feat(helm): update chart app-template to 3.4.0

also fix: incorrect namespace for wildcard cert

.taskfiles/Flux/Taskfile.yaml

@@ -3,20 +3,20 @@
 version: "3"
 
 vars:
-  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/sops-key.sops.yaml"
+  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
-  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/forgejo-deploy-key.sops.yaml"
+  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"
 
 tasks:
   bootstrap:
     desc: Bootstrap Flux into a Kubernetes cluster
     cmds:
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/bootstrap/flux
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
       - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
       - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/flux/config
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
     preconditions:
       - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }
 
   reconcile:
-    desc: Force update Flux to pull in changes from your Git repository
+    desc: Force update Flux to pull in changes from the Git repository
     cmd: flux reconcile --namespace flux-system kustomization cluster --with-source

Taskfile.yaml

@@ -3,7 +3,7 @@
 version: "3"
 
 vars:
-  CLUSTER_DIR: "{{.ROOT_DIR}}/cluster"
+  CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"
 
 includes:
   flux: .taskfiles/Flux/Taskfile.yaml

kubernetes/common/apps/cert-manager/app/files/helm-release.yaml

@@ -14,7 +14,7 @@ spec:
         name: jetstack-charts
         namespace: flux-system
   values:
-    installCRDs: false
+    installCRDs: true
     webhook:
       enabled: true
     extraArgs:
@@ -26,8 +26,8 @@ spec:
       nameservers:
         - "1.1.1.1"
         - "9.9.9.9"
-    prometheus:
+#    prometheus:
-      servicemonitor:
+#      servicemonitor:
-        enabled: true
+#        enabled: false
-        labels:
+#        labels:
-          release: kube-prometheus-stack
+#          release: kube-prometheus-stack

kubernetes/common/apps/cert-manager/app/files/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./longhorn
+- ./helm-repository.yaml
-- ./openebs
+- ./helm-release.yaml
-#- ./local-path-provisioner

kubernetes/common/apps/cert-manager/app/ks.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ca-cert
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: cluster-ca
+  secretName: ca-cert-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: self-signed-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml

@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+spec:
+  ca:
+    secretName: ca-cert-secret

kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./self-signed-issuer.yaml
+- ./ca-cert.yaml
+- ./ca-issuer.yaml

kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}

kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml

@@ -1,10 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./namespace.yaml
 - ./cloudflare-cred.sops.yaml
-- ./helm-repository.yaml
-- ./helm-release.yaml
 - ./letsencrypt-prod.yaml
 - ./letsencrypt-stage.yaml
-- ./wildcard-cert.yaml
+- ./ca

kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml

@@ -10,9 +10,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-production
     solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
       - dns01:
           cloudflare:
             email: "${SECRET_MY_EMAIL}"
@@ -21,4 +18,6 @@ spec:
               key: api-token
         selector:
           dnsZones:
-            - "${SECRET_NEW_DOMAIN}"
+            - "${SECRET_NEW_DOMAIN}"
+            - "internal.${SECRET_NEW_DOMAIN}"
+            - "*.internal.${SECRET_NEW_DOMAIN}"

kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml

@@ -10,9 +10,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-staging
     solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
       - dns01:
           cloudflare:
             email: "${SECRET_MY_EMAIL}"

kubernetes/common/apps/cert-manager/certs/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-certificates
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/certs/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cert-manager
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/cert-manager/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./app/ks.yaml
+- ./certs/ks.yaml

kubernetes/common/apps/database/dbs/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgresql
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/database/dbs/postgresql
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: openebs-sc
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/database/dbs/postgresql/helm-release.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: database
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: postgresql
+      version: 14.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami-charts
+        namespace: flux-system
+  values:
+    auth:
+      existingSecret: "pgsql-secrets"
+      secretKeys:
+        adminPasswordKey: "adminPassword"
+        replicationPasswordKey: "replicationPassword"
+
+    serviceMonitor:
+      enabled: true
+      labels:
+        release: kube-prometheus-stack
+
+    volumePermissions:
+      enabled: true
+
+    primary:
+      persistence:
+        existingClaim: "postgresql-pvc"
+
+      containerSecurityContext:
+        enabled: true
+        runAsUser: 655
+
+    readReplicas:
+      containerSecurityContext:
+        enabled: true
+        runAsUser: 655

kubernetes/common/apps/database/dbs/postgresql/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./pgsql-pv.yaml
+- ./pgsql.sops.yaml
+- ./helm-release.yaml
+#- ./pgadmin4

kubernetes/common/apps/database/dbs/postgresql/pgadmin4/helm-release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pgadmin4
+  namespace: database
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: pgadmin4
+      version: "1.28.0"
+      sourceRef:
+        kind: HelmRepository
+        name: runix-charts
+        namespace: flux-system
+  values:
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-production
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      hosts:
+        - host: &host pgadm.${SECRET_NEW_DOMAIN}
+          paths:
+            - path: "/"
+              pathType: Prefix
+      tls:
+        - hosts:
+            - *host
+
+#    securityContext:
+#      runAsUser: 10000
+#      runAsGroup: 10000
+#      fsGroup: 10000
+#
+#    containerSecurityContext:
+#      enabled: true
+#      allowPrivilegeEscalation: false
+
+#    envVarsFromConfigMaps:
+#    - pgadmin4-secret
+
+    persistentVolume:
+      enabled: false
+
+    volumePermissions:
+      enabled: true

kubernetes/common/apps/database/dbs/postgresql/pgadmin4/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: runix-charts
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://helm.runix.net

kubernetes/common/apps/database/dbs/postgresql/pgadmin4/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./pgadmin4.sops.yaml
+- ./helm-repository.yaml
+- ./helm-release.yaml

kubernetes/common/apps/database/dbs/postgresql/pgsql-pv.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgresql-pvc
+  namespace: database
+spec:
+  storageClassName: openebs-dual
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

kubernetes/common/apps/database/dbs/postgresql/pgsql.sops.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: pgsql-secrets
+    namespace: database
+stringData:
+    adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
+    userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
+    replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-10-22T16:25:15Z"
+    mac: ENC[AES256_GCM,data:uWVPfKwPpR212js7f2RnCzEsMnxk2JpGPcf2L5i4gJCddJCrRJkdhjWGyVVpp/ociP3JLRTI95+WSEUH0KkPZpY1ptQevCVsUemRytOCtBlR0yR4qsBwEisSu8m4B5dbAYsqlXAndrBNL2WGB7uBv+ILgNxkhlN58unseSWJBDM=,iv:e7QyZSlhpyQ+A8OmV4p1848itIUxyam6CJOI9/N7DDY=,tag:N28mfrAjUTTYkly1hu0OhA==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:35:15Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
+            Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
+            opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
+            iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
+            JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
+            lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
+            SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
+            8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
+            VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
+            H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
+            9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
+            aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
+            di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
+            c5WTfk81xmbT
+            =UE14
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:35:15Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
+            kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
+            64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
+            zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
+            rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
+            5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
+            cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
+            hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
+            0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
+            lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
+            mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
+            aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
+            ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
+            GFDjOxp0lMGV
+            =LHSB
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.0

kubernetes/common/apps/database/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./dbs/ks.yaml

kubernetes/common/apps/database/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: database

kubernetes/common/apps/intel-gpu/ks.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: intel-gpu
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/intel-gpu/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+  - name: nfd
+    namespace: flux-system
+  # requires certificates for communications between plugins
+  - name: cert-manager
+    namespace: flux-system

kubernetes/common/apps/metallb/app/files/helm-release.yaml

@@ -24,4 +24,4 @@ spec:
         namespace: flux-system
   values:
     crds:
-      enabled: false
+      enabled: true

kubernetes/common/apps/metallb/app/files/kustomization.yaml

@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./traefik
+- ./helm-release.yaml
-- ./metallb

kubernetes/common/apps/metallb/app/ks.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/metallb/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./app/ks.yaml
+- ./pool/ks.yaml

kubernetes/common/apps/metallb/pool/files/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./metallb-static-ips.yaml

kubernetes/common/apps/metallb/pool/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-pool
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/pool/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: metallb
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/nfd/ks.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   timeout: 5m
   interval: 10m
-  path: ./kubernetes/main/core/nfd/files
+  path: ./kubernetes/common/apps/nfd/files
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/common/apps/openebs/kustomization.yaml

@@ -4,5 +4,4 @@ resources:
 - ./namespace.yaml
 - ./helm-repository.yaml
 - ./helm-release.yaml
-- ./mainpool-sc.yaml
 - ./monitoring-helm-release.yaml

kubernetes/main/apps/authentik/helm-release.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: 2024.6.4
+      version: 2024.8.2
       sourceRef:
         kind: HelmRepository
         name: authentik-charts

kubernetes/main/apps/database/minio/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/database/mysql/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: mysql
-      version: 11.1.15
+      version: 11.1.17
       sourceRef:
         kind: HelmRepository
         name: bitnami-charts

kubernetes/main/apps/database/postgresql/cert.yaml

@@ -0,0 +1,17 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-cert
+  namespace: database
+spec:
+  secretName: postgres-cert
+
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+
+  issuerRef:
+    name: cluster-ca-issuer
+    kind: ClusterIssuer
+
+  dnsNames:
+  - postgresql.database

kubernetes/main/apps/database/postgresql/helm-release.yaml

@@ -20,6 +20,12 @@ spec:
         adminPasswordKey: "adminPassword"
         replicationPasswordKey: "replicationPassword"
 
+    tls:
+      enabled: true
+      certificatesSecret: postgres-cert
+      certFilename: "tls.crt"
+      certKeyFilename: "tls.key"
+
     serviceMonitor:
       enabled: true
       labels:
@@ -39,4 +45,5 @@ spec:
     readReplicas:
       containerSecurityContext:
         enabled: true
-        runAsUser: 10000
+        runAsUser: 10000
+    

kubernetes/main/apps/database/postgresql/kustomization.yaml

@@ -3,5 +3,6 @@ kind: Kustomization
 resources:
 - ./pgsql-pv.yaml
 - ./pgsql.sops.yaml
+- ./cert.yaml
 - ./helm-release.yaml
 #- ./pgadmin4

kubernetes/main/apps/database/postgresql/pgadmin4/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: pgadmin4
-      version: "1.28.0"
+      version: "1.29.0"
       sourceRef:
         kind: HelmRepository
         name: runix-charts

kubernetes/main/apps/database/redis/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: redis
-      version: 20.0.x
+      version: 20.1.x
       sourceRef:
         kind: HelmRepository
         name: bitnami-charts

kubernetes/main/apps/default/dendrite/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -30,7 +30,7 @@ spec:
           main:
             image:
               repository: matrixdotorg/dendrite-monolith
-              tag: v0.13.7
+              tag: v0.13.8
 
     service:
       app:

kubernetes/main/apps/default/exim/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/default/fireflyiii/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/default/ganymede/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -103,7 +103,7 @@ spec:
           frontend:
             image:
               repository: ghcr.io/zibbp/ganymede-frontend
-              tag: 3.0.0
+              tag: 3.0.1
 
             env:
             - name: API_URL

kubernetes/main/apps/default/ganymede/temporal-helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -22,7 +22,7 @@ spec:
           main:
             image:
               repository: temporalio/auto-setup
-              tag: 1.24
+              tag: 1.25
 
             env:
             - name: DB

kubernetes/main/apps/default/huginn/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/default/mealie/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/default/piwigo/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/default/trilium/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/default/well-known-site/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/dev/woodpecker/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: woodpecker
-      version: "1.5.1"
+      version: "1.6.0"
       sourceRef:
         kind: HelmRepository
         name: woodpecker-charts

kubernetes/main/apps/download/bazarr/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/bazarr
-      tag: "1.4.3"
+      tag: "1.4.4"
 
     env:
       TZ: America/New_York

kubernetes/main/apps/download/flaresolverr/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/download/kapowarr/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/download/mylar3/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/download/prowlarr/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/prowlarr-develop
-      tag: "1.21.2.4649"
+      tag: "1.24.0.4721"
 
     # Metrics sidecar
     sidecars:

kubernetes/main/apps/download/qbit-manage/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -35,7 +35,7 @@ spec:
 
     image:
       repository: bobokun/qbit_manage
-      tag: "v4.1.7"
+      tag: "v4.1.9"
 
     env:
       QBT_STARTUP_DELAY: 45 # seconds

kubernetes/main/apps/download/qbittorrent/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -28,7 +28,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/qbittorrent
-              tag: 4.6.5
+              tag: 4.6.7
 
             env:
               QBITTORRENT__PORT: 8080

kubernetes/main/apps/download/radarr/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/radarr-develop
-      tag: "5.10.0.9090"
+      tag: "5.10.3.9178"
 
     # Metrics sidecar
     sidecars:

kubernetes/main/apps/download/readarr/audiobook-helm.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/download/readarr/ebook-helm.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/download/sabnzbd/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/download/sonarr/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/sonarr-develop
-      tag: "4.0.9.2300"
+      tag: "4.0.9.2386"
 
     # Metrics sidecar
     sidecars:

kubernetes/main/apps/download/unpackerr/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/game-servers/factorio/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: goofball222/factorio
-      tag: "1.1.109"
+      tag: "1.1.110"
 
     service:
       main:

kubernetes/main/apps/game-servers/palworld/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/irc/thelounge/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/irc/znc/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -21,7 +21,7 @@ spec:
     # Add init container for pulling znc modules and putting them into the modules directory
     initContainers:
       pull-module-source:
-        image: alpine:3.20.2
+        image: alpine:3.20.3
         command:
           - "sh"
           - "-c"

kubernetes/main/apps/media/audiobookshelf/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.1.0
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -23,7 +23,7 @@ spec:
           main:
             image:
               repository: ghcr.io/advplyr/audiobookshelf
-              tag: 2.13.2
+              tag: 2.13.4
 
     service:
       app:

kubernetes/main/apps/media/freshrss/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: linuxserver/freshrss
-      tag: "1.24.2"
+      tag: "1.24.3"
 
     env:
       PUID: 10000

kubernetes/main/apps/media/jellyfin/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.3.2
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -22,7 +22,7 @@ spec:
           app:
             image:
               repository: linuxserver/jellyfin
-              tag: 10.9.10
+              tag: 10.9.11
             
             env:
               PUID: 10000

kubernetes/main/apps/media/jellyseerr/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/media/kavita/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/media/komga/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: gotson/komga
-      tag: "1.12.0"
+      tag: "1.13.0"
 
     env:
       TZ: America/New_York

kubernetes/main/apps/media/ombi/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/media/plex/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 3.3.2
+      version: 3.4.0
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/media/tautulli/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/monitoring/alertmanager-gotify-bridge/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: app-template
-      version: 1.3.x
+      version: 3.4.x
       sourceRef:
         kind: HelmRepository
         name: bjws-charts

kubernetes/main/apps/monitoring/grafana/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: grafana
-      version: "8.5.0"
+      version: "8.5.1"
       sourceRef:
         kind: HelmRepository
         name: grafana-charts