authelia: Update to 4.39.5

The _hatch.chat_ Matrix server has been gone for quite some time.

ansible/ara.yaml

@@ -32,6 +32,7 @@ spec:
       containers:
       - name: ara-api
         image: quay.io/recordsansible/ara-api
+        imagePullPolicy: IfNotPresent
         env:
         - name: ARA_BASE_DIR
           value: /etc/ara

ansible/rbac.yaml

@@ -54,6 +54,7 @@ rules:
   - get
   resourceNames:
   - cluster-info
+  - kube-root-ca.crt
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -132,3 +133,38 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: host-provisioner
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: host-provisioner
+  namespace: victoria-metrics
+  annotations:
+    kubernetes.io/description: >-
+      Allows the host-provisioner to update the scrape-collectd
+      ConfigMap when adding new hosts.
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - patch
+  - get
+  resourceNames:
+  - scrape-collectd
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: host-provisioner
+  namespace: victoria-metrics
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: host-provisioner
+subjects:
+- kind: ServiceAccount
+  name: host-provisioner

argocd/kustomization.yaml

@@ -24,6 +24,66 @@ configMapGenerator:
   - policy.csv
 
 patches:
+- patch: |-
+    apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      name: argocd-application-controller
+    spec:
+      template:
+        spec:
+          containers:
+          - name: argocd-application-controller
+            imagePullPolicy: IfNotPresent
+
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: argocd-notifications-controller
+    spec:
+      template:
+        spec:
+          containers:
+          - name: argocd-notifications-controller
+            imagePullPolicy: IfNotPresent
+
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: argocd-redis
+    spec:
+      template:
+        spec:
+          containers:
+          - name: redis
+            imagePullPolicy: IfNotPresent
+
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: argocd-repo-server
+    spec:
+      template:
+        spec:
+          containers:
+          - name: argocd-repo-server
+            imagePullPolicy: IfNotPresent
+
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: argocd-server
+    spec:
+      template:
+        spec:
+          containers:
+          - name: argocd-server
+            imagePullPolicy: IfNotPresent
+
 - patch: |-
     $patch: delete
     apiVersion: apiextensions.k8s.io/v1

authelia/configuration.yml

@@ -104,6 +104,8 @@ identity_providers:
       - profile
       - email
       - offline_access
+      - address
+      - phone
       authorization_policy: one_factor
       pre_configured_consent_duration: 8h
       token_endpoint_auth_method: client_secret_post

authelia/kustomization.yaml

@@ -37,6 +37,7 @@ patches:
         spec:
           containers:
           - name: authelia
+            imagePullPolicy: IfNotPresent
             env:
             - name: AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE
               value: /run/authelia/certs/postgresql/tls.crt

autoscaler/kustomization.yaml

@@ -22,6 +22,7 @@ patches:
         spec:
           containers:
           - name: cluster-autoscaler
+            imagePullPolicy: IfNotPresent
             command:
             - ./cluster-autoscaler
             - --v=4

cert-manager/cert-exporter.config.yml

@@ -9,16 +9,6 @@ certs:
   namespace: default
   key: acme.sh/dustin.hatch.name/dustin.hatch.name.key
   cert: acme.sh/dustin.hatch.name/fullchain.cer
-- name: hatchchat-cert
-  namespace: default
-  key: certificates/hatch.chat.key
-  cert: certificates/hatch.chat.crt
-  bundle: certificates/hatch.chat.pem
-- name: tabitha-cert
-  namespace: default
-  key: certificates/tabitha.biz.key
-  cert: certificates/tabitha.biz.crt
-  bundle: certificates/tabitha.biz.pem
 - name: chmod777-cert
   namespace: default
   key: certificates/chmod777.sh.key
@@ -34,8 +24,3 @@ certs:
   key: certificates/hatchlearningcenter.org.key
   cert: certificates/hatchlearningcenter.org.crt
   bundle: certificates/hatchlearningcenter.org.pem
-- name: appsxyz-cert
-  namespace: default
-  key: certificates/apps.du5t1n.xyz.key
-  cert: certificates/apps.du5t1n.xyz.crt
-  bundle: certificates/apps.du5t1n.xyz.pem

cert-manager/cert-exporter.yaml

@@ -19,12 +19,9 @@ rules:
   resourceNames:
   - pyrocufflink-cert
   - dustinhatchname-cert
-  - hatchchat-cert
-  - tabitha-cert
   - chmod777-cert
   - dustinandtabitha-cert
   - hlc-cert
-  - appsxyz-cert
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

cert-manager/certificates.yaml

@@ -35,42 +35,6 @@ spec:
     algorithm: ECDSA
     rotationPolicy: Always
 
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: hatchchat-cert
-spec:
-  secretName: hatchchat-cert
-  dnsNames:
-  - hatch.chat
-  - '*.hatch.chat'
-  issuerRef:
-    group: cert-manager.io
-    kind: ClusterIssuer
-    name: zerossl
-  privateKey:
-    algorithm: ECDSA
-    rotationPolicy: Always
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: tabitha-cert
-spec:
-  secretName: tabitha-cert
-  dnsNames:
-  - tabitha.biz
-  - '*.tabitha.biz'
-  issuerRef:
-    group: cert-manager.io
-    kind: ClusterIssuer
-    name: zerossl
-  privateKey:
-    algorithm: ECDSA
-    rotationPolicy: Always
-
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -136,20 +100,3 @@ spec:
   privateKey:
     algorithm: ECDSA
     rotationPolicy: Always
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: appsxyz-cert
-spec:
-  secretName: appsxyz-cert
-  dnsNames:
-  - apps.du5t1n.xyz
-  issuerRef:
-    group: cert-manager.io
-    kind: ClusterIssuer
-    name: zerossl
-  privateKey:
-    algorithm: ECDSA
-    rotationPolicy: Always

cert-manager/jenkins.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: jenkins
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - get
+  resourceNames:
+  - pyrocufflink-cert
+  - dustinhatchname-cert
+  - chmod777-cert
+  - dustinandtabitha-cert
+  - hlc-cert
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: jenkins
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: jenkins
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: jenkins-jobs

cert-manager/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
 - cert-exporter.yaml
 - dch-ca-issuer.yaml
 - secrets.yaml
+- jenkins.yaml
 
 configMapGenerator:
 - name: cert-exporter

firefly-iii/firefly-iii.yaml

@@ -66,6 +66,7 @@ spec:
       containers:
       - name: firefly-iii
         image: docker.io/fireflyiii/core:version-6.0.19
+        imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:
             name: firefly-iii
@@ -127,6 +128,7 @@ spec:
         spec:
           containers:
           - image: docker.io/library/busybox
+            imagePullPolicy: IfNotPresent
             name: wget
             command:
             - wget

jenkins/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 - secrets.yaml
 - iscsi.yaml
 - gentoo-storage.yaml
-- ../ssh-host-keys
+- ssh-host-keys
 
 patches:
 - patch: |

jenkins/ssh-host-keys/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: jenkins-jobs
+
+resources:
+- ../../ssh-host-keys

kitchen/secrets.yaml

@@ -73,13 +73,13 @@ spec:
         weather:
           metrics:
             temperature: >-
-              homeassistant_sensor_temperature_celsius{entity="sensor.outdoor_temperature"}
+              round(homeassistant_sensor_temperature_celsius{entity="sensor.outdoor_temperature"}, 0.1)
             humidity: >-
-              homeassistant_sensor_humidity_percent{entity="sensor.outdoor_humidity"}
+              round(homeassistant_sensor_humidity_percent{entity="sensor.outdoor_humidity"}, 0.1)
             wind_speed: >-
-              homeassistant_sensor_unit_m_per_s{entity="sensor.wind_speed"}
+              round(homeassistant_sensor_unit_m_per_s{entity="sensor.wind_speed"}, 0.1)
             pool: >-
-              homeassistant_sensor_temperature_celsius{entity="sensor.pool_sensor_temperature"}
+              round(homeassistant_sensor_temperature_celsius{entity="sensor.pool_sensor_temperature"}, 0.1)
 
         homeassistant:
           url: wss://homeassistant.pyrocufflink.blue/api/websocket

kubelet-csr-approver/clusterrole.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubelet-csr-approver
+rules:
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/approval
+  verbs:
+  - update
+- apiGroups:
+  - certificates.k8s.io
+  resourceNames:
+  - kubernetes.io/kubelet-serving
+  resources:
+  - signers
+  verbs:
+  - approve
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create

kubelet-csr-approver/deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubelet-csr-approver
+  namespace: kube-system
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: kubelet-csr-approver
+
+  template:
+    metadata:
+      annotations:
+        prometheus.io/port: '8080'
+        prometheus.io/scrape: 'true'
+      labels:
+        app: kubelet-csr-approver
+
+    spec:
+      serviceAccountName: kubelet-csr-approver
+      containers:
+        - name: kubelet-csr-approver
+          image: postfinance/kubelet-csr-approver:latest
+          resources:
+            limits:
+              memory: "128Mi"
+              cpu: "500m"
+
+          args:
+            - -metrics-bind-address
+            - ":8080"
+            - -health-probe-bind-address
+            - ":8081"
+            - -leader-election
+
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+
+          env:
+            - name: PROVIDER_REGEX
+              value: ^[abcdef]\.test\.ch$
+            - name: PROVIDER_IP_PREFIXES
+              value: "0.0.0.0/0,::/0"
+            - name: MAX_EXPIRATION_SEC
+              value: "31622400" # 366 days
+
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Equal

kubelet-csr-approver/kustomization.yaml

@@ -0,0 +1,42 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+labels:
+- pairs:
+    app.kubernetes.io/instance: kubelet-csr-approver
+
+resources:
+- clusterrole.yaml
+- deployment.yaml
+- rolebinding.yaml
+- serviceaccount.yaml
+
+patches:
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: kubelet-csr-approver
+      namespace: kube-system
+    spec:
+      template:
+        spec:
+          containers:
+          - name: kubelet-csr-approver
+            imagePullPolicy: IfNotPresent
+            env:
+            - name: PROVIDER_REGEX
+              value: ^(i-[a-z0-9]+\.[a-z0-9-]+\.compute\.internal|k8s-[a-z0-9-]+\.pyrocufflink\.blue|[a-z0-9-]+\.k8s\.pyrocufflink\.black)$
+            - name: PROVIDER_IP_PREFIXES
+              value: 172.30.0.0/16
+            - name: BYPASS_DNS_RESOLUTION
+              value: 'true'
+
+replicas:
+- name: kubelet-csr-approver
+  count: 1
+
+images:
+- name: postfinance/kubelet-csr-approver
+  newName: ghcr.io/postfinance/kubelet-csr-approver
+  newTag: v1.2.10

kubelet-csr-approver/rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubelet-csr-approver
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubelet-csr-approver
+subjects:
+- kind: ServiceAccount
+  name: kubelet-csr-approver
+  namespace: kube-system

kubelet-csr-approver/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubelet-csr-approver
+  namespace: kube-system

ntfy/ntfy.yaml

@@ -54,6 +54,7 @@ spec:
       containers:
       - name: ntfy
         image: docker.io/binwiederhier/ntfy:v2.5.0
+        imagePullPolicy: IfNotPresent
         args:
         - serve
         ports:

restic/kustomization.yaml

@@ -36,6 +36,7 @@ patches:
             spec:
               containers:
               - name: restic-prune
+                imagePullPolicy: IfNotPresent
                 env:
                 - name: RESTIC_CACERT
                   value: /run/dch-ca/dch-root-ca.crt
@@ -48,3 +49,6 @@ patches:
                 configMap:
                   name: dch-root-ca
 
+images:
+- name: ghcr.io/restic/restic
+  newTag: 0.18.0

ssh-host-keys/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 
 configMapGenerator:
 - name: ssh-known-hosts
-  namespace: jenkins-jobs
   files:
   - ssh_known_hosts
   options:

victoria-metrics/scrape.yml

@@ -242,6 +242,22 @@ scrape_configs:
   - source_labels: [__address__]
     target_label: instance
 
+- job_name: victoria-logs
+  scheme: https
+  tls_config:
+    ca_file: /run/dch-ca/dch-root-ca.crt
+  dns_sd_configs:
+  - names:
+    - logs.pyrocufflink.blue
+    type: A
+    port: 443
+  relabel_configs:
+  - source_labels: [__meta_dns_name, __meta_dns_srv_record_port]
+    separator: ':'
+    target_label: __address__
+  - source_labels: [__address__]
+    target_label: instance
+
 - job_name: promtail
   static_configs:
   - targets: