feat(helm): update chart app-template to 3.5.1

kubernetes/common/templates/volsync/b2.yaml

@@ -11,11 +11,11 @@ spec:
     copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}"
     pruneIntervalDays: 7
     repository: "${APP}-volsync-b2-secret"
-    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-longhorn}"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
     cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}"
     cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
     cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
-    storageClassName: "${VOLSYNC_STORAGECLASS:-longhorn}"
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
     accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
     moverSecurityContext:
       runAsUser: 10000

kubernetes/common/templates/volsync/minio.yaml

@@ -12,11 +12,11 @@ spec:
     copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}"
     pruneIntervalDays: 7
     repository: "${APP}-volsync-secret"
-    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-longhorn}"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
     cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}"
     cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
     cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
-    storageClassName: "${VOLSYNC_STORAGECLASS:-longhorn}"
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
     accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
     moverSecurityContext:
       runAsUser: 10000
@@ -38,11 +38,11 @@ spec:
   restic:
     repository: "${APP}-volsync-secret"
     copyMethod: Snapshot # must be Snapshot
-    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-longhorn}"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
     cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
     cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
     cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-8Gi}"
-    storageClassName: "${VOLSYNC_STORAGECLASS:-longhorn}"
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
     accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
     capacity: "${VOLSYNC_CAPACITY}"
     # moverSecurityContext:

kubernetes/common/templates/volsync/pvc.yaml

@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: "${VOLSYNC_CAPACITY}"
-  storageClassName: "${VOLSYNC_STORAGECLASS:-longhorn}"
+  storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"

kubernetes/main/apps/download/kustomization.yaml

@@ -6,7 +6,7 @@ resources:
 - ./qbittorrent
 - ./qbit-manage
 - ./radarr/ks.yaml
-- ./sonarr
+- ./sonarr/ks.yaml
 - ./prowlarr
 - ./bazarr
 - ./readarr

kubernetes/main/apps/download/namespace.yaml

@@ -2,5 +2,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: download
-  labels:
-    name: download
+  annotations:
+    volsync.backube/privileged-movers: "true"

kubernetes/main/apps/download/radarr/app/helm-release.yaml

@@ -31,25 +31,51 @@ spec:
             image:
               repository: ghcr.io/onedr0p/radarr-develop
               tag: 5.12.0.9255
-
+            envFrom:
+            - secretRef:
+                name: radarr-secret
             env:
               TZ: America/New_York
-
+              RADARR__APP__INSTANCENAME: Radarr
+              RADARR__APP__THEME: dark
+              RADARR__AUTH__METHOD: External
+              RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              RADARR__LOG__DBENABLED: "False"
+              RADARR__LOG__LEVEL: info
+              RADARR__SERVER__PORT: &port 7878
+              RADARR__UPDATE__BRANCH: develop
+              RADARR__POSTGRES__HOST: postgresql.database.svc
+              RADARR__POSTGRES__PORT: "5432"
+              RADARR__POSTGRES__MAINDB: radarr_main
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
             resources:
               requests:
-                cpu: 1m
-                memory: 350Mi
+                memory: 100Mi
               limits:
-                memory: 1500Mi
+                memory: 4Gi
 
           exportarr:
             image:
               repository: ghcr.io/onedr0p/exportarr
               tag: v2.0.1
-
             args:
             - radarr
-            
             env:
             - name: URL
               value: "http://localhost"
@@ -83,7 +109,7 @@ spec:
 
         ports:
           http:
-            port: 7878
+            port: *port
           metrics:
             port: 9000
             protocol: HTTP

kubernetes/main/apps/download/radarr/app/kustomization.yaml

@@ -1,8 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./backup-creds.sops.yaml
-- ./minio-creds.sops.yaml
+#- ./backup-creds.sops.yaml
+#- ./minio-creds.sops.yaml
+#- ../../../../../common/templates/volsync
+- ./pvc.yaml
+- ./secret.sops.yaml
 - ./helm-release.yaml
 - ./radarr-exportarr-metrics.yaml
-- ../../../../../common/templates/volsync

kubernetes/main/apps/download/radarr/app/pvc.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 15Gi
+  storageClassName: openebs-zfs-mainpool

kubernetes/main/apps/download/radarr/app/secret.sops.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: radarr-secret
+    namespace: download
+stringData:
+    RADARR__AUTH__APIKEY: ENC[AES256_GCM,data:n6NygOta67GMqWV6+Q3EjU3JyhY84xNf546FfpOMi4k=,iv:IRGuOPzo0azEmznl0tKe+v9QhwogjjUsMUR9oGqncdU=,tag:O2WEgQxh6E3g7mRJ41Vbwg==,type:str]
+    RADARR__POSTGRES__USER: ENC[AES256_GCM,data:nAaR02DM,iv:xh8ahgckhgFZDu7snxQFM19x8qC5s7smn1hSjY+zxLw=,tag:0ziWTKZq5tjMrdhoFQY6jw==,type:str]
+    RADARR__POSTGRES__PASSWORD: ENC[AES256_GCM,data:6fXWGDYTjoSkJ7jccI3/5hCC6jsKPwh/CgM7hBlUu9g=,iv:vOX435yfn0V4ZPR6OOQgsnQlQZI+TPTjsuiAvgcpAMA=,tag:z5Ctt5dd/rq9alCiUDLcTA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-15T01:16:00Z"
+    mac: ENC[AES256_GCM,data:t19Lz6df6hohcynjqib03Qj+uqpIC4eLSAJTLTqFEXBtRInsADbEsypvnyUU0Q4A2z6dUKZpP/SEncxAP/8WimaQvpfVPFsWeVUWHvK8ISz5bBxjscgwMI1/TRfA5/BfCMLmfyNDlOYAzshAzJ97aeXLDJKZvrnbMWNgvvMw6W4=,iv:DWRaA3APzKv9cOC0afeBfw2fzhLPraKKvMSNZa8yVQs=,tag:zrOAk8ZZP+8ThVc66RDJlQ==,type:str]
+    pgp:
+        - created_at: "2024-10-15T01:16:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//UeSC+2Dk6gQlSW6v0mKf/vfety3Qd0ptrvhL8HmPm8nj
+            a3UDvfvDXfjClJeIVBaV838XYB6U8+tMukQrm5gQxxfP/cxTNCkpCBT4o9hjOvM6
+            5enrWpBgcbD7HqSav8FllR/9kfDZpRV4YccnYD4LT9ExiQd6VGKzSoyojyzQU8ec
+            lzec0cg00BF9be/t7lVZ6/0lbfQaRaqurphkA6cFx0+/i3figs2eSv1vmIK+UQe1
+            4HRXI9AZw/rm+PmFszMipTjwceX2Me0G100eLVWGsP5McSgM1ISJWSC+MM6EmpYO
+            juKcW3Spy5hC7JM3FBNNwAxh4w6d3RdKHYrBvjwZzLDEKChLEZhxKSFKJ+w7QcSN
+            67KpcNNAVTD1Rnf1si3MPEayZWCjvKy56suT5Juhjltcq78kiw690zCVdHlVfAcv
+            v55wpQF5Lq2O8ZWS4dyhx+7ZFKyUW/LCcvYxZLGxutfMqX2gNPtE3427T1Zm5Fnx
+            QOsE92bkeiSkH0uHzhrTPW/9SW9IW5wk/5+sGBRyu8bnO1hWdOaRMe4EWa/Q004t
+            p75kwiaKgjXS8ZsdbkclXBTKRzwGkA/qCWGd7Uj/kxV1fcFJB8B3Sub5DeRypvB9
+            +Z6DisUumBaKRLVCFLk5mf/X/PqHxlswqA86R4bGT3124RywBpFLBsiaYbBPDmaF
+            AgwDAAAAAAAAAAABEADSiLYQigE9hRrSjD97hp10foCPT6n72arrsmXTSRHCLPoW
+            A7v9sSXMeqbvOL8+sgY761RDfmOtYCGLsP6z2UP6mIanalc18chVT8k+frdrcogF
+            3WDBhtyV63Rru9G0HuPqhtq8Q7m6ELC+qo9/MrEQhVxdYuyi7+2jZmOpLKBoNSaw
+            pdC41VE2cx4LEXI5scViXNPSl1zcPgTuIWvr4/ApewDBYvNFElZqGrWPFyJ+2UC2
+            05QlgOJS9akGYmkB44IWXfRQoELzj9UE0jdBpi8SnK7bMMlQOEG1p1SLqyYZ1cln
+            gktnms5jzhTk/XDqpfjzXy7xsJm5G1VBZHTBHub5lzpXJGD2vYfX/AYICEmMfljV
+            WpgmjZGQflPZPdWBm5JEhEvXtimHss9XRKJPfphVFHARWcxjKAtfScXbG5CWFAhA
+            pZzz8nfCTJqMEF5XfB4vOqR6PGI3eIG2NXS/tjptKVczJHUF7C4rh7gthNOcoZOd
+            tTbZPLj73hSWRw22ADJNkNu9xiyU41iA92B7xWk6E4TUGSpgj6pWd1ss+TB3ZsjI
+            fE1q2cyq5yfq2jRnEBbVFypkkVhXpMgICsQv+wJZ+nYNrbYs/wNx5VWOA0xkYPWx
+            Doa2R17tdBX2YYhK7mUaHq74voy2ejnJFTTLP517dTF+8PPaq9v+LHRMbOsFntRo
+            AQkCEBQ7y3f8blmvfqZZr0fR0R83qz1B74oIyOGIeLYtGzqVpNxIQWrL1PBz60qV
+            0n4qynu+C2l+8i+iUBDsp38jl49wIlB5z210f3wmL2SMzhpWL0DsN4GFIRw6OsVd
+            YR+05RNcPRg=
+            =Vl2t
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-15T01:16:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ/+IoF55lQey7yi64PUfhMWc3Be+1EBNGzhHR5RfZMAI3w4
+            rqQdZyGp3SY1tB3q1qHk2TCySL70FZLcT0mdPHHU8bt8kn9M3HWEAHo0TJuoH7K3
+            qlwWnPh0OQuF+AUkmsAzCUDcBpW9CNHifPJjHWgSlhsH+r4DrYdIzGi2vaTDhXU8
+            GMHlEuZ2wrgra78avw9G/v+7I/cnnkzMnFc3zR6F+FbSv9S/w4Z4YCEv4AhLRUox
+            T03kG8r/Gv5UTFZ08TnRGXNzICykBfIHXg5xsXB+ePgh/djD3fLDlByEc8BhE2T/
+            8MbkgNbj7i3V0E3+I53NJocCGkH/SwBOwKlvbstop5eQTN+nuBQC5nYnupO7n1cf
+            wY6gIqODXZjQRItNuygE7yNDkVsF3pcb0/uRNFxc2rkUJQMT2OqusThuvVU1HLho
+            LHYPzx8bvWoPHwY1oFvB+VXU9K5J00jzkAjONRTMqIMYceoqncInoiArjDi+Bby3
+            HGjTblEik+2cuKc9JF6cuwfrSKhrNgoqm7nhNS0beF4Uf+0xvpo1urfAAYycIjWy
+            SC/wPAzwsvU92l7LilfVn8seX+1jVIZnzkxxk2z0USuoRR5Fiiuf3O1zBMOKOU6E
+            /ExchxWvA/9USgvPjtc8JCrZUxIRrI03hIwILzLXOriA2T68ejp8613DnuZuJHLU
+            aAEJAhBLSQzeER6pJ3hCGsB6kMcivumgRoWt9qonf0KqPTb4gRO8KFL2pbV04x58
+            v4FJ3nqUelKEdM9C5oXdHBdiG48gm+EOxzSzey0xRJqsVHi7S7tCj39HR3h47r/k
+            hhBax1k3ZD0e
+            =doxn
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1

kubernetes/main/apps/download/radarr/ks.yaml

@@ -17,6 +17,9 @@ spec:
     provider: sops
     secretRef:
       name: sops-gpg
+  dependsOn:
+    - name: openebs
+    - name: openebs-sc
   postBuild:
     substituteFrom:
       - kind: ConfigMap

kubernetes/main/apps/download/sonarr/app/helm-release.yaml

@@ -0,0 +1,130 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sonarr
+  namespace: download
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    controllers:
+      main:
+        pod:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            fsGroup: 10000
+            fsGroupChangePolicy: OnRootMismatch
+
+        containers:
+          sonarr:
+            image:
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: 4.0.9.2457
+            envFrom:
+            - secretRef:
+                name: sonarr-secret
+            env:
+              TZ: America/New_York
+              SONARR__APP__INSTANCENAME: Sonarr
+              SONARR__APP__THEME: dark
+              SONARR__AUTH_METHOD: External
+              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              SONARR__LOG__DBENABLED: "False"
+              SONARR__LOG__LEVEL: info
+              SONARR__SERVER__PORT: &port 8989
+              SONARR__UPDATE__BRANCH: develop
+              SONARR__POSTGRES__HOST: postgresql.database.svc
+              SONARR__POSTGRES__PORT: "5432"
+              SONARR__POSTGRES__MAINDB: sonarr_main
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                memory: 100Mi
+              limits:
+                memory: 4Gi
+
+          exportarr:
+            image:
+              repository: ghcr.io/onedr0p/exportarr
+              tag: v2.0.1
+            args:
+            - sonarr
+            env:
+            - name: URL
+              value: "http://localhost"
+            - name: PORT
+              value: &metricsPort 9000
+            - name: ENABLE_ADDITIONAL_METRICS
+              value: "true"
+            - name: ENABLE_UNKNOWN_QUEUE_ITEMS
+              value: "true"
+            - name: API_KEY
+              secretKeyRef:
+                name: sonarr-secret
+                key: SONARR__AUTH__APIKEY
+
+    ingress:
+      main:
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+
+        hosts:
+        - host: "sonarr.${SECRET_NEW_DOMAIN}"
+          paths:
+          - path: /
+            service:
+              identifier: main
+              port: http
+
+    service:
+      main:
+        controller: main
+
+        ports:
+          http:
+            port: *port
+          metrics:
+            port: *metricsPort
+            protocol: HTTP
+    
+    persistence:
+      config:
+        existingClaim: sonarr
+        globalMounts:
+          - path: /config
+      storage:
+        type: hostPath
+        hostPath: /mnt/MainPool/Media
+        advancedMounts:
+          main: # controller name
+            sonarr: # container name
+            - path: /storage

kubernetes/main/apps/download/sonarr/app/kustomization.yaml

@@ -1,5 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+- ./pvc.yaml
+- ./secret.sops.yaml
 - ./helm-release.yaml
 - ./sonarr-exportarr-metrics.yaml

kubernetes/main/apps/download/sonarr/app/pvc.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 15Gi
+  storageClassName: openebs-zfs-mainpool

kubernetes/main/apps/download/sonarr/app/secret.sops.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: sonarr-secret
+    namespace: download
+stringData:
+    SONARR__AUTH__APIKEY: ENC[AES256_GCM,data:Z0TKYOp2veBJ/ctC3z1ooj/b8J1p7ewUWX7ItIFWcpA=,iv:oY+k9x+BZxsGW5oAmNncApU+6M6YUx1q+pXDMldsg0M=,tag:lBJHGeSHw8IKS2nSFP/0aA==,type:str]
+    SONARR__POSTGRES__USER: ENC[AES256_GCM,data:vdcAhdIh,iv:tCRA3HFh6G7GUPpt5jFuqunaSRFiD90+b857vrt7tys=,tag:k02ojbFwZi6iufAOP2Fvjg==,type:str]
+    SONARR__POSTGRES__PASSWORD: ENC[AES256_GCM,data:0uqO/FMm3b/DXtthjBLI7HXoujqpjCvs66yTbzuAiDM=,iv:E/FP0rDmFQPlAM00hOGR3lB4WW22W7XezSKYGfStUGM=,tag:cC+IOkw6Oqzz8iFoTrZq1Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-15T21:30:43Z"
+    mac: ENC[AES256_GCM,data:cX94qYBsvl4+cUOrEI6xSpHY/mlQAvk4d6Q5KyRE1QaqX/pau0zJEzczaF4j9UvWGfl7dm5xuR0mrSldwRBg6M/lA6B8xxIACXaCNxdDBj2pmwOCROi6v78BLtB5P7E8Y+wwoQzVxEQQnOQDIFQJ/mMmy+D6a9BmJ5ulneEeouc=,iv:aZf9GZXAOeU3Z3oq2rQ1P6fW8TMKVHwJXjn2CpZHNjg=,tag:wK0iU+FRJylxmYl5qcq4xg==,type:str]
+    pgp:
+        - created_at: "2024-10-15T21:30:43Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ/+J4pyPCDaePFBF+1IgYzwaefDpRFAkP0kNzHObPZL1vUD
+            4GM3dQTqN8Ay8NoBAasq/dNKzDSjOvMTShZO2YXQJoA8019Q6yZhgc+l1B7bnB+W
+            6tDz5Rtlu+gbJWngvyLFkUhFCmOQ6UyQHKPpC2iObrNj3Rb9ZxxxVTCRa2n6/2g3
+            Bp2lRAIESK/cWxmQbus8PZnzphIAmfwEijot5tQjQy7Virhz4xMiqbxvuWowA2zk
+            X5PY5dHv+l7p+3Ckr7qbOGA/oAxbvFvL3hzLlE0xYj6sXdgWY5a5yqXhbxDtSQ8u
+            rT0QxtDtt3lPie0e4w+f/cxNURw4yitb7IzGFhwvyPi+7eRfzgAaQHndffFv9RM8
+            26la2JeamyXCQgUOJF7EGBD6Ix6fZJE8mHF80yerlC27unZ75Rac7ckxq9GYpKia
+            tdyrU8OrV+f9uUdEyNCeD6wuZrxuKyyL6f+zQs6uj+zzaLYg3/p8iZLgT5HsxBLs
+            dMRVnCEvCWyYd9OJrOLVld9qrvbmuypLuPOUQpTYt9WrC5SxfMPkQQYNnXEGcI0K
+            n2s4eSv4tFOQw4xjRH4hl1H678faXen83F9ScOXWyHpqE54fFCCMAJV6NXMWKByv
+            9l/Rz81+J8kd1wQ4+CcJslsVM06XpwEPPRM9xunxwxPWB2wZQYCF9mQitRmnIliF
+            AgwDAAAAAAAAAAABD/0YtuvVooC7OW45KsL7rJwRMJOryjkJmffl5ocjyU6aicQw
+            MRjD+d8xa3WUsVbCnSYHQATpAltPrKLybi1MpneRk3j7b6kAz8iJaawEcgTUiM3H
+            h6SjtrwCpjNSI7RN3eRAUyxDtdrrvR5P1ynfmMHUWnuQjXlYcBZqtnA/THWOIGnC
+            joEixpi7e2RlAUzFuG2+Mlux2nLdtO+YcGI2ta9qHHp1O1+46HxvYO982dFRTuLq
+            VAHJcdROw1eNBCvwK2n27mKBMo9kfQMLrcUyO8PZqZyxEIimsHM4aQbYp8NvxAtx
+            LuveKR3s60VjC7gHIqfWJw/fqPlv73V/ONwwruC/2WSzZSfZ0C1Z7LPJt84wqbXz
+            7+t7St0R+u4cJ+Vim/XXRpTQOX+xnfO3UZu9Nwszm144uWdkt/5L9zGGLPnYBmPy
+            eAfhcSz7S0xe9qBM1LWXQHqQ3U1U0cSlizE87oYrJgfYCRQ4CsT3MOWEhwfFpd9E
+            wLLXOgCLiFIw77OUBNa4Rcg/v6oYrHKf2UKklOtt6QrqcnVnZT2l2bTUaWupD0Rl
+            lq0/sadpV8FsYtIS1EQ6j7EVvAOZNEdC6L090CQ7bnPiwQyHdS3b6J49RE55TcOP
+            n743wfZNcmqEeV0ooUkGoW6r5q0jvaUBrTbVpJszktps9uBybO5qgqobjdexUtRo
+            AQkCEIda5ST1hWg6TgORmRI2cHqUdw+b4dMy74l3a1RZpBPHyKPbP9e7J98BGm7C
+            XAyNC9vgDwjfp+BwHzPjfA3KtXZDjg2Gu5PFU3cdWWlWhLSreG1+mtsjWjXGAKq+
+            GN4DyUYIF60=
+            =DCkn
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-15T21:30:43Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//bqiURh1qRFK0fbL6E7UlU9wIw0Q2jkGQ+FF4gYKTTTtr
+            XdBS+CTBYLlTTpEGMMCSRJJsfOAXVUVRzpgopDt8Imhckqdx4/+I9VVsd6urEkOA
+            MyYXaKc2dY9rQjFj4kKB0vcEJ+tqZ8BrpMktUdt+3/g8QdgTWEfzv2inKi2OsrHQ
+            RevUJpM2FgBjR6f+JbsrbnOuEfYw0B9uD6otBre88HM2uECfEvuu+jMtPbA3X4YZ
+            J7UcmEsiH5oHxIFXNBvJiRQJycbrXwMWaU8m6IkbuADua2dcjsu9kYvPyM5OB1xX
+            f/3UIUa+UFTgS47GadXV/r8Voychp8mo9KflmY+7A66oxnmBo3hSYj83vBKiK+QP
+            qL78M9OSITicDeLYidDRUg5f+J3Ybc9O9duj5w8O/bS4LXWkD8B+9wiytbL80gkV
+            SU8TIat0f0U52ygZH72F60hdXsHoFTfUVD61nrtbIUwDTsS0A6se/5leXrI+23uq
+            boJU5Sz/Q0vzybOUeFjKU40r23D1mYsBqxDoD6LoMwAuZjd//T6yx5ZIVdp8kE5s
+            MMycUsDLAy7jmbsZvG2QmRgaRiTKvKLcvrWeYLrGHsrcExO5sbDDzLjeC61B3tSb
+            X3GUVg+9aOPPoUVB/COG1554F4l2Bbq9aYA9/Uw1tFZGWC9WjCRa3z/HMQQHm4vU
+            aAEJAhAgzTiHxfIdJmKQxVlkdME8Orw11Xo3hdbee9j9qx75+TkPifuNSkUIxKon
+            ufOAcIGDynnUpqD/xStmwCqS3uqpVEy6PGIfXTls34+nLPDWJ4wQ71P3v3kSHLYY
+            Q7jW3gYe3ohw
+            =xHcO
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1

kubernetes/main/apps/download/sonarr/helm-release.yaml

@@ -1,120 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: sonarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/sonarr-develop
-      tag: "4.0.9.2457"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
-        args:
-        - sonarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-
-    env:
-      TZ: America/New_York
-      SONARR__AUTHENTICATION_METHOD: "External"
-
-    service:
-      main:
-        labels:
-          app: sonarr-service
-
-        ports:
-          http:
-            port: 8989
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: true
-        custom: true
-        spec:
-          httpGet:
-            path: /ping
-            port: 8989
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          timeoutSeconds: 1
-          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "sonarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/sonarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 350Mi
-      limits:
-        memory: 2500Mi

kubernetes/main/apps/download/sonarr/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sonarr
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  targetNamespace: download
+  path: ./kubernetes/main/apps/download/sonarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: openebs
+    - name: openebs-sc
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/main/core/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 - ./traefik/ks.yaml
 # storage
 - ./longhorn
-- ./openebs
+- ./openebs/ks.yaml
 
 - ./kube-replicator
 

kubernetes/main/core/longhorn/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
 - ./helm-release.yaml
 - ./alerts.yaml
 - ./service-monitor.yaml
+- ./snapshot-class.yaml

kubernetes/main/core/longhorn/snapshot-class.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/snapshot.storage.k8s.io/volumesnapshotclass_v1.json
+kind: VolumeSnapshotClass
+apiVersion: snapshot.storage.k8s.io/v1
+metadata:
+  name: longhorn
+driver: driver.longhorn.io
+deletionPolicy: Delete

kubernetes/main/core/openebs/app/helm-release.yaml

@@ -0,0 +1,59 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openebs
+  namespace: openebs-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: openebs
+      version: 4.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: openebs
+        namespace: flux-system
+  values:
+    openebs-crds:
+      csi:
+        volumeSnapshots:
+          enabled: false
+          keep: false
+
+    zfs-localpv:
+      crds:
+        zfsLocalPv:
+          enabled: true
+        csi:
+          volumeSnapshots:
+            enabled: false
+
+    # Refer to https://github.com/openebs/dynamic-localpv-provisioner/blob/HEAD/deploy/helm/charts/values.yaml for complete set of values.
+    localpv-provisioner:
+      rbac:
+        create: true
+
+    # Refer to https://github.com/openebs/lvm-localpv/blob/lvm-localpv-1.6.2/deploy/helm/charts/values.yaml for complete set of values.
+    lvm-localpv:
+      crds:
+        lvmLocalPv:
+          enabled: false
+        csi:
+          volumeSnapshots:
+            enabled: false
+
+    # Refer to https://github.com/openebs/mayastor-extensions/blob/v2.7.0/chart/values.yaml for complete set of values.
+    mayastor:
+      enabled: false
+
+    engines:
+      local:
+        lvm:
+          enabled: false
+        zfs:
+          enabled: true
+      replicated:
+        mayastor:
+          enabled: false
+

kubernetes/main/core/openebs/app/helm-repository.yaml

@@ -0,0 +1,17 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: openebs
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://openebs.github.io/openebs
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: openebs-monitoring
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://openebs.github.io/monitoring

kubernetes/main/core/openebs/app/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./helm-repository.yaml
+- ./helm-release.yaml
+- ./monitoring-helm-release.yaml

kubernetes/main/core/openebs/app/monitoring-helm-release.yaml

@@ -0,0 +1,39 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openebs-monitoring
+  namespace: openebs-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: openebs-monitoring
+      version: 0.4.13
+      sourceRef:
+        kind: HelmRepository
+        name: openebs-monitoring-charts
+        namespace: flux-system
+
+  values:
+    kube-prometheus-stack:
+      install: false
+
+    openebsMonitoringAddon:
+      # this is the only provisioner enabled
+      localPV:
+        enabled: true
+
+      cStore:
+        enabled: false
+      jiva:
+        enabled: false
+      ndm:
+        enabled: false
+      npd:
+        enabled: false
+      deviceLocalPV:
+        enabled: false
+      lvmLocalPV:
+        enabled: false
+      zfsLocalPV:
+        enabled: true

kubernetes/main/core/openebs/app/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openebs-system

kubernetes/main/core/openebs/ks.yaml

@@ -0,0 +1,54 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openebs
+  namespace: flux-system
+spec:
+  targetNamespace: openebs-system
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/main/core/openebs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openebs-sc
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/main/core/openebs/storage-class
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: openebs
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/main/core/openebs/storage-class/kustomization.yaml

@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ../../../common/apps/openebs
 - ./mainpool-sc.yaml
+- ./zfs-mainpool-sc.yaml
+- ./zfs-snapshot.yaml

kubernetes/main/core/openebs/storage-class/zfs-mainpool-sc.yaml

@@ -0,0 +1,7 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-zfs-mainpool
+parameters:
+  poolname: "MainPool/openebs-zfs"
+provisioner: zfs.csi.openebs.io

kubernetes/main/core/openebs/storage-class/zfs-snapshot.yaml

@@ -0,0 +1,6 @@
+kind: VolumeSnapshotClass
+apiVersion: snapshot.storage.k8s.io/v1
+metadata:
+  name: zfs-mainpool
+driver: zfs.csi.openebs.io
+deletionPolicy: Delete