@
-apiVersion: gateway.networking.k8s.io/v1
+apiVersion: networking.k8s.io/v1
-kind: HTTPRoute
+kind: Ingress
 metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12
+  labels:
+    app.kubernetes.io/component: drupal
   name: drupal
   namespace: fornix
 spec:
-  parentRefs:
+  ingressClassName: nginx
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-hel1
-  hostnames:
-  - drupal.hel1.oceanbox.io
   rules:
-  - matches:
+    - host: drupal.hel1.oceanbox.io
-    - path:
+      http:
-        type: PathPrefix
+        paths:
-        value: "/"
+          - backend:
-    backendRefs:
+              service:
-    - name: drupal
+                name: drupal
-      port: 80
+                port:
----
+                  number: 80
-apiVersion: cilium.io/v2
+            path: /
-kind: CiliumNetworkPolicy
+            pathType: Prefix
-metadata:
+  tls:
-  name: allow-gateway-to-drupal
+    - hosts:
-  namespace: fornix
+        - drupal.hel1.oceanbox.io
-spec:
+      secretName: drupal-tls
-  endpointSelector:
-    matchLabels:
-      app: drupal
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": fornix

values/env-ekman.yaml

@@ -1,7 +1,7 @@
 clusterConfig:
   manifests: https://git.oceanbox.io/platform/manifests.git
   cilium:
-    enabled: true
+    enabled: false
   env: "prod"
   distro: "nixos"
   domain: "ekman.oceanbox.io"

values/env-hel1.yaml

@@ -20,8 +20,6 @@ clusterConfig:
     patterns: []
     cidr: []
   nodes: []
-  gatewayAPI:
-    enabled: true
   ingress_whitelist:
     - 10.0.0.0/8
     - 172.16.0.0/12

values/env-oceanbox.yaml

@@ -27,5 +27,3 @@ clusterConfig:
     - 192.168.0.0/16
     - 172.19.255.0/24
     - 100.64.0.0/12
-    # hel1
-    - 37.27.203.38/28

values/env.yaml

@@ -20,8 +20,6 @@ clusterConfig:
     - 192.168.0.0/16
     - 172.19.255.0/24
     - 100.64.0.0/12 # tailnet
-  gatewayAPI:
-    enabled: false
   ingress_hostnetwork: false
   ingress_hostport: false
   ingress_nodeport: true

values/fornix/manifests/fornix.yaml

@@ -31,9 +31,6 @@ spec:
     targetRevision: main
     ref: values
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/fornix/manifests/gateway-routes.yaml

@@ -1,38 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: fornix
-  namespace: fornix
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-hel1
-  hostnames:
-  - fornix.hel1.oceanbox.io
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: fornix
-      port: 8085
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-fornix
-  namespace: fornix
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: fornix
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": fornix

values/fornix/values/values.yaml

@@ -3,7 +3,7 @@ drupalUrl: http://drupal
 
 replicaCount: 1
 ingress:
-  enabled: false
+  enabled: true
   className: "nginx"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production

values/gatus/manifests/gatus.yaml

@@ -26,7 +26,6 @@ spec:
     managedNamespaceMetadata:
       labels:
         component: sys
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/gatus/manifests/ingress.yaml

@@ -1,48 +1,8 @@
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: gatus
-  namespace: uptime
-spec:
-  parentRefs:
-  - name: shared-gateway
-    namespace: kube-system
-    sectionName: https-internal
-  hostnames:
-  - uptime.{{ .Values.clusterConfig.domain }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: "/"
-    backendRefs:
-    - name: gatus
-      port: 80
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-gatus
-  namespace: uptime
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gatus
-  ingress:
-  - fromCIDRSet:
-    {{- range .Values.clusterConfig.ingress_whitelist }}
-    - cidr: {{ . }}
-    {{- end }}
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": uptime
-{{- else }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
+    cert-manager.io/cluster-issuer: ca-issuer
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, x-gatus-cache
     nginx.ingress.kubernetes.io/enable-cors: "true"
@@ -55,7 +15,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: uptime.{{ .Values.clusterConfig.domain }}
+    - host: uptime.adm.hel1.obx
       http:
         paths:
           - backend:
@@ -67,6 +27,5 @@ spec:
             pathType: ImplementationSpecific
   tls:
     - hosts:
-        - uptime.{{ .Values.clusterConfig.domain }}
+        - uptime.adm.hel1.obx
       secretName: gatus-tls
-{{- end }}

values/gatus/values/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: twinproduction/gatus
-  tag: v5.35.0
+  tag: v5.34.0
 
 # Does envFrom secret named gatus
 secrets: true
@@ -93,13 +93,6 @@ config:
       alerts:
         - type: custom
 
-    - name: Atlantis Beta TOS
-      <<: *https-endpoint
-      group: "Primary Services"
-      url: https://maps.beta.oceanbox.io/healthz
-      alerts:
-        - type: custom
-
     # NOTE: Ingress is down
     # - name: Sorcerer VTN
     #   <<: *https-endpoint
@@ -122,16 +115,16 @@ config:
       alerts:
         - type: custom
 
-    - name: Atlantis Dev TOS
+    - name: Atlantis Beta
       <<: *https-endpoint
       group: "Experimental Services"
-      url: https://maps.dev.oceanbox.io/healthz
+      url: https://atlantis.beta.oceanbox.io/healthz
       extra-labels:
         environment: staging
       alerts:
         - type: custom
 
-    - name: Sorcerer Dev TOS
+    - name: Sorcerer Beta
       <<: *https-endpoint
       group: "Experimental Services"
       url: https://sorcerer.ekman.oceanbox.io/healthz
@@ -140,7 +133,7 @@ config:
       alerts:
         - type: custom
 
-    - name: Plume Dev TOS
+    - name: Plume Beta
       <<: *https-endpoint
       group: "Experimental Services"
       url: https://plume.ekman.oceanbox.io/healthz

values/gitea/manifests/gateway-routes.yaml

@@ -14,36 +14,11 @@ spec:
     - path:
         type: PathPrefix
         value: "/"
-    timeouts:
-      request: 600s
-      backendRequest: 600s
     backendRefs:
     - name: gitea-http
       port: 3000
 
 ---
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gateway-to-gitea
-  namespace: gitea
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gitea
-  ingress:
-  - fromCIDRSet:
-    - cidr: 10.0.0.0/8
-    - cidr: 172.16.0.0/12
-    - cidr: 192.168.0.0/16
-    - cidr: 172.19.255.0/24
-    - cidr: 100.64.0.0/12
-    - cidr: 185.125.160.4/32
-    - cidr: 37.27.203.38/32
-  - fromEndpoints:
-    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": gitea
----
 apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: TCPRoute
 metadata:

values/gitea/values/values.yaml.gotmpl

@@ -1,8 +0,0 @@
-{{- /* Gateway API: disable ingress when cilium gateway is enabled (HTTPRoute is in manifests/gateway-routes.yaml) */ -}}
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-ingress:
-  enabled: false
-{{- else }}
-ingress:
-  enabled: true
-{{- end }}

values/grafana-pdc-agent/manifests/pdc-agent-deployment.yaml

@@ -49,9 +49,11 @@ spec:
         image: grafana/pdc-agent:latest
         imagePullPolicy: Always
         resources:
+          limits:
+            memory: 1Gi
           requests:
-            cpu: 200m
+            cpu: 1
-            memory: 250Mi
+            memory: 1Gi
         securityContext:
           allowPrivilegeEscalation: false
           privileged: false

values/headscale-router/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 
 args: [ "serve" ]
 

values/headscale/acl.yaml

@@ -0,0 +1,164 @@
+apiVersion: v1
+data:
+  policy: |
+    {
+      // groups are collections of users having a common scope. A user can be in multiple groups
+      // groups cannot be composed of groups
+      "groups": {
+        "group:admin": [
+          "jonas.juselius@oceanbox.io",
+          "Moritz.Jorg@oceanbox.io",
+          "simen.kirkvik@oceanbox.io",
+          "stig.r.jensen@oceanbox.io",
+          "system-tos",
+        ],
+        "group:devops": [
+          "jonas.juselius@oceanbox.io",
+          "Moritz.Jorg@oceanbox.io",
+          "stig.r.jensen@oceanbox.io",
+          "radovan.bast@oceanbox.io",
+          "simen.kirkvik@oceanbox.io",
+          "Ole.Tytlandsvik@tromso.serit.no",
+        ],
+        "group:oceanographer": [
+          "frank.gaardsted@oceanbox.io",
+          "ole.anders.nost@oceanbox.io",
+          "helge.avlesen@oceanbox.io",
+          "isa.rosso@oceanbox.io",
+          "jonathan.lilly@oceanbox.io",
+        ],
+        "group:manager": [
+          "svenn.hanssen@oceanbox.io",
+          "hilde.iversen@oceanbox.io",
+        ],
+        "group:dev": [],
+        "group:intern": [],
+      },
+      // tagOwners in tailscale is an association between a TAG and the people allowed to set this TAG on a server.
+      // This is documented [here](https://tailscale.com/kb/1068/acl-tags#defining-a-tag)
+      // and explained [here](https://tailscale.com/blog/rbac-like-it-was-meant-to-be/)
+      "tagOwners": {
+        "tag:k8s": [ "group:admin" ],
+        "tag:hpc": [ "group:admin" ],
+      },
+      // hosts should be defined using its IP addresses and a subnet mask.
+      // to define a single host, use a /32 mask. You cannot use DNS entries here,
+      // as they're prone to be hijacked by replacing their IP addresses.
+      // see https://github.com/tailscale/tailscale/issues/3800 for more information.
+      "hosts": {
+        "ingress.ekman.tos": "10.255.241.99/32",
+        "ingress.ceph.tos": "10.255.241.10/32",
+        "ingress.ceph.vtn": "172.16.239.50/32",
+        "ingress.adm.ceph.vtn": "172.16.239.51/32",
+        "ingress.oceanbox.tos": "10.255.241.11/32",
+        "manage.ekman.tos": "10.255.241.99/32",
+        "k8s.oceanbox.tos": "10.255.241.200/32",
+        "k8s.ekman.tos": "10.255.241.99/32",
+        "k8s.ceph.tos": "10.255.241.29/32",
+        "printer.office.tos": "10.132.46.108/32",
+        "net.office.tos": "10.132.46.0/24",
+        "net.dc.tos": "10.255.241.0/24",
+        "net.100gbe.tos": "10.255.244.0/24",
+        "net.mgmt.tos": "10.255.240.0/24",
+        "net.dc.vtn": "172.16.239.0/24",
+        "net.mgmt.vtn": "172.16.238.0/24",
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": [
+            "group:admin",
+            "group:devops",
+            "group:oceanographer",
+            "group:manager",
+            "group:dev",
+          ],
+          "dst": [
+            "100.64.0.0/24:0",
+            "100.64.0.0/24:22",
+          ]
+        },
+        {
+          "action": "accept",
+          "src": [ "ekman", "net.dc.tos" ],
+          "dst": [
+            "net.dc.vtn:*",
+            "100.64.0.0/24:0",
+            "100.64.0.0/24:22",
+          ]
+        },
+        {
+          "action": "accept",
+          "src": [ "rossby", "net.dc.vtn" ],
+          "dst": [
+            "net.dc.tos:*",
+            "100.64.0.0/24:0",
+            "100.64.0.0/24:22",
+          ]
+        },
+        {
+          "action": "accept",
+          "src": [ "group:admin" ],
+          "dst": [
+             "net.dc.tos:*",
+             "net.mgmt.tos:*",
+             "net.100gbe.tos:*",
+             "net.office.tos:*",
+             "net.dc.vtn:*",
+             "net.mgmt.vtn:*",
+          ]
+        },
+        {
+          "action": "accept",
+          "src": [ "group:devops" ],
+          "dst": [
+             "k8s.oceanbox.tos:6443",
+             "k8s.ekman.tos:4443",
+          ]
+        },
+        {
+          "action": "accept",
+          "src": [
+              "group:admin",
+              "group:devops",
+              "group:oceanographer",
+              "group:manager",
+              "group:dev",
+          ],
+          "dst": [
+             "ingress.oceanbox.tos:443",
+             "ingress.ekman.tos:443",
+             "printer.office.tos:631",
+             "10.255.241.99/32:22",
+             "10.255.241.100/32:22",
+          ]
+        },
+        {
+          "action": "accept",
+          "src": [
+              "group:admin",
+              "group:devops",
+              "group:oceanographer",
+              "group:manager",
+              "group:dev",
+          ],
+          "dst": [
+             "100.64.0.0/24:*",
+             "autogroup:internet:*",
+          ]
+        },
+      ]
+    }
+kind: ConfigMap
+metadata:
+  annotations:
+    argocd.argoproj.io/tracking-id: headscale:/ConfigMap:headscale/headscale-acl
+  labels:
+    app.kubernetes.io/instance: headscale
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: headscale
+    app.kubernetes.io/version: v0.25.0
+    helm.sh/chart: headscale-0.16.0
+  name: headscale-acl
+  namespace: headscale
+

values/headscale/values/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: ghcr.io/juanfont/headscale
   pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 
 args: ["serve"]
 
@@ -253,8 +253,6 @@ configMaps:
             { "action": "accept", "src": [ "hilde.iversen@oceanbox.io" ], "dst": [ "hilde.iversen@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "pal.herstad@oceanbox.io" ], "dst": [ "pal.herstad@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "faith.iha@oceanbox.io" ], "dst": [ "faith.iha@oceanbox.io:*" ] },
-            { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
-            { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
             // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
           ]
         }
@@ -266,6 +264,7 @@ configMaps:
            { "name": "maps.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "maps.beta.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "atlantis.beta.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "codex.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
 
@@ -353,7 +352,6 @@ configMaps:
            { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
            { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-diadash.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },

values/jobset/env-ekman.yaml.gotmpl

@@ -1,3 +0,0 @@
-jobset:
-  enabled: true
-  autosync: false

values/jobset/env.yaml.gotmpl

@@ -1,3 +0,0 @@
-jobset:
-  enabled: false
-  autosync: false

values/jobset/manifests/jobset.yaml

@@ -1,44 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: jobset
-  namespace: argocd
-spec:
-  destination:
-    namespace: jobset-system
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-      - name: CLUSTER_NAME
-        value: {{ .Values.clusterConfig.cluster }}
-      - name: HELMFILE_ENVIRONMENT
-        value: default
-      - name: HELMFILE_FILE_PATH
-        value: jobset.yaml.gotmpl
-  project: sys
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      - ServerSideApply=true
-    {{- if .Values.jobset.autosync }}
-    automated:
-      prune: true
-    {{- end }}
-  ignoreDifferences:
-   - group: ""
-     kind: Secret
-     name: jobset-webhook-server-cert
-     namespace: default
-     jsonPointers:
-       - /data
-{{- end }}

values/jobset/values/jobset.yaml.gotmpl

@@ -1,4 +0,0 @@
-prometheus:
-  enable: false
-certManager:
-  enable: false

values/kyverno/manifests/kyverno.yaml

@@ -36,13 +36,6 @@ spec:
       # selfHeal: false
     {{- end }}
   ignoreDifferences:
-  - group: apiextensions.k8s.io
-    kind: CustomResourceDefinition
-    jsonPointers:
-      - /metadata/managedFields
-      - /metadata/generation
-      - /metadata/annotations
-      - /metadata/labels
   - group: batch
     kind: CronJob
     jqPathExpressions:

values/makai/manifests/gateway-routes.yaml

@@ -1 +0,0 @@
-{{- /* HTTPRoute and CiliumNetworkPolicy are managed by the makai chart template */ -}}

values/makai/manifests/makai.yaml

@@ -28,9 +28,6 @@ spec:
       - name: HELMFILE_FILE_PATH
         value: makai.yaml.gotmpl
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        shared-gateway-access: "true"
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "d5e61949-debug"
+  tag: "436608af-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"

values/makai/values/values.yaml.gotmpl

@@ -1,46 +0,0 @@
-replicaCount: 1
-image:
-  tag: "d5e61949-debug"
-env:
-  - name: APP_VERSION
-    value: "0.0.0"
-  - name: LOG_LEVEL
-    value: "1"
-{{- if .Values.clusterConfig.gatewayAPI.enabled }}
-ingress:
-  enabled: false
-  className: "nginx"
-httpRoute:
-  enabled: true
-  parentRefs:
-    - name: shared-gateway
-      namespace: kube-system
-      sectionName: https
-  hostnames:
-    - makai.oceanbox.io
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/"
-{{- else }}
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: makai.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - makai.oceanbox.io
-      secretName: makai-tls
-{{- end }}

values/plume/kustomize/staging/appsettings.json

@@ -1,5 +1,5 @@
 {
-    "archmaesterUrl": "https://maps.dev.oceanbox.io",
+    "archmaesterUrl": "https://atlantis.beta.oceanbox.io",
     "appName": "plume",
     "appEnv": "staging",
     "appNamespace": "staging-plume",

values/plume/values/values-staging.yaml

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: "git.oceanbox.io/oceanbox/plume/plume"
-  tag: v1.6.13
+  tag: 9d99f7cf-debug
 podAnnotations:
   dapr.io/enabled: "true"
   dapr.io/app-id: "staging-plume"

values/prometheus/env-ekman.yaml.gotmpl

@@ -1,2 +1,3 @@
 prometheus:
   snitchUrl: "https://nosnch.in/bceb803932"
+

values/prometheus/env-oceanbox.yaml.gotmpl

@@ -14,7 +14,6 @@ prometheus:
     - marcusolsson-static-datasource
     - marcusolsson-calendar-panel
     - grafana-clock-panel
-    - redis-datasource
   thanos:
     enabled: true
   coredns: