feat(helm): update chart app-template to 3.4.0

chore: switch thin cluster to main branch after the merge
feat: cert-manager ca for internal certs, enable tls for postgres
2024-09-20 01:07:36 +00:00 · 2024-09-19 20:29:29 -04:00 · 2024-09-19 20:28:32 -04:00 · 2024-09-19 19:11:35 -04:00 · 2024-09-19 19:07:11 -04:00 · 2024-09-19 19:07:11 -04:00
188 changed files with 2246 additions and 271 deletions
--- a/.taskfiles/Flux/Taskfile.yaml
+++ b/.taskfiles/Flux/Taskfile.yaml
@ -3,20 +3,20 @@
 version: "3"

 vars:
-  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/sops-key.sops.yaml"
-  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/forgejo-deploy-key.sops.yaml"
+  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
+  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"

 tasks:
  bootstrap:
    desc: Bootstrap Flux into a Kubernetes cluster
    cmds:
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/bootstrap/flux
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
      - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
      - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/flux/config
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
    preconditions:
      - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }

  reconcile:
-    desc: Force update Flux to pull in changes from your Git repository
+    desc: Force update Flux to pull in changes from the Git repository
    cmd: flux reconcile --namespace flux-system kustomization cluster --with-source
--- a/Taskfile.yaml
+++ b/Taskfile.yaml
@ -3,7 +3,7 @@
 version: "3"

 vars:
-  CLUSTER_DIR: "{{.ROOT_DIR}}/cluster"
+  CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"

 includes:
  flux: .taskfiles/Flux/Taskfile.yaml
--- a/kubernetes/common/apps/cert-manager/app/files/helm-release.yaml
+++ b/kubernetes/common/apps/cert-manager/app/files/helm-release.yaml
@ -14,7 +14,7 @@ spec:
        name: jetstack-charts
        namespace: flux-system
  values:
-    installCRDs: false
+    installCRDs: true
    webhook:
      enabled: true
    extraArgs:
@ -26,8 +26,8 @@ spec:
      nameservers:
        - "1.1.1.1"
        - "9.9.9.9"
-    prometheus:
-      servicemonitor:
-        enabled: true
-        labels:
-          release: kube-prometheus-stack
+#    prometheus:
+#      servicemonitor:
+#        enabled: false
+#        labels:
+#          release: kube-prometheus-stack
--- a/kubernetes/common/apps/cert-manager/app/files/helm-repository.yaml
+++ b/kubernetes/common/apps/cert-manager/app/files/helm-repository.yaml
--- a/kubernetes/common/apps/cert-manager/app/files/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/app/files/kustomization.yaml
@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ./longhorn
- ./openebs
-#- ./local-path-provisioner
+- ./helm-repository.yaml
+- ./helm-release.yaml
--- a/kubernetes/common/apps/cert-manager/app/ks.yaml
+++ b/kubernetes/common/apps/cert-manager/app/ks.yaml
@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml
@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ca-cert
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: cluster-ca
+  secretName: ca-cert-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: self-signed-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml
@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+spec:
+  ca:
+    secretName: ca-cert-secret
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./self-signed-issuer.yaml
+- ./ca-cert.yaml
+- ./ca-issuer.yaml
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml
@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}
--- a/kubernetes/common/apps/cert-manager/certs/files/cloudflare-cred.sops.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/cloudflare-cred.sops.yaml
--- a/kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml
@ -1,10 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ./namespace.yaml
 - ./cloudflare-cred.sops.yaml
- ./helm-repository.yaml
- ./helm-release.yaml
 - ./letsencrypt-prod.yaml
 - ./letsencrypt-stage.yaml
- ./wildcard-cert.yaml
+- ./ca
--- a/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml
@ -10,9 +10,6 @@ spec:
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
      - dns01:
          cloudflare:
            email: "${SECRET_MY_EMAIL}"
@ -22,3 +19,5 @@ spec:
        selector:
          dnsZones:
            - "${SECRET_NEW_DOMAIN}"
+            - "internal.${SECRET_NEW_DOMAIN}"
+            - "*.internal.${SECRET_NEW_DOMAIN}"
--- a/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml
@ -10,9 +10,6 @@ spec:
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
      - dns01:
          cloudflare:
            email: "${SECRET_MY_EMAIL}"
--- a/kubernetes/common/apps/cert-manager/certs/ks.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/ks.yaml
@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-certificates
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/certs/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cert-manager
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/cert-manager/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./app/ks.yaml
+- ./certs/ks.yaml
--- a/kubernetes/common/apps/cert-manager/namespace.yaml
+++ b/kubernetes/common/apps/cert-manager/namespace.yaml
--- a/kubernetes/common/apps/database/dbs/ks.yaml
+++ b/kubernetes/common/apps/database/dbs/ks.yaml
@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgresql
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/database/dbs/postgresql
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: openebs-sc
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/database/dbs/postgresql/helm-release.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/helm-release.yaml
@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: database
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: postgresql
+      version: 14.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami-charts
+        namespace: flux-system
+  values:
+    auth:
+      existingSecret: "pgsql-secrets"
+      secretKeys:
+        adminPasswordKey: "adminPassword"
+        replicationPasswordKey: "replicationPassword"
+
+    serviceMonitor:
+      enabled: true
+      labels:
+        release: kube-prometheus-stack
+
+    volumePermissions:
+      enabled: true
+
+    primary:
+      persistence:
+        existingClaim: "postgresql-pvc"
+
+      containerSecurityContext:
+        enabled: true
+        runAsUser: 655
+
+    readReplicas:
+      containerSecurityContext:
+        enabled: true
+        runAsUser: 655
--- a/kubernetes/common/apps/database/dbs/postgresql/kustomization.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/kustomization.yaml
@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./pgsql-pv.yaml
+- ./pgsql.sops.yaml
+- ./helm-release.yaml
+#- ./pgadmin4
--- a/kubernetes/common/apps/database/dbs/postgresql/pgadmin4/helm-release.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/pgadmin4/helm-release.yaml
@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pgadmin4
+  namespace: database
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: pgadmin4
+      version: "1.28.0"
+      sourceRef:
+        kind: HelmRepository
+        name: runix-charts
+        namespace: flux-system
+  values:
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-production
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      hosts:
+        - host: &host pgadm.${SECRET_NEW_DOMAIN}
+          paths:
+            - path: "/"
+              pathType: Prefix
+      tls:
+        - hosts:
+            - *host
+
+#    securityContext:
+#      runAsUser: 10000
+#      runAsGroup: 10000
+#      fsGroup: 10000
+#
+#    containerSecurityContext:
+#      enabled: true
+#      allowPrivilegeEscalation: false
+
+#    envVarsFromConfigMaps:
+#    - pgadmin4-secret
+
+    persistentVolume:
+      enabled: false
+
+    volumePermissions:
+      enabled: true
--- a/kubernetes/common/apps/database/dbs/postgresql/pgadmin4/helm-repository.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/pgadmin4/helm-repository.yaml
@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: runix-charts
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://helm.runix.net
--- a/kubernetes/common/apps/database/dbs/postgresql/pgadmin4/kustomization.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/pgadmin4/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./pgadmin4.sops.yaml
+- ./helm-repository.yaml
+- ./helm-release.yaml
--- a/kubernetes/common/apps/database/dbs/postgresql/pgsql-pv.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/pgsql-pv.yaml
@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgresql-pvc
+  namespace: database
+spec:
+  storageClassName: openebs-dual
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
--- a/kubernetes/common/apps/database/dbs/postgresql/pgsql.sops.yaml
+++ b/kubernetes/common/apps/database/dbs/postgresql/pgsql.sops.yaml
@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: pgsql-secrets
+    namespace: database
+stringData:
+    adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
+    userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
+    replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-10-22T16:25:15Z"
+    mac: ENC[AES256_GCM,data:uWVPfKwPpR212js7f2RnCzEsMnxk2JpGPcf2L5i4gJCddJCrRJkdhjWGyVVpp/ociP3JLRTI95+WSEUH0KkPZpY1ptQevCVsUemRytOCtBlR0yR4qsBwEisSu8m4B5dbAYsqlXAndrBNL2WGB7uBv+ILgNxkhlN58unseSWJBDM=,iv:e7QyZSlhpyQ+A8OmV4p1848itIUxyam6CJOI9/N7DDY=,tag:N28mfrAjUTTYkly1hu0OhA==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:35:15Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
+            Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
+            opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
+            iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
+            JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
+            lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
+            SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
+            8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
+            VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
+            H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
+            9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
+            aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
+            di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
+            c5WTfk81xmbT
+            =UE14
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:35:15Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
+            kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
+            64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
+            zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
+            rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
+            5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
+            cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
+            hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
+            0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
+            lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
+            mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
+            aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
+            ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
+            GFDjOxp0lMGV
+            =LHSB
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.0
--- a/kubernetes/common/apps/database/kustomization.yaml
+++ b/kubernetes/common/apps/database/kustomization.yaml
@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./dbs/ks.yaml
--- a/kubernetes/common/apps/database/namespace.yaml
+++ b/kubernetes/common/apps/database/namespace.yaml
@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: database
--- a/kubernetes/common/apps/intel-gpu/files/gpu-plugin.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/gpu-plugin.yaml
--- a/kubernetes/common/apps/intel-gpu/files/helm-repos.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/helm-repos.yaml
--- a/kubernetes/common/apps/intel-gpu/files/intel-device-plugins-operator.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/intel-device-plugins-operator.yaml
--- a/kubernetes/common/apps/intel-gpu/files/kustomization.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/kustomization.yaml
--- a/kubernetes/common/apps/intel-gpu/files/namespace.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/namespace.yaml
--- a/kubernetes/common/apps/intel-gpu/ks.yaml
+++ b/kubernetes/common/apps/intel-gpu/ks.yaml
@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: intel-gpu
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/intel-gpu/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+  - name: nfd
+    namespace: flux-system
+  # requires certificates for communications between plugins
+  - name: cert-manager
+    namespace: flux-system
--- a/kubernetes/common/apps/metallb/app/files/helm-release.yaml
+++ b/kubernetes/common/apps/metallb/app/files/helm-release.yaml
@ -24,4 +24,4 @@ spec:
        namespace: flux-system
  values:
    crds:
-      enabled: false
+      enabled: true
--- a/kubernetes/common/apps/metallb/app/files/kustomization.yaml
+++ b/kubernetes/common/apps/metallb/app/files/kustomization.yaml
@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ./traefik
- ./metallb
+- ./helm-release.yaml
--- a/kubernetes/common/apps/metallb/app/ks.yaml
+++ b/kubernetes/common/apps/metallb/app/ks.yaml
@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/metallb/kustomization.yaml
+++ b/kubernetes/common/apps/metallb/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./app/ks.yaml
+- ./pool/ks.yaml
--- a/kubernetes/main/core/networking/metallb/namespace.yaml
+++ b/kubernetes/main/core/networking/metallb/namespace.yaml
--- a/kubernetes/common/apps/metallb/pool/files/kustomization.yaml
+++ b/kubernetes/common/apps/metallb/pool/files/kustomization.yaml
@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./metallb-static-ips.yaml
--- a/kubernetes/common/apps/metallb/pool/files/metallb-static-ips.yaml
+++ b/kubernetes/common/apps/metallb/pool/files/metallb-static-ips.yaml
--- a/kubernetes/common/apps/metallb/pool/ks.yaml
+++ b/kubernetes/common/apps/metallb/pool/ks.yaml
@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-pool
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/pool/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: metallb
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/nfd/files/helm-repos.yaml
+++ b/kubernetes/common/apps/nfd/files/helm-repos.yaml
--- a/kubernetes/common/apps/nfd/files/kustomization.yaml
+++ b/kubernetes/common/apps/nfd/files/kustomization.yaml
--- a/kubernetes/common/apps/nfd/files/nfd.yaml
+++ b/kubernetes/common/apps/nfd/files/nfd.yaml
--- a/kubernetes/common/apps/nfd/ks.yaml
+++ b/kubernetes/common/apps/nfd/ks.yaml
@ -7,7 +7,7 @@ metadata:
 spec:
  timeout: 5m
  interval: 10m
-  path: ./kubernetes/main/core/nfd/files
+  path: ./kubernetes/common/apps/nfd/files
  prune: true
  sourceRef:
    kind: GitRepository
--- a/kubernetes/main/core/storage/openebs/helm-release.yaml
+++ b/kubernetes/main/core/storage/openebs/helm-release.yaml
--- a/kubernetes/main/core/storage/openebs/helm-repository.yaml
+++ b/kubernetes/main/core/storage/openebs/helm-repository.yaml
--- a/kubernetes/main/core/storage/openebs/kustomization.yaml
+++ b/kubernetes/main/core/storage/openebs/kustomization.yaml
@ -4,5 +4,4 @@ resources:
 - ./namespace.yaml
 - ./helm-repository.yaml
 - ./helm-release.yaml
- ./mainpool-sc.yaml
 - ./monitoring-helm-release.yaml
--- a/kubernetes/main/core/storage/openebs/monitoring-helm-release.yaml
+++ b/kubernetes/main/core/storage/openebs/monitoring-helm-release.yaml
--- a/kubernetes/main/core/storage/openebs/namespace.yaml
+++ b/kubernetes/main/core/storage/openebs/namespace.yaml
--- a/kubernetes/common/bootstrap/flux/forgejo-deploy-key.sops.yaml
+++ b/kubernetes/common/bootstrap/flux/forgejo-deploy-key.sops.yaml
--- a/kubernetes/common/bootstrap/flux/kustomization.yaml
+++ b/kubernetes/common/bootstrap/flux/kustomization.yaml
--- a/kubernetes/common/bootstrap/flux/sops-key.sops.yaml
+++ b/kubernetes/common/bootstrap/flux/sops-key.sops.yaml
--- a/kubernetes/main/apps/authentik/helm-release.yaml
+++ b/kubernetes/main/apps/authentik/helm-release.yaml
@ -10,7 +10,7 @@ spec:
  chart:
    spec:
      chart: authentik
-      version: 2024.6.4
+      version: 2024.8.2
      sourceRef:
        kind: HelmRepository
        name: authentik-charts
--- a/kubernetes/main/apps/database/minio/helm-release.yaml
+++ b/kubernetes/main/apps/database/minio/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/database/mysql/helm-release.yaml
+++ b/kubernetes/main/apps/database/mysql/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: mysql
-      version: 11.1.15
+      version: 11.1.17
      sourceRef:
        kind: HelmRepository
        name: bitnami-charts
--- a/kubernetes/main/apps/database/postgresql/cert.yaml
+++ b/kubernetes/main/apps/database/postgresql/cert.yaml
@ -0,0 +1,17 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-cert
+  namespace: database
+spec:
+  secretName: postgres-cert
+
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+
+  issuerRef:
+    name: cluster-ca-issuer
+    kind: ClusterIssuer
+
+  dnsNames:
+  - postgresql.database
--- a/kubernetes/main/apps/database/postgresql/helm-release.yaml
+++ b/kubernetes/main/apps/database/postgresql/helm-release.yaml
@ -20,6 +20,12 @@ spec:
        adminPasswordKey: "adminPassword"
        replicationPasswordKey: "replicationPassword"

+    tls:
+      enabled: true
+      certificatesSecret: postgres-cert
+      certFilename: "tls.crt"
+      certKeyFilename: "tls.key"
+
    serviceMonitor:
      enabled: true
      labels:
@ -40,3 +46,4 @@ spec:
      containerSecurityContext:
        enabled: true
        runAsUser: 10000
+    
--- a/kubernetes/main/apps/database/postgresql/kustomization.yaml
+++ b/kubernetes/main/apps/database/postgresql/kustomization.yaml
@ -3,5 +3,6 @@ kind: Kustomization
 resources:
 - ./pgsql-pv.yaml
 - ./pgsql.sops.yaml
+- ./cert.yaml
 - ./helm-release.yaml
 #- ./pgadmin4
--- a/kubernetes/main/apps/database/postgresql/pgadmin4/helm-release.yaml
+++ b/kubernetes/main/apps/database/postgresql/pgadmin4/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: pgadmin4
-      version: "1.28.0"
+      version: "1.29.0"
      sourceRef:
        kind: HelmRepository
        name: runix-charts
--- a/kubernetes/main/apps/database/redis/helm-release.yaml
+++ b/kubernetes/main/apps/database/redis/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: redis
-      version: 20.0.x
+      version: 20.1.x
      sourceRef:
        kind: HelmRepository
        name: bitnami-charts
--- a/kubernetes/main/apps/default/dendrite/helm-release.yaml
+++ b/kubernetes/main/apps/default/dendrite/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -30,7 +30,7 @@ spec:
          main:
            image:
              repository: matrixdotorg/dendrite-monolith
-              tag: v0.13.7
+              tag: v0.13.8

    service:
      app:
--- a/kubernetes/main/apps/default/exim/helm-release.yaml
+++ b/kubernetes/main/apps/default/exim/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/default/fireflyiii/helm-release.yaml
+++ b/kubernetes/main/apps/default/fireflyiii/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/default/ganymede/helm-release.yaml
+++ b/kubernetes/main/apps/default/ganymede/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -103,7 +103,7 @@ spec:
          frontend:
            image:
              repository: ghcr.io/zibbp/ganymede-frontend
-              tag: 3.0.0
+              tag: 3.0.1

            env:
            - name: API_URL
--- a/kubernetes/main/apps/default/ganymede/temporal-helm-release.yaml
+++ b/kubernetes/main/apps/default/ganymede/temporal-helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -22,7 +22,7 @@ spec:
          main:
            image:
              repository: temporalio/auto-setup
-              tag: 1.24
+              tag: 1.25

            env:
            - name: DB
--- a/kubernetes/main/apps/default/huginn/helm-release.yaml
+++ b/kubernetes/main/apps/default/huginn/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/default/mealie/helm-release.yaml
+++ b/kubernetes/main/apps/default/mealie/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/default/piwigo/helm-release.yaml
+++ b/kubernetes/main/apps/default/piwigo/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/default/trilium/helm-release.yaml
+++ b/kubernetes/main/apps/default/trilium/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/default/well-known-site/helm-release.yaml
+++ b/kubernetes/main/apps/default/well-known-site/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/dev/woodpecker/helm-release.yaml
+++ b/kubernetes/main/apps/dev/woodpecker/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: woodpecker
-      version: "1.5.1"
+      version: "1.6.0"
      sourceRef:
        kind: HelmRepository
        name: woodpecker-charts
--- a/kubernetes/main/apps/download/bazarr/helm-release.yaml
+++ b/kubernetes/main/apps/download/bazarr/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: ghcr.io/onedr0p/bazarr
-      tag: "1.4.3"
+      tag: "1.4.4"

    env:
      TZ: America/New_York
--- a/kubernetes/main/apps/download/flaresolverr/helm-release.yaml
+++ b/kubernetes/main/apps/download/flaresolverr/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/download/kapowarr/helm-release.yaml
+++ b/kubernetes/main/apps/download/kapowarr/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/download/mylar3/helm-release.yaml
+++ b/kubernetes/main/apps/download/mylar3/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/download/prowlarr/helm-release.yaml
+++ b/kubernetes/main/apps/download/prowlarr/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: ghcr.io/onedr0p/prowlarr-develop
-      tag: "1.21.2.4649"
+      tag: "1.24.0.4721"

    # Metrics sidecar
    sidecars:
--- a/kubernetes/main/apps/download/qbit-manage/helm-release.yaml
+++ b/kubernetes/main/apps/download/qbit-manage/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -35,7 +35,7 @@ spec:

    image:
      repository: bobokun/qbit_manage
-      tag: "v4.1.7"
+      tag: "v4.1.9"

    env:
      QBT_STARTUP_DELAY: 45 # seconds
--- a/kubernetes/main/apps/download/qbittorrent/helm-release.yaml
+++ b/kubernetes/main/apps/download/qbittorrent/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -28,7 +28,7 @@ spec:
          app:
            image:
              repository: ghcr.io/onedr0p/qbittorrent
-              tag: 4.6.5
+              tag: 4.6.7

            env:
              QBITTORRENT__PORT: 8080
--- a/kubernetes/main/apps/download/radarr/helm-release.yaml
+++ b/kubernetes/main/apps/download/radarr/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: ghcr.io/onedr0p/radarr-develop
-      tag: "5.10.0.9090"
+      tag: "5.10.3.9178"

    # Metrics sidecar
    sidecars:
--- a/kubernetes/main/apps/download/readarr/audiobook-helm.yaml
+++ b/kubernetes/main/apps/download/readarr/audiobook-helm.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/download/readarr/ebook-helm.yaml
+++ b/kubernetes/main/apps/download/readarr/ebook-helm.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/download/sabnzbd/helm-release.yaml
+++ b/kubernetes/main/apps/download/sabnzbd/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/download/sonarr/helm-release.yaml
+++ b/kubernetes/main/apps/download/sonarr/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: ghcr.io/onedr0p/sonarr-develop
-      tag: "4.0.9.2300"
+      tag: "4.0.9.2386"

    # Metrics sidecar
    sidecars:
--- a/kubernetes/main/apps/download/unpackerr/helm-release.yaml
+++ b/kubernetes/main/apps/download/unpackerr/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/game-servers/factorio/helm-release.yaml
+++ b/kubernetes/main/apps/game-servers/factorio/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: goofball222/factorio
-      tag: "1.1.109"
+      tag: "1.1.110"

    service:
      main:
--- a/kubernetes/main/apps/game-servers/palworld/helm-release.yaml
+++ b/kubernetes/main/apps/game-servers/palworld/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/irc/thelounge/helm-release.yaml
+++ b/kubernetes/main/apps/irc/thelounge/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/irc/znc/helm-release.yaml
+++ b/kubernetes/main/apps/irc/znc/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -21,7 +21,7 @@ spec:
    # Add init container for pulling znc modules and putting them into the modules directory
    initContainers:
      pull-module-source:
-        image: alpine:3.20.2
+        image: alpine:3.20.3
        command:
          - "sh"
          - "-c"
--- a/kubernetes/main/apps/media/audiobookshelf/helm-release.yaml
+++ b/kubernetes/main/apps/media/audiobookshelf/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.1.0
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -23,7 +23,7 @@ spec:
          main:
            image:
              repository: ghcr.io/advplyr/audiobookshelf
-              tag: 2.13.2
+              tag: 2.13.4

    service:
      app:
--- a/kubernetes/main/apps/media/freshrss/helm-release.yaml
+++ b/kubernetes/main/apps/media/freshrss/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: linuxserver/freshrss
-      tag: "1.24.2"
+      tag: "1.24.3"

    env:
      PUID: 10000
--- a/kubernetes/main/apps/media/jellyfin/helm-release.yaml
+++ b/kubernetes/main/apps/media/jellyfin/helm-release.yaml
@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.3.2
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -22,7 +22,7 @@ spec:
          app:
            image:
              repository: linuxserver/jellyfin
-              tag: 10.9.10
+              tag: 10.9.11
            
            env:
              PUID: 10000
--- a/kubernetes/main/apps/media/jellyseerr/helm-release.yaml
+++ b/kubernetes/main/apps/media/jellyseerr/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/media/kavita/helm-release.yaml
+++ b/kubernetes/main/apps/media/kavita/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/media/komga/helm-release.yaml
+++ b/kubernetes/main/apps/media/komga/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
@ -17,7 +17,7 @@ spec:
  values:
    image:
      repository: gotson/komga
-      tag: "1.12.0"
+      tag: "1.13.0"

    env:
      TZ: America/New_York
--- a/kubernetes/main/apps/media/ombi/helm-release.yaml
+++ b/kubernetes/main/apps/media/ombi/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/media/plex/helm-release.yaml
+++ b/kubernetes/main/apps/media/plex/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 3.3.2
+      version: 3.4.0
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/media/tautulli/helm-release.yaml
+++ b/kubernetes/main/apps/media/tautulli/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/monitoring/alertmanager-gotify-bridge/helm-release.yaml
+++ b/kubernetes/main/apps/monitoring/alertmanager-gotify-bridge/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: app-template
-      version: 1.3.x
+      version: 3.4.x
      sourceRef:
        kind: HelmRepository
        name: bjws-charts
--- a/kubernetes/main/apps/monitoring/grafana/helm-release.yaml
+++ b/kubernetes/main/apps/monitoring/grafana/helm-release.yaml
@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: grafana
-      version: "8.5.0"
+      version: "8.5.1"
      sourceRef:
        kind: HelmRepository
        name: grafana-charts
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Renovate Bot	a176f96ac8	feat(helm): update chart app-template to 3.4.0	2024-09-20 01:07:36 +00:00
SeanOMik	5c41d2ad58	chore: switch thin cluster to main branch after the merge	2024-09-19 20:29:29 -04:00
SeanOMik	d7d81b3903	feat: cert-manager ca for internal certs, enable tls for postgres also fix: incorrect namespace for wildcard cert	2024-09-19 20:28:32 -04:00
SeanOMik	4fe6efbfc9	Merge pull request 'Add a cluster of thin clients' (#399 ) from feat/thin-cluster into main Reviewed-on: #399	2024-09-19 19:11:35 -04:00
SeanOMik	dd70c87b36	fix: use correct kustomize file paths	2024-09-19 19:07:11 -04:00
SeanOMik	9e58733a47	feat: add kubevirt to thin cluster	2024-09-19 19:07:11 -04:00
SeanOMik	2b432acd32	feat: add home-assistant to thin cluster	2024-09-19 19:07:11 -04:00
SeanOMik	473ffdffc0	fix: use correct file path	2024-09-19 19:07:11 -04:00
SeanOMik	5a9e883b75	feat: switch from traefik to nginx-ingress	2024-09-19 19:07:11 -04:00
SeanOMik	3da1b8e693	fix(postgres): use correct file paths	2024-09-19 19:07:11 -04:00
SeanOMik	4fd71c59d0	feat: add postgres	2024-09-19 19:07:11 -04:00
SeanOMik	d7c8537074	fix(whoami): specifiy internal ingress class	2024-09-19 19:07:11 -04:00
SeanOMik	f02811f4f2	fix: use correct name and path of kustomization	2024-09-19 19:07:11 -04:00
SeanOMik	3209590082	feat: add snapshot-system and openebs mayastor	2024-09-19 19:07:11 -04:00
SeanOMik	daa10b10e1	fix: change load balancer subnet, make certs valid for '*.internal' domains	2024-09-19 19:07:11 -04:00
SeanOMik	bed6a15588	fix: specify bgp label on traefik services	2024-09-19 19:07:11 -04:00
SeanOMik	d2be6e6cc9	fix: use correct path of thin cluster traefik	2024-09-19 19:07:11 -04:00
SeanOMik	6bb2b612a8	feat: add internal ingress, generate internal certs, setup cilium bgp, create whoami deployment	2024-09-19 19:07:11 -04:00
SeanOMik	41a06897c3	chore: remove metallb from thin cluster	2024-09-19 19:07:11 -04:00
SeanOMik	219b416fb4	fix: use correct file path	2024-09-19 19:07:11 -04:00
SeanOMik	63ad2c9c31	feat: move metallb to common, install it in thin cluster	2024-09-19 19:07:11 -04:00
SeanOMik	3a8639f80d	feat: reorganize cert-manager to avoid crds race condition	2024-09-19 19:07:11 -04:00
SeanOMik	9134f887a7	feat: move cert-manager to common, add it to thin cluster	2024-09-19 19:07:11 -04:00
SeanOMik	2ec21aa757	fix(nfd, intel-gpu): use correct kustomization path	2024-09-19 19:07:11 -04:00
SeanOMik	8c224b4464	fix(traefik): add substituteFrom config map and secrets	2024-09-19 19:07:11 -04:00
SeanOMik	18c99ba347	fix: traefik crds race condition	2024-09-19 19:07:11 -04:00
SeanOMik	ea0ba61a26	fix: remove metallb, use cilium load balancer ip pool instead	2024-09-19 19:07:11 -04:00
SeanOMik	d54748b324	chore: remove unused traefik entrypoint	2024-09-19 19:07:11 -04:00
SeanOMik	9c3743714c	fix: enable metallb crds	2024-09-19 19:07:11 -04:00
SeanOMik	9dcb7c6d90	fix: remove dependsOn: core for thin cluster	2024-09-19 19:07:11 -04:00
SeanOMik	14216829c9	feat: add new cluster, create common directory	2024-09-19 19:07:06 -04:00
SeanOMik	5917341e26	Merge pull request 'feat(github-release)!: Update traefik-crd-source to v31.1.0' (#385 ) from renovate/traefik-crd-source-31.x into main Reviewed-on: #385	2024-09-19 09:40:12 -04:00
Renovate Bot	b0e4718047	feat(github-release)!: Update traefik-crd-source to v31.1.0	2024-09-19 09:40:12 -04:00
SeanOMik	f1132025cc	Merge pull request 'fix(container): update image alpine to v3.20.3' (#395 ) from renovate/alpine-3.x into main Reviewed-on: #395	2024-09-19 09:39:03 -04:00
Renovate Bot	4abd76770a	fix(container): update image alpine to v3.20.3	2024-09-19 09:39:03 -04:00
SeanOMik	8ef1659f35	Merge pull request 'feat(container): update image temporalio/auto-setup to v1.25' (#389 ) from renovate/temporalio-auto-setup-1.x into main Reviewed-on: #389	2024-09-19 09:38:47 -04:00
Renovate Bot	f22cf45dfa	feat(container): update image temporalio/auto-setup to v1.25	2024-09-19 09:38:47 -04:00
SeanOMik	11f2fbde57	Merge pull request 'fix(container): update image ghcr.io/advplyr/audiobookshelf to v2.13.4' (#370 ) from renovate/ghcr.io-advplyr-audiobookshelf-2.x into main Reviewed-on: #370	2024-09-19 09:38:21 -04:00
Renovate Bot	b389d60b02	fix(container): update image ghcr.io/advplyr/audiobookshelf to v2.13.4	2024-09-19 09:38:21 -04:00
SeanOMik	679f61756e	Merge pull request 'fix(container): update image ghcr.io/onedr0p/qbittorrent to v4.6.7' (#371 ) from renovate/ghcr.io-onedr0p-qbittorrent-4.x into main Reviewed-on: #371	2024-09-19 09:37:55 -04:00
Renovate Bot	1817bfd41c	fix(container): update image ghcr.io/onedr0p/qbittorrent to v4.6.7	2024-09-19 09:37:55 -04:00
SeanOMik	d3d6f0e9bf	Merge pull request 'fix(container): update image ghcr.io/onedr0p/radarr-develop to v5.10.3.9178' (#372 ) from renovate/ghcr.io-onedr0p-radarr-develop-5.x into main Reviewed-on: #372	2024-09-19 09:37:32 -04:00
Renovate Bot	b34c9d5bb3	fix(container): update image ghcr.io/onedr0p/radarr-develop to v5.10.3.9178	2024-09-19 09:37:32 -04:00
SeanOMik	09dc2632f5	Merge pull request 'fix(container): update image ghcr.io/onedr0p/sonarr-develop to v4.0.9.2386' (#373 ) from renovate/ghcr.io-onedr0p-sonarr-develop-4.x into main Reviewed-on: #373	2024-09-19 09:37:05 -04:00
Renovate Bot	60cef12727	fix(container): update image ghcr.io/onedr0p/sonarr-develop to v4.0.9.2386	2024-09-19 09:37:05 -04:00
SeanOMik	45bf2d5495	Merge pull request 'fix(container): update image ghcr.io/zibbp/ganymede-frontend to v3.0.1' (#374 ) from renovate/ghcr.io-zibbp-ganymede-frontend-3.x into main Reviewed-on: #374	2024-09-19 09:36:42 -04:00
Renovate Bot	dee1286dcb	fix(container): update image ghcr.io/zibbp/ganymede-frontend to v3.0.1	2024-09-19 09:36:42 -04:00
SeanOMik	f0e997d8e7	Merge pull request 'feat(container): update image gotson/komga to v1.13.0' (#375 ) from renovate/gotson-komga-1.x into main Reviewed-on: #375	2024-09-19 09:35:32 -04:00
Renovate Bot	1589ac5ec8	feat(container): update image gotson/komga to v1.13.0	2024-09-19 09:35:32 -04:00
SeanOMik	fd8e63ba5d	Merge pull request 'fix(github-release): update local-path-provisioner to v0.0.29' (#376 ) from renovate/local-path-provisioner-0.x into main Reviewed-on: #376	2024-09-19 09:34:15 -04:00
Renovate Bot	e7bfe2e240	fix(github-release): update local-path-provisioner to v0.0.29	2024-09-19 09:34:15 -04:00
SeanOMik	87a28dc58e	Merge pull request 'fix(helm): update chart grafana to 8.5.1' (#377 ) from renovate/grafana-8.x into main Reviewed-on: #377	2024-09-19 09:33:53 -04:00
Renovate Bot	dd89ee09e8	fix(helm): update chart grafana to 8.5.1	2024-09-19 09:33:53 -04:00
SeanOMik	746e48c3de	Merge pull request 'fix(helm): update chart longhorn to 1.7.1' (#378 ) from renovate/longhorn-1.x into main Reviewed-on: #378	2024-09-19 09:33:33 -04:00
Renovate Bot	7d8a75c6f0	fix(helm): update chart longhorn to 1.7.1	2024-09-19 09:33:33 -04:00
SeanOMik	fefad39b44	Merge pull request 'fix(helm): update chart mysql to 11.1.17' (#379 ) from renovate/mysql-11.x into main Reviewed-on: #379	2024-09-19 09:33:12 -04:00
Renovate Bot	d3fc019ff3	fix(helm): update chart mysql to 11.1.17	2024-09-19 09:33:12 -04:00
SeanOMik	e8c01c01b8	Merge pull request 'fix(helm): update chart victoria-metrics-single to 0.11.2' (#380 ) from renovate/victoria-metrics-single-0.x into main Reviewed-on: #380	2024-09-19 09:32:50 -04:00
Renovate Bot	7f870f9d1b	fix(helm): update chart victoria-metrics-single to 0.11.2	2024-09-19 09:32:50 -04:00
SeanOMik	7f78457843	Merge pull request 'feat(container): update image ghcr.io/onedr0p/prowlarr-develop to v1.24.0.4721' (#381 ) from renovate/ghcr.io-onedr0p-prowlarr-develop-1.x into main Reviewed-on: #381	2024-09-19 09:32:37 -04:00
Renovate Bot	6d5e8ec895	feat(container): update image ghcr.io/onedr0p/prowlarr-develop to v1.24.0.4721	2024-09-19 09:32:37 -04:00
SeanOMik	bc1149f243	Merge pull request 'feat(helm): update chart authentik to 2024.8.2' (#382 ) from renovate/authentik-2024.x into main Reviewed-on: #382	2024-09-19 09:32:14 -04:00
Renovate Bot	f1abdfbb0e	feat(helm): update chart authentik to 2024.8.2	2024-09-19 09:32:14 -04:00
SeanOMik	739f3c8e6c	Merge pull request 'feat(helm): update chart kube-prometheus-stack to 62.7.0' (#383 ) from renovate/kube-prometheus-stack-62.x into main Reviewed-on: #383	2024-09-19 09:31:55 -04:00
Renovate Bot	09fe06eff6	feat(helm): update chart kube-prometheus-stack to 62.7.0	2024-09-19 09:31:55 -04:00
SeanOMik	f62690f18a	Merge pull request 'feat(helm): update chart pgadmin4 to 1.29.0' (#384 ) from renovate/pgadmin4-1.x into main Reviewed-on: #384	2024-09-19 09:31:23 -04:00
Renovate Bot	c6a94e76d0	feat(helm): update chart pgadmin4 to 1.29.0	2024-09-19 09:31:23 -04:00
SeanOMik	3c0566d981	feat(helm)!: Update chart traefik to 31.1.0 (#386 )	2024-09-19 09:29:06 -04:00
Renovate Bot	d0a46c4ee2	feat(helm)!: Update chart traefik to 31.1.0	2024-09-19 09:29:06 -04:00
SeanOMik	624d26c435	fix(container): update image bobokun/qbit_manage to v4.1.9 (#387 )	2024-09-19 09:28:54 -04:00
Renovate Bot	fcf78e64c6	fix(container): update image bobokun/qbit_manage to v4.1.9	2024-09-19 09:28:54 -04:00
SeanOMik	42a970b65e	fix(container): update image linuxserver/freshrss to v1.24.3 (#388 )	2024-09-19 09:28:24 -04:00
Renovate Bot	91f0423f7e	fix(container): update image linuxserver/freshrss to v1.24.3	2024-09-19 09:28:24 -04:00
SeanOMik	8afa7376f1	fix(container): update image linuxserver/jellyfin to v10.9.11 (#391 )	2024-09-19 09:26:42 -04:00
Renovate Bot	b40999472a	fix(container): update image linuxserver/jellyfin to v10.9.11	2024-09-19 09:26:42 -04:00
SeanOMik	298ef2620f	fix(container): update image goofball222/factorio to v1.1.110 (#392 )	2024-09-19 09:26:28 -04:00
Renovate Bot	ba8aaf37e2	fix(container): update image goofball222/factorio to v1.1.110	2024-09-19 09:26:28 -04:00
SeanOMik	c36eabc91e	feat(helm): update chart redis to 20.1.4 (#393 )	2024-09-19 09:26:08 -04:00
Renovate Bot	fa68e1d42f	feat(helm): update chart redis to 20.1.0	2024-09-19 09:26:08 -04:00
SeanOMik	c380710973	fix(container): update image matrixdotorg/dendrite-monolith to v0.13.8 (#394 )	2024-09-19 09:25:42 -04:00
Renovate Bot	92a6b9cb82	fix(container): update image matrixdotorg/dendrite-monolith to v0.13.8	2024-09-19 09:25:42 -04:00
SeanOMik	581f2e5f01	fix(container): update image ghcr.io/onedr0p/bazarr to v1.4.4 (#396 )	2024-09-19 09:25:02 -04:00
Renovate Bot	96f0fd9874	fix(container): update image ghcr.io/onedr0p/bazarr to v1.4.4	2024-09-19 09:25:02 -04:00
SeanOMik	cd7a0ee7b7	fix(container): update image prompve/prometheus-pve-exporter to v3.4.5 (#397 )	2024-09-19 09:24:40 -04:00
Renovate Bot	daffc5df08	fix(container): update image prompve/prometheus-pve-exporter to v3.4.5	2024-09-19 09:24:40 -04:00
SeanOMik	340bbd55f4	feat(helm): update chart woodpecker to 1.6.0 (#398 )	2024-09-19 09:22:50 -04:00
Renovate Bot	94e4747f20	feat(helm): update chart woodpecker to 1.6.0	2024-09-18 19:07:11 +00:00