Update spegel Docker tag to v0.7.0

bootstrap/values.yaml

@@ -13,7 +13,7 @@ applications:
       server: https://kubernetes.default.svc
     project: sys
     sources:
-      - repoURL: https://git.oceanbox.io/platform/manifests.git
+      - repoURL: https://gitlab.com/oceanbox//manifests.git
         targetRevision: HEAD
         path: helmfile.d
         plugin:

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.13.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.13.3
+appVersion: v2.5.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.13.3
+  tag: v2.5.2
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v2.13.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.13.3"
+appVersion: "v2.5.2"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v2.13.3
+  tag: v2.5.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/docs/Chart.yaml

@@ -12,7 +12,7 @@ description: Oceanbox Documentation
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v0.0.2
+version: v0.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v0.0.2
+appVersion: v0.1.0

charts/docs/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/documentation/docs
-  tag: v0.0.2
+  tag: v0.1.0
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -21,9 +21,8 @@ env:
     valueFrom:
       fieldRef:
         fieldPath: metadata.namespace
-        # imagePullSecrets:
+# imagePullSecrets:
-# - name: gitea-pull-secret
+  # - name: gitea-pull-secret
-
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
@@ -48,7 +47,7 @@ service:
   port: 8080
 ingress:
   enabled: true
-  className: haproxy
+  className: nginx
 persistence:
   enabled: false
   size: 1G

charts/fapr/Chart.yaml

@@ -1,6 +0,0 @@
-apiVersion: v2
-name: fapr
-description: A Helm chart for Fapr (F# Dapr workflow orchestrator)
-type: application
-version: v0.1.0
-appVersion: v0.1.0

charts/fapr/templates/_helpers.tpl

@@ -1,61 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "fapr.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-*/}}
-{{- define "fapr.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "fapr.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "fapr.labels" -}}
-helm.sh/chart: {{ include "fapr.chart" . }}
-{{ include "fapr.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "fapr.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "fapr.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "fapr.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create -}}
-    {{ default (include "fapr.fullname" .) .Values.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccount.name }}
-{{- end -}}
-{{- end -}}

charts/fapr/templates/deployment.yaml

@@ -1,85 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  replicas: {{ .Values.replicaCount }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "fapr.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "fapr.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "fapr.serviceAccountName" . }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: {{ .Values.service.port }}
-              protocol: TCP
-          env:
-            {{- toYaml .Values.env | nindent 12 }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 15
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 3
-            periodSeconds: 10
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: appsettings
-              mountPath: /app/appsettings.json
-              subPath: appsettings.json
-              readOnly: true
-      volumes:
-        - name: data
-        {{- if .Values.persistence.enabled }}
-          persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim | default (include "fapr.fullname" .) }}
-        {{- else }}
-          emptyDir: {}
-        {{- end }}
-        - name: appsettings
-          configMap:
-            name: {{ include "fapr.fullname" . }}-appsettings
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}

charts/fapr/templates/pvc.yaml

@@ -1,21 +0,0 @@
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-{{ include "fapr.labels" . | indent 4 }}
-spec:
-  accessModes:
-    - {{ .Values.persistence.accessMode | quote }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.size | quote }}
-{{- if .Values.persistence.storageClass }}
-{{- if (eq "-" .Values.persistence.storageClass) }}
-  storageClassName: ""
-{{- else }}
-  storageClassName: "{{ .Values.persistence.storageClass }}"
-{{- end }}
-{{- end }}
-{{- end }}

charts/fapr/templates/redis.yaml

@@ -1,49 +0,0 @@
-{{- if .Values.redis.enabled -}}
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: {{ include "fapr.fullname" . }}-redis
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    linkerd.io/inject: disabled
-  labels:
-    app.kubernetes.io/created-by: dragonfly-operator
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  args:
-    - --dbfilename=dump
-    - --maxmemory=$(MAX_MEMORY)Mi
-    - --proactor_threads=1
-    - --logtostderr
-    - --save_schedule=
-  env:
-    - name: MAX_MEMORY
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-          divisor: 1Mi
-  replicas: {{ .Values.redis.replicas | default "1" }}
-  resources:
-    requests:
-      cpu: {{ .Values.redis.resources.cpu | default "100m" }}
-      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
-    limits:
-      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
-  authentication:
-    passwordFromSecret:
-      name: {{ .Values.redis.secret.name | default (printf "%s-redis" (include "fapr.fullname" .)) | quote }}
-      key: {{ .Values.redis.secret.key | quote }}
-  {{- if .Values.redis.backup.enabled }}
-  snapshot:
-    dir: /data
-    cron: "0 3 * * *"
-    enableOnMasterOnly: false
-    persistentVolumeClaimSpec:
-      storageClassName: {{ .Values.redis.storageClass | default "managed-nfs-storage" }}
-      accessModes:
-        - ReadWriteOnce
-      resources:
-        requests:
-          storage: {{ .Values.redis.size | default "1Gi" }}
-  {{- end }}
-{{- end }}

charts/fapr/templates/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fapr.selectorLabels" . | nindent 4 }}

charts/fapr/templates/serviceaccount.yaml

@@ -1,12 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "fapr.serviceAccountName" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/fapr/values.yaml

@@ -1,67 +0,0 @@
-# Default values for fapr.
-
-replicaCount: 1
-image:
-  repository: git.oceanbox.io/oceanbox/fapr/fapr
-  tag: v0.1.0
-  pullPolicy: IfNotPresent
-env:
-  - name: APP_NAME
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.name
-  - name: APP_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-imagePullSecrets:
-  - name: gitlab-pull-secret
-nameOverride: ""
-fullnameOverride: ""
-serviceAccount:
-  create: true
-  annotations: {}
-  name: ""
-podAnnotations: {}
-podSecurityContext:
-  fsGroup: 0
-securityContext:
-  capabilities:
-    drop:
-      - ALL
-  readOnlyRootFilesystem: false
-  runAsNonRoot: false
-  runAsUser: 0
-service:
-  type: ClusterIP
-  port: 8080
-persistence:
-  enabled: true
-  existingClaim: ""
-  size: 1Gi
-  storageClass: "ceph-rbd"
-  accessMode: ReadWriteMany
-redis:
-  enabled: true
-  replicas: 1
-  backup:
-    enabled: false
-  size: 1Gi
-  storageClass: "ceph-rbd"
-  secret:
-    name: ""
-    key: "redis-password"
-  resources:
-    cpu: 100m
-    memory: 128Mi
-resources: {}
-autoscaling:
-  enabled: false
-  minReplicas: 1
-  maxReplicas: 3
-  targetCPUUtilizationPercentage: 80
-serviceMonitor:
-  enabled: false
-nodeSelector: {}
-tolerations: []
-affinity: {}

charts/makai/values.yaml

@@ -47,7 +47,7 @@ service:
   port: 8080
 ingress:
   enabled: true
-  className: haproxy
+  className: nginx
 persistence:
   enabled: false
   size: 1G

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.13.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.13.3
+appVersion: v2.5.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v2.13.3
+  tag: v2.5.2
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.5.19
+  version: 9.5.2
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -27,7 +27,7 @@ releases:
 - name: argocd-apps
   namespace: argocd
   chart: argo/argocd-apps
-  version: 2.0.5
+  version: 2.0.4
   condition: argo.apps.enabled
   values:
   - ../values/argo/values/apps.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
   namespace: argocd
   chart: argo/argo-rollouts
-  version: 2.41.0
+  version: 2.40.9
   condition: argo.rollouts.enabled
   values:
   - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 1.0.14
+  version: 1.0.10
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests

helmfile.d/fapr.yaml.gotmpl

@@ -1,39 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-commonLabels:
-  tier: oceanbox
-
-releases:
-- name: {{ .Environment.Name }}-fapr
-  namespace: {{ .Environment.Name }}-fapr
-  chart: ../charts/fapr
-  condition: fapr.enabled
-  values:
-  - ../values/fapr/values/values.yaml
-  - ../values/fapr/values/values-{{ .Environment.Name }}.yaml
-  - ../values/fapr/values/values-{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/fapr/kustomize/{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: {{ .Environment.Name }}-fapr
-  chart: manifests
-  condition: fapr.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/fapr/env.yaml.gotmpl
-  - ../values/fapr/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/fapr/manifests
-    - manifests

helmfile.d/gitea.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: gitea
   namespace: gitea
   chart: gitea/gitea
-  version: 12.6.0
+  version: 12.5.3
   condition: gitea.enabled
   values:
   - ../values/gitea/values/values.yaml

helmfile.d/ingress-haproxy.yaml.gotmpl

@@ -1,44 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
-- name: haproxytech
-  oci: true
-  url: 'ghcr.io/haproxytech/helm-charts'
-
-commonLabels:
-  tier: system
-
-releases:
-- name: ingress-haproxy
-  namespace: ingress-haproxy
-  chart: haproxytech/kubernetes-ingress
-  version: 1.49.0
-  condition: haproxy.enabled
-  values:
-  - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl
-  - ../values/ingress-haproxy/values/ingress-haproxy-{{ .Environment.Name }}.yaml.gotmpl
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/ingress-haproxy/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: ingress-haproxy
-  chart: manifests
-  condition: haproxy.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/ingress-haproxy/env.yaml.gotmpl
-  - ../values/ingress-haproxy/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/ingress-haproxy/manifests
-    - manifests

helmfile.d/kueue.yaml.gotmpl

@@ -8,7 +8,7 @@ releases:
 - name: kueue
   namespace: kueue-system
   chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.17.3
+  version: 0.17.1
   condition: kueue.enabled
   values:
   - ../values/kueue/values/values.yaml

helmfile.d/kyverno.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: kyverno
   namespace: kyverno
   chart: kyverno/kyverno
-  version: 3.8.1
+  version: 3.7.1
   condition: kyverno.enabled
   values:
   - ../values/kyverno/values/kyverno.yaml.gotmpl

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 7.0.0
+  version: 6.55.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/niks3.yaml.gotmpl

@@ -1,27 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-commonLabels:
-  tier: system
-
-releases:
-- name: manifests
-  namespace: niks3
-  chart: manifests
-  condition: niks3.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/niks3/env.yaml.gotmpl
-  - ../values/niks3/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/niks3/manifests
-    - manifests

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.3.7
+  version: 0.3.2
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.158.1
+  version: 0.150.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/postgres-operator.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: postgres-operator
   namespace: cnpg
   chart: cloudnative-pg/cloudnative-pg
-  version: 0.28.2
+  version: 0.28.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/postgres-operator.yaml.gotmpl

helmfile.d/prometheus.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: prometheus
   namespace: prometheus
   chart: prometheus/kube-prometheus-stack
-  version: 86.2.0
+  version: 82.15.1
   condition: prometheus.enabled
   values:
   - ../values/prometheus/values/prometheus.yaml.gotmpl

helmfile.d/spegel.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: spegel
   namespace: spegel
   chart: spegel/spegel
-  version: 0.6.0
+  version: 0.7.0
   condition: spegel.enabled
   values:
   - ../values/spegel/values/spegel.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.9.4
+  version: 7.7.20
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/velero.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: velero
   namespace: velero
   chart: velero/velero
-  version: 12.0.2
+  version: 12.0.0
   condition: velero.enabled
   values:
   - ../values/velero/values/velero.yaml.gotmpl

helmfile.d/x509-exporter.yaml.gotmpl

@@ -3,8 +3,7 @@ bases:
 
 repositories:
   - name: x509-exporter
-    oci: true
+    url: 'https://charts.enix.io'
-    url: 'quay.io/enix/charts'
 
 commonLabels:
   tier: sys
@@ -13,7 +12,7 @@ releases:
 - name: x509-exporter
   namespace: x509-exporter
   chart: x509-exporter/x509-certificate-exporter
-  version: 4.1.0
+  version: 3.20.1
   condition: x509_exporter.enabled
   values:
   - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl

values/argo/manifests/sys-project.yaml

@@ -94,22 +94,18 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: jobset-system
     server: https://kubernetes.default.svc
-  - namespace: ingress-haproxy
-    server: https://kubernetes.default.svc
   - namespace: dex
     server: https://kubernetes.default.svc
   - namespace: cra-agent
     server: https://kubernetes.default.svc
   - namespace: catalyst
     server: https://kubernetes.default.svc
-  - namespace: niks3
-    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
   - https://git.oceanbox.io/platform/manifests.git
   - https://git.oceanbox.io/platform/manifests
-  - https://git.oceanbox.io/oceanbox/manifests.git
+  - https://gitlab.com/oceanbox/manifests.git
   - https://kubernetes.github.io/ingress-nginx
   - https://cloudnative-pg.github.io/charts
   - https://charts.jetstack.io
@@ -143,7 +139,6 @@ spec:
   - ghcr.io/spegel-org/helm-charts
   - quay.io/cilium/charts
   - quay.io/jetstack/charts
-  - quay.io/enix/charts
   - registry.k8s.io/jobset/charts/jobset
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
   - docker.gitea.com
@@ -153,4 +148,3 @@ spec:
   - https://twin.github.io/helm-charts
   - https://charts.dexidp.io
   - public.ecr.aws/diagrid/catalyst
-  - ghcr.io/haproxytech/helm-charts

values/atlantis/kustomize/beta/actor-config.yaml

@@ -3,8 +3,7 @@ kind: ConfigMap
 metadata:
   name: beta-atlantis-actor-config
 data:
-  KUEUE_NAMESPACE: "prod-queue"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.14"
   XTRACT_QUEUE: "prod-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.14"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
   PLUME_QUEUE: "prod-queue"

values/atlantis/kustomize/beta/appsettings.json

@@ -76,7 +76,7 @@
         "https://maps.beta.oceanbox.io"
     ],
     "appName": "atlantis",
-    "appEnv": "preprod",
+    "appEnv": "prod",
     "appNamespace": "atlantis",
     "appVersion": "2.95.1",
     "otelCollector": "http://opentelemetry-collector.otel.svc:4317",

values/atlantis/kustomize/prod/actor-config.yaml

@@ -3,7 +3,6 @@ kind: ConfigMap
 metadata:
   name: prod-atlantis-actor-config
 data:
-  KUEUE_NAMESPACE: "prod-queue"
   XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
   XTRACT_QUEUE: "prod-queue"
   PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"

values/atlantis/kustomize/staging/actor-config.yaml

@@ -3,7 +3,7 @@ kind: ConfigMap
 metadata:
   name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.4.0"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
   XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.4.0"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
   PLUME_QUEUE: "dev-queue"

values/atlantis/values/values-beta.yaml.gotmpl

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.13.1
+  tag: v1.48.1
 
 podAnnotations:
   dapr.io/app-id: "beta-atlantis"
@@ -11,7 +11,7 @@ env:
   - name: APP_NAMESPACE
     value: beta-atlantis
   - name: APP_VERSION
-    value: "2.13.1-beta"
+    value: "2.97.4-beta"
   - name: LOG_LEVEL
     value: "1"
   - name: ANALYTICS_WEB_ID

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: ebead312-debug
+  tag: 5d810716-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/attic/env-oceanbox.yaml.gotmpl

@@ -0,0 +1,2 @@
+attic:
+  enabled: false

values/attic/env.yaml.gotmpl

@@ -1,3 +1,3 @@
-niks3:
+attic:
   enabled: false
   autosync: false

values/attic/manifests/attic.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: attic
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: attic
+    server: "https://kubernetes.default.svc"
+  sources:
+    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
+      targetRevision: HEAD
+      path: values/attic/manifests
+  project: aux
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: aux
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      # - ServerSideApply=true
+    automated:
+      prune: true
+      # selfHeal: false

values/attic/manifests/cluster.yaml

@@ -1,10 +1,10 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: niks3-db
+  name: attic-db
-  namespace: niks3
+  namespace: attic
   labels:
-    app: niks3-db
+    app: attic-db
 spec:
   instances: 1
   primaryUpdateStrategy: unsupervised

values/attic/manifests/cm.yaml

@@ -0,0 +1,167 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: attic
+  name: attic-config
+  namespace: attic
+data:
+  config.toml: |
+    # src: https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
+
+    # Socket address to listen on
+    listen = "[::]:8080"
+
+    # Allowed `Host` headers
+    #
+    # This _must_ be configured for production use. If unconfigured or the
+    # list is empty, all `Host` headers are allowed.
+    allowed-hosts = []
+
+    # The canonical API endpoint of this server
+    #
+    # This is the endpoint exposed to clients in `cache-config` responses.
+    #
+    # This _must_ be configured for production use. If not configured, the
+    # API endpoint is synthesized from the client's `Host` header which may
+    # be insecure.
+    #
+    # The API endpoint _must_ end with a slash (e.g., `https://domain.tld/attic/`
+    # not `https://domain.tld/attic`).
+    api-endpoint = "https://attic.srv.oceanbox.io/"
+
+    # Whether to soft-delete caches
+    #
+    # If this is enabled, caches are soft-deleted instead of actually
+    # removed from the database. Note that soft-deleted caches cannot
+    # have their names reused as long as the original database records
+    # are there.
+    #soft-delete-caches = false
+
+    # Whether to require fully uploading a NAR if it exists in the global cache.
+    #
+    # If set to false, simply knowing the NAR hash is enough for
+    # an uploader to gain access to an existing NAR in the global
+    # cache.
+    #require-proof-of-possession = true
+
+    # Database connection
+    [database]
+    # Connection URL
+    #
+    # For production use it's recommended to use PostgreSQL.
+    url = "postgresql://app:mZP1BnmnpDU33B7UZvomYKOSS1laRJ4bvUR7jNDZ1AJqPdNxH2rLXykghczg7Bgy@attic-db-rw:5432/app"
+
+    # Whether to enable sending on periodic heartbeat queries
+    #
+    # If enabled, a heartbeat query will be sent every minute
+    #heartbeat = false
+
+    # File storage configuration
+    [storage]
+    # Storage type
+    #
+    # Can be "local" or "s3".
+    type = "local"
+
+    # ## Local storage
+
+    # The directory to store all files under
+    path = "/attic"
+
+    # ## S3 Storage (set type to "s3" and uncomment below)
+
+    # The AWS region
+    #region = "us-east-1"
+
+    # The name of the bucket
+    #bucket = "some-bucket"
+
+    # Custom S3 endpoint
+    #
+    # Set this if you are using an S3-compatible object storage (e.g., Minio).
+    #endpoint = "https://xxx.r2.cloudflarestorage.com"
+
+    # Credentials
+    #
+    # If unset, the credentials are read from the `AWS_ACCESS_KEY_ID` and
+    # `AWS_SECRET_ACCESS_KEY` environment variables.
+    #[storage.credentials]
+    #  access_key_id = ""
+    #  secret_access_key = ""
+
+    # Data chunking
+    #
+    # Warning: If you change any of the values here, it will be
+    # difficult to reuse existing chunks for newly-uploaded NARs
+    # since the cutpoints will be different. As a result, the
+    # deduplication ratio will suffer for a while after the change.
+    [chunking]
+    # The minimum NAR size to trigger chunking
+    #
+    # If 0, chunking is disabled entirely for newly-uploaded NARs.
+    # If 1, all NARs are chunked.
+    nar-size-threshold = 65536 # chunk files that are 64 KiB or larger
+
+    # The preferred minimum size of a chunk, in bytes
+    min-size = 16384            # 16 KiB
+
+    # The preferred average size of a chunk, in bytes
+    avg-size = 65536            # 64 KiB
+
+    # The preferred maximum size of a chunk, in bytes
+    max-size = 262144           # 256 KiB
+
+    # Compression
+    [compression]
+    # Compression type
+    #
+    # Can be "none", "brotli", "zstd", or "xz"
+    type = "zstd"
+
+    # Compression level
+    #level = 8
+
+    # Garbage collection
+    [garbage-collection]
+    # The frequency to run garbage collection at
+    #
+    # By default it's 12 hours. You can use natural language
+    # to specify the interval, like "1 day".
+    #
+    # If zero, automatic garbage collection is disabled, but
+    # it can still be run manually with `atticd --mode garbage-collector-once`.
+    interval = "1 week"
+
+    # Default retention period
+    #
+    # Zero (default) means time-based garbage-collection is
+    # disabled by default. You can enable it on a per-cache basis.
+    default-retention-period = "6 months"
+
+    [jwt]
+    # WARNING: Changing _anything_ in this section will break any existing
+    # tokens. If you need to regenerate them, ensure that you use the the
+    # correct secret and include the `iss` and `aud` claims.
+
+    # JWT `iss` claim
+    #
+    # Set this to the JWT issuer that you want to validate.
+    # If this is set, all received JWTs will validate that the `iss` claim
+    # matches this value.
+    #token-bound-issuer = "some-issuer"
+
+    # JWT `aud` claim
+    #
+    # Set this to the JWT audience(s) that you want to validate.
+    # If this is set, all received JWTs will validate that the `aud` claim
+    # contains at least one of these values.
+    #token-bound-audiences = ["some-audience1", "some-audience2"]
+
+    [jwt.signing]
+    # JWT RS256 secret key
+    #
+    # Set this to the base64-encoded private half of an RSA PEM PKCS1 key.
+    # You can also set it via the `ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64`
+    # environment variable.
+    token-rs256-secret-base64 = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBdlZrMHQyZUtvdjhpV3prVFFtQzJtRklvd0gxc2liNlVpUFhUaGVwcURiWHMyaERFCnFYa1pKUXRjTnY0T2RtcldmZ2tsbjVyblJNQk5yL1B5dE05OFFMVVJnbzFSU2VTeUVjcmxSU1N4MElVRlhkM3YKV0U0aTJJTktsSzgxblJoY0o4czRUM09iYUpvSUQweEpqS2IzMkhxZmpOSU1vcVdBRk1ES2YyMUM5OWxQeTRXSgpVUUVnYTRzbHo5RzZHVi8wZW5qbFNMa2RRNjEvdEwyRE1ISHgvV2VRUEtpWkF4c2Fwczd3ZVJiNVBrS3J0MVlGClRxa1lJSjY3eDFiNDR1N0NmdWdVbHhMM2JCQ1lqVXVXNnoxdGU3T2ZQUUhoM1FPU2lFZTczQ3I4dU1lSkplV0wKN2VKc1hWSG9uVzBMZWl0aDk5WmJTUTF3YlhieDVPZzNTQ3ZWYnkyZE90Y3Rud2Y2aDN5YlJ3SUNoc24xbk4zMwowRkMyOXlFY0ExQ2VFVzRsMVVHNmxoMGw5cEpiWEhRNlFJS1paempaTlgxZTRGRW5TdytGNGhXd3R1Z2JtKzZnCnVPdEE5QVJxYndJOTFLeEtoT204Q0RJQlRwWThSZG1SaElicWUrc3czT3p3dGk0eTVkU3FMREsrT3Y5b05ucngKQW9TN21TaXNQeDVJS3JwaFhMT3JvVmI2L1puSmNOK3ljaExuenptMDY2Zk5RaTBLNHhzaitvWkphaXVjZnBacAphSElHZGpaY1U3aE5FUzdJNVliVEFqUDdkaDRzdXJnMk1xTUtxbUxsa2ZPcGFoRTlMQTZVVFZRZHZLVFVGNWZwCkdYSnhaT1RKWlpiOGNQTFYxZFdXbnBMaEZNV2h2OUZQTCtDVGZQVUFvQmtmOTE3TzFLdkE3bGsvcTJzQ0F3RUEKQVFLQ0FnQU9WZ3k1dmlzdkFDWTN4ZkNCWEJVM0h6RmFzYVJnSVgvWmh0TkhGbUtGT3pyOW43dGtJWGtYNXU1SwpjNTNndFdJY0ZORTJibUlJUUk4aFBWVW8vM1NtNlk2ejFjTkwxdmJzaGZJcDlBZEtoR2ZOblpvYmszN3I2YlRoCjRRb3NKTVlGZFV1RUtIcWh4dGZKWUx0STNQTnkvb1hLQWJWWE16U3BYWmQzWW14cG01aUJEbEZCUXRhVGpldUUKK3BvZWhiZGE5b0JWcXo1ZCsycnA0bGRtZVpvYTE1YUNJVG5FbEc3R0puRHFtaVN3NUJkZ1FERVNyWmJZRVd5aQpRU0dDL1JUWXl2V1VJcWw5RXh5WnhobGRJaitCMkMyOFRzSXRHN0lpZzF2ajVaVlE0RHF3RmRzc1hiSmF0bkxvClNITlFBcXplT09xY2Mxb0p6N0dzNVRBYVZNZEtEQXZCZm1JMFBMcDNqNmVFOFFIYlduMHk2NzVYbnlqWllLUUcKaWx5R0pUNVRzMWZHWHlPSXBrNG4yQjM1V3dHcjIyTkxnYUd5cnZjRkgxN3JoZGVnaGlrZFJRd1FOcXRsZjBIZApMWDVRQWVwcUt3SE9uR1BGVy9XU2xGU0lEdkt1VFZSVGtvQmFSMTA3OFpiS2JXckZBbEdqYTFvbnNXQUh1YW5UClh5dFE4dWoxUEFFeWFMZUJEaUJxRVJ2am1VVFQ1ZktCOTdaVnRJenVBZ0lyWWZ6YjIyVEk2VFJ6OVZiQ2VyWG8KdTc0cnoxMjM2TXMrbmg5Y2xYd3VtQlBOU1d1eE9OdldOWEZ6VWdIOURzdlFRMWRsMFRJWEFQMGhFYkRHRkNBQwowUlg2M0lpcXFzUG1ZZUZNTGR5K2tVWjViNzI1TlhXWFRHbDRnQ1Y3NFVRU01ya0xrUUtDQVFFQStobXIwYjdnClVYcWRKaGtLRXVsa29IVzVuYzZ4QmhobCtuTkFucVFSTm5tQWpiaDlCeDVpLzQ2WUwxcHFYQUY5cTNIRlowSDIKZEJRZXN2Q0pxbmtSTHVwTi95VE1KSlo0ZE5kMHZqRzZ0UGhMUjZuRmRabHU0TFBRMXRKcU5XZkhZeCtwQ3N2SQo4Wkx3VG8rRGFxSjArZDk3WWF0b0dWNUZHOWtUSjhBYWFXb0Q1R1AyOGtOd0djKzI0b2VNYnJtU0ppQ2I2UlJoCjA5WWJaMGpXdkFHaXJyMzFOTW5nR0dtVmRPMThoOXVMUStLNzFUQWt1eFEzZEhpUzh6UVd6YythRnM1THgyUnIKeXppcEJhR3VySmFJQ05XNklFQm5ndFcvZEZaYXpMbjhQcDVrQlJzQ1NyN1JpQkNFSFZmeHBYVFNoS3cwVWp4NQo2a0gwc01YZnFoOFpMUUtDQVFFQXdkQ3BPUXBRa1RhK0t6Z0VrWGdMVnk2QmZJKzRWdC9BYjRtK2pFSm85aUIzCnN4dEtKNU5tNXltNldXcmFWS25zekxNZy85Mi9vSVZreUlNSklrOWNYdEpuaEU5ak1aVzc2ZjhYbW5CUnJIMnAKVHVmNWtYWWdVUHZLQ2g1U1g5Q2w0UHJENHNSb3cwNHJjbHVxSE1MT2g1MncxUmJPalRrb05tNXBHWlFoVkhxeApaUzh3aVk3bzhLNFZJQXZOVlZOdGlIZFNOY2Y0cDMxL0F6SU5aQjJWdlczeWJHTWNIdDByekQ5TkpZLzhTekc3CktEME5mRTgzeng2OWxHTlhUcURGSnBTV2ZNVlFwSGVCM0FTRTV1YVhVM1c5S3EwN2NDOEJWSHRaK3B5a1B0RTYKOHgrZE9NYWh6UElaMjRqbkIzZkVsaWc0Rk5zd01LZm9aeDdKYUJLRjl3S0NBUUVBdWJUTUgwOWpVenovYVdXWQpWRmlYVG9wN3pGRElvNlVFUEFiT1NiMjd4ajVNRlcrUzd2RkNRMDZIZEVubnhlK1pkKzlmeS85djE5dUV2QXZkCnZRWnVtdTZDQWQwNTlFVUNwb2ZCZU9TR0paQmtuWTdUUHpJeDRZbkRuVy9hUzFPRyt2UnNXY2JkcTNzWEVzNS8KbjNPSDltNWFPRGpGY0dqT1doSkNwZlovNWh4QlRacG9xSlVvclJIT1U4Q2dweXNGK1dlblBWZlVHQzdZWkVYeQpwT0YyQWRpdE5ZaGM3T09oaFpRK0xzYjNUdTRSMlFnSmpoeEIzU3NXdXAzSC9RU1UvekFwbHFIYlpLZnE0WEtmCnVDbUNVMFVZRXBDZ0M4ZFpoVElGOUJSNTE2bFd6Vyt6c1BxbHJTbk9YOWVJWi9vcHd6ZjNGY1V3SmFEWjUxVFcKY29UcTlRS0NBUUVBckhtVTdpYkl0Y0Zpa0RGa2wxT2R1L0t0MW54TFRqd0dFdndnYnM3MmV2ay9yRXEvdmVKRgpzN2NGbDJjb2JpbGRpbmhxQ0doOGpFdkkrVXJxeVBhWXUrVS9xNVcrTHpVUnFkV1JXcVZUZVUzR2FtcXpSQWc4CkQvVlJ3WmxrTXRJSm0rRnNpcFBBcXZVWVlzZEI1aUJTREl0Ky90SXg4NmtHcVJHdVE4MzNyeWNVVUhnakdIYnQKd3FrWU1aRnZJOXgvWCs3WFlQYll4Nnc5YUVtVmN4K0V6ck5XQmJCWktQb25iTFowWDlYM2JhOE8zMnNkWWg5WgpDZDlRVkFubmV4aEUrZVZHMmpmNVlMTGRCRCtkU2FHd3p0dTdBSXh5bFkydkFGQlpMVlZTTUhpZm5oWG5Jc3hZCjFub29HcDZGQWJkS1lWbmZObWdzUlZCVzE5V2s1QkYvMXdLQ0FRRUFqVnR1RXdYZzU5NERIaVN4UjlWbGRBaHYKcXF5dlpieVhPT2pnNHNKZjFLUlpxZkkzV28yL05IQWN0MlZlREE1bnlEM001YndHWEwrdVZGaUlMVk1ZMUp0WQp6MmlHWHgwZVdlbFJya2tRZHFncTI1TE9BQ2dxYTFMNW9tQS9tMGcwQWljWVdYa1FYSXpXRkhwb0ZqcU9KZHpTCnZ0MHhLV2lpWHUxVk5YeDJibFR1dXBCa1JUZUlQNTVxdWdyOUh0ZmY1MHc5MHhwTllaMFR3d0lDMG1neVVMMWEKRkdVdHlPUTlqVFBUUUdGM3h6REJCQ2U2MW5uZUV0TThRMEJ1MXh3Rm90aWFYSE9NaGhiMFBndVkzNHhiekNHYgpHcTlsWjVaN2lRVXByUWNNYjhrUzZ1WFk3VHBDTmUzaDBiTTM5dVlKeHNYNXUzcmVNRWsyZlBNT3dnTlFjdz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="

values/attic/manifests/deployment.yaml

@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: attic
+spec:
+  selector:
+    matchLabels:
+      app: attic
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: attic
+    spec:
+      containers:
+        - name: attic
+          image: ghcr.io/zhaofengli/attic:latest
+          args:
+           - -f
+           - /config.toml
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          env:
+            - name: ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
+              value: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBdlZrMHQyZUtvdjhpV3prVFFtQzJtRklvd0gxc2liNlVpUFhUaGVwcURiWHMyaERFCnFYa1pKUXRjTnY0T2RtcldmZ2tsbjVyblJNQk5yL1B5dE05OFFMVVJnbzFSU2VTeUVjcmxSU1N4MElVRlhkM3YKV0U0aTJJTktsSzgxblJoY0o4czRUM09iYUpvSUQweEpqS2IzMkhxZmpOSU1vcVdBRk1ES2YyMUM5OWxQeTRXSgpVUUVnYTRzbHo5RzZHVi8wZW5qbFNMa2RRNjEvdEwyRE1ISHgvV2VRUEtpWkF4c2Fwczd3ZVJiNVBrS3J0MVlGClRxa1lJSjY3eDFiNDR1N0NmdWdVbHhMM2JCQ1lqVXVXNnoxdGU3T2ZQUUhoM1FPU2lFZTczQ3I4dU1lSkplV0wKN2VKc1hWSG9uVzBMZWl0aDk5WmJTUTF3YlhieDVPZzNTQ3ZWYnkyZE90Y3Rud2Y2aDN5YlJ3SUNoc24xbk4zMwowRkMyOXlFY0ExQ2VFVzRsMVVHNmxoMGw5cEpiWEhRNlFJS1paempaTlgxZTRGRW5TdytGNGhXd3R1Z2JtKzZnCnVPdEE5QVJxYndJOTFLeEtoT204Q0RJQlRwWThSZG1SaElicWUrc3czT3p3dGk0eTVkU3FMREsrT3Y5b05ucngKQW9TN21TaXNQeDVJS3JwaFhMT3JvVmI2L1puSmNOK3ljaExuenptMDY2Zk5RaTBLNHhzaitvWkphaXVjZnBacAphSElHZGpaY1U3aE5FUzdJNVliVEFqUDdkaDRzdXJnMk1xTUtxbUxsa2ZPcGFoRTlMQTZVVFZRZHZLVFVGNWZwCkdYSnhaT1RKWlpiOGNQTFYxZFdXbnBMaEZNV2h2OUZQTCtDVGZQVUFvQmtmOTE3TzFLdkE3bGsvcTJzQ0F3RUEKQVFLQ0FnQU9WZ3k1dmlzdkFDWTN4ZkNCWEJVM0h6RmFzYVJnSVgvWmh0TkhGbUtGT3pyOW43dGtJWGtYNXU1SwpjNTNndFdJY0ZORTJibUlJUUk4aFBWVW8vM1NtNlk2ejFjTkwxdmJzaGZJcDlBZEtoR2ZOblpvYmszN3I2YlRoCjRRb3NKTVlGZFV1RUtIcWh4dGZKWUx0STNQTnkvb1hLQWJWWE16U3BYWmQzWW14cG01aUJEbEZCUXRhVGpldUUKK3BvZWhiZGE5b0JWcXo1ZCsycnA0bGRtZVpvYTE1YUNJVG5FbEc3R0puRHFtaVN3NUJkZ1FERVNyWmJZRVd5aQpRU0dDL1JUWXl2V1VJcWw5RXh5WnhobGRJaitCMkMyOFRzSXRHN0lpZzF2ajVaVlE0RHF3RmRzc1hiSmF0bkxvClNITlFBcXplT09xY2Mxb0p6N0dzNVRBYVZNZEtEQXZCZm1JMFBMcDNqNmVFOFFIYlduMHk2NzVYbnlqWllLUUcKaWx5R0pUNVRzMWZHWHlPSXBrNG4yQjM1V3dHcjIyTkxnYUd5cnZjRkgxN3JoZGVnaGlrZFJRd1FOcXRsZjBIZApMWDVRQWVwcUt3SE9uR1BGVy9XU2xGU0lEdkt1VFZSVGtvQmFSMTA3OFpiS2JXckZBbEdqYTFvbnNXQUh1YW5UClh5dFE4dWoxUEFFeWFMZUJEaUJxRVJ2am1VVFQ1ZktCOTdaVnRJenVBZ0lyWWZ6YjIyVEk2VFJ6OVZiQ2VyWG8KdTc0cnoxMjM2TXMrbmg5Y2xYd3VtQlBOU1d1eE9OdldOWEZ6VWdIOURzdlFRMWRsMFRJWEFQMGhFYkRHRkNBQwowUlg2M0lpcXFzUG1ZZUZNTGR5K2tVWjViNzI1TlhXWFRHbDRnQ1Y3NFVRU01ya0xrUUtDQVFFQStobXIwYjdnClVYcWRKaGtLRXVsa29IVzVuYzZ4QmhobCtuTkFucVFSTm5tQWpiaDlCeDVpLzQ2WUwxcHFYQUY5cTNIRlowSDIKZEJRZXN2Q0pxbmtSTHVwTi95VE1KSlo0ZE5kMHZqRzZ0UGhMUjZuRmRabHU0TFBRMXRKcU5XZkhZeCtwQ3N2SQo4Wkx3VG8rRGFxSjArZDk3WWF0b0dWNUZHOWtUSjhBYWFXb0Q1R1AyOGtOd0djKzI0b2VNYnJtU0ppQ2I2UlJoCjA5WWJaMGpXdkFHaXJyMzFOTW5nR0dtVmRPMThoOXVMUStLNzFUQWt1eFEzZEhpUzh6UVd6YythRnM1THgyUnIKeXppcEJhR3VySmFJQ05XNklFQm5ndFcvZEZaYXpMbjhQcDVrQlJzQ1NyN1JpQkNFSFZmeHBYVFNoS3cwVWp4NQo2a0gwc01YZnFoOFpMUUtDQVFFQXdkQ3BPUXBRa1RhK0t6Z0VrWGdMVnk2QmZJKzRWdC9BYjRtK2pFSm85aUIzCnN4dEtKNU5tNXltNldXcmFWS25zekxNZy85Mi9vSVZreUlNSklrOWNYdEpuaEU5ak1aVzc2ZjhYbW5CUnJIMnAKVHVmNWtYWWdVUHZLQ2g1U1g5Q2w0UHJENHNSb3cwNHJjbHVxSE1MT2g1MncxUmJPalRrb05tNXBHWlFoVkhxeApaUzh3aVk3bzhLNFZJQXZOVlZOdGlIZFNOY2Y0cDMxL0F6SU5aQjJWdlczeWJHTWNIdDByekQ5TkpZLzhTekc3CktEME5mRTgzeng2OWxHTlhUcURGSnBTV2ZNVlFwSGVCM0FTRTV1YVhVM1c5S3EwN2NDOEJWSHRaK3B5a1B0RTYKOHgrZE9NYWh6UElaMjRqbkIzZkVsaWc0Rk5zd01LZm9aeDdKYUJLRjl3S0NBUUVBdWJUTUgwOWpVenovYVdXWQpWRmlYVG9wN3pGRElvNlVFUEFiT1NiMjd4ajVNRlcrUzd2RkNRMDZIZEVubnhlK1pkKzlmeS85djE5dUV2QXZkCnZRWnVtdTZDQWQwNTlFVUNwb2ZCZU9TR0paQmtuWTdUUHpJeDRZbkRuVy9hUzFPRyt2UnNXY2JkcTNzWEVzNS8KbjNPSDltNWFPRGpGY0dqT1doSkNwZlovNWh4QlRacG9xSlVvclJIT1U4Q2dweXNGK1dlblBWZlVHQzdZWkVYeQpwT0YyQWRpdE5ZaGM3T09oaFpRK0xzYjNUdTRSMlFnSmpoeEIzU3NXdXAzSC9RU1UvekFwbHFIYlpLZnE0WEtmCnVDbUNVMFVZRXBDZ0M4ZFpoVElGOUJSNTE2bFd6Vyt6c1BxbHJTbk9YOWVJWi9vcHd6ZjNGY1V3SmFEWjUxVFcKY29UcTlRS0NBUUVBckhtVTdpYkl0Y0Zpa0RGa2wxT2R1L0t0MW54TFRqd0dFdndnYnM3MmV2ay9yRXEvdmVKRgpzN2NGbDJjb2JpbGRpbmhxQ0doOGpFdkkrVXJxeVBhWXUrVS9xNVcrTHpVUnFkV1JXcVZUZVUzR2FtcXpSQWc4CkQvVlJ3WmxrTXRJSm0rRnNpcFBBcXZVWVlzZEI1aUJTREl0Ky90SXg4NmtHcVJHdVE4MzNyeWNVVUhnakdIYnQKd3FrWU1aRnZJOXgvWCs3WFlQYll4Nnc5YUVtVmN4K0V6ck5XQmJCWktQb25iTFowWDlYM2JhOE8zMnNkWWg5WgpDZDlRVkFubmV4aEUrZVZHMmpmNVlMTGRCRCtkU2FHd3p0dTdBSXh5bFkydkFGQlpMVlZTTUhpZm5oWG5Jc3hZCjFub29HcDZGQWJkS1lWbmZObWdzUlZCVzE5V2s1QkYvMXdLQ0FRRUFqVnR1RXdYZzU5NERIaVN4UjlWbGRBaHYKcXF5dlpieVhPT2pnNHNKZjFLUlpxZkkzV28yL05IQWN0MlZlREE1bnlEM001YndHWEwrdVZGaUlMVk1ZMUp0WQp6MmlHWHgwZVdlbFJya2tRZHFncTI1TE9BQ2dxYTFMNW9tQS9tMGcwQWljWVdYa1FYSXpXRkhwb0ZqcU9KZHpTCnZ0MHhLV2lpWHUxVk5YeDJibFR1dXBCa1JUZUlQNTVxdWdyOUh0ZmY1MHc5MHhwTllaMFR3d0lDMG1neVVMMWEKRkdVdHlPUTlqVFBUUUdGM3h6REJCQ2U2MW5uZUV0TThRMEJ1MXh3Rm90aWFYSE9NaGhiMFBndVkzNHhiekNHYgpHcTlsWjVaN2lRVXByUWNNYjhrUzZ1WFk3VHBDTmUzaDBiTTM5dVlKeHNYNXUzcmVNRWsyZlBNT3dnTlFjdz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="
+              # valueFrom:
+              #   secretKeyRef:
+              #     name: server
+              #     key: token
+            - name: ATTIC_SERVER_DATABASE_URL
+              value: "postgresql://app:mZP1BnmnpDU33B7UZvomYKOSS1laRJ4bvUR7jNDZ1AJqPdNxH2rLXykghczg7Bgy@attic-db-rw:5432/app"
+              # valueFrom:
+                # secretKeyRef:
+                  # name: database
+                  # key: url
+          volumeMounts:
+          - name: data
+            mountPath: /attic
+          - name: attic-config
+            mountPath: /config.toml
+            subPath: config.toml
+      volumes:
+        - name: server
+          secret:
+            secretName: server
+        - name: attic-config
+          configMap:
+            defaultMode: 420
+            name: attic-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: attic

values/attic/manifests/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  labels:
+    app.kubernetes.io/component: attic
+  name: attic
+  namespace: attic
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: attic.srv.oceanbox.io
+    http:
+      paths:
+      - backend:
+          service:
+            name: attic
+            port:
+              name: http
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - attic.srv.oceanbox.io
+    secretName: attic.srv.oceanbox.io-tls

values/attic/manifests/policies/allow-cache-nixos.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-cache-nixos
+  namespace: ncps
+spec:
+  egress:
+    - toFQDNs:
+        - matchPattern: 'cache.nixos.org'
+        - matchPattern: 'nix-community.cachix.org'
+  endpointSelector:
+    matchLabels:
+      app: nix-cache

values/attic/manifests/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: attic
+  labels:
+    app: attic
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi

values/attic/manifests/secret.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: server
+stringData:
+  token: "ref+sops://secrets.yml#attic/jwtToken"

values/attic/manifests/svc.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: niks3
+  name: attic
   labels:
-    app: niks3
+    app: attic
 spec:
   type: ClusterIP
   selector:
-    app: niks3
+    app: attic
   ports:
     - name: http
-      port: 5751
+      port: 8080
       targetPort: http

values/catalyst/env-hel1.yaml.gotmpl

@@ -1,3 +1,3 @@
 catalyst:
-  enabled: false
+  enabled: true
   autosync: false

values/cilium/cilium-manifests/gateway.yaml

@@ -9,6 +9,14 @@ metadata:
   name: shared-gateway
   namespace: kube-system
 spec:
+  infrastructure:
+    annotations:
+      load-balancer.hetzner.cloud/location: hel1
+      load-balancer.hetzner.cloud/type: lb11
+      load-balancer.hetzner.cloud/name: load-balancer-2
+      load-balancer.hetzner.cloud/use-private-ip: "true"
+      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+      load-balancer.hetzner.cloud/http-redirect-https: "false"
   gatewayClassName: cilium
   listeners:
     - name: http

values/codex/values/values-staging.yaml

@@ -38,4 +38,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: a07f3de9-debug
+  tag: 651291bd-debug

values/docs/manifests/docs.yaml

@@ -1,8 +1,8 @@
-{{- if .Values.clusterConfig.argo.enabled }}
+{{ if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: {{ .Values.docs.env }}-docs
+  name: docs
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -11,11 +11,7 @@ metadata:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    {{- if eq .Values.docs.env "prod" }}
     namespace: docs
-    {{- else }}
-    namespace: {{ .Values.docs.env }}-docs
-    {{- end }}
     server: https://kubernetes.default.svc
   project: default
   sources:
@@ -28,7 +24,7 @@ spec:
       - name: CLUSTER_NAME
         value: {{ .Values.clusterConfig.cluster }}
       - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.docs.env }}
+        value: default
       - name: HELMFILE_FILE_PATH
         value: docs.yaml.gotmpl
   syncPolicy:

values/docs/values/values-staging.yaml

@@ -1,20 +0,0 @@
-fullnameOverride: staging-docs
-image:
-  tag: "e19982e6-debug"
-ingress:
-  enabled: true
-  className: "haproxy"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/cors-enable: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: docs.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - docs.oceanbox.io
-      secretName: default-docs-tls

values/docs/values/values.yaml

@@ -1,6 +1,27 @@
 replicaCount: 1
+image:
+  tag: "ea8cf7dc-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"
   - name: LOG_LEVEL
     value: "1"
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: docs.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - docs.oceanbox.io
+      secretName: docs-tls

values/env.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://git.oceanbox.io/platform/manifests.git
+  manifests: https://gitlab.com/oceanbox/manifests.git
   env: "" #[dev, test, staging, prod]
   initca: ""
   domain: ".local"

values/fapr/env-ekman.yaml.gotmpl

@@ -1,2 +0,0 @@
-fapr:
-  enabled: true

values/fapr/env.yaml.gotmpl

@@ -1,4 +0,0 @@
-fapr:
-  enabled: true
-  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
-  env: {{ .Environment.Name }}

values/fapr/kustomize/base/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - _manifest.yaml

values/fapr/kustomize/prod-ekman/appsettings.json

@@ -1,20 +0,0 @@
-{
-  "appName": "fapr",
-  "appEnv": "prod",
-  "logLevel": "Information",
-  "aromeOutputDir": "/data/hdd/data/AROME",
-  "aromeStartDate": "2026-04-24",
-  "nveOutputDir": "/data/hdd/data/river-data/Data",
-  "nveNdays": 5000,
-  "nveApiUrl": "https://chartserver.nve.no/ShowData.aspx?req=getchart&ver=1.0",
-  "riverrunBinary": "/app/riverrun",
-  "norshelfOutputDir": "/data/hdd/data/norshelf/sea_norshelf_files",
-  "norshelfStartDate": "2026-03-01",
-  "nemoOutputDir": "/data/hdd/data/NEMO",
-  "copernicusmarineBinary": "/usr/local/bin/copernicusmarine",
-  "copernicusUsername": "",
-  "copernicusPassword": "",
-  "murOutputDir": "/data/hdd/data/river-data/MUR/MUR_SST_nc",
-  "netrcPath": "/root/.netrc",
-  "norkystOutputDir": "/data/hdd/data/norkyst"
-}

values/fapr/kustomize/prod-ekman/cron-bindings.yaml

@@ -1,77 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-arome
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 6 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-nve
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 8 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-norshelf
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-nemo
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-mur
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 6 * * *"
-scopes:
-  - prod-fapr
----
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-norkyst
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr

values/fapr/kustomize/prod-ekman/deployment_patch.yaml

@@ -1,3 +0,0 @@
-- op: add
-  path: /spec/template/spec/containers/0/envFrom
-  value: []

values/fapr/kustomize/prod-ekman/kustomization.yaml

@@ -1,21 +0,0 @@
-generatorOptions:
-  disableNameSuffixHash: true
-configMapGenerator:
-  - name: prod-fapr-appsettings
-    files:
-      - appsettings.json
-patches:
-  - target:
-      group: apps
-      version: v1
-      kind: Deployment
-    path: deployment_patch.yaml
-resources:
-  - ../base
-  - pv.yaml
-  - pvc.yaml
-  - secrets.yaml
-  - secretstore.yaml
-  - statestore.yaml
-  - tracing.yaml
-  - cron-bindings.yaml

values/fapr/kustomize/prod-ekman/pv.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-prod-fapr-ceph-data
-spec:
-  accessModes:
-    - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-prod-fapr-ceph-data
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem

values/fapr/kustomize/prod-ekman/pvc.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prod-fapr-ceph-data
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-prod-fapr-ceph-data

values/fapr/kustomize/prod-ekman/secrets.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: prod-fapr-redis
-type: Opaque
-data:

values/fapr/kustomize/prod-ekman/secretstore.yaml

@@ -1,12 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: secretstore
-spec:
-  type: secretstores.kubernetes
-  version: v1
-  metadata:
-    - name: defaultNamespace
-      value: prod-fapr
-scopes:
-  - prod-fapr

values/fapr/kustomize/prod-ekman/statestore.yaml

@@ -1,22 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: statestore
-spec:
-  type: state.redis
-  version: v1
-  metadata:
-    - name: redisHost
-      value: prod-fapr-redis:6379
-    - name: redisUsername
-      value: default
-    - name: redisPassword
-      secretKeyRef:
-        name: prod-fapr-redis
-        key: redis-password
-    - name: actorStateStore
-      value: "true"
-    - name: redisDB
-      value: "0"
-scopes:
-  - prod-fapr

values/fapr/kustomize/prod-ekman/tracing.yaml

@@ -1,11 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Configuration
-metadata:
-  name: tracing
-spec:
-  tracing:
-    samplingRate: "1"
-    otel:
-      endpointAddress: "10.255.241.12:4317"
-      protocol: grpc
-      isSecure: false

values/fapr/manifests/fapr.yaml

@@ -1,42 +0,0 @@
-{{ if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: {{ .Values.fapr.env }}-fapr
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-    argocd.argoproj.io/compare-options: ServerSideDiff=true
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    namespace: {{ .Values.fapr.env }}-fapr
-    server: https://kubernetes.default.svc
-  project: atlantis
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-      - name: CLUSTER_NAME
-        value: {{ .Values.clusterConfig.cluster }}
-      - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.fapr.env }}
-      - name: HELMFILE_FILE_PATH
-        value: fapr.yaml.gotmpl
-  - repoURL: https://git.oceanbox.io/platform/manifests.git
-    targetRevision: main
-    ref: values
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-    {{- if .Values.fapr.autosync }}
-    automated:
-      prune: true
-      selfHeal: false
-    {{- end }}
-{{- end }}

values/fapr/values/values-prod.yaml

@@ -1,55 +0,0 @@
-replicaCount: 1
-
-podAnnotations:
-  dapr.io/enabled: "true"
-  dapr.io/app-id: "prod-fapr"
-  dapr.io/app-port: "8080"
-  dapr.io/api-token-secret: "dapr-api-token"
-  dapr.io/config: "tracing"
-  dapr.io/app-protocol: "http"
-  dapr.io/log-as-json: "true"
-  dapr.io/sidecar-cpu-request: "10m"
-  dapr.io/sidecar-memory-request: "50Mi"
-
-env:
-  - name: APP_NAME
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.name
-  - name: APP_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-  - name: DAPR_API_TOKEN
-    valueFrom:
-      secretKeyRef:
-        name: dapr-api-token
-        key: token
-
-persistence:
-  enabled: true
-  existingClaim: prod-fapr-ceph-data
-
-redis:
-  enabled: true
-  replicas: 1
-  backup:
-    enabled: true
-  size: 2Gi
-  storageClass: "ceph-rbd"
-  secret:
-    name: "prod-fapr-redis"
-    key: "redis-password"
-  resources:
-    cpu: 100m
-    memory: 128Mi
-
-affinity:
-  nodeAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: "topology.kubernetes.io/group"
-              operator: In
-              values:
-                - srv

values/fapr/values/values.yaml

@@ -1 +0,0 @@
-# Base values for fapr - overridden per environment

values/gatus/manifests/ingress.yaml

@@ -3,15 +3,17 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: ca-issuer
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/cors-allow-headers: Content-Type, x-gatus-cache
+    nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, x-gatus-cache
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
   labels:
     app.kubernetes.io/name: gatus
   name: gatus
   namespace: uptime
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
   rules:
     - host: uptime.adm.hel1.obx
       http:
@@ -22,7 +24,7 @@ spec:
                 port:
                   number: 80
             path: /
-            pathType: Prefix
+            pathType: ImplementationSpecific
   tls:
     - hosts:
         - uptime.adm.hel1.obx

values/gatus/values/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: twinproduction/gatus
-  tag: v5.36.0
+  tag: v5.35.0
 
 # Does envFrom secret named gatus
 secrets: true

values/gitea/manifests/dragonfly.yaml

@@ -8,13 +8,18 @@ spec:
   resources:
     requests:
       cpu: 150m
-      memory: 1Gi
+      memory: 256Mi
     limits:
-      memory: 1Gi
+      memory: 256Mi
   args:
-    - --dbfilename=dump               # Static filename prevents disk exhaustion
+    - --dbfilename=dump           # Static filename prevents disk exhaustion
-    - --maxmemory=920Mi # ~90% of the 1Gi limit, leaving headroom
+    - --maxmemory=$(MAX_MEMORY)Mi # Graceful memory management (90% of limit)
-    - --cache_mode=true # evict near maxmemory instead of rejecting writes (graceful degradation)
     - --proactor_threads=1 # Auto-detect CPU cores (optimal threading)
     - --cluster_mode=emulated
     - --logtostderr
+  env:
+    - name: MAX_MEMORY
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+          divisor: 1Mi

values/gitea/values/values.yaml

@@ -3,11 +3,11 @@ replicaCount: 1
 image:
   registry: "docker.gitea.com"
   repository: gitea
-  tag: "1.26.2"
+  tag: "1.26.0"
 
 resources:
   requests:
-    cpu: 500m
+    cpu: 200m
     memory: 512Mi
 
 strategy:
@@ -82,8 +82,6 @@ gitea:
     database:
       DB_TYPE: postgres
       MAX_OPEN_CONNS: 90
-      MAX_IDLE_CONNS: 20
-      CONN_MAX_LIFETIME: 3h
     openid:
       ENABLE_OPENID_SIGNIN: false
       ENABLE_OPENID_SIGNUP: false
@@ -137,12 +135,15 @@ gitea:
 
 ingress:
   enabled: true
-  className: haproxy
+  className: nginx
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    haproxy.org/timeout-server: 600s
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/allow-list: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
   hosts:
     - host: git.oceanbox.io
       paths:

values/headscale/values/values.yaml

@@ -129,7 +129,6 @@ configMaps:
             "group:dev": [],
             "group:intern": [
               "haavahak@stud.ntnu.no",
-              "haavahak@ntnu.no",
             ],
             "group:ceph": [
               "jonas.juselius@oceanbox.io",
@@ -272,14 +271,6 @@ configMaps:
             { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
             { "action": "accept", "src": [ "erlend.mundal@oceanbox.io" ], "dst": [ "erlend.mundal@oceanbox.io:*" ] },
             // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
-          ],
-          "ssh": [
-            {
-              "action": "accept",
-              "src": [ "group:admin" ],
-              "dst": [ "autogroup:self", "tag:hpc", "tag:mumindalen", "tag:hel1" ],
-              "users": [ "autogroup:nonroot", "root" ]
-            }
           ]
         }
   dns:
@@ -311,13 +302,13 @@ configMaps:
            { "name": "cache.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "makai.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "makai.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "docs.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
 
            { "name": "slurm.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "slurm-gateway.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "yolo-registry.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
 
            { "name": "argocd.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "cache.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "prometheus.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "alertmanager.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "grafana.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
@@ -330,7 +321,6 @@ configMaps:
            { "name": "git.oceanbox.io", "type": "A", "value": "10.0.1.3" },
            { "name": "makai.oceanbox.io", "type": "A", "value": "10.0.1.3" },
            { "name": "docs.oceanbox.io", "type": "A", "value": "10.0.1.3" },
-           { "name": "docs.dev.oceanbox.io", "type": "A", "value": "10.0.1.3" },
 
            { "name": "kueue.dev.tos.obx", "type": "A", "value": "10.255.241.99" },
            { "name": "slurm-agent.rossby.oceanbox.io", "type": "A", "value": "172.16.239.222" },
@@ -367,21 +357,25 @@ configMaps:
 
            { "name": "jonas-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "jonas-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "jonas-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "stig-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "stig-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "stig-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
+           { "name": "stig-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "radovan-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "radovan-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "mrtz-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
-           { "name": "mrtz-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
+           { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "mrtz-diadash.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "simkir-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "simkir-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
+           { "name": "simkir-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
            { "name": "ole-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
-           { "name": "ole-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
            { "name": "ole-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "ole-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" }
+           { "name": "ole-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" }
         ]

values/ingress-haproxy/env-hel1.yaml.gotmpl

@@ -1,14 +0,0 @@
-haproxy:
-  enabled: true
-  autosync: true
-  pdb:
-    minAvailable: 1
-  resources:
-    controller:
-      cpu: "100m"
-      memory: "100Mi"
-  annotations:
-    load-balancer.hetzner.cloud/location: hel1
-    load-balancer.hetzner.cloud/name: load-balancer-1
-    load-balancer.hetzner.cloud/type: lb11
-    load-balancer.hetzner.cloud/use-private-ip: "true"

values/ingress-haproxy/env.yaml.gotmpl

@@ -1,10 +0,0 @@
-haproxy:
-  enabled: false
-  autosync: true
-  pdb:
-    minAvailable: 1
-  resources:
-    controller:
-      cpu: "100m"
-      memory: "100Mi"
-  annotations: []

values/ingress-haproxy/manifests/ingress-haproxy.yaml

@@ -1,40 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-haproxy
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  destination:
-    namespace: ingress-haproxy
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-        - name: CLUSTER_NAME
-          value: {{ .Values.clusterConfig.cluster }}
-        - name: HELMFILE_ENVIRONMENT
-          value: default
-        - name: HELMFILE_FILE_PATH
-          value: ingress-haproxy.yaml.gotmpl
-  project: sys
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      - ServerSideApply=true
-    {{- if .Values.haproxy.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -1,16 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: ingress-haproxy
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-        - host
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-hubble-traffic.yaml

@@ -1,16 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-traffic
-  namespace: ingress-haproxy
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: hubble.*.*.*
-        - matchPattern: hubble.*.*.*.*
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -1,19 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: ingress-haproxy
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ingress-haproxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "1024"
-              protocol: TCP
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-world-to-ingress-haproxy.yaml

@@ -1,21 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-ingress-haproxy
-  namespace: ingress-haproxy
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-  ingress:
-    - fromEntities:
-        - world
-    - toPorts:
-        - ports:
-            - port: "80"
-              protocol: TCP
-            - port: "443"
-              protocol: TCP
-{{- end }}

values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl

@@ -1,114 +0,0 @@
-## HAProxy Kubernetes Ingress Controller configuration
-## Ref: https://www.haproxy.com/documentation/kubernetes-ingress/
-##
-controller:
-  resources:
-    requests:
-      cpu: {{ .Values.haproxy.resources.controller.cpu }}
-      memory: {{ .Values.haproxy.resources.controller.memory }}
-
-  ingressClass: haproxy
-
-  ingressClassResource:
-    name: haproxy
-    default: true
-
-  config:
-    body-size: "0"
-    tune.bufsize: "131072"
-    ssl-redirect: "true"
-    forwarded-for: "true"
-
-    # NOTE: Emit HAProxy access logs (real client IP + request line)
-    # to the controller's stdout so `kubectl logs` can see them.
-    syslog-server: "address:stdout, format: raw, facility: daemon"
-
-    # Disable QUIC ar Hetzner LB doesn't support UDP
-    quic-enabled: "false"
-
-    # Proxy protocol
-    proxy-protocol: "10.0.0.0/8"
-    use-proxy-protocol: "true"
-
-  tolerations:
-   - key: unschedulable
-     operator: Exists
-     effect: NoSchedule
-   - key: node-role.kubernetes.io/control-plane
-     operator: Exists
-     effect: NoSchedule
-
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: kubernetes.io/hostname
-            operator: In
-            values: {{ .Values.clusterConfig.ingress_nodes }}
-
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchExpressions:
-          - key: app.kubernetes.io/instance
-            operator: In
-            values:
-            - ingress-haproxy
-          - key: app.kubernetes.io/name
-            operator: In
-            values:
-            - kubernetes-ingress
-        topologyKey: "kubernetes.io/hostname"
-
-  replicaCount: {{ .Values.clusterConfig.ingress_replica_count }}
-
-  PodDisruptionBudget:
-    enable: true
-    minAvailable: {{ .Values.haproxy.pdb.minAvailable }}
-
-  service:
-  {{- if .Values.clusterConfig.ingress_loadbalancer }}
-    type: LoadBalancer
-    {{- if .Values.clusterConfig.ingress_nodeport }}
-    nodePorts:
-      http: 30080
-      https: 30443
-    {{- end }}
-  {{- else if .Values.clusterConfig.ingress_nodeport }}
-    type: NodePort
-    externalTrafficPolicy: Local
-    nodePorts:
-      http: 30080
-      https: 30443
-  {{- else }}
-    type: ClusterIP
-  {{- end }}
-    annotations:
-      {{- with .Values.haproxy.annotations }}
-      {{ toYaml . | nindent 8 }}
-      {{- end }}
-
-  hostNetwork: {{ .Values.clusterConfig.ingress_hostnetwork }}
-
-  hostPorts:
-    enable: {{ .Values.clusterConfig.ingress_hostport }}
-    http: 80
-    https: 443
-
-  stats:
-    enabled: true
-
-  prometheus:
-    enabled: true
-    port: 1024
-    service:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "1024"
-
-  serviceMonitor:
-    enabled: true
-
-  extraArgs:
-    - --disable-quic

values/ingress-nginx/env-hel1.yaml.gotmpl

@@ -1,5 +1,5 @@
 nginx:
-  enabled: false
+  enabled: true
   autosync: true
   pdb:
     minAvailable: 1

values/kueue/manifests/sorcerer-queue-access.yaml

@@ -1,42 +1,3 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-prod-queue-ceph-archives
-spec:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  csi:
-    driver: rook-ceph.cephfs.csi.ceph.com
-    nodeStageSecretRef:
-      name: rook-csi-cephfs-node
-      namespace: rook-ceph
-    volumeAttributes:
-      clusterID: rook-ceph
-      fsName: data
-      rootPath: /
-      staticVolume: "true"
-    volumeHandle: pv-prod-queue-ceph-archives
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prod-queue-ceph-archives
-  namespace: prod-queue
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-prod-queue-ceph-archives
----
 # Cross-namespace RBAC: allow sorcerer ServiceAccounts to manage JobSets in dev-queue
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "5c518c62-debug"
+  tag: "ad49e745-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"
@@ -8,11 +8,13 @@ env:
     value: "1"
 ingress:
   enabled: true
-  className: "haproxy"
+  className: "nginx"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
     oceanbox.io/expose: internal
   hosts:
     - host: makai.oceanbox.io

values/niks3/env-ekman.yaml.gotmpl

@@ -1,2 +0,0 @@
-niks3:
-  enabled: true

values/niks3/manifests/deployment.yaml

@@ -1,73 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: niks3
-spec:
-  selector:
-    matchLabels:
-      app: niks3
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: niks3
-    spec:
-      containers:
-        - name: niks3
-          image: ghcr.io/mic92/niks3:v1.6.1
-          ports:
-            - name: http
-              containerPort: 5751
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          env:
-            - name: NIKS3_DB
-              valueFrom:
-                secretKeyRef:
-                  name: niks3-db-app
-                  key: uri
-            - name: NIKS3_API_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: server
-                  key: api-token
-            - name: NIKS3_S3_ENDPOINT
-              value: "10.255.241.30:30080"
-            - name: NIKS3_S3_BUCKET
-              value: "niks3"
-            - name: NIKS3_S3_REGION
-              value: "default"
-            - name: NIKS3_S3_USE_SSL
-              value: "false"
-            - name: NIKS3_S3_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: server
-                  key: s3-access-key
-            - name: NIKS3_S3_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: server
-                  key: s3-secret-key
-            - name: NIKS3_ENABLE_READ_PROXY
-              value: "true"
-            - name: NIKS3_CACHE_URL
-              value: "https://cache.ekman.oceanbox.io"
-            - name: NIKS3_SIGN_KEY_PATHS
-              value: "/secrets/sign-key"
-          volumeMounts:
-            - name: server
-              mountPath: /secrets
-              readOnly: true
-      volumes:
-        - name: server
-          secret:
-            secretName: server

values/niks3/manifests/gc-cronjob.yaml

@@ -1,49 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: niks3-gc
-  namespace: niks3
-  labels:
-    app: niks3-gc
-spec:
-  # Daily at 03:00. niks3 gc asks the server to drop closures older than
-  # --older-than and clean up stale failed uploads; the server performs the
-  # actual S3 deletions, so this job only needs to reach the in-cluster API.
-  schedule: "0 3 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 2
-      template:
-        metadata:
-          # NOT app: niks3 — that label is the Service selector and would route
-          # cache traffic to this job. Its egress is governed by allow-gc-egress.
-          labels:
-            app: niks3-gc
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: gc
-              image: ghcr.io/mic92/niks3:v1.6.1
-              # Image entrypoint is /bin/niks3-server; override with the client.
-              command: ["/bin/niks3", "gc"]
-              args:
-                - --server-url=http://niks3:5751
-                - --auth-token-path=/secrets/api-token
-                - --older-than=720h
-              volumeMounts:
-                - name: server
-                  mountPath: /secrets
-                  readOnly: true
-              resources:
-                requests:
-                  cpu: 10m
-                  memory: 32Mi
-                limits:
-                  memory: 128Mi
-          volumes:
-            - name: server
-              secret:
-                secretName: server

values/niks3/manifests/ingress.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    oceanbox.io/expose: internal
-  labels:
-    app.kubernetes.io/component: niks3
-  name: niks3
-  namespace: niks3
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: cache.ekman.oceanbox.io
-    http:
-      paths:
-      - backend:
-          service:
-            name: niks3
-            port:
-              name: http
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - cache.ekman.oceanbox.io
-    secretName: cache.ekman.oceanbox.io-tls

values/niks3/manifests/niks3.yaml

@@ -1,39 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: niks3
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    namespace: niks3
-    server: https://kubernetes.default.svc
-  project: sys
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-      - name: CLUSTER_NAME
-        value: {{ .Values.clusterConfig.cluster }}
-      - name: HELMFILE_ENVIRONMENT
-        value: default
-      - name: HELMFILE_FILE_PATH
-        value: niks3.yaml.gotmpl
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
-    {{- if .Values.niks3.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
-{{- end }}

values/niks3/manifests/policies/allow-egress.yaml

@@ -1,47 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-egress
-  namespace: niks3
-spec:
-  # ekman has no cluster-wide allow-namespace-traffic baseline (unlike hel1/oceanbox),
-  # so once niks3 is selected by an egress rule it is default-deny for egress and every
-  # destination must be listed explicitly: RGW (S3), in-namespace PostgreSQL, and DNS.
-  description: niks3 egress to Ceph RGW (S3), in-namespace PostgreSQL, and kube-dns
-  endpointSelector:
-    matchLabels:
-      app: niks3
-  egress:
-    # Ceph RadosGW (S3 object storage backend) via NodePort
-    - toCIDR:
-        - 10.255.241.30/32
-        - 10.255.241.31/32
-        - 10.255.241.32/32
-      toPorts:
-        - ports:
-            - port: "30080"
-              protocol: TCP
-    # PostgreSQL (CNPG niks3-db cluster, same namespace)
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: niks3
-      toPorts:
-        - ports:
-            - port: "5432"
-              protocol: TCP
-    # DNS resolution
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-          rules:
-            dns:
-              - matchPattern: "*"
-{{- end }}

values/niks3/manifests/policies/allow-gc-egress.yaml

@@ -1,35 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-gc-egress
-  namespace: niks3
-spec:
-  description: niks3-gc job egress to the in-namespace niks3 server and kube-dns
-  endpointSelector:
-    matchLabels:
-      app: niks3-gc
-  egress:
-    # niks3 server HTTP API (same namespace)
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: niks3
-      toPorts:
-        - ports:
-            - port: "5751"
-              protocol: TCP
-    # DNS resolution
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-          rules:
-            dns:
-              - matchPattern: "*"
-{{- end }}

values/prometheus/values/prometheus.yaml.gotmpl

@@ -167,7 +167,7 @@ grafana:
   {{- if .Values.prometheus.grafana.persistence }}
   persistence:
     enabled: true
-    size: 20Gi
+    size: 10Gi
   {{- end }}
   ingress:
     enabled: true
@@ -233,7 +233,7 @@ grafana:
         nodeGraph:
           enabled: true
         serviceMap:
-          datasourceUid: 'prometheus'
+          datasourceUid: 'Prometheus'
         tracesToLogs:
           datasourceUid: loki
           filterByTraceID: false

values/sorcerer/kustomize/beta-ekman/deployment_patch.yaml

@@ -21,7 +21,7 @@
   path: /spec/template/spec/containers/0/envFrom/-
   value:
     secretRef:
-      name: beta-sorcerer-env
+      name: prod-sorcerer-env
 - op: add
   path: /spec/template/spec/containers/0/envFrom/-
   value: