firefly-iii: Update to 6.2.21

ansible/ara.yaml

@@ -32,7 +32,6 @@ spec:
       containers:
       - name: ara-api
         image: quay.io/recordsansible/ara-api
-        imagePullPolicy: IfNotPresent
         env:
         - name: ARA_BASE_DIR
           value: /etc/ara

ansible/rbac.yaml

@@ -54,7 +54,6 @@ rules:
   - get
   resourceNames:
   - cluster-info
-  - kube-root-ca.crt
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -133,38 +132,3 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: host-provisioner
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: host-provisioner
-  namespace: victoria-metrics
-  annotations:
-    kubernetes.io/description: >-
-      Allows the host-provisioner to update the scrape-collectd
-      ConfigMap when adding new hosts.
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - configmaps
-  verbs:
-  - patch
-  - get
-  resourceNames:
-  - scrape-collectd
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: host-provisioner
-  namespace: victoria-metrics
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: host-provisioner
-subjects:
-- kind: ServiceAccount
-  name: host-provisioner

argocd/kustomization.yaml

@@ -24,66 +24,6 @@ configMapGenerator:
   - policy.csv
 
 patches:
-- patch: |-
-    apiVersion: apps/v1
-    kind: StatefulSet
-    metadata:
-      name: argocd-application-controller
-    spec:
-      template:
-        spec:
-          containers:
-          - name: argocd-application-controller
-            imagePullPolicy: IfNotPresent
-
-- patch: |-
-    apiVersion: apps/v1
-    kind: Deployment
-    metadata:
-      name: argocd-notifications-controller
-    spec:
-      template:
-        spec:
-          containers:
-          - name: argocd-notifications-controller
-            imagePullPolicy: IfNotPresent
-
-- patch: |-
-    apiVersion: apps/v1
-    kind: Deployment
-    metadata:
-      name: argocd-redis
-    spec:
-      template:
-        spec:
-          containers:
-          - name: redis
-            imagePullPolicy: IfNotPresent
-
-- patch: |-
-    apiVersion: apps/v1
-    kind: Deployment
-    metadata:
-      name: argocd-repo-server
-    spec:
-      template:
-        spec:
-          containers:
-          - name: argocd-repo-server
-            imagePullPolicy: IfNotPresent
-
-- patch: |-
-    apiVersion: apps/v1
-    kind: Deployment
-    metadata:
-      name: argocd-server
-    spec:
-      template:
-        spec:
-          containers:
-          - name: argocd-server
-            imagePullPolicy: IfNotPresent
-
 - patch: |-
     $patch: delete
     apiVersion: apiextensions.k8s.io/v1

authelia/configuration.yml

@@ -104,8 +104,6 @@ identity_providers:
       - profile
       - email
       - offline_access
-      - address
-      - phone
       authorization_policy: one_factor
       pre_configured_consent_duration: 8h
       token_endpoint_auth_method: client_secret_post

authelia/kustomization.yaml

@@ -37,7 +37,6 @@ patches:
         spec:
           containers:
           - name: authelia
-            imagePullPolicy: IfNotPresent
             env:
             - name: AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE
               value: /run/authelia/certs/postgresql/tls.crt

autoscaler/kustomization.yaml

@@ -22,7 +22,6 @@ patches:
         spec:
           containers:
           - name: cluster-autoscaler
-            imagePullPolicy: IfNotPresent
             command:
             - ./cluster-autoscaler
             - --v=4

cert-manager/cert-exporter.config.yml

@@ -9,6 +9,16 @@ certs:
   namespace: default
   key: acme.sh/dustin.hatch.name/dustin.hatch.name.key
   cert: acme.sh/dustin.hatch.name/fullchain.cer
+- name: hatchchat-cert
+  namespace: default
+  key: certificates/hatch.chat.key
+  cert: certificates/hatch.chat.crt
+  bundle: certificates/hatch.chat.pem
+- name: tabitha-cert
+  namespace: default
+  key: certificates/tabitha.biz.key
+  cert: certificates/tabitha.biz.crt
+  bundle: certificates/tabitha.biz.pem
 - name: chmod777-cert
   namespace: default
   key: certificates/chmod777.sh.key
@@ -24,3 +34,8 @@ certs:
   key: certificates/hatchlearningcenter.org.key
   cert: certificates/hatchlearningcenter.org.crt
   bundle: certificates/hatchlearningcenter.org.pem
+- name: appsxyz-cert
+  namespace: default
+  key: certificates/apps.du5t1n.xyz.key
+  cert: certificates/apps.du5t1n.xyz.crt
+  bundle: certificates/apps.du5t1n.xyz.pem

cert-manager/cert-exporter.yaml

@@ -19,9 +19,12 @@ rules:
   resourceNames:
   - pyrocufflink-cert
   - dustinhatchname-cert
+  - hatchchat-cert
+  - tabitha-cert
   - chmod777-cert
   - dustinandtabitha-cert
   - hlc-cert
+  - appsxyz-cert
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

cert-manager/certificates.yaml

@@ -35,6 +35,42 @@ spec:
     algorithm: ECDSA
     rotationPolicy: Always
 
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hatchchat-cert
+spec:
+  secretName: hatchchat-cert
+  dnsNames:
+  - hatch.chat
+  - '*.hatch.chat'
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: zerossl
+  privateKey:
+    algorithm: ECDSA
+    rotationPolicy: Always
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: tabitha-cert
+spec:
+  secretName: tabitha-cert
+  dnsNames:
+  - tabitha.biz
+  - '*.tabitha.biz'
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: zerossl
+  privateKey:
+    algorithm: ECDSA
+    rotationPolicy: Always
+
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -100,3 +136,20 @@ spec:
   privateKey:
     algorithm: ECDSA
     rotationPolicy: Always
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: appsxyz-cert
+spec:
+  secretName: appsxyz-cert
+  dnsNames:
+  - apps.du5t1n.xyz
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: zerossl
+  privateKey:
+    algorithm: ECDSA
+    rotationPolicy: Always

cert-manager/jenkins.yaml

@@ -1,31 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: jenkins
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - secrets
-  verbs:
-  - get
-  resourceNames:
-  - pyrocufflink-cert
-  - dustinhatchname-cert
-  - chmod777-cert
-  - dustinandtabitha-cert
-  - hlc-cert
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: jenkins
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: jenkins
-subjects:
-- kind: ServiceAccount
-  name: default
-  namespace: jenkins-jobs

cert-manager/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
 - cert-exporter.yaml
 - dch-ca-issuer.yaml
 - secrets.yaml
-- jenkins.yaml
 
 configMapGenerator:
 - name: cert-exporter

firefly-iii/firefly-iii.yaml

@@ -66,7 +66,6 @@ spec:
       containers:
       - name: firefly-iii
         image: docker.io/fireflyiii/core:version-6.0.19
-        imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:
             name: firefly-iii
@@ -128,7 +127,6 @@ spec:
         spec:
           containers:
           - image: docker.io/library/busybox
-            imagePullPolicy: IfNotPresent
             name: wget
             command:
             - wget

jenkins/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 - secrets.yaml
 - iscsi.yaml
 - gentoo-storage.yaml
-- ssh-host-keys
+- ../ssh-host-keys
 
 patches:
 - patch: |

jenkins/ssh-host-keys/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: jenkins-jobs
-
-resources:
-- ../../ssh-host-keys

kitchen/secrets.yaml

@@ -73,13 +73,13 @@ spec:
         weather:
           metrics:
             temperature: >-
-              round(homeassistant_sensor_temperature_celsius{entity="sensor.outdoor_temperature"}, 0.1)
+              homeassistant_sensor_temperature_celsius{entity="sensor.outdoor_temperature"}
             humidity: >-
-              round(homeassistant_sensor_humidity_percent{entity="sensor.outdoor_humidity"}, 0.1)
+              homeassistant_sensor_humidity_percent{entity="sensor.outdoor_humidity"}
             wind_speed: >-
-              round(homeassistant_sensor_unit_m_per_s{entity="sensor.wind_speed"}, 0.1)
+              homeassistant_sensor_unit_m_per_s{entity="sensor.wind_speed"}
             pool: >-
-              round(homeassistant_sensor_temperature_celsius{entity="sensor.pool_sensor_temperature"}, 0.1)
+              homeassistant_sensor_temperature_celsius{entity="sensor.pool_sensor_temperature"}
 
         homeassistant:
           url: wss://homeassistant.pyrocufflink.blue/api/websocket

kubelet-csr-approver/clusterrole.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kubelet-csr-approver
-rules:
-- apiGroups:
-  - certificates.k8s.io
-  resources:
-  - certificatesigningrequests
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - create
-  - get
-  - update
-- apiGroups:
-  - certificates.k8s.io
-  resources:
-  - certificatesigningrequests/approval
-  verbs:
-  - update
-- apiGroups:
-  - certificates.k8s.io
-  resourceNames:
-  - kubernetes.io/kubelet-serving
-  resources:
-  - signers
-  verbs:
-  - approve
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create

kubelet-csr-approver/deployment.yaml

@@ -1,53 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kubelet-csr-approver
-  namespace: kube-system
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: kubelet-csr-approver
-
-  template:
-    metadata:
-      annotations:
-        prometheus.io/port: '8080'
-        prometheus.io/scrape: 'true'
-      labels:
-        app: kubelet-csr-approver
-
-    spec:
-      serviceAccountName: kubelet-csr-approver
-      containers:
-        - name: kubelet-csr-approver
-          image: postfinance/kubelet-csr-approver:latest
-          resources:
-            limits:
-              memory: "128Mi"
-              cpu: "500m"
-
-          args:
-            - -metrics-bind-address
-            - ":8080"
-            - -health-probe-bind-address
-            - ":8081"
-            - -leader-election
-
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8081
-
-          env:
-            - name: PROVIDER_REGEX
-              value: ^[abcdef]\.test\.ch$
-            - name: PROVIDER_IP_PREFIXES
-              value: "0.0.0.0/0,::/0"
-            - name: MAX_EXPIRATION_SEC
-              value: "31622400" # 366 days
-
-      tolerations:
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/control-plane
-          operator: Equal

kubelet-csr-approver/kustomization.yaml

@@ -1,42 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-labels:
-- pairs:
-    app.kubernetes.io/instance: kubelet-csr-approver
-
-resources:
-- clusterrole.yaml
-- deployment.yaml
-- rolebinding.yaml
-- serviceaccount.yaml
-
-patches:
-- patch: |-
-    apiVersion: apps/v1
-    kind: Deployment
-    metadata:
-      name: kubelet-csr-approver
-      namespace: kube-system
-    spec:
-      template:
-        spec:
-          containers:
-          - name: kubelet-csr-approver
-            imagePullPolicy: IfNotPresent
-            env:
-            - name: PROVIDER_REGEX
-              value: ^(i-[a-z0-9]+\.[a-z0-9-]+\.compute\.internal|k8s-[a-z0-9-]+\.pyrocufflink\.blue|[a-z0-9-]+\.k8s\.pyrocufflink\.black)$
-            - name: PROVIDER_IP_PREFIXES
-              value: 172.30.0.0/16
-            - name: BYPASS_DNS_RESOLUTION
-              value: 'true'
-
-replicas:
-- name: kubelet-csr-approver
-  count: 1
-
-images:
-- name: postfinance/kubelet-csr-approver
-  newName: ghcr.io/postfinance/kubelet-csr-approver
-  newTag: v1.2.10

kubelet-csr-approver/rolebinding.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubelet-csr-approver
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubelet-csr-approver
-subjects:
-- kind: ServiceAccount
-  name: kubelet-csr-approver
-  namespace: kube-system

kubelet-csr-approver/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kubelet-csr-approver
-  namespace: kube-system

ntfy/ntfy.yaml

@@ -54,7 +54,6 @@ spec:
       containers:
       - name: ntfy
         image: docker.io/binwiederhier/ntfy:v2.5.0
-        imagePullPolicy: IfNotPresent
         args:
         - serve
         ports:

restic/kustomization.yaml

@@ -36,7 +36,6 @@ patches:
             spec:
               containers:
               - name: restic-prune
-                imagePullPolicy: IfNotPresent
                 env:
                 - name: RESTIC_CACERT
                   value: /run/dch-ca/dch-root-ca.crt
@@ -49,6 +48,3 @@ patches:
                 configMap:
                   name: dch-root-ca
 
-images:
-- name: ghcr.io/restic/restic
-  newTag: 0.18.0

ssh-host-keys/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 
 configMapGenerator:
 - name: ssh-known-hosts
+  namespace: jenkins-jobs
   files:
   - ssh_known_hosts
   options:

victoria-metrics/scrape.yml

@@ -242,22 +242,6 @@ scrape_configs:
   - source_labels: [__address__]
     target_label: instance
 
-- job_name: victoria-logs
-  scheme: https
-  tls_config:
-    ca_file: /run/dch-ca/dch-root-ca.crt
-  dns_sd_configs:
-  - names:
-    - logs.pyrocufflink.blue
-    type: A
-    port: 443
-  relabel_configs:
-  - source_labels: [__meta_dns_name, __meta_dns_srv_record_port]
-    separator: ':'
-    target_label: __address__
-  - source_labels: [__address__]
-    target_label: instance
-
 - job_name: promtail
   static_configs:
   - targets: