Add more Nix Apps

Rewrite of some of the Apps to Nix. Tried to convert
ApplicationSets to simple Applications with an ${env}
modifier.

.envrc

@@ -1,9 +1 @@
-#!/usr/bin/env bash
-# the shebang is ignored, but nice for editors
-watch_file nix/sources.json
-
-# Load .env file if it exists
-dotenv_if_exists
-
-# Activate development shell
 use nix

.gitignore

@@ -2,5 +2,5 @@
 _*/
 .direnv/
 .pre-commit-config.yaml
-_*.yaml
-backup/
+_manifest.yaml
+_resources.yaml

README.md

@@ -1,33 +0,0 @@
-# Manifests
-
-> [!note]
-> For CI/CD to push updates to this repo add your repo [here](https://gitlab.com/oceanbox/alpine-k8s/-/settings/ci_cd#js-token-access)
-
-Manifest repo managed using [Helmfile](https://github.com/helmfile/helmfile).
-
-Repository structure:
-
-```bash
-/
-├── helmfile.d/                                                 # Helmfiles, *.yaml.gotmpl
-├── charts/                                                     # Our own charts, e.g `Atlantis`
-├── values                                                      # Values for helmfiles
-│   ├── <chart>
-│   │   ├── env.yaml.gotmpl                                     # Values to be templated in `values/`
-│   │   ├── kustomize                                           # Kustomizations per environment
-│   │   ├── manifests                                           # Raw manifests
-│   │   │   ├── <chart>.yaml                                    # Argo App for bootstrap
-│   │   │   ├── dashboards                                      # Grafana dashboards
-│   │   │   │   └── <chart>-metrics.yaml
-│   │   │   └── policies                                        # Cilium and Kyverno policies
-│   │   │       ├── CiliumNetworkPolicy-allow-api-server.yaml
-│   │   │       └── KyvernoPolicy-regred-secret.yaml
-│   │   └── values                                              # Values for each environment
-│   │       ├── <chart>-staging.yaml.gotmpl                     # Values for staging environment
-│   │       ├── <chart>-prod.yaml.gotmpl                        # Values for prod environment
-│   │       └── <chart>.yaml.gotmpl                             # Standard values for all environments
-│   │
-│   ├── env.yaml                                             # Standard values for all cluster
-│   ├── env-oceanbox.yaml                                    # Values overrides for oceanbox
-│   ├── env-ekman.yaml                                       # Values overrides for ekman
-```

apps/archmeister.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: archmeister
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+        hostname: archmeister.srv.oceanbox.io
+        autoSync: false
+        prune: true
+      # - cluster: https://staging-vcluster.staging-vcluster
+      #   env: staging
+      #   hostname: archmeister.beta.oceanbox.io
+      #   autoSync: true
+      #   prune: true
+  template:
+    metadata:
+      name: "{{ .env }}-archmeister"
+    spec:
+      project: atlantis
+      destination:
+        namespace: atlantis
+        server: "{{ .cluster }}"
+      sources:
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/archmeister
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: "{{ .env }}"
+          - name: hostname
+            string: "{{ .hostname }}"
+  templatePatch: |
+    {{- if .autoSync }}
+    spec:
+      syncPolicy:
+        automated:
+          prune: {{ .prune }}
+          selfHeal: false
+    {{- end }}

apps/atlantis-host-resources.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: atlantis-cluster-resources
+  namespace: argocd
+  # annotations: # close, but no cigar
+  #   argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
+spec:
+  project: atlantis
+  destination:
+    server: https://kubernetes.default.svc
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: false
+  # ignoreDifferences:
+  #   - kind: Secret
+  #     name: prod-rabbitmq
+  #     jqPathExpressions:
+  #       - '.data'
+  #       - '.metadata.annotations.clone'
+  #       - '.metadata.labels'
+  sources:
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: main
+    path: resources/atlantis
+

apps/atlantis-resources.yaml

@@ -0,0 +1,41 @@
+# Currently not in use. Configured via the create-vcluster script.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: atlantis-resources
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+        autoSync: false
+        prune: false
+      # - cluster: https://staging-vcluster.staging-vcluster
+      #   env: staging
+      #   autoSync: false
+      #   prune: false
+  template:
+    metadata:
+      name: "{{ .env }}-atlantis-resources"
+    spec:
+      project: aux
+      syncPolicy:
+        automated: {}
+      destination:
+        server: "{{ .cluster }}"
+        namespace: atlantis
+      sources: {}
+      # - repoURL: https://gitlab.com/oceanbox/manifests.git
+      #   targetRevision: main
+      #   path: 'resources/atlantis/manifests/{{ env }}'
+  templatePatch: |
+    {{- if .autoSync }}
+    spec:
+      syncPolicy:
+        automated:
+          prune: {{ .prune }}
+          selfHeal: false
+    {{- end }}

apps/atlantis.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: atlantis
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+        hostname: atlantis.srv.oceanbox.io
+        autoSync: false
+        prune: true
+      # - cluster: https://staging-vcluster.staging-vcluster
+      #   env: staging
+      #   hostname: atlantis.beta.oceanbox.io
+      #   autoSync: true
+      #   prune: true
+  template:
+    metadata:
+      name: '{{ .env }}-atlantis'
+    spec:
+      project: atlantis
+      destination:
+        namespace: atlantis
+        server: '{{ .cluster }}'
+      sources:
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/atlantis
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: '{{ .env }}'
+          - name: hostname
+            string: '{{ .hostname }}'
+  templatePatch: |
+    {{- if .autoSync }}
+    spec:
+      syncPolicy:
+        automated:
+          prune: {{ .prune }}
+          selfHeal: false
+    {{- end }}

apps/busynix.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: busynix
+  namespace: argocd
+spec:
+  generators:
+  - list:
+      elements:
+      # - cluster: https://kubernetes.default.svc
+      #   env: prod
+      #   hostname: busynix.srv.oceanbox.io
+      - cluster: https://staging-vcluster.staging-vcluster
+        env: staging
+        hostname: busynix.beta.oceanbox.io
+  template:
+    metadata:
+      name: '{{ env }}-busynix'
+    spec:
+      project: aux
+      destination:
+        namespace: default
+        server: '{{ cluster }}'
+      source:
+        repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/busynix
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: '{{ env }}'
+          - name: hostname
+            string: '{{ hostname }}'

apps/cerbos.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: cerbos
+  namespace: argocd
+spec:
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+      - cluster: https://staging-vcluster.staging-vcluster
+        env: staging
+  template:
+    metadata:
+      name: '{{ env }}-cerbos'
+    spec:
+      project: aux
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: idp
+      sources:
+        - repoURL: https://download.cerbos.dev/helm-charts
+          targetRevision: 0.33.0
+          chart: cerbos
+          helm:
+            valueFiles:
+              - $values/values/cerbos/values.yaml
+              - $values/values/cerbos/values-{{ env }}.yaml
+        - repoURL: https://gitlab.com/oceanbox/manifests.git
+          targetRevision: main
+          ref: values

apps/dapr.nix

@@ -0,0 +1,46 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.dapr;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    extraValues = {
+      global.ha.enabled = true;
+    };
+  };
+
+in
+{
+  options.apps.dapr = lib.apps.appOptions {
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "1.14.4";
+      description = "Dapr chart version";
+    };
+  };
+
+  config = lib.apps.appConfig cfg "dapr" {
+    namespace = "argocd";
+    helm.releases.dapr = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://dapr.github.io/helm-charts/";
+        chart = "dapr";
+        version = cfg.revision;
+      };
+    };
+    annotations = {
+      "argocd.argoproj.io/sync-options" = "SkipDryRunOnMissingResource=true";
+    };
+    resources = {
+      "argoproj.io".v1alpha1.Application.dapr.spec = {
+        destination = {
+          namespace = "dapr-system";
+          server = "https://kubernetes.default.svc";
+        };
+        project = "default";
+      };
+    };
+  };
+}

apps/dapr.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.dapr.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -32,4 +31,3 @@ spec:
         global:
           ha:
             enabled: true
-{{- end }}

apps/default.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  imports = [
+    ./atlantis.nix
+    ./dapr.nix
+    ./dex.nix
+    ./keycloak.nix
+    ./loki.nix
+    ./openfga.nix
+    ./opentelemetry-collector.nix
+    ./rabbitmq.nix
+    ./redis.nix
+    ./tempo.nix
+    ./wordpress.nix
+  ];
+}

apps/dex.nix

@@ -0,0 +1,39 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.dex;
+  env = config.apps.env;
+  
+  values = lib.apps.appValues {
+    inherit env;
+    base = ../values/dex;
+    extraValues = {};
+  };
+in
+{
+  options.apps.dex = lib.apps.appOptions { 
+    enable = lib.mkEnableOption "Dex";
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "0.16.0";
+      description = "Dex chart version";
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      description = "Dex hostname";
+      default = "idp.${env}.oceanbox.io";
+    };
+  };
+  config = lib.apps.appConfig cfg "${env}-dex" {
+    namespace = "idp";
+    helm.releases.dex = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://charts.dexidp.io";
+        chart = "dex";
+        version = cfg.revision;
+        chartHash = "";
+      };
+      transformer = rs: builtins.map (x: kustomize x) rs;
+    };
+  };
+}

apps/dex.yaml

@@ -0,0 +1,15 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dex
+  namespace: argocd
+spec:
+  project: aux
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: idp
+  source:
+    repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    path: values/dex/manifests
+

apps/geoserver.yaml

@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: geoserver
+  namespace: argocd
+spec:
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+        hostname: geoserver.srv.oceanbox.io
+      # - cluster: https://kubernetes.default.svc
+      #   env: staging
+      #   hostname: geoserver.beta.oceanbox.io
+  template:
+    metadata:
+      name: '{{ env }}-geoserver'
+    spec:
+      project: aux
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: geoserver
+      sources:
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/geoserver
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: '{{ env }}'
+          - name: hostname
+            string: geoserver.srv.oceanbox.io
+          - name: flags
+            string: "--skip-tests"
+          - name: chart
+            string: ncsa/geoserver

apps/hipster.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: hipster
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+        hostname: hipster.srv.oceanbox.io
+        autoSync: false
+        prune: true
+      # - cluster: https://staging-vcluster.staging-vcluster
+      #   env: staging
+      #   hostname: hipster.beta.oceanbox.io
+      #   autoSync: true
+      #   prune: true
+  template:
+    metadata:
+      name: '{{ .env }}-hipster'
+    spec:
+      project: atlantis
+      destination:
+        namespace: atlantis
+        server: '{{ .cluster }}'
+      sources:
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/hipster
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: '{{ .env }}'
+          - name: hostname
+            string: '{{ .hostname }}'
+  templatePatch: |
+    {{- if .autoSync }}
+    spec:
+      syncPolicy:
+        automated:
+          prune: {{ .prune }}
+          selfHeal: false
+    {{- end }}

apps/jaeger.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.jaeger-operator.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -21,4 +20,3 @@ spec:
     # path: values/jaeger/manifests
     ref: values
 
-{{- end }}

apps/keycloak.nix

@@ -0,0 +1,34 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.keycloak;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    base = ../values/keycloak;
+    extraValues = {};
+  };
+in
+{
+  options.apps.keycloak = lib.apps.appOptions {
+    enable = lib.mkEnableOption "Keycloak";
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "24.0.2";
+      description = "Keycloak chart version";
+    };
+  };
+  config = lib.apps.appConfig cfg "keycloak" {
+    namespace = "idp";
+    helm.releases.keycloak = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://charts.bitnami.com/bitnami";
+        chart = "keycloak";
+        version = cfg.revision;
+        chartHash = "";
+      };
+      transformer = rs: builtins.map (x: kustomize x) rs;
+    };
+  };
+}

apps/keycloak.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: keycloak
+  namespace: argocd
+spec:
+  project: aux
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: idp
+  sources:
+  - repoURL: https://charts.bitnami.com/bitnami
+    targetRevision: 24.0.2
+    chart: keycloak
+    helm:
+      valueFiles:
+        - $values/values/keycloak/values.yaml
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    ref: values
+

apps/loki.nix

@@ -0,0 +1,249 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.loki;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    extraValues = {
+      loki = {
+        auth_enabled = false;
+        storage = {
+          bucketNames = {
+            chunks = cfg.buckets.chunks;
+            ruler = cfg.buckets.ruler;
+            admin = cfg.buckets.admin;
+          };
+          s3 =
+            {
+              endpoint = cfg.s3.endpoint;
+              region = cfg.s3.region;
+              secretAccessKey = "\${S3SECRET}";
+              accessKeyId = "\${S3KEY}";
+              s3ForcePathStyle = true;
+            }
+            // lib.optionalAttrs cfg.s3.insecureSkipVerify {
+              http_config.insecure_skip_verify = true;
+            };
+        };
+        schemaConfig.configs = [
+          {
+            from = "2024-04-01";
+            index.period = "24h";
+            index.prefix = "loki_index_";
+            object_store = "s3";
+            schema = "v13";
+            store = "tsdb";
+          }
+        ];
+        compactor = {
+          compaction_interval = "10m";
+          working_directory = "/tmp/loki/compactor";
+          retention_enabled = true;
+          retention_delete_delay = "2h";
+          retention_delete_worker_count = 150;
+          delete_request_store = "s3";
+        };
+        limits_config.retention_period = "744h";
+      };
+
+      write = {
+        extraArgs = [ "-config.expand-env=true" ];
+        extraEnv = [
+          {
+            name = "S3KEY";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.accessKey;
+            };
+          }
+          {
+            name = "S3SECRET";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.secretKey;
+            };
+          }
+        ];
+        tolerations = [
+          {
+            effect = "NoSchedule";
+            operator = "Equal";
+            key = "unschedulable";
+            value = "true";
+          }
+        ];
+      };
+
+      read = {
+        extraArgs = [ "-config.expand-env=true" ];
+        extraEnv = [
+          {
+            name = "S3KEY";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.accessKey;
+            };
+          }
+          {
+            name = "S3SECRET";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.secretKey;
+            };
+          }
+        ];
+        tolerations = [
+          {
+            effect = "NoSchedule";
+            operator = "Equal";
+            key = "unschedulable";
+            value = "true";
+          }
+        ];
+      };
+
+      ingress = {
+        enabled = true;
+        ingressClassName = "nginx";
+        annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt-staging";
+          "nginx.ingress.kubernetes.io/ssl-redirect" = "true";
+          "atlantis.oceanbox.io/expose" = "internal";
+        };
+        hosts = [ "loki.adm.oceanbox.io" ];
+        tls = [{
+          hosts = [ "loki.adm.oceanbox.io" ];
+          secretName = "loki-distributed-tls";
+        }];
+      };
+
+      compactor = {
+        extraArgs = [ "-config.expand-env=true" ];
+        extraEnv = [
+          {
+            name = "S3KEY";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.accessKey;
+            };
+          }
+          {
+            name = "S3SECRET";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.secretKey;
+            };
+          }
+        ];
+      };
+
+      backend = {
+        extraArgs = [ "-config.expand-env=true" ];
+        extraEnv = [
+          {
+            name = "S3KEY";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.accessKey;
+            };
+          }
+          {
+            name = "S3SECRET";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.secretKey;
+            };
+          }
+        ];
+      };
+    };
+  };
+
+in
+{
+  options.apps.loki = lib.apps.appOptions {
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "6.12.0";
+      description = "Loki chart version";
+    };
+    buckets = {
+      chunks = lib.mkOption {
+        type = lib.types.str;
+        default = "loki-chunks";
+        description = "S3 bucket for chunks";
+      };
+      ruler = lib.mkOption {
+        type = lib.types.str;
+        default = "loki-chunks";
+        description = "S3 bucket for ruler";
+      };
+      admin = lib.mkOption {
+        type = lib.types.str;
+        default = "loki-chunks";
+        description = "S3 bucket for admin";
+      };
+    };
+    s3 = {
+      endpoint = lib.mkOption {
+        type = lib.types.str;
+        default = "http://10.255.241.30:30080";
+        description = "S3 endpoint";
+      };
+      region = lib.mkOption {
+        type = lib.types.str;
+        default = "tos";
+        description = "S3 region";
+      };
+      insecureSkipVerify = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Skip TLS verification";
+      };
+    };
+    secret = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "loki-s3";
+        description = "Name of the S3 credentials secret";
+      };
+      accessKey = lib.mkOption {
+        type = lib.types.str;
+        default = "AWS_ACCESS_KEY_ID";
+        description = "Access key field in secret";
+      };
+      secretKey = lib.mkOption {
+        type = lib.types.str;
+        default = "AWS_ACCESS_KEY_SECRET";
+        description = "Secret key field in secret";
+      };
+    };
+  };
+
+  config = lib.apps.appConfig cfg "loki" {
+    namespace = "argocd";
+    helm.releases.loki = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://grafana.github.io/helm-charts";
+        chart = "loki";
+        version = cfg.revision;
+        chartHash = "sha256-YUtEIUiQWRzlttfOOgDk1xfTaiAZ12tIgpGr1QcMpro=";
+      };
+    };
+    annotations = {
+      "argocd.argoproj.io/sync-options" = "SkipDryRunOnMissingResource=true";
+    };
+    # TODO: Add network policies as a second source or integrate them into `resources`.
+    resources = {
+      "argoproj.io".v1alpha1.Application.loki.spec.ignoreDifferences = [
+        {
+          group = "apps";
+          kind = "StatefulSet";
+          jsonPointers = [ "/spec/persistentVolumeClaimRetentionPolicy" ];
+        }
+      ];
+    };
+  };
+}

apps/loki.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.loki.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -29,8 +28,8 @@ spec:
       prune: true
       selfHeal: true
   sources:
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
-    path: policies/oceanbox/network/loki
+  - repoURL: https://gitlab.com/serit/k8s/serit-platform-manifests.git
+    path: network-policies/netpol-loki
     targetRevision: HEAD
   - repoURL: 'https://grafana.github.io/helm-charts'
     targetRevision: 6.12.0
@@ -114,7 +113,7 @@ spec:
           annotations:
             cert-manager.io/cluster-issuer: letsencrypt-staging
             nginx.ingress.kubernetes.io/ssl-redirect: "true"
-            oceanbox.io/expose: internal
+            atlantis.oceanbox.io/expose: internal
           hosts:
             - loki.adm.oceanbox.io
           tls:
@@ -149,4 +148,3 @@ spec:
               secretKeyRef:
                 name: loki-s3
                 key: AWS_ACCESS_KEY_SECRET
-{{- end }}

apps/openfga.nix

@@ -24,8 +24,8 @@ in
           chart = lib.helm.downloadHelmChart {
             repo = "https://openfga.github.io/helm-charts";
             chart = "openfga";
-              version = "0.2.12";
-              chartHash = "sha256-7yLcw9/oNPvCePrtTJwKAG88t0Ym5Dl/S83Gz+gQdDU=";
+            version = "0.2.12";
+            chartHash = "sha256-7yLcw9/oNPvCePrtTJwKAG88t0Ym5Dl/S83Gz+gQdDU=";
           };
           transformer = rs: builtins.map (x: kustomize x) rs;
         };

apps/opentelemetry-collector.nix

@@ -0,0 +1,117 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.opentelemetry-collector;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    extraValues = {
+      mode = "deployment";
+      image = {
+        repository = "otel/opentelemetry-collector-k8s";
+      };
+      service = {
+        type = "LoadBalancer";
+        loadBalancerIP = "10.255.241.12";
+      };
+      config = {
+        receivers = {
+          "prometheus/collector" = {
+            config.scrape_configs = [{
+              job_name = "opentelemetry-collector";
+              static_configs = [{
+                targets = [ "\${env:MY_POD_IP}:8888" ];
+              }];
+            }];
+          };
+          zipkin.endpoint = "\${env:MY_POD_IP}:9411";
+        };
+        exporters = {
+          otlp = {
+            endpoint = "tempo.tempo.svc:4317";
+            tls.insecure = true;
+          };
+          "otlphttp/metrics" = {
+            endpoint = "http://prom-prometheus.prometheus:9090/api/v1/otlp";
+            tls.insecure = true;
+          };
+          "otlphttp/logs" = {
+            endpoint = "http://loki-write-headless.loki:3100/otlp";
+            tls.insecure = true;
+          };
+          "debug/metrics".verbosity = "detailed";
+          "debug/traces".verbosity = "detailed";
+          "debug/logs".verbosity = "detailed";
+        };
+        service = {
+          telemetry.logs.level = "info";
+          pipelines = {
+            traces = {
+              receivers = [ "otlp" "zipkin" ];
+              processors = [ "batch" ];
+              exporters = [ "otlp" ];
+            };
+            metrics = {
+              receivers = [ "otlp" "prometheus/collector" ];
+              processors = [ "batch" ];
+              exporters = [ "otlphttp/metrics" ];
+            };
+            logs = {
+              receivers = [ "otlp" ];
+              processors = [ "batch" ];
+              exporters = [ "otlphttp/logs" ];
+            };
+          };
+        };
+      };
+      ports.metrics.enabled = true;
+      ingress = {
+        enabled = false;
+        annotations = {
+          "cert-manager.io/cluster-issuer" = "letsencrypt-production";
+          "nginx.ingress.kubernetes.io/ssl-redirect" = "true";
+          "atlantis.oceanbox.io/expose" = "internal";
+        };
+        ingressClassName = "nginx";
+        hosts = [{
+          host = "opentelemetry-collector.adm.oceanbox.io";
+          paths = [{
+            path = "/";
+            pathType = "Prefix";
+            port = 4318;
+          }];
+        }];
+        tls = [{
+          secretName = "collector-tls";
+          hosts = [ "opentelemetry-collector.adm.oceanbox.io" ];
+        }];
+      };
+    };
+  };
+
+in
+{
+  options.apps.opentelemetry-collector = lib.apps.appOptions {
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "0.107.0";
+      description = "OpenTelemetry Collector chart version";
+    };
+  };
+
+  config = lib.apps.appConfig cfg "opentelemetry-collector" {
+    namespace = "argocd";
+    helm.releases.opentelemetry-collector = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://open-telemetry.github.io/opentelemetry-helm-charts";
+        chart = "opentelemetry-collector";
+        version = cfg.revision;
+        chartHash = "sha256-0000000000000000000000000000000000000000000000"; # TODO: Add correct hash
+      };
+    };
+    annotations = {
+      "argocd.argoproj.io/sync-options" = "SkipDryRunOnMissingResource=true";
+    };
+  };
+}

apps/opentelemetry-collector.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.opentelemetry-collector.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -96,7 +95,7 @@ spec:
           annotations:
               cert-manager.io/cluster-issuer: letsencrypt-production
               nginx.ingress.kubernetes.io/ssl-redirect: "true"
-              oceanbox.io/expose: internal
+              atlantis.oceanbox.io/expose: internal
           ingressClassName: nginx
           hosts:
             - host: opentelemetry-collector.adm.oceanbox.io
@@ -108,4 +107,3 @@ spec:
             - secretName: collector-tls
               hosts:
                 - opentelemetry-collector.adm.oceanbox.io
-{{- end }}

apps/osm-tile-server.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.osm-tile-server.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
 metadata:
@@ -16,12 +15,12 @@ spec:
         hostname: osm.beta.oceanbox.io
   template:
     metadata:
-      name: '{{- env }}-osm-tile-server'
+      name: '{{ env }}-osm-tile-server'
     spec:
       project: aux
       destination:
         namespace: oceanbox
-        server: '{{- cluster }}'
+        server: '{{ cluster }}'
       source:
         repoURL: https://gitlab.com/oceanbox/manifests.git
         targetRevision: HEAD
@@ -30,7 +29,6 @@ spec:
           name: kustomize-helm-with-rewrite
           parameters:
           - name: env
-            string: '{{- env }}'
+            string: '{{ env }}'
           - name: hostname
-            string: '{{- hostname }}'
-{{- end }}
+            string: '{{ hostname }}'

apps/petimeter.yaml

@@ -0,0 +1,50 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: petimeter
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+        hostname: petimeter.srv.oceanbox.io
+        autoSync: false
+        prune: true
+      # - cluster: https://staging-vcluster.staging-vcluster
+      #   env: staging
+      #   hostname: petimeter.beta.oceanbox.io
+      #   autoSync: true
+      #   prune: true
+  template:
+    metadata:
+      name: '{{ .env }}-petimeter'
+    spec:
+      project: atlantis
+      destination:
+        namespace: atlantis
+        server: '{{ .cluster }}'
+      sources:
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/petimeter
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: '{{ .env }}'
+          - name: hostname
+            string: '{{ .hostname }}'
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/petimeter/manifests
+  templatePatch: |
+    {{- if .autoSync }}
+    spec:
+      syncPolicy:
+        automated:
+          prune: {{ .prune }}
+          selfHeal: false
+    {{- end }}

apps/prod-atlantis.yaml

@@ -0,0 +1,66 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: prod-atlantis
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: prod-atlantis
+    server: https://kubernetes.default.svc
+  project: atlantis
+  sources:
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    ref: values
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    path: values/atlantis
+    plugin:
+      name: kustomize-helm-with-rewrite
+      parameters:
+      - name: env
+        string: prod
+      - name: hostname
+        string: maps.oceanbox.io
+  - repoURL: https://charts.bitnami.com/bitnami
+    targetRevision: 20.1.7
+    chart: redis
+    helm:
+      valueFiles:
+      - $values/values/atlantis/prod/redis.yaml
+  ignoreDifferences:
+    - kind: Secret
+      name: azure-keyvault
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
+    - kind: Secret
+      name: prod-atlantis-rabbitmq
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
+    - kind: Secret
+      name: prod-archmeister-replication
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
+    - kind: Secret
+      name: prod-archmeister-ca
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+    # automated:
+    #   prune: true
+    #   selfHeal: false

apps/prod-keycloak.yaml

@@ -1,4 +1,3 @@
-{{ if .Values.keycloak.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -25,7 +24,7 @@ spec:
       selfHeal: true
   sources:
   - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
+    targetRevision: nixidy
     path: values/keycloak/prod
   - repoURL: https://charts.bitnami.com/bitnami
     targetRevision: 24.0.2
@@ -34,6 +33,6 @@ spec:
       valueFiles:
         - $values/values/keycloak/values-prod.yaml
   - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
+    targetRevision: nixidy
     ref: values
-{{- end }}
+

apps/prod-openfga.yaml

@@ -1,5 +1,3 @@
-{{ if .Values.openfga.enabled }}
-{{- range .Values.atlantis.envs }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -31,13 +29,11 @@ spec:
       selfHeal: true
   sources:
   - repoURL: https://openfga.github.io/helm-charts
-    targetRevision: 0.2.21
+    targetRevision: 0.2.19
     chart: openfga
     helm:
       valueFiles:
       - $values/values/openfga/values-prod.yaml
   - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
+    targetRevision: nixidy
     ref: values
-{{- end }}
-{{- end }}

apps/prod-sorcerer.yaml

@@ -1,5 +1,3 @@
-{{ if .Values.sorcerer.enabled }}
-{{- range .Values.atlantis.envs }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -16,10 +14,10 @@ spec:
   project: atlantis
   sources:
   - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
+    targetRevision: nixidy
     ref: values
   - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
+    targetRevision: nixidy
     path: values/sorcerer
     plugin:
       name: kustomize-helm-with-rewrite
@@ -54,5 +52,3 @@ spec:
     # automated:
     #   prune: true
     #   selfHeal: false
-{{- end }}
-{{- end }}

apps/rabbitmq.nix

@@ -0,0 +1,39 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.rabbitmq;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    base = ../values/rabbitmq;
+    extraValues = {};
+  };
+in
+{
+  options.apps.rabbitmq = lib.apps.appOptions {
+    enable = lib.mkEnableOption "RabbitMQ";
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "12.9.0";
+      description = "RabbitMQ chart version";
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      description = "RabbitMQ hostname";
+      default = "rabbitmq.${env}.oceanbox.io";
+    };
+  };
+  config = lib.apps.appConfig cfg "${env}-rabbitmq" {
+    namespace = "rabbitmq";
+    helm.releases.rabbitmq = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://charts.bitnami.com/bitnami";
+        chart = "rabbitmq";
+        version = cfg.revision;
+        chartHash = "";
+      };
+      transformer = rs: builtins.map (x: kustomize x) rs;
+    };
+  };
+}

apps/rabbitmq.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.rabbitmq.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
 metadata:
@@ -16,7 +15,7 @@ spec:
         hostname: rabbitmq.beta.oceanbox.io
   template:
     metadata:
-      name: '{{- env }}-rabbitmq'
+      name: '{{ env }}-rabbitmq'
     spec:
       project: aux
       destination:
@@ -28,9 +27,8 @@ spec:
           chart: rabbitmq
           helm:
             valueFiles:
-              - $values/values/rabbitmq/values-{{- env }}.yaml
+              - $values/values/rabbitmq/values-{{ env }}.yaml
         - repoURL: https://gitlab.com/oceanbox/manifests.git
           targetRevision: main
-          path: values/rabbitmq/{{- env }}
+          path: values/rabbitmq/{{ env }}
           ref: values
-{{- end }}

apps/redis.nix

@@ -0,0 +1,34 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.redis;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    base = ../values/redis;
+    extraValues = {};
+  };
+in
+{
+  options.apps.redis = lib.apps.appOptions {
+    enable = lib.mkEnableOption "Redis";
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "19.5.2";
+      description = "Redis chart version";
+    };
+  };
+  config = lib.apps.appConfig cfg "${env}-redis" {
+    namespace = "redis";
+    helm.releases.redis = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://charts.bitnami.com/bitnami";
+        chart = "redis";
+        version = cfg.revision;
+        chartHash = "";
+      };
+      transformer = rs: builtins.map (x: kustomize x) rs;
+    };
+  };
+}

apps/redis.yaml

@@ -0,0 +1,39 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: redis
+  namespace: argocd
+spec:
+  generators:
+  - list:
+      elements:
+      - cluster: https://kubernetes.default.svc
+        env: prod
+      - cluster: https://kubernetes.default.svc
+        env: staging
+  template:
+    metadata:
+      name: '{{ env }}-redis'
+    spec:
+      project: aux
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: redis
+      sources:
+        - repoURL: https://charts.bitnami.com/bitnami
+          targetRevision: 19.5.2
+          chart: redis
+          helm:
+            valueFiles:
+              - $values/values/redis/values-{{ env }}.yaml
+        - repoURL: https://gitlab.com/oceanbox/manifests.git
+          targetRevision: HEAD
+          ref: values
+        - repoURL: https://gitlab.com/oceanbox/manifests.git
+          targetRevision: main
+          path: values/redis/{{ env }}
+      ignoreDifferences:
+        - group: apps
+          kind: StatefulSet
+          jqPathExpressions:
+            - '.spec.template.spec.containers[].resources.limits.cpu'

apps/seq.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.seq.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -19,4 +18,3 @@ spec:
   - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: main
     ref: values
-{{- end }}

apps/sorcerer.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: sorcerer
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+  - list:
+      elements:
+      - cluster: https://10.255.241.99:4443
+        env: prod
+        hostname: sorcerer.data.oceanbox.io
+        autoSync: false
+        prune: true
+      # - cluster: https://10.255.241.99:4443
+      #   env: staging
+      #   hostname: sorcerer.ekman.oceanbox.io
+      #   autoSync: true
+      #   prune: true
+  template:
+    metadata:
+      name: '{{ .env }}-sorcerer'
+    spec:
+      project: atlantis
+      destination:
+        namespace: sorcerer
+        server: '{{ .cluster }}'
+      sources:
+      - repoURL: https://gitlab.com/oceanbox/manifests.git
+        targetRevision: main
+        path: values/sorcerer
+        plugin:
+          name: kustomize-helm-with-rewrite
+          parameters:
+          - name: env
+            string: '{{ .env }}'
+          - name: hostname
+            string: '{{ .hostname }}'
+  templatePatch: |
+    {{- if .autoSync }}
+    spec:
+      syncPolicy:
+        automated:
+          prune: {{ .prune }}
+          selfHeal: false
+    {{- end }}

apps/staging-atlantis.yaml

@@ -1,41 +1,37 @@
-{{ if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: {{ .Values.atlantis.env }}-atlantis
+  name: staging-atlantis
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-    argocd.argoproj.io/compare-options: ServerSideDiff=true
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: {{ .Values.atlantis.env }}-atlantis
+    namespace: staging-atlantis
     server: https://kubernetes.default.svc
   project: atlantis
   sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    ref: values
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    path: values/atlantis
     plugin:
-      name: helmfile-cmp
-      env:
-      - name: CLUSTER_NAME
-        value: {{ .Values.clusterConfig.cluster }}
-      - name: HELMFILE_ENVIRONMENT
-        value: {{ .Values.atlantis.env }}
-      - name: HELMFILE_FILE_PATH
-        value: atlantis.yaml.gotmpl
+      name: kustomize-helm-with-rewrite
+      parameters:
+      - name: env
+        string: staging
+      - name: hostname
+        string: atlantis.beta.oceanbox.io
   - repoURL: https://charts.bitnami.com/bitnami
     targetRevision: 20.1.7
     chart: redis
     helm:
       valueFiles:
-      - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
-    ref: values
+      - $values/values/atlantis/staging/redis.yaml
   ignoreDifferences:
     - kind: Secret
       name: azure-keyvault
@@ -44,25 +40,19 @@ spec:
         - '.metadata.labels'
         - '.metadata.annotations'
     - kind: Secret
-      name: dapr-api-token
+      name: staging-atlantis-rabbitmq
       jqPathExpressions:
         - '.data'
         - '.metadata.labels'
         - '.metadata.annotations'
     - kind: Secret
-      name: {{ .Values.atlantis.env }}-atlantis-rabbitmq
+      name: prod-archmeister-replication
       jqPathExpressions:
         - '.data'
         - '.metadata.labels'
         - '.metadata.annotations'
     - kind: Secret
-      name: prod-atlantis-db-replication
-      jqPathExpressions:
-        - '.data'
-        - '.metadata.labels'
-        - '.metadata.annotations'
-    - kind: Secret
-      name: prod-atlantis-db-ca
+      name: prod-archmeister-ca
       jqPathExpressions:
         - '.data'
         - '.metadata.labels'
@@ -71,9 +61,6 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-    {{- if .Values.atlantis.autosync }}
     automated:
       prune: true
       selfHeal: false
-    {{- end }}
-{{- end }}

apps/staging-openfga.yaml

@@ -0,0 +1,39 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: staging-openfga
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: openfga
+    server: https://kubernetes.default.svc
+  project: aux
+  # ignoreDifferences:
+  # - group: apps
+  #   kind: StatefulSet
+  #   jsonPointers:
+  #   - /spec/persistentVolumeClaimRetentionPolicy
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: aux
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+    automated:
+      prune: true
+      selfHeal: true
+  sources:
+  - repoURL: https://openfga.github.io/helm-charts
+    targetRevision: 0.2.19
+    chart: openfga
+    helm:
+      valueFiles:
+      - $values/values/openfga/values-staging.yaml
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    ref: values

apps/staging-sorcerer.yaml

@@ -0,0 +1,54 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: staging-sorcerer
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: staging-sorcerer
+    server: https://10.255.241.99:4443
+  project: atlantis
+  sources:
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    ref: values
+  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    targetRevision: nixidy
+    path: values/sorcerer
+    plugin:
+      name: kustomize-helm-with-rewrite
+      parameters:
+      - name: env
+        string: staging
+      - name: hostname
+        string: sorcerer.ekman.oceanbox.io
+  - repoURL: https://charts.bitnami.com/bitnami
+    targetRevision: 20.1.7
+    chart: redis
+    helm:
+      valueFiles:
+      - $values/values/sorcerer/staging/redis.yaml
+  ignoreDifferences:
+    - kind: Secret
+      name: azure-keyvault
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
+    - kind: Secret
+      name: prod-atlantis-rabbitmq
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+    # automated:
+    #   prune: true
+    #   selfHeal: false

apps/tempo.nix

@@ -0,0 +1,124 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.tempo;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    extraValues = {
+      tempo = {
+        storage = {
+          trace = {
+            backend = "s3";
+            s3 = {
+              bucket = cfg.s3.bucket;
+              endpoint = cfg.s3.endpoint;
+              access_key = "\${S3SECRET}";
+              secret_key = "\${S3KEY}";
+              insecure = true;
+            };
+            local = {
+              path = "/var/tempo/traces";
+            };
+            wal = {
+              path = "/var/tempo/wal";
+            };
+          };
+        };
+        metricsGenerator = {
+          enabled = true;
+          remoteWriteUrl = "http://prom-prometheus.prometheus:9090/api/v1/write";
+        };
+        extraEnv = [
+          {
+            name = "S3KEY";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.accessKey;
+            };
+          }
+          {
+            name = "S3SECRET";
+            valueFrom.secretKeyRef = {
+              name = cfg.secret.name;
+              key = cfg.secret.secretKey;
+            };
+          }
+        ];
+      };
+
+      tempoQuery = {
+        ingress = {
+          enabled = true;
+          ingressClassName = "nginx";
+          annotations = {
+            "cert-manager.io/cluster-issuer" = "letsencrypt-staging";
+            "nginx.ingress.kubernetes.io/ssl-redirect" = "true";
+            "atlantis.oceanbox.io/expose" = "internal";
+          };
+          path = "/";
+          pathType = "Prefix";
+          hosts = [ "query.tempo.adm.oceanbox.io" ];
+          tls = [{
+            secretName = "tempo-query-tls";
+            hosts = [ "query.tempo.adm.oceanbox.io" ];
+          }];
+        };
+      };
+    };
+  };
+
+in
+{
+  options.apps.tempo = lib.apps.appOptions {
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "1.10.3";
+      description = "Tempo chart version";
+    };
+    s3 = {
+      bucket = lib.mkOption {
+        type = lib.types.str;
+        default = "tempo-traces";
+        description = "S3 bucket for traces";
+      };
+      endpoint = lib.mkOption {
+        type = lib.types.str;
+        default = "http://10.255.241.30:30080";
+        description = "S3 endpoint";
+      };
+    };
+    secret = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "tempo-s3";
+        description = "Name of the S3 credentials secret";
+      };
+      accessKey = lib.mkOption {
+        type = lib.types.str;
+        default = "AWS_ACCESS_KEY_ID";
+        description = "Access key field in secret";
+      };
+      secretKey = lib.mkOption {
+        type = lib.types.str;
+        default = "AWS_ACCESS_KEY_SECRET";
+        description = "Secret key field in secret";
+      };
+    };
+  };
+
+  config = lib.apps.appConfig cfg "tempo" {
+    namespace = "argocd";
+    helm.releases.tempo = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://grafana.github.io/helm-charts";
+        chart = "tempo";
+        version = cfg.revision;
+      };
+    };
+    annotations = {
+      "argocd.argoproj.io/sync-options" = "SkipDryRunOnMissingResource=true";
+    };
+  };
+}

apps/tempo.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.tempo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -66,7 +65,7 @@ spec:
             annotations:
               cert-manager.io/cluster-issuer: letsencrypt-staging
               nginx.ingress.kubernetes.io/ssl-redirect: "true"
-              oceanbox.io/expose: internal
+              atlantis.oceanbox.io/expose: internal
             path: /
             pathType: Prefix
             hosts:
@@ -75,4 +74,3 @@ spec:
              - secretName: tempo-query-tls
                hosts:
                  - query.tempo.adm.oceanbox.io
-{{- end }}

apps/wordpress.nix

@@ -0,0 +1,39 @@
+{ lib, config, ... }:
+let
+  cfg = config.apps.wordpress;
+  env = config.apps.env;
+
+  values = lib.apps.appValues {
+    inherit env;
+    base = ../values/wordpress;
+    extraValues = {};
+  };
+in
+{
+  options.apps.wordpress = lib.apps.appOptions {
+    enable = lib.mkEnableOption "WordPress";
+    revision = lib.mkOption {
+      type = lib.types.str;
+      default = "19.2.2";
+      description = "WordPress chart version";
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      description = "WordPress hostname";
+      default = "www.${env}.oceanbox.io";
+    };
+  };
+  config = lib.apps.appConfig cfg "www-oceanbox" {
+    namespace = "www-oceanbox";
+    helm.releases.wordpress = {
+      inherit values;
+      chart = lib.helm.downloadHelmChart {
+        repo = "https://charts.bitnami.com/bitnami";
+        chart = "wordpress";
+        version = cfg.revision;
+        chartHash = "";
+      };
+      transformer = rs: builtins.map (x: kustomize x) rs;
+    };
+  };
+}

apps/wordpress.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.wordpress.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -15,8 +14,7 @@ spec:
     chart: wordpress
     helm:
       valueFiles:
-        - $values/values/wordpress/values.yaml
+        - $values/wordpress/values.yaml
   - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: HEAD
     ref: values
-{{- end }}

apps/yolo-dl.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.yolo-dl.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -13,4 +12,3 @@ spec:
   - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: main
     path: charts/yolo-dl
-{{- end }}

argocd/ekman.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 stringData:
-  config: '{"bearerToken":"@token@","tlsClientConfig":{"insecure":true}}'
+  config: |
+    {"bearerToken":"","tlsClientConfig":{"insecure":true}}
   name: ekman
   server: https://10.255.241.99:4443
 kind: Secret
 metadata:
   labels:
     argocd.argoproj.io/secret-type: cluster
-  name: cluster-ekman
+  name: cluster-10.255.241.99-4046803085
   namespace: argocd
 type: Opaque
 
-

argocd/kustomize-helm-with-rewrite/deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
+img=registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite
 tag=${1:-latest}
 
 docker build -t $img:$tag .

argocd/kustomize-helm-with-rewrite/generate.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-export HOME=/plugin
+export HOME=/helm-working-dir
 
 env > /tmp/$ARGOCD_APP_NAME.env
 
@@ -23,12 +23,11 @@ fi
 [ -f values-$PARAM_ENV.yaml ] && VALUES="$VALUES -f values-$PARAM_ENV.yaml"
 VALUES="$VALUES -f parameters.yaml"
 
-helm dependency update $CHART >/tmp/$ARGOCD_APP_NAME-helm-dependency-build.out
-
 mkdir -p base
 echo "helm template -n $ARGOCD_APP_NAMESPACE $PARAM_FLAGS $VALUES $ARGOCD_APP_NAME $CHART" > /tmp/$ARGOCD_APP_NAME-helm.sh
 helm template -n $ARGOCD_APP_NAMESPACE $PARAM_FLAGS $VALUES $ARGOCD_APP_NAME $CHART > ./base/_manifest.yaml
 
+sed -i "$PARAM_REWRITE" ./base/_manifest.yaml
 cp ./base/_manifest.yaml /tmp/$ARGOCD_APP_NAME-manifest.yaml
 
 [ -d "$PARAM_ENV" ] && kubectl kustomize $PARAM_ENV > /tmp/$ARGOCD_APP_NAME-manifest.yaml

argocd/kustomize-helm-with-rewrite/init-helm-repos.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-export HOME=/plugin
+export HOME=/helm-working-dir
 
 helm repo add --username argocd-helm --password "$OCEANBOX_HELM_ACCESS_TOKEN" oceanbox \
     https://gitlab.com/api/v4/projects/54396343/packages/helm/stable

argocd/kustomize-helm-with-rewrite/init.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-export HOME=/plugin
+export HOME=/helm-working-dir
 
 helm repo update oceanbox
 

argocd/kustomize-helm-with-rewrite/plugin.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: ConfigManagementPlugin
 metadata:
-  name: helm-kustomize-cmp
+  name: kustomize-helm-with-rewrite
 spec:
   # version: v1.2
   # The init command runs in the Application source directory at the beginning of each manifest generation. The init
@@ -52,6 +52,13 @@ spec:
         itemType: string
         collectionType: string
         string: "staging"
+      - name: rewrite
+        title: Rewrite
+        tooltip: sed rewrite experssion
+        required: false
+        itemType: string
+        collectionType: string
+        string: ""
       - name: chart
         title: Chart
         tooltip: Name or path of helm chart
@@ -76,10 +83,10 @@ spec:
       #   map:
       #     some: value
       #   collectionType: map
-    # dynamic:
+    dynamic:
       # The command is run in an Application's source directory. Standard output must be JSON matching the schema of the
       # static parameter announcements list.
-      # command: [ /bin/sh, /plugin/get-values.sh ]
+      command: [ /bin/sh, /plugin/get-values.sh ]
 
     # If set to `true` then the plugin receives repository files with original file mode. Dangerous since the repository
     # might have executable files. Set to true only if you trust the CMP plugin authors.

attic/.helmignore

@@ -1,26 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-*.nix
-old/
-nix/

attic/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: sys
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"
-dependencies: # A list of the chart requirements (optional)
-  - name: sys-cilium-policies
-    condition: cilium.enabled

attic/charts/cilium/.helmignore

@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/

attic/charts/cilium/Chart.yaml

@@ -1,24 +0,0 @@
-apiVersion: v2
-name: cilium
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-applicationset-ingress.yaml

@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-applicationset-ingress
-  namespace: argocd
-spec:
-  description: Allow access from the ingress controller
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: applicationset-controller
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-argo-notifications.yaml

@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-notifications
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD Notifications
-  egress:
-    - toFQDNs:
-        - matchName: slack.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: notifications-controller

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-argo-repo-access-applicationset.yaml

@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-repo-access-applicationset
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD repo Applicationset
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: applicationset-controller

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-argo-repo-access.yaml

@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-repo-access
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD repo server
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: repo-server

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-chartmuseum-ingress.yaml

@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-chartmuseum-ingress
-  namespace: argocd
-spec:
-  description: Allow access to the chartmuseum ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: chartmuseum
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-image-updater-repo-access.yaml

@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-image-updater-repo-access
-  namespace: argocd
-spec:
-  description: Allow argoCD image updater to access github container registry
-  egress:
-    - toFQDNs:
-        - matchName: ghcr.io
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-image-updater

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-ingress.yaml

@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-ingress
-  namespace: argocd
-spec:
-  description: Allow access from the ingress controller
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: server
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: argocd
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-microsoft-sso.yaml

@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-microsoft-sso
-  namespace: argocd
-spec:
-  description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
-  egress:
-    - toFQDNs:
-        - matchName: login.microsoftonline.com
-        - matchPattern: '*.microsoftonline.com'
-        - matchName: github.com
-        - matchName: api.github.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-dex-server

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-prometheus-metrics-rollout.yaml

@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics-rollout
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argo-rollouts
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8090"
-              protocol: TCP

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-prometheus-metrics-workflows.yaml

@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics-workflows
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argo-workflows
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "9090"
-              protocol: TCP

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -1,30 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argocd
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8082"
-              protocol: TCP
-            - port: "8080"
-              protocol: TCP
-            - port: "9001"
-              protocol: TCP
-            - port: "9121"
-              protocol: TCP
-            - port: "8084"
-              protocol: TCP
-            - port: "8083"
-              protocol: TCP
-            - port: "5558"
-              protocol: TCP

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-api-server-to-cert-manager.yaml

@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server-to-cert-manager
-  namespace: cert-manager
-spec:
-  description: Allow the API server to communicate with the cert-manager pods
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  ingress:
-    - fromEntities:
-        - remote-node

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-api-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cert-manager
-spec:
-  description: Allow the Kube API server to communicate with cert-manager
-  egress:
-    - toEntities:
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: cert-manager
-spec:
-  description: Allow Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9402"
-              protocol: TCP

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-world-traffic.yaml

@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-traffic
-  namespace: cert-manager
-spec:
-  description: Allow the world to communicate with cert-manager
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}

attic/charts/cilium/templates/cilium-spire/CiliumNetworkPolicy-allow-api-server.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-spire
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}

attic/charts/cilium/templates/cilium-spire/CiliumNetworkPolicy-allow-remote-node-to-server.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-server
-  namespace: cilium-spire
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: "8081"
-              protocol: TCP

attic/charts/cilium/templates/cilium-test/CiliumNetworkPolicy-allow-api-server.yaml

@@ -1,22 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-test
-spec:
-  egress:
-    - toEndpoints:
-        - {}
-    - toEntities:
-        - cluster
-    - toEntities:
-        - remote-node
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - cluster
-    - fromEntities:
-        - world

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-acme-solvers.yaml

@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-acme-solvers
-spec:
-  description: Policy for ingress for Acme Solvers.
-  endpointSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-dns.yaml

@@ -1,24 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-dns
-spec:
-  description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-        - rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchExpressions:
-      - key: io.kubernetes.pod.namespace
-        operator: NotIn
-        values:
-          - kube-system

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-mariadb-operator.yaml

@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-mariadb-operator
-spec:
-  description: allow mariadb instances to be reached by operator
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: mariadb
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: mariadb-operator
-            io.kubernetes.pod.namespace: mariadb-operator
-      toPorts:
-        - ports:
-            - port: "3306"
-              protocol: TCP

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-s3.yaml

@@ -1,20 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-spec:
-  description: Policy for egress for CNPG Backups.
-  egress:
-    - toFQDNs:
-      {{- range .Values.s3.hosts }}
-        - matchName: {{ . | quote }}
-      {{- end }}
-      {{- range .Values.s3.patterns }}
-        - matchPattern: {{ . | quote }}
-      {{- end }}
-    - toCIDR:
-      {{- range .Values.s3.cidr }}
-        - {{ . | quote }}
-      {{- end }}
-  endpointSelector:
-    matchLabels: {}

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-cilium-health-checks.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: cilium-health-checks
-spec:
-  description: Health checks
-  egress:
-    - toEntities:
-        - remote-node
-  endpointSelector:
-    matchLabels:
-      reserved:health: ""
-  ingress:
-    - fromEntities:
-        - remote-node

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-deny-all.yaml

@@ -1,9 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: deny-all
-spec:
-  description: Deny all
-  egress: []
-  endpointSelector: {}
-  ingress: []

attic/charts/cilium/templates/cnpg/CiliumNetworkPolicy-allow-api-server.yaml

@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cnpg
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: postgres-operator

attic/charts/cilium/templates/cnpg/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: cnpg
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP

attic/charts/cilium/templates/downscaler/CiliumNetworkPolicy-allow-api-server.yaml

@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kube-downscaler
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      application: downscaler-py-kube-downscaler

attic/charts/cilium/templates/downscaler/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: kube-downscaler
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-        - host
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-hubble-traffic.yaml

@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: hubble.*.*.*
-        - matchPattern: hubble.*.*.*.*
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: ingress-nginx
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ingress-nginx
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9913"
-              protocol: TCP

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-s3-traffic.yaml

@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toCIDR:
-        - 10.139.2.10/32
-    - toCIDR:
-        - 10.139.2.11/32
-    - toCIDR:
-        - 10.139.2.20/32
-    - toCIDR:
-        - 10.139.2.21/32
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-world-to-ingress-nginx.yaml

@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-ingress-nginx
-  namespace: ingress-nginx
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
-  ingress:
-    - fromEntities:
-        - world
-    - toPorts:
-        - ports:
-            - port: "80"
-              protocol: TCP
-            - port: "443"
-              protocol: TCP

attic/charts/cilium/templates/jaeger/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: jaeger
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}

attic/charts/cilium/templates/jaeger/CiliumNetworkPolicy-allow-remote-node-to-jaeger.yaml

@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-jaeger
-  namespace: jaeger
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: jaeger-operator
-  ingress:
-    - fromEntities:
-        - remote-node

attic/charts/cilium/templates/kafka/CiliumNetworkPolicy-allow-api-server.yaml

@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kafka
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kafka-operator

attic/charts/cilium/templates/kafka/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: kafka
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-controller-metrics.yaml

@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-controller-metrics
-  namespace: kube-system
-spec:
-  description: Allow Controller Metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-controller-manager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "10257"
-              protocol: TCP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-csi-webhook.yaml

@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-csi-webhook
-  namespace: kube-system
-spec:
-  endpointSelector:
-    matchLabels:
-      app: csi-snapshot-webhook
-  ingress:
-    - fromEntities:
-        - remote-node

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-dns-metrics.yaml

@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-metrics
-  namespace: kube-system
-spec:
-  description: Allow DNS metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9153"
-              protocol: TCP