commit b551c8a09851ef681897113a2b34e598165f62d3
parent 648793b46a20abd8ff36785e787eb89fddcb8163
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 25 Feb 2026 14:36:56 +0100
update and format
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
20 files changed, 3303 insertions(+), 6996 deletions(-)
diff --git a/apps/talos_cluster/bookwyrm/deployment.yaml b/apps/talos_cluster/bookwyrm/deployment.yaml
@@ -191,7 +191,7 @@ spec:
image: nginxinc/nginx-unprivileged:1.27-alpine
securityContext:
allowPrivilegeEscalation: false
- readOnlyRootFilesystem: false # envsubst template processing writes to /etc/nginx/conf.d/
+ readOnlyRootFilesystem: false # envsubst template processing writes to /etc/nginx/conf.d/
runAsNonRoot: true
runAsUser: 101
runAsGroup: 101
diff --git a/apps/talos_cluster/clickstack/release.yaml b/apps/talos_cluster/clickstack/release.yaml
@@ -33,24 +33,24 @@ spec:
appUserPassword: ENC[AES256_GCM,data:UZQQ9Yg8yDlC2Hm5z/YYj2xw3fCdbV+2Brnn/UEB0B+wMiyGH9s4GupK0Q4/uvqIGkCjRvZH4DqG+higPyaJ,iv:kipnRldYvL/NaQTDwQuus1Skt2pV8TLXIGoiLrm0iFM=,tag:u+tv9dGEWVPmrnhfOWuStA==,type:str]
otelUserPassword: ENC[AES256_GCM,data:s0QRS+ZMfLg/eLJoqxpkiYxgNheTpj4hZwqdUynRSysSzL5dxVMwSZq/lRhJQ8FqmHP5miGETJNF11Y0kEUb,iv:VCXLiq961D/LJMl0X9/ccFisNXJbE+9RxvlqBcxCAeg=,tag:V7UxUW46qQlrVShZpKiEOw==,type:str]
otelUserName: otelcollector
- # otel:
- # customConfig: |
- # processors:
- # batch:
- # tail_sampling:
- # decission_wait: 30s
- # num_traces: 20000
- # expected_new_traces_per_sec: 50
- # policies:
- # - name: always_on_error
- # type: error
- # - name: slow_traces
- # type: latency
- # latency_threshold: 250ms
- # - name: probabilistic_fallback
- # type: probabilistic
- # sampling_percentage: 5.0
- # # TODO: Unclear how to configure the pipelines as its hardcoded over at https://github.com/hyperdxio/hyperdx/blob/af3bbcf1a0f3d31a0a74b4f4fe3073af229a8df7/packages/api/src/opamp/controllers/opampController.ts#L4 possibly?
+ # otel:
+ # customConfig: |
+ # processors:
+ # batch:
+ # tail_sampling:
+ # decission_wait: 30s
+ # num_traces: 20000
+ # expected_new_traces_per_sec: 50
+ # policies:
+ # - name: always_on_error
+ # type: error
+ # - name: slow_traces
+ # type: latency
+ # latency_threshold: 250ms
+ # - name: probabilistic_fallback
+ # type: probabilistic
+ # sampling_percentage: 5.0
+ # # TODO: Unclear how to configure the pipelines as its hardcoded over at https://github.com/hyperdxio/hyperdx/blob/af3bbcf1a0f3d31a0a74b4f4fe3073af229a8df7/packages/api/src/opamp/controllers/opampController.ts#L4 possibly?
sops:
kms: []
gcp_kms: []
diff --git a/apps/talos_cluster/clickstack/secrets.yaml b/apps/talos_cluster/clickstack/secrets.yaml
@@ -1,57 +1,57 @@
apiVersion: v1
kind: Secret
metadata:
- name: hyperdx-secret
- namespace: clickstack
+ name: hyperdx-secret
+ namespace: clickstack
type: Opaque
stringData:
- HYPERDX_API_KEY: ENC[AES256_GCM,data:A+gj3fg/FMVjRuqMVUoYWqJWl25L4hZrw6YiQNlbtKKeMb5C,iv:hOFqFn2vV+mSNTZAu5OG/NVgPvAugSaSPJ2NG/9Tpj4=,tag:U4/K9zHnpGSpKnc+zIUhTQ==,type:str]
+ HYPERDX_API_KEY: ENC[AES256_GCM,data:A+gj3fg/FMVjRuqMVUoYWqJWl25L4hZrw6YiQNlbtKKeMb5C,iv:hOFqFn2vV+mSNTZAu5OG/NVgPvAugSaSPJ2NG/9Tpj4=,tag:U4/K9zHnpGSpKnc+zIUhTQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ
- VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5
- MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl
- amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh
- u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-01-07T08:48:49Z"
- mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ
+ VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5
+ MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl
+ amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh
+ u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-01-07T08:48:49Z"
+ mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
# Configmap for the otel collector endpoint
apiVersion: v1
kind: ConfigMap
metadata:
- name: otel-config-vars
- namespace: clickstack
+ name: otel-config-vars
+ namespace: clickstack
data:
- YOUR_OTEL_COLLECTOR_ENDPOINT: ENC[AES256_GCM,data:jKOaxrj5Fb+wNMZcybCMD/+eP2E+Wz0hOe8H6ctGq8mW/FD601kX2IP6azbfobz8NbgwvQc5RQrao05FuYDOY9Jq,iv:Bu71B4EPiwT+3nh5xO2J3u50Fmb1KduivEYPi8sS+Ak=,tag:evJx/AUSJzLiKvW9D92L5Q==,type:str]
+ YOUR_OTEL_COLLECTOR_ENDPOINT: ENC[AES256_GCM,data:jKOaxrj5Fb+wNMZcybCMD/+eP2E+Wz0hOe8H6ctGq8mW/FD601kX2IP6azbfobz8NbgwvQc5RQrao05FuYDOY9Jq,iv:Bu71B4EPiwT+3nh5xO2J3u50Fmb1KduivEYPi8sS+Ak=,tag:evJx/AUSJzLiKvW9D92L5Q==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ
- VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5
- MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl
- amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh
- u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-01-07T08:48:49Z"
- mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ
+ VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5
+ MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl
+ amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh
+ u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-01-07T08:48:49Z"
+ mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/codeberg/deploy.yaml b/apps/talos_cluster/codeberg/deploy.yaml
@@ -22,12 +22,8 @@ spec:
initContainers:
- name: init
image: code.forgejo.org/forgejo/runner:9
- command:
- [
- "sh",
- "-c",
- "if ! [ -f /data/.runner ]; then forgejo-runner register --no-interactive --token ${RUNNER_REGISTRATION_TOKEN} --labels ${LABELS} --name ${RUNNER_NAME} --instance ${INSTANCE_URL}; fi",
- ]
+ command: ["sh", "-c", "if ! [ -f /data/.runner ]; then forgejo-runner register --no-interactive --token ${RUNNER_REGISTRATION_TOKEN} --labels ${LABELS} --name ${RUNNER_NAME} --instance ${INSTANCE_URL};
+ fi"]
env:
- name: INSTANCE_URL
value: https://codeberg.org
@@ -57,12 +53,7 @@ spec:
containers:
- name: runner
image: code.forgejo.org/forgejo/runner:9
- command:
- [
- "sh",
- "-c",
- "while ! [ -f /certs/client/ca.pem ]; do echo 'waiting for docker certs...'; sleep 2; done; forgejo-runner daemon --config /config/config.yaml",
- ]
+ command: ["sh", "-c", "while ! [ -f /certs/client/ca.pem ]; do echo 'waiting for docker certs...'; sleep 2; done; forgejo-runner daemon --config /config/config.yaml"]
env:
- name: DOCKER_HOST
value: tcp://localhost:2376
diff --git a/apps/talos_cluster/connectivity-tester/connectivity_tester.yaml b/apps/talos_cluster/connectivity-tester/connectivity_tester.yaml
@@ -1,57 +1,57 @@
apiVersion: v1
kind: Secret
metadata:
- name: connectivity-tester-stage-config
- namespace: matrix
+ name: connectivity-tester-stage-config
+ namespace: matrix
type: Opaque
stringData:
- config.yaml: ENC[AES256_GCM,data:ddgSAW7lFXtemFOykySQX1QSHAYqUGsLHHlxDxEPiwaCni+pWpTuuiffbTtJ/IPmhcBdMhaEMi6pAqKAaxYdpzagwtg+HMLT4ROO+RXJ1S5DUrJUwuY8k/doezslcxOC8G9g61/RI/t6EDUauOICKgERSQTxtaMksdZKCxiSXkCMWtVwWwQAbh050Oqo+ikCU4CcfMwgUNMVq1uMCzL+01EeEhsuxg/T/ytKveId7n3wRcc1Ia3vMDuvPRMrhhk1pHjVPSMbwo10uywhvJyRRkkDO0TPqc5JuZcNcUv21aySKY0Gr3kU1lbDGb0wzyetT6Suy4eJlxIfAOF0OX6ObOrZPKE9+gS3QHN5+C7tXSJdcDHdPj6++QFD92LjtfY3Ol7kyZsDH1x7Ogjg56Eol9l0Fdvx8zwG/ZMsiTvlXQjoUQBVN9u3Iv8M4Rw6Q13qmkPGcLUCkLqYJ6cI1xJsQEy1rM7KPuAk2+zgE0LJ1Ia48e2hheQJyeF2nlc9hazwP4SD8LBCXSJn/eDoi08DmlHMTtcDBVapLxupHc0FmoyoHZRbtr7hAvBb8DNQitrGBeucd3hdtIX0y/NsLMFNOIPAo+kfFkX8m7BLDtrf8uSlNgjEJ5sXPSNQDWebEiAV84jdEAQjs66dExxKvrHlalJ1Y30UnduGfacTLoNm+odJKSTRnDh6aX9BglVnq0LckesN/kGqTJDilwzcXpmbiYRNge+/msGn92kH1t/UEvIoCkruJflRj2Tfkqj5hClEAFwnObIAOmbn59TC2B6NgUvDizRs9M6gFM31ZHVjpX3dPtEvvJYvFDXcNZKebWGR8Kl1Xta9ZsThpFDelrnVpb2sglrkPdJbYGmXdWZ3gl9V6Y9eRfmyCkpVCj/71dmEZmfkPihyhMmyhGozfWHKCIC30EjQI8NsBoTqYSaoN1ebg9cBuFzCmZ7Z49gIUOfKa82AMRAInPh8toWYZWS3fKhqwjvpKvNn3yxkHnigpCDLl/uHuPdYOUJgBQDT3Xe881GYyacIIRR3OoOd4MFBj2ELHtzQkoOe/ENmRSmqm7R/zNr6rheL60HpXo0W8fRpMecnA+/OxndvSofDuDgzwggiO5QEzcPYw3jKfZF+wvbZ+v968UZ/+TCvSPXOMqKrAPhM30g7Hi2jU2GKy0bytlP/bVoqGz+WLZfgBITpN3y13OKMrIclQlzscw4r4X3eMgqRacciwzl1OQ==,iv:z3QkqeqqJo6V23C3rqB4nQ7HWZszE8Ma9NZ65pJGk8Y=,tag:Xh3FCg/OF3FWkActOneiUw==,type:str]
+ config.yaml: ENC[AES256_GCM,data:ddgSAW7lFXtemFOykySQX1QSHAYqUGsLHHlxDxEPiwaCni+pWpTuuiffbTtJ/IPmhcBdMhaEMi6pAqKAaxYdpzagwtg+HMLT4ROO+RXJ1S5DUrJUwuY8k/doezslcxOC8G9g61/RI/t6EDUauOICKgERSQTxtaMksdZKCxiSXkCMWtVwWwQAbh050Oqo+ikCU4CcfMwgUNMVq1uMCzL+01EeEhsuxg/T/ytKveId7n3wRcc1Ia3vMDuvPRMrhhk1pHjVPSMbwo10uywhvJyRRkkDO0TPqc5JuZcNcUv21aySKY0Gr3kU1lbDGb0wzyetT6Suy4eJlxIfAOF0OX6ObOrZPKE9+gS3QHN5+C7tXSJdcDHdPj6++QFD92LjtfY3Ol7kyZsDH1x7Ogjg56Eol9l0Fdvx8zwG/ZMsiTvlXQjoUQBVN9u3Iv8M4Rw6Q13qmkPGcLUCkLqYJ6cI1xJsQEy1rM7KPuAk2+zgE0LJ1Ia48e2hheQJyeF2nlc9hazwP4SD8LBCXSJn/eDoi08DmlHMTtcDBVapLxupHc0FmoyoHZRbtr7hAvBb8DNQitrGBeucd3hdtIX0y/NsLMFNOIPAo+kfFkX8m7BLDtrf8uSlNgjEJ5sXPSNQDWebEiAV84jdEAQjs66dExxKvrHlalJ1Y30UnduGfacTLoNm+odJKSTRnDh6aX9BglVnq0LckesN/kGqTJDilwzcXpmbiYRNge+/msGn92kH1t/UEvIoCkruJflRj2Tfkqj5hClEAFwnObIAOmbn59TC2B6NgUvDizRs9M6gFM31ZHVjpX3dPtEvvJYvFDXcNZKebWGR8Kl1Xta9ZsThpFDelrnVpb2sglrkPdJbYGmXdWZ3gl9V6Y9eRfmyCkpVCj/71dmEZmfkPihyhMmyhGozfWHKCIC30EjQI8NsBoTqYSaoN1ebg9cBuFzCmZ7Z49gIUOfKa82AMRAInPh8toWYZWS3fKhqwjvpKvNn3yxkHnigpCDLl/uHuPdYOUJgBQDT3Xe881GYyacIIRR3OoOd4MFBj2ELHtzQkoOe/ENmRSmqm7R/zNr6rheL60HpXo0W8fRpMecnA+/OxndvSofDuDgzwggiO5QEzcPYw3jKfZF+wvbZ+v968UZ/+TCvSPXOMqKrAPhM30g7Hi2jU2GKy0bytlP/bVoqGz+WLZfgBITpN3y13OKMrIclQlzscw4r4X3eMgqRacciwzl1OQ==,iv:z3QkqeqqJo6V23C3rqB4nQ7HWZszE8Ma9NZ65pJGk8Y=,tag:Xh3FCg/OF3FWkActOneiUw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUDd3Q2ZrcWRJeXVKdmxs
- UVhET0p3VW13SGZ2UGc2bE1oNUduTURNNVdjCmxkT01KZTl0QnVDek9XUjRyWjhU
- N1hDTUd2ck1vL3QzcnN5SkF4Q014aTgKLS0tIDZLYm1NWXZqU1RlZ1ZrYWtieWxU
- SXVDSGMyTjhqbWhvUzNQWk9CR1A4MVkKHSiUheRpdkmvhY0Y3yvsYWQHYjZJRgEs
- weOy+GG0WF4Gj+r6SgwEI0tFb/dOw+ENHD+oMzwyQ1B2WHxrfNvLlw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-22T00:03:05Z"
- mac: ENC[AES256_GCM,data:/xcbROrte/AVjvkd0XbDLbyx5DOCmyRfmNr9Tr07qQMjjmV86Bl16s33hogfLg8qki7Rtr98HwpQ3/AwK+u1N3hCu9xo+UiGOFZbidlyvhwJfF7I33Z0IaG6nPMDkqC1zKD91SSYRVq69ICxawaLuDWGQAms0LhFluL5V6v/FwM=,iv:xy7lUknZMFnNycRe7hMD7RLEMJkLBa6v5cM6zQ1qc64=,tag:WEm3vt3wtLCfbabSa7qQXQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUDd3Q2ZrcWRJeXVKdmxs
+ UVhET0p3VW13SGZ2UGc2bE1oNUduTURNNVdjCmxkT01KZTl0QnVDek9XUjRyWjhU
+ N1hDTUd2ck1vL3QzcnN5SkF4Q014aTgKLS0tIDZLYm1NWXZqU1RlZ1ZrYWtieWxU
+ SXVDSGMyTjhqbWhvUzNQWk9CR1A4MVkKHSiUheRpdkmvhY0Y3yvsYWQHYjZJRgEs
+ weOy+GG0WF4Gj+r6SgwEI0tFb/dOw+ENHD+oMzwyQ1B2WHxrfNvLlw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-22T00:03:05Z"
+ mac: ENC[AES256_GCM,data:/xcbROrte/AVjvkd0XbDLbyx5DOCmyRfmNr9Tr07qQMjjmV86Bl16s33hogfLg8qki7Rtr98HwpQ3/AwK+u1N3hCu9xo+UiGOFZbidlyvhwJfF7I33Z0IaG6nPMDkqC1zKD91SSYRVq69ICxawaLuDWGQAms0LhFluL5V6v/FwM=,iv:xy7lUknZMFnNycRe7hMD7RLEMJkLBa6v5cM6zQ1qc64=,tag:WEm3vt3wtLCfbabSa7qQXQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: connectivity-tester-config
- namespace: matrix
+ name: connectivity-tester-config
+ namespace: matrix
type: Opaque
stringData:
- config.yaml: ENC[AES256_GCM,data:Q0bigRJfrb27G61qgdP3LI7mzbLcTHRqwNAfgWk6qW3wU4VwxDZRRHolEsMj+OA6pos/IlJemUQbs8Yb3ilSOOz076VpwXwuPeX1hIIFJ4DhYftmLt5PJ52M5CuYBtHRxdbV2l0IqmSfuGcrelqBnUOLRdYQ4eBB+DTGmzsOr1KzrFg2tmgLEN6lrlhrhphX56l+zCayf+XYxffRNSNueG7rIyqc8EBNNxmOn3uv82CVSCwUjoIV9TGsn3IZzuoT5PNpTdimj7rHXHz3K24PvOOekTuVWEmwM6IJRSCarv9NT2CRR1u4Y9K2HoIq2zknM/CdpNc3xWfkndNzgEew1tOc7tTwzMtWXM+IYICEr1NRKDwbendShLqIlSKQbjMb2PMYwKELZKPNk3RaedsY/lGAbAvOPIKZMWFKpzOp4TpCxhu0DBDyvkXIooCDscBrhf9qdI9CPyZqpO5IJF82SKl3AVIGGU9F7BrHXVsonHZMjJ5gFQilsFmEmH+bYo2QW6Dx5BRwLGUB+8eYXTI2KlahRs39Wmu1SaFpS7aVgNNupWGBSCEnvYlxX4LMv1Ck7CpgOskuiBTiMzHNKsumtwW8oD3tm7aWbztRUVWi5gPJwkytev03LSD9GvX0vOyp6j0RdaLV5O1BA5YfVz6aC64WUmThBIM6dJhRgWA8xD5fJZ/sTb3KXcPDgTu+/jPiJxp564G8g/7LmhB4VflgNGRQKdjvMhM+LvzlZsaC3rKvokhHFgHa8lvpLuw3rc4pL4pZWMG1TYLtvOJNAjnFDWk6nIN6QjLm5hU3tcvcGzHIl41S5SntKbzGxKyRn+DIvH4llm7uQAeXbCJrXe+XxTM5ClfzbIXkibjSHbUe5CTJAJyJmp9vzbmGLu6OqxxD0mu0OQmzkF9BaD5fgpUDviAewKoilF+EwQ1IvPvpodxisV5tVdek0SguGxcf0kJUwFqWTyWXzhr8H+xUXAo6XRWD7f3SpTx4CEDPnNC8bDkMi6hxIqDj5J8pom2lVuKAW3nTm0iExpjiLbMJV9a1LGjW3RoDlaVvgH461TntMbudcEYDy2XETp57Qj5f2fsPHw0O7pAuhm3ZTr1rCwyZt/oiyqYJvPHHQJdcULef6SrN3NyAUPi5hEhgVOcgYVz1RTHVhBVKwJCMc0UG/DDyvclM1gC2XvtNu99GO6QACkbCXVPPxZKP,iv:q9rqVBQ8yjjTGHyu2u8f3x74ztCEi3bwKkAuwgbAXWI=,tag:YtXb3IOJq7ZnPFX5CJdjdQ==,type:str]
+ config.yaml: ENC[AES256_GCM,data:Q0bigRJfrb27G61qgdP3LI7mzbLcTHRqwNAfgWk6qW3wU4VwxDZRRHolEsMj+OA6pos/IlJemUQbs8Yb3ilSOOz076VpwXwuPeX1hIIFJ4DhYftmLt5PJ52M5CuYBtHRxdbV2l0IqmSfuGcrelqBnUOLRdYQ4eBB+DTGmzsOr1KzrFg2tmgLEN6lrlhrhphX56l+zCayf+XYxffRNSNueG7rIyqc8EBNNxmOn3uv82CVSCwUjoIV9TGsn3IZzuoT5PNpTdimj7rHXHz3K24PvOOekTuVWEmwM6IJRSCarv9NT2CRR1u4Y9K2HoIq2zknM/CdpNc3xWfkndNzgEew1tOc7tTwzMtWXM+IYICEr1NRKDwbendShLqIlSKQbjMb2PMYwKELZKPNk3RaedsY/lGAbAvOPIKZMWFKpzOp4TpCxhu0DBDyvkXIooCDscBrhf9qdI9CPyZqpO5IJF82SKl3AVIGGU9F7BrHXVsonHZMjJ5gFQilsFmEmH+bYo2QW6Dx5BRwLGUB+8eYXTI2KlahRs39Wmu1SaFpS7aVgNNupWGBSCEnvYlxX4LMv1Ck7CpgOskuiBTiMzHNKsumtwW8oD3tm7aWbztRUVWi5gPJwkytev03LSD9GvX0vOyp6j0RdaLV5O1BA5YfVz6aC64WUmThBIM6dJhRgWA8xD5fJZ/sTb3KXcPDgTu+/jPiJxp564G8g/7LmhB4VflgNGRQKdjvMhM+LvzlZsaC3rKvokhHFgHa8lvpLuw3rc4pL4pZWMG1TYLtvOJNAjnFDWk6nIN6QjLm5hU3tcvcGzHIl41S5SntKbzGxKyRn+DIvH4llm7uQAeXbCJrXe+XxTM5ClfzbIXkibjSHbUe5CTJAJyJmp9vzbmGLu6OqxxD0mu0OQmzkF9BaD5fgpUDviAewKoilF+EwQ1IvPvpodxisV5tVdek0SguGxcf0kJUwFqWTyWXzhr8H+xUXAo6XRWD7f3SpTx4CEDPnNC8bDkMi6hxIqDj5J8pom2lVuKAW3nTm0iExpjiLbMJV9a1LGjW3RoDlaVvgH461TntMbudcEYDy2XETp57Qj5f2fsPHw0O7pAuhm3ZTr1rCwyZt/oiyqYJvPHHQJdcULef6SrN3NyAUPi5hEhgVOcgYVz1RTHVhBVKwJCMc0UG/DDyvclM1gC2XvtNu99GO6QACkbCXVPPxZKP,iv:q9rqVBQ8yjjTGHyu2u8f3x74ztCEi3bwKkAuwgbAXWI=,tag:YtXb3IOJq7ZnPFX5CJdjdQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUDd3Q2ZrcWRJeXVKdmxs
- UVhET0p3VW13SGZ2UGc2bE1oNUduTURNNVdjCmxkT01KZTl0QnVDek9XUjRyWjhU
- N1hDTUd2ck1vL3QzcnN5SkF4Q014aTgKLS0tIDZLYm1NWXZqU1RlZ1ZrYWtieWxU
- SXVDSGMyTjhqbWhvUzNQWk9CR1A4MVkKHSiUheRpdkmvhY0Y3yvsYWQHYjZJRgEs
- weOy+GG0WF4Gj+r6SgwEI0tFb/dOw+ENHD+oMzwyQ1B2WHxrfNvLlw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-22T00:03:05Z"
- mac: ENC[AES256_GCM,data:/xcbROrte/AVjvkd0XbDLbyx5DOCmyRfmNr9Tr07qQMjjmV86Bl16s33hogfLg8qki7Rtr98HwpQ3/AwK+u1N3hCu9xo+UiGOFZbidlyvhwJfF7I33Z0IaG6nPMDkqC1zKD91SSYRVq69ICxawaLuDWGQAms0LhFluL5V6v/FwM=,iv:xy7lUknZMFnNycRe7hMD7RLEMJkLBa6v5cM6zQ1qc64=,tag:WEm3vt3wtLCfbabSa7qQXQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUDd3Q2ZrcWRJeXVKdmxs
+ UVhET0p3VW13SGZ2UGc2bE1oNUduTURNNVdjCmxkT01KZTl0QnVDek9XUjRyWjhU
+ N1hDTUd2ck1vL3QzcnN5SkF4Q014aTgKLS0tIDZLYm1NWXZqU1RlZ1ZrYWtieWxU
+ SXVDSGMyTjhqbWhvUzNQWk9CR1A4MVkKHSiUheRpdkmvhY0Y3yvsYWQHYjZJRgEs
+ weOy+GG0WF4Gj+r6SgwEI0tFb/dOw+ENHD+oMzwyQ1B2WHxrfNvLlw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-22T00:03:05Z"
+ mac: ENC[AES256_GCM,data:/xcbROrte/AVjvkd0XbDLbyx5DOCmyRfmNr9Tr07qQMjjmV86Bl16s33hogfLg8qki7Rtr98HwpQ3/AwK+u1N3hCu9xo+UiGOFZbidlyvhwJfF7I33Z0IaG6nPMDkqC1zKD91SSYRVq69ICxawaLuDWGQAms0LhFluL5V6v/FwM=,iv:xy7lUknZMFnNycRe7hMD7RLEMJkLBa6v5cM6zQ1qc64=,tag:WEm3vt3wtLCfbabSa7qQXQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/convex/deployment.yaml b/apps/talos_cluster/convex/deployment.yaml
@@ -48,39 +48,39 @@ spec:
value: "1"
- name: "ACTIONS_USER_TIMEOUT_SECS"
value: "60"
- # Unused
- # - name: "AWS_ACCESS_KEY_ID"
- # value: ""
- # - name: "AWS_REGION"
- # value: ""
- # - name: "AWS_S3_DISABLE_CHECKSUMS"
- # value: ""
- # - name: "AWS_S3_DISABLE_SSE"
- # value: ""
- # - name: "AWS_S3_FORCE_PATH_STYLE"
- # value: ""
- # - name: "AWS_SECRET_ACCESS_KEY"
- # value: ""
- # - name: "AWS_SESSION_TOKEN"
- # value: ""
- # - name: "CONVEX_RELEASE_VERSION_DEV"
- # value: ""
- # - name: "DATABASE_URL"
- # value: ""
- # - name: "REDACT_LOGS_TO_CLIENT"
- # value: ""
- # - name: "S3_ENDPOINT_URL"
- # value: ""
- # - name: "S3_STORAGE_EXPORTS_BUCKET"
- # value: ""
- # - name: "S3_STORAGE_FILES_BUCKET"
- # value: ""
- # - name: "S3_STORAGE_MODULES_BUCKET"
- # value: ""
- # - name: "S3_STORAGE_SEARCH_BUCKET"
- # value: ""
- # - name: "S3_STORAGE_SNAPSHOT_IMPORTS_BUCKET"
- # value: ""
+ # Unused
+ # - name: "AWS_ACCESS_KEY_ID"
+ # value: ""
+ # - name: "AWS_REGION"
+ # value: ""
+ # - name: "AWS_S3_DISABLE_CHECKSUMS"
+ # value: ""
+ # - name: "AWS_S3_DISABLE_SSE"
+ # value: ""
+ # - name: "AWS_S3_FORCE_PATH_STYLE"
+ # value: ""
+ # - name: "AWS_SECRET_ACCESS_KEY"
+ # value: ""
+ # - name: "AWS_SESSION_TOKEN"
+ # value: ""
+ # - name: "CONVEX_RELEASE_VERSION_DEV"
+ # value: ""
+ # - name: "DATABASE_URL"
+ # value: ""
+ # - name: "REDACT_LOGS_TO_CLIENT"
+ # value: ""
+ # - name: "S3_ENDPOINT_URL"
+ # value: ""
+ # - name: "S3_STORAGE_EXPORTS_BUCKET"
+ # value: ""
+ # - name: "S3_STORAGE_FILES_BUCKET"
+ # value: ""
+ # - name: "S3_STORAGE_MODULES_BUCKET"
+ # value: ""
+ # - name: "S3_STORAGE_SEARCH_BUCKET"
+ # value: ""
+ # - name: "S3_STORAGE_SNAPSHOT_IMPORTS_BUCKET"
+ # value: ""
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
diff --git a/apps/talos_cluster/convex/pg-secret.yaml b/apps/talos_cluster/convex/pg-secret.yaml
@@ -1,28 +1,28 @@
apiVersion: v1
kind: Secret
metadata:
- name: pg-secret
- namespace: convex
+ name: pg-secret
+ namespace: convex
type: Opaque
stringData:
- postgres-url: ENC[AES256_GCM,data:ffKU9idxC92vBmk3SNi8qyJPNmFLoIR9UVZyWi+bC3bzQ7reCLO3V7IJvY3NalTkxPu1M+1acCLKbMwAyQzzd03QHFDPYgpMHOmDvp+86caJv+oU6Qk15sOzrTXBsz2EH/FwA4ZBhPav/q61B85cPsYObPoCiABtP0sQsGl+NEHLDU79nnoI6KqlLQplSMeuTKDuk50JAfOKgs4nsw==,iv:LsuY34WE5QjZ4sJBYLm8FP8wVuXEUU+7CkZeb3pvmm0=,tag:3wc1md9fnSgNxYFYbco57w==,type:str]
+ postgres-url: ENC[AES256_GCM,data:ffKU9idxC92vBmk3SNi8qyJPNmFLoIR9UVZyWi+bC3bzQ7reCLO3V7IJvY3NalTkxPu1M+1acCLKbMwAyQzzd03QHFDPYgpMHOmDvp+86caJv+oU6Qk15sOzrTXBsz2EH/FwA4ZBhPav/q61B85cPsYObPoCiABtP0sQsGl+NEHLDU79nnoI6KqlLQplSMeuTKDuk50JAfOKgs4nsw==,iv:LsuY34WE5QjZ4sJBYLm8FP8wVuXEUU+7CkZeb3pvmm0=,tag:3wc1md9fnSgNxYFYbco57w==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQWxhcEhobjI2ald5U1Ew
- N2trZzM1ZTB3UkNjWW01bDhsV1hpSzVGVTI4CitISndvaGQzM1l1RUJNZWQwc2xq
- RGZIQ0dxSUFEZkFRMEg5eFRSZy90em8KLS0tIDhwYzdvLzNqZ3Q2U1pPY3dKN2N4
- RlNSNlAwNi9UZzg3cFRCeHNYK1p2b3MKHV/X/MQr34vZJV9jjRS3pZX306YQPt5r
- 7G0Zh2mzcp3aAE72YQ7Z+ndB1mkc7Fvxmk9KSrWnEfJcQJ3jRN7Nxg==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-01-03T16:53:50Z"
- mac: ENC[AES256_GCM,data:nc9K1ncqIoPpVeWLI+JTRi5t/Fi7AXMsw+OZyZKOW1E9FErbWvg74j3qeB6RYmgNBqyLqDRduuRI4BmpNpyFYNw64QskHbBPKIIb1QkbdERJy2i1MKE9foJbANa31kbrQDoXt1Kv70LKA9N1wewug/YQsVJA4XM4NpqveHkdo9M=,iv:CiWDSsnqBOrHHrjwnFpK0mfO2TGcRj1O56jBmP+iVSM=,tag:+BtHzj1NHUtFXMMWK6SF6Q==,type:str]
- pgp: []
- encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQWxhcEhobjI2ald5U1Ew
+ N2trZzM1ZTB3UkNjWW01bDhsV1hpSzVGVTI4CitISndvaGQzM1l1RUJNZWQwc2xq
+ RGZIQ0dxSUFEZkFRMEg5eFRSZy90em8KLS0tIDhwYzdvLzNqZ3Q2U1pPY3dKN2N4
+ RlNSNlAwNi9UZzg3cFRCeHNYK1p2b3MKHV/X/MQr34vZJV9jjRS3pZX306YQPt5r
+ 7G0Zh2mzcp3aAE72YQ7Z+ndB1mkc7Fvxmk9KSrWnEfJcQJ3jRN7Nxg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-01-03T16:53:50Z"
+ mac: ENC[AES256_GCM,data:nc9K1ncqIoPpVeWLI+JTRi5t/Fi7AXMsw+OZyZKOW1E9FErbWvg74j3qeB6RYmgNBqyLqDRduuRI4BmpNpyFYNw64QskHbBPKIIb1QkbdERJy2i1MKE9foJbANa31kbrQDoXt1Kv70LKA9N1wewug/YQsVJA4XM4NpqveHkdo9M=,iv:CiWDSsnqBOrHHrjwnFpK0mfO2TGcRj1O56jBmP+iVSM=,tag:+BtHzj1NHUtFXMMWK6SF6Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/draupnir4all/deployment.yaml b/apps/talos_cluster/draupnir4all/deployment.yaml
@@ -69,18 +69,7 @@ spec:
- name: NODE_OPTIONS
value: "--trace-warnings"
command: ["./draupnir-entrypoint.sh"]
- args:
- [
- "appservice",
- "-c",
- "/data/config/config.appservice.yaml",
- "-f",
- "/data/config/draupnir-registration.yaml",
- "--draupnir-config",
- "/data/config/draupnir-config.yaml",
- "-p",
- "9000",
- ]
+ args: ["appservice", "-c", "/data/config/config.appservice.yaml", "-f", "/data/config/draupnir-registration.yaml", "--draupnir-config", "/data/config/draupnir-config.yaml", "-p", "9000"]
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
diff --git a/apps/talos_cluster/immich/database-credentials.yaml b/apps/talos_cluster/immich/database-credentials.yaml
@@ -2,31 +2,31 @@
apiVersion: v1
kind: Secret
metadata:
- name: immich-database
- namespace: immich
+ name: immich-database
+ namespace: immich
type: Opaque
stringData:
- host: ENC[AES256_GCM,data:ReseNUa2mc2Cf7C17/rxjYh5K+EZkZzKBe03vMqIBcKv1seGnP5Nqzk2SG5Svgxyh/8b,iv:anQMpD9bLkyOSQeKWfIQvsVEiOUz8aW/jzXV4yJrs7g=,tag:OdFmwjnoKp5Jb1xERMTQ5A==,type:str]
- username: ENC[AES256_GCM,data:i4xsvTHL,iv:l5Mfr9/oLlP3hqfIpDqhz8Z1KtmvgD2OxewEZChcCC8=,tag:AVOWSu1IjhzpfvtE/xTNKQ==,type:str]
- password: ENC[AES256_GCM,data:oJuJ7ulDQoreyuML5en4UOrhwRiNBqUCgaMsxE8EDtKgZQGFmtH8O1FFiU2IUWKvYCf3/4hLAr0KPNhNbXqQWQ==,iv:Bcu4WnbNIs8QCoqIxUO0VhdCOrsYkk9g0+YE7yeVHB8=,tag:bKNZ4nQbZL/YDlEx8d11Ug==,type:str]
- dbname: ENC[AES256_GCM,data:NYj7qrNm,iv:K867td+2mraT2ne7ga8zEsO7kRG35MCKAEZ9xdrpGbw=,tag:vURQGZYVxC4Buvk8z3D42A==,type:str]
+ host: ENC[AES256_GCM,data:ReseNUa2mc2Cf7C17/rxjYh5K+EZkZzKBe03vMqIBcKv1seGnP5Nqzk2SG5Svgxyh/8b,iv:anQMpD9bLkyOSQeKWfIQvsVEiOUz8aW/jzXV4yJrs7g=,tag:OdFmwjnoKp5Jb1xERMTQ5A==,type:str]
+ username: ENC[AES256_GCM,data:i4xsvTHL,iv:l5Mfr9/oLlP3hqfIpDqhz8Z1KtmvgD2OxewEZChcCC8=,tag:AVOWSu1IjhzpfvtE/xTNKQ==,type:str]
+ password: ENC[AES256_GCM,data:oJuJ7ulDQoreyuML5en4UOrhwRiNBqUCgaMsxE8EDtKgZQGFmtH8O1FFiU2IUWKvYCf3/4hLAr0KPNhNbXqQWQ==,iv:Bcu4WnbNIs8QCoqIxUO0VhdCOrsYkk9g0+YE7yeVHB8=,tag:bKNZ4nQbZL/YDlEx8d11Ug==,type:str]
+ dbname: ENC[AES256_GCM,data:NYj7qrNm,iv:K867td+2mraT2ne7ga8zEsO7kRG35MCKAEZ9xdrpGbw=,tag:vURQGZYVxC4Buvk8z3D42A==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsU2doMSt0cWhSd2M2L3BN
- VEp5UktUSWRGUWh6OHNUTlpxbThkTVBEaGlBCjFrait6N3o0RFJkVGFpSEg0VlI4
- TFYvb1htTHVaUmNES3pMTTN3bWRJUk0KLS0tIGFVY1RxdTZtMjNNZk1lNVJxNTRz
- WUlrOGIrRWVOSFloTnlWMFdkQXpPWm8KwmzW87pNLHUEafGJG3tDyJv1aGgqv+5X
- U86qdfLwxtg220rm6sq1+x0qdWRlAmmg1mij920dDL9lMZ2PqRT+TA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-12-20T22:26:54Z"
- mac: ENC[AES256_GCM,data:Xf1XzBBgz4rPJqvrvpTmamE3f1pVLh9QYAxtQRqA0qKsauFiTXx2T+gjz91RDZozhI5dVu8rq+qfVEzIMCslwi3brBASeOIDZhozdkbS3PkCWNP5a/YaL727QZ7uViIIu+SoxyBZMYIMPyUSHG3Q3H77Ad6ICvE2PmNBMv3roeo=,iv:ToqbvhLxbeikmioryuJUs2ptc2MSPMrNT0h1hA9frSE=,tag:susZLm6jz8D6iqGq9uvTFw==,type:str]
- pgp: []
- encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsU2doMSt0cWhSd2M2L3BN
+ VEp5UktUSWRGUWh6OHNUTlpxbThkTVBEaGlBCjFrait6N3o0RFJkVGFpSEg0VlI4
+ TFYvb1htTHVaUmNES3pMTTN3bWRJUk0KLS0tIGFVY1RxdTZtMjNNZk1lNVJxNTRz
+ WUlrOGIrRWVOSFloTnlWMFdkQXpPWm8KwmzW87pNLHUEafGJG3tDyJv1aGgqv+5X
+ U86qdfLwxtg220rm6sq1+x0qdWRlAmmg1mij920dDL9lMZ2PqRT+TA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-12-20T22:26:54Z"
+ mac: ENC[AES256_GCM,data:Xf1XzBBgz4rPJqvrvpTmamE3f1pVLh9QYAxtQRqA0qKsauFiTXx2T+gjz91RDZozhI5dVu8rq+qfVEzIMCslwi3brBASeOIDZhozdkbS3PkCWNP5a/YaL727QZ7uViIIu+SoxyBZMYIMPyUSHG3Q3H77Ad6ICvE2PmNBMv3roeo=,iv:ToqbvhLxbeikmioryuJUs2ptc2MSPMrNT0h1hA9frSE=,tag:susZLm6jz8D6iqGq9uvTFw==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/immich/release.yaml b/apps/talos_cluster/immich/release.yaml
@@ -1,4 +1,3 @@
----
# PVC for immich
apiVersion: v1
kind: PersistentVolumeClaim
diff --git a/apps/talos_cluster/monitoring-stack/release.yaml b/apps/talos_cluster/monitoring-stack/release.yaml
@@ -1,780 +1,781 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
- name: vm
- namespace: monitoring
+ name: vm
+ namespace: monitoring
spec:
- interval: 5m
- chart:
- spec:
- version: 0.71.x
- chart: victoria-metrics-k8s-stack
- sourceRef:
- kind: HelmRepository
- name: vm
- interval: 60m
- install:
- crds: CreateReplace
- upgrade:
- crds: CreateReplace
- # Force recreation due to Helm not properly patching Deployment with e.g. added port,
- # causing spurious drift detection
- force: true
- # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
- values:
- vmsingle:
- enabled: false
- spec:
- extraArgs:
- search.maxSeries: "3000000"
- search.maxConcurrentRequests: "25"
- search.maxQueryDuration: 60s
- search.maxLabelsAPIDuration: 60s
- storage:
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 10Gi
- vmcluster:
- enabled: true
- spec:
- retentionPeriod: 30d
- vminsert:
- replicaCount: 1
- resources:
- limits:
- cpu: "1"
- memory: 500Mi
- affinity:
- podAntiAffinity:
- requiredDuringSchedulingIgnoredDuringExecution:
- - labelSelector:
- matchExpressions:
- - key: ENC[AES256_GCM,data:oaiM,iv:1/KF+DpK3Z+sabGww8dbOme4E6sTppvCdhR3nIqshQ8=,tag:PYKYx/WC7j9Zcibi4fjYxA==,type:str]
- operator: In
- values:
- - vminsert
- topologyKey: kubernetes.io/hostname
- vmselect:
- extraArgs:
- search.maxSeries: "3000000"
- search.maxConcurrentRequests: "15"
- search.maxQueryDuration: 60s
- search.maxLabelsAPIDuration: 60s
- replicaCount: 1
- resources:
- limits:
- cpu: "1"
- memory: 500Mi
- storage:
- volumeClaimTemplate:
- spec:
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 2Gi
- affinity:
- podAntiAffinity:
- requiredDuringSchedulingIgnoredDuringExecution:
- - labelSelector:
- matchExpressions:
- - key: ENC[AES256_GCM,data:cfbl,iv:cTBVA2YCWsennTnzt8IrNktvcLIy+8KzRho5dd2UzrY=,tag:3bUXy7h1gNo0W8opqDCp8Q==,type:str]
- operator: In
- values:
- - vmselect
- topologyKey: kubernetes.io/hostname
- vmstorage:
- replicaCount: 1
- extraArgs:
- search.maxConcurrentRequests: "25"
- resources:
- limits:
- cpu: "1"
- memory: 2048Mi
- affinity:
- podAntiAffinity:
- requiredDuringSchedulingIgnoredDuringExecution:
- - labelSelector:
- matchExpressions:
- - key: ENC[AES256_GCM,data:PJqU,iv:nC51jS9O10HQbrGFxjvuU+XCExTlHjumkMr7io+Frm8=,tag:C/KYP/uaudN9tL5fKzwaJA==,type:str]
- operator: In
- values:
- - vmstorage
- topologyKey: kubernetes.io/hostname
- storage:
- volumeClaimTemplate:
- spec:
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 10Gi
- victoria-metrics-operator:
- operator:
- disable_prometheus_converter: false
- grafana:
- sidecar:
- dashboards:
- folderAnnotation: grafana_folder
- provider:
- foldersFromFilesStructure: true
- logLevel: WARN
- watchServerTimeout: 3600
- enabled: true
- adminPassword: ENC[AES256_GCM,data:ioUYJMeIay5i4cibExmAtkU+G2r50+Ew58EwuT7QCEbWskQpQ1jK8qAWFCJUOPu9UswHcbiC1ICwsfGE4Y8Ehg==,iv:WSNPXRsrXRdG9NDu5rimj+1uqHl3iLL3Reh9u9TZPnA=,tag:NEbvo5Fqmn44z8MtpllZgg==,type:str]
- alerting:
- rules.yaml:
- apiVersion: 1
- groups:
- - orgId: 1
- name: Ceph
- folder: Ceph
- interval: 5m
- rules:
- - uid: fef44llxxufpca
- title: CephOSDNearFull
- condition: A
- data:
- - refId: ENC[AES256_GCM,data:iw==,iv:6nhewBYb7bZDuPIS1sUErR23NOj+m8xvU079o9iYPzM=,tag:fB8iHC5j15bEcsBJgEA+KQ==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:q9Ks,iv:uA1I8hszRmM0pa0RdvYT4lctm5imQxbByRsyVf2/CNU=,tag:KfUEiidOvWJnE/dds5UxnQ==,type:int]
- to: ENC[AES256_GCM,data:nw==,iv:JOEwe1nLoVCHi8ZQ7loCc7x78t4Tnjs987MCcYpysO4=,tag:fDM2xpAJ9SElmeYQyKTggA==,type:int]
- datasourceUid: ENC[AES256_GCM,data:cpX8wkknbnmS7X4+4G7Irgs=,iv:9RsFw7x6ye9vR8opu2CpbRW4ANArJc9fXQXIyAio7KM=,tag:gPQZOIB2/8Q3nD6IwL9wlA==,type:str]
- model:
- editorMode: ENC[AES256_GCM,data:JfOBrg==,iv:AefNKUyxYvyELXJ38RfH2urHf2O0gAP7SUKVtIhZdlw=,tag:/9dsOh11CITFB7U0KoKgnw==,type:str]
- expr: ENC[AES256_GCM,data:KnAilAE/V8BYOlyPepN0NpWuEq3ktrvotXofjuf+3No3X9ngtA3NyK+8TS8=,iv:CFdilsgMVK/ux7lv9s/FyQdofO7YxIOJdNjyGmEc5aA=,tag:y8HbKCkg3/PoIBs4quVy8w==,type:str]
- instant: ENC[AES256_GCM,data:07GJMA==,iv:U5XMuiZCcznEXOauj+7BdW6hNBer9sVv2yHdBP/SCBc=,tag:1l8E6ksExlm6u+D8W8wtEA==,type:bool]
- intervalMs: ENC[AES256_GCM,data:W3sFng==,iv:5d7hPT0jUBnheAEpqnzaxBNU3hy9gQHI5IDNQc4UPPk=,tag:K+40yhvXd3SdRbCpkZAXWQ==,type:int]
- legendFormat: ENC[AES256_GCM,data:S48h6wS0,iv:AEJKP4LhwM+VVRPDN0d95r2vXNljY5Ck1LpfR2Rs3e0=,tag:8nNCBY0D5I7+k8Gu/DsBgQ==,type:str]
- maxDataPoints: ENC[AES256_GCM,data:kRf/zPA=,iv:9/IWWyl4R/s7V7CnY0XgKJwODnrYuqE8VCg7P2ovJqM=,tag:zrWQxQNObp271xn6DvzX9w==,type:int]
- range: ENC[AES256_GCM,data:XItEUGs=,iv:2eHWsC2Trs2zWFaSx80qvQ7/ppPIVuWZdLWaGOFWwDk=,tag:MHVVIqeCiKaiA55ShOCqkA==,type:bool]
- refId: ENC[AES256_GCM,data:uQ==,iv:xbblOx4pYlYdqPEbqBSQlLjvKYP/vbRP+OPPc4pMXTg=,tag:/6iZuHmrINF6v+iVuuOAJA==,type:str]
- dashboardUid: tbO9LAiZK
- panelId: 7
- noDataState: OK
- execErrState: OK
- for: 5m
- annotations:
- __dashboardUid__: tbO9LAiZK
- __panelId__: "7"
- description: One or more OSDs have reached the NEARFULL threshold. Use 'ceph health detail' and 'ceph osd df' to identify the problem. To resolve, add capacity to the affected OSD's failure domain, restore down/out OSDs, or delete unwanted data.
- runbook_url: https://docs.ceph.com/en/latest/rados/operations/health-checks#osd-nearfull
- summary: OSD(s) running low on free space (NEARFULL)
- isPaused: false
- notification_settings:
- receiver: PagerDuty
- - orgId: 1
- name: CertManager
- folder: Cluster
- interval: 5m
- rules:
- - uid: ddz3zj028wb28b
- title: CertManagerHittingRateLimits
- condition: B
- data:
- - refId: ENC[AES256_GCM,data:Hg==,iv:4kSVstGwwjgBpzF03l1nxxbCph9QuAtaaCv18+amw6M=,tag:gkQ1TGeI4tX3wlpaZMfqBg==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:6SsE,iv:E+cs42ZRfWc3eR5SXBp9mCevKxJtVFHFElazzo5wKJk=,tag:JbSyN+G/HjAg1UxNXn1MRw==,type:int]
- to: ENC[AES256_GCM,data:iw==,iv:81g8zArzlmo74ZzrLx1HTLPevYrbz2d4em1NA4qlkvk=,tag:MfBzRiBRWVEp9EVuAEuTyA==,type:int]
- datasourceUid: ENC[AES256_GCM,data:k81x9frxCmFpdQ==,iv:AuVcxgxNkPE47pArw4sgTKLBwm54SMkJVggANYAODow=,tag:a2FWnC2j48dr1b6c25JSxA==,type:str]
- model:
- editorMode: ENC[AES256_GCM,data:XUt8aA==,iv:iijgCX51Y3jkEi8zEDQPaZVd4xxhHY+qOYr5jBD+BQs=,tag:HetKRu6UAeysm19U6BvPeg==,type:str]
- expr: ENC[AES256_GCM,data:DutNOqaVDUnKYw4gQUb8qS8yaczhyL32AtdkeRVtDaSir8TAAkGx+vLjRoZaRVJh+jhDgVJnU7dzgqfExPfrFrmYUTB4QrTjeDaTJe9NFEsiY48pJE2SCfDhzZ9I1FL1mKEm2UEyXltL7fS2MGpSk9s4,iv:6miN/HJtkWZNyzPJLTMZllCCp/qpF85zxFHNwDKwDBk=,tag:34XAzyBXp1TwCicsA95A0A==,type:str]
- instant: ENC[AES256_GCM,data:UEq79g==,iv:Vgu4VE2/6l2UlR6fsOfFpvzSo3TcwV9svmaieiGbruI=,tag:AoBVwe0uFyAfn2iOnb+r2w==,type:bool]
- intervalMs: ENC[AES256_GCM,data:6PP06Q==,iv:chBco7kF5zbp5Apzvq48bJMt6K7brGcA+GY3bFAxl1Y=,tag:RQAz8OwTX3nUcJUibyaCJQ==,type:int]
- legendFormat: ENC[AES256_GCM,data:s6/XQnFT,iv:IHheK61vucMV1mv/Hde5xgwHeccYrzHIcxF0dBrHErk=,tag:b5N8hLeyHHpY06xPQw5UIQ==,type:str]
- maxDataPoints: ENC[AES256_GCM,data:Pq1iGy8=,iv:ojwazGqa9gqGt6gPnzcWPeNnwwO2sFGtgdVii9StY70=,tag:656IEmF1cjnEYddzOrOnYA==,type:int]
- range: ENC[AES256_GCM,data:HkNe8IM=,iv:1DVoDlwouhZM+1m6kSUwBGgxgB3iV9Pi0pddEe8mPbw=,tag:YxNdSHsyN5KL7lKzRcWPag==,type:bool]
- refId: ENC[AES256_GCM,data:dw==,iv:3kBazTOK+UJjLuy51lfkZmyqnEnsRDR4pYxXCOWluJw=,tag:lHqqPlYa8n9IXOwok/4swA==,type:str]
- - refId: ENC[AES256_GCM,data:Og==,iv:P1A6C840z3ntyo8ecU/TWuQF5XI364eO5s1EMIlO+HE=,tag:MItjkxsLgucDlmItcxHK7g==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:gKen,iv:nhQ2/e72N5wcxcIehDEszanAmBEPpB+tU9N1z/WT9tQ=,tag:sDuZP+7sFwhKGQ2pnrJkYw==,type:int]
- to: ENC[AES256_GCM,data:6Q==,iv:B6bIsUOtkhq2CUOreGIgBD51S5fylTQkeHs3avgE3uY=,tag:ifGU1J/v6RSXOwv1+usDHA==,type:int]
- datasourceUid: ENC[AES256_GCM,data:tAcQ3fc3qAo=,iv:EuBsu53aFt2zu99Ov/wQQDrfiH/Ol/gtiA6JSbFBpSc=,tag:6mUn1MWhwSOF6EN6hYIRfA==,type:str]
- model:
- conditions:
- - evaluator:
- params: []
- type: ENC[AES256_GCM,data:kSw=,iv:BKBZwtgHVE0JHQX52HsCgDXjbYyVDHK74jPtQGZHyZg=,tag:puqrxc2fGLLh+hX6+yip8g==,type:str]
- operator:
- type: ENC[AES256_GCM,data:rm9N,iv:FYFXYr4Fl9dZag+LoIN8s13Z7r2ngVbVPGvZNKorMqs=,tag:dGF5rz5+xPjaHAkl6Mq5pQ==,type:str]
- query:
- params:
- - ENC[AES256_GCM,data:vQ==,iv:/+xldPv5c5j0UJ1mCk8vTxWttkVW/hIxpHZv/qsdEvQ=,tag:mztZWWQHGnwHC8F6mYO7QQ==,type:str]
- reducer:
- params: []
- type: ENC[AES256_GCM,data:Vb90cA==,iv:qxAA4yqX0k3hsDLVBMTpMtGqmM9GLbgEdISAq4A+HMY=,tag:cN3auYLwu8xBeH2YewRCKQ==,type:str]
- type: ENC[AES256_GCM,data:yY4QOcQ=,iv:QDLiy0aaDJ2Og3kQFp+kqKiSdfCjtaDM90egebTqW2E=,tag:3KrRjFkoYPs2GyaVEN3CWQ==,type:str]
- datasource:
- type: ENC[AES256_GCM,data:7ompik7mROc=,iv:9nQ7Kzjyr/gEhh4e20QExQ8XfA21sqj/eV2luqP+Wk8=,tag:sXamA6GFMQ7S2tkRXaZC5w==,type:str]
- uid: ENC[AES256_GCM,data:gM9HDK/66bU=,iv:j35m4HhghIvTaYWXGjhMF6SdmPxyNW5HdWxUXi6kn+c=,tag:7kKENR3W7wGvKeoZAOqJfg==,type:str]
- expression: ENC[AES256_GCM,data:Pw==,iv:FLjquIGw/F7q1RlvDTvec8VMt4CLNToD6JFIsuGULJA=,tag:wXhMSV0O1SjD2sFKAKhSfQ==,type:str]
- intervalMs: ENC[AES256_GCM,data:5RvaHQ==,iv:gMCCR8lv/Az2eR4HUIjpADakrwYTuRDyCt1wAld+zEM=,tag:Ovu9UkK4BZEyTQLb0lp8Tw==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:lAQKLBY=,iv:3Ngg+Ol1lpCbgJJi24VxDSJRVPlCxoRAwVFfLETmhc4=,tag:IMv075SUxJaKv8tg8v9GPw==,type:int]
- reducer: ENC[AES256_GCM,data:etM1EA==,iv:GPeOoQJOcjoDxEDql2/FnTkRho6sLwbslPv0wdF/CGU=,tag:q2Cw7H/p4zq8Ru4snHZvdg==,type:str]
- refId: ENC[AES256_GCM,data:2Q==,iv:Ivb9W4cSqrHIhZf5IQr8lXZP5/WEuLgAsVrvnhCjzfY=,tag:93WGZKbAQfgOUWNiPIcOgA==,type:str]
- type: ENC[AES256_GCM,data:X8NgHDJt,iv:zUodvCcmXWARKi2KZcqnwFcxiKsmY59rJX1OuHsPEzU=,tag:xMrx5lfOfFtyhxSLzAHdyA==,type:str]
- noDataState: OK
- execErrState: Error
- for: 5m
- annotations:
- description: Depending on the rate limit, cert-manager may be unable to generate certificates for up to a week.
- summary: Cert manager hitting LetsEncrypt rate limits.
- labels: {}
- isPaused: false
- notification_settings:
- receiver: PagerDuty Warning
- - orgId: 1
- name: Resources
- folder: Cluster
- interval: 15m
- rules:
- - uid: bdz3y4mow1o1se
- title: KubePersistentVolumeFillingUp
- condition: B
- data:
- - refId: ENC[AES256_GCM,data:VQ==,iv:seCzN48f4Rx+MVHVBqbQuhlBBcgf4xxJlhFPiqQbHzA=,tag:gtpqeR7TZpDvmsGN/9P6IA==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:Mz2Z,iv:7V/EW/RKb/KfVtARlEv71enNR9Ly2svCijoIu7i0fOo=,tag:tysIqgzjlGwHfu+sr/94YQ==,type:int]
- to: ENC[AES256_GCM,data:og==,iv:fZFV+WOCaTRvNbjMmpijOJGaVe5GP5tLRU79xR7xGHY=,tag:E3psj0LdmuyseaywZ5SGEg==,type:int]
- datasourceUid: ENC[AES256_GCM,data:e+byxHieHuNG3Q==,iv:hnNcKEePscR5P0sYGXcDZk8OsqXGysT1AWOQio9dN44=,tag:4HW3j1094mzHm8TD5/khzQ==,type:str]
- model:
- datasource:
- type: ENC[AES256_GCM,data:ZhRg//npyVUUhQ==,iv:uPvckTI05sLs3xBWZMv4Tn7q1++DJLxWi0iweQR8ZkM=,tag:ig/Y5DdcEahlZh5zXqFk6w==,type:str]
- uid: ENC[AES256_GCM,data:1rxkPKBxxREppw==,iv:19xNtf3RImuBR6WEfzXGiuP3sWBCeaVMDhFDiECrFIc=,tag:nmZvZRB3KC3FcxofsgDxgg==,type:str]
- editorMode: ENC[AES256_GCM,data:0Hu05Q==,iv:QmhAVbhM4qpQEXUm/ogygjdVxqCUJkh9J9UIEjM/MYI=,tag:5NYIIl0DRkjpkZ/0rni2gA==,type:str]
- expr: ENC[AES256_GCM,data:2ir3JookEJOwntW1cc+XsVIL1BrxYuibl/AX1O3ou2ZofLSopynqqx5fM30VIXNvMiSAQJV3HxZ0bGFV+EYBx397F7G0Z4/hsgMVohWr+PvJncP8y4rEPHx0MrdsWD8ixPiJKXKBYt1uESf2MfijOyeL0CctNGIRFiZ93H/08fytoFc6+akdBNcErEbVk0Z+6gXtvuVpBsj9OSee/ru1mqgobYwYYHPadIUoF1eaExKxGNM2+DMnRVvfOKXMwa+pkdKJEvJkk61uB0gXzFbKslq19DAJkMWyvx386KKNo3LXz2cmo0HZ7nAForLIdxKhN8WOvK8HzmIkkBI8KKKAMPhSuXeBSDxGN4nU3nvTOkTjHej673KJr3CNVWKFtcUsuC8bVf6/cy9qR7NAxyeeU0YmLxSuUSVebBwPDNwmmzcGj6arHscmk7HEdgzA9F/yVltVc0wgIpoi7yb5D7Pi1FTSD9LkSEkS+EczbvvTyZo+EWNedRlJ5VzlMAMJRmvAL4ajfkY/Y86x7NaCq4KgAcSeETdxAE35jeWM+pyOp2wHen5u3BcKA5o8Fk6PLbyzLOKNQnAjgueY/esSUwBw7710GCisgZE29qR0HCL6Cfff44yNyPPA0n3qHWgZkk6PWSNAiocuha8Av+EvWQu64YIsKnwddxb5LH+bYZYH4akF8g5Q2IbBVnEdOEjC514FpTwDGGUN4dp/t84jr/AwNvrQuDUA9cfYTMwH5fE=,iv:OShYxAuf+EG1B5/33y3dxt7xSKkRktPDZU+Y3F6IWFw=,tag:iZGOXvFTyYNGi+VnggAJfg==,type:str]
- instant: ENC[AES256_GCM,data:5sRsZw==,iv:HAjDngkx3ek4zWM76RBib6ZR9+ombZcOI3MP3feusVQ=,tag:XThNyxa37uo/PhwLWZwS7g==,type:bool]
- intervalMs: ENC[AES256_GCM,data:aNrYhg==,iv:Kg3ZfLyE8d8yUTdYkDNKIKrfkxtdazwp8vClGRihz3s=,tag:C7nsNVc+jl828hf6fXnykg==,type:int]
- legendFormat: ENC[AES256_GCM,data:sHGrLsV6,iv:ZWRzVb5+1SBxo8ruVtu6CkFtScbxS8wTpR/MKq0i8bE=,tag:k+/q/BDx/gMXEM8GzDqz0w==,type:str]
- maxDataPoints: ENC[AES256_GCM,data:0xRT2Cs=,iv:lJ3ytqIikkBgBhe9DTLdTFTh/LBHjxBsLmbe3pZCvsM=,tag:ryn1JIJ5pUpnVJLP1UhwCA==,type:int]
- range: ENC[AES256_GCM,data:rJ/mOZI=,iv:dZMHMKbObSuW9KDLKdWQTfMhrN4+be03AhDPkokRbkE=,tag:Bmf3yXCJzZmw3UZA9f0T4Q==,type:bool]
- refId: ENC[AES256_GCM,data:Rw==,iv:oe4AgAWyq7js3IcP/35pgKfOR1IPvv5q8iYj5IQDBMA=,tag:WZryL3iP5b1gkHiEChddlw==,type:str]
- - refId: ENC[AES256_GCM,data:cA==,iv:hde51F1IfzxtG0rr8nHgNWw50aShZoJi1Ui07Lub9KI=,tag:Oh/oNMLp7xgKlrHFxmJo4A==,type:str]
- datasourceUid: ENC[AES256_GCM,data:IpNtpywt2jw=,iv:beoaCef/3mR3Bi/qZNJRrJjA1xe36s2lvigQg/pks9U=,tag:H6x+4i1qGWmvwRxyhZXB8w==,type:str]
- model:
- conditions:
- - evaluator:
- params:
- - ENC[AES256_GCM,data:cQ==,iv:2JzRVzgp5c65uOpcxw6QSGb0pO5NQAi0g4nxa8f4iAw=,tag:9jhkO9UaIXRhuSuUI3MWTQ==,type:int]
- - ENC[AES256_GCM,data:Uw==,iv:c8wt1TkTRFkR8l4+jnAt6Srxh68cFDuHdJjjdPlvb+0=,tag:l9nxu3VCegzUspZg79w39g==,type:int]
- type: ENC[AES256_GCM,data:kFQ=,iv:Dvyjkdc7nhID4cL4xh4F7a2pgozq4qo/EfFsITDCYcI=,tag:sryWd/aQj28KiMh3KWBdbg==,type:str]
- operator:
- type: ENC[AES256_GCM,data:BvuW,iv:DgrFlbICKgOElkDcc0t6kVVNpgUnl1u4K9Wz1ZKeanE=,tag:BbD4PCnVIjW9PyKLOQjSjQ==,type:str]
- query:
- params: []
- reducer:
- params: []
- type: ENC[AES256_GCM,data:MuK/,iv:w7PRSjkD3Fk9xodZqxVwQdomKcUqS2HTF/fpq3+t9mI=,tag:pumP+b/NCgl65QCVp7swhw==,type:str]
- type: ENC[AES256_GCM,data:5lV4JQc=,iv:nM53zY/clddRBtp7nYYko31DbE9wZLWuXmGaffuYUsc=,tag:k2Yh/9RALREwHoNAdO9p/Q==,type:str]
- datasource:
- name: ENC[AES256_GCM,data:/B9atxd+GGW9tQ==,iv:Z8YIx4Q1/AG1fiDWqsQogu2tQMCOa5I3MjmDBl8+Hq4=,tag:1fbxy0srCvwPrUHIRvpqrg==,type:str]
- type: ENC[AES256_GCM,data:SCCjnbo39/g=,iv:81ZM6zJ6nE+Y7EPnGdErLlEZMkp/dAanASG5OhmZHtA=,tag:hEPl2yGVzhOJlVq93V6q+g==,type:str]
- uid: ENC[AES256_GCM,data:IUynWgnUWFo=,iv:Vt8h0yL4vGgyZ6Nz/2h5m4/kgNpnFcV6uhuESglvSFU=,tag:47vkscNvw+dvS3J/OZ6kZA==,type:str]
- expression: ENC[AES256_GCM,data:8A==,iv:wWDYs6o8KTHHbPPgpGq3Jds8j/L76tyN61M0jJgD2zk=,tag:X5fqZ2k1CVGOywqLIKreXQ==,type:str]
- intervalMs: ENC[AES256_GCM,data:BgNxXQ==,iv:PN9UmgRMUAMK/P7ekg3MhqVzsDI0XEC9ys+0YCgabM8=,tag:C4FYKf0YffNCDP7LPRbKaQ==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:B0zWCRY=,iv:NNvA+Y6OmeO3XRo51g2WIIum6kaZvEfmMiilbwbX5Lk=,tag:wmDtXb7fWO1L7yVVpRrBHg==,type:int]
- reducer: ENC[AES256_GCM,data:XE5HTw==,iv:2SHYuQrFYz/ZXHTL5faCvspfsR3JMXYnpsvDrKCRC9I=,tag:UgoJbhh2HSizwPZyywGSCQ==,type:str]
- refId: ENC[AES256_GCM,data:fw==,iv:301rKGw8WIG4qwDSGa4yn8xVLRHg73J0LMHbH2yujGQ=,tag:3PrTVYYhu73/ZgL1lLpG/A==,type:str]
- type: ENC[AES256_GCM,data:7uKgjiwL,iv:x5G4m73KY20JXHSI8l524dnVIDPZLATOkvPN0pEXpEA=,tag:2sGhjxXS6B7UsazvuxrruA==,type:str]
- noDataState: OK
- execErrState: Error
- for: 20m
- annotations:
- runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumefillingup
- summary: |-
- {{`The PersistentVolume claimed by {{ $labels.persistentvolumeclaim }}
- in Namespace {{ $labels.namespace }}
- {{ with $labels.cluster - }}
- on Cluster {{ . }}
- {{ - end }}
- is only {{ $value | humanizePercentage }}
- free.`}}
- labels: {}
- isPaused: false
- notification_settings:
- receiver: PagerDuty Warning
- - uid: cdz3yt59a0miob
- title: KubePersistentVolumeErrors
- condition: B
- data:
- - refId: ENC[AES256_GCM,data:kg==,iv:u9cu+V/2FNOnSOzLv0i6d704gN1dR1+kVklnlfTK+cE=,tag:QwexyP4WgrZpRaTEMWT8Xw==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:l8WL,iv:UMoJ6jZl0NSkKCcij6axP8b66KbNtZYSagx9m57egTo=,tag:DEfDp1Pa73b5Ohms5Y6B7w==,type:int]
- to: ENC[AES256_GCM,data:2w==,iv:ZFTml27RryXA+EmlLv38H2LCQX8oXOHzSck/gx6d/6g=,tag:mqn6GobTW8cleMazO3Y+Ew==,type:int]
- datasourceUid: ENC[AES256_GCM,data:y3vlgdYuEret2g==,iv:RzGrmjCLFi804bk6mv/PxfMGEDHfNUggEn3IWRAniHc=,tag:BL+yk518hYISR8OrhjBkaQ==,type:str]
- model:
- editorMode: ENC[AES256_GCM,data:4ffRxg==,iv:eeDscspxTkLFCHfkkfkKqJtOe7eO/+VxuUT/mb6VreA=,tag:JmcMOJXM5Fa0UK04NvmEdA==,type:str]
- expr: ENC[AES256_GCM,data:8QX1mYvlFsXrZZiMUZhnp1SoU2UmgRyngu4VV3dKaavVEnLKcgaceqa2L4kqzWNjQf7pYOEEQU8aNwWFQVZ/RI1m/gleD+HRKOrh5C43LsoFDXsHN5SDP1TI,iv:EI+ythA4QhLcvhPPEqPCZbPQ49Fehm7NDF8XohYgq6A=,tag:/8JRLc1Um7sSAymrUK+oCw==,type:str]
- instant: ENC[AES256_GCM,data:KzdXww==,iv:eAV0MIR8eo+H+s3SITpEsSkzy1KjErp5AYik5vOsaUE=,tag:cxuRoqWPLqpSIOWdN1vk2w==,type:bool]
- intervalMs: ENC[AES256_GCM,data:P9RwdQ==,iv:+zssBiaMTs2n5hpief1yF40/qOZj4ang9RP3aoLdUrs=,tag:vgn+k9EPqZv1Y/gDR5tb+g==,type:int]
- legendFormat: ENC[AES256_GCM,data:uhZA3JoS,iv:MDUQOODVwuE9stTyGLd4r9o7WT47VNENAlQDuiYydbg=,tag:UGxinMY7CU1/bDvt50g5xA==,type:str]
- maxDataPoints: ENC[AES256_GCM,data:9QzlycY=,iv:DtFaYMBzdljIcP40Tu2k//YMYXeqdPuR/l51oFt1YX0=,tag:mV7oXH3Y+jCGUppefQM9Gw==,type:int]
- range: ENC[AES256_GCM,data:ACKlO3A=,iv:numHoxp5mznjxFh20E0K9tTg9e/LLpXJ+gV/P4F1DWw=,tag:6G20rD882rVMuwR+qQDJFA==,type:bool]
- refId: ENC[AES256_GCM,data:Tw==,iv:VqJlgcey1Cf434f48CZMCsgaS3whOn00O+hMbqlHuvY=,tag:/WYxXPTN1oauYJjWgRkivw==,type:str]
- - refId: ENC[AES256_GCM,data:oA==,iv:zM2fgPAUWK/V3RE96+3BF+cNI6i5voM/1w8AX8IzhYM=,tag:jdY1Dw3v/zKk0YS2iVGHxA==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:Rf/k,iv:Mkp2H0SeB6GK7G6L0XLG78B0gI0hMy8erf/Md2GUSsQ=,tag:Sr2Yi3aktmMd0hKnIP5NoQ==,type:int]
- to: ENC[AES256_GCM,data:7g==,iv:foamWpMtreWRFbTyj/rHPuUZXJCpPLeYN6QFTiZb9OY=,tag:n7fexQbjwBPGsgUxEMKfng==,type:int]
- datasourceUid: ENC[AES256_GCM,data:EXGCblX+1CM=,iv:63/9m9qBc+Q9kCEBLDiwdCq3XfHjQxePRM6Y49YhNUE=,tag:wH+x1STbfZQchFTZiJpD4A==,type:str]
- model:
- conditions:
- - evaluator:
- params: []
- type: ENC[AES256_GCM,data:/14=,iv:olM7hkc2+hTJ2+M127l5K2q8Wq4TtAgl8rv6oRtGCYY=,tag:DVlaqJyeiJZOp7AHPs1VsA==,type:str]
- operator:
- type: ENC[AES256_GCM,data:9vu/,iv:4tgg+tK6EFUhuNQCJn+EWLfLfZ9jHEz/mZ2cUaLZcwk=,tag:t94wICgmEcKcI8mVjCqCPQ==,type:str]
- query:
- params:
- - ENC[AES256_GCM,data:xA==,iv:bgWhSTNqHMbmGW5E4ZfioWd2Q8BaSdWuRtg4dNiVPds=,tag:PzcbiwJRw1sIeJNYxxnAdA==,type:str]
- reducer:
- params: []
- type: ENC[AES256_GCM,data:/cO66A==,iv:keLqEybSynnZMMA4BwhtJT76GZJ4YoCTKYShcrFRx88=,tag:neU+V2M9qbj/86Hqy6QaUQ==,type:str]
- type: ENC[AES256_GCM,data:eyCnzWE=,iv:uYjmspV2rlGJaTSbUn+bhcSzwIlaxzLwTnoqlRAzZJc=,tag:8YIzwLSzijZanMOfjx7YMw==,type:str]
- datasource:
- type: ENC[AES256_GCM,data:lzvwrH5H69U=,iv:CzV9NRFYn5gO9WFE8MDauivoyyVFdbBFXNGLXfIJyxM=,tag:rGlpjLR67xhsOE0XAhT/yg==,type:str]
- uid: ENC[AES256_GCM,data:52j/8DTHNkE=,iv:ljxDVw6agT3b4fZBR1rQkwVmBAAAaGfj8CQugx0yksE=,tag:EJgqwCMgsbuMEcR9DWPJog==,type:str]
- expression: ENC[AES256_GCM,data:Tg==,iv:VKamXk9Tx4vGJg/KsXb8golPJ2U92yu8207A6Wk4EKk=,tag:zgsZcgzR2qpbnT79jjEdOg==,type:str]
- intervalMs: ENC[AES256_GCM,data:d0XdsQ==,iv:Cr/q+PRRF9QQKMIgWzKAI/v73J2yuXdLEn8EYhg4I7A=,tag:Q3IBHleAuYcln9UhKDY0EQ==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:R2yVlPA=,iv:d3qcTvKXmu88jth9aldMNimvfe/Z0ITn+mJq2Pdklfg=,tag:mDBgNX4Vqx0/vfznophwLA==,type:int]
- reducer: ENC[AES256_GCM,data:xmCJsQ==,iv:56N6aLGenp9dTiK2c2OWXhz3dejbIaFUuqIDBMIolQI=,tag:qp95Yw03Vp8l/mRjLhC3xA==,type:str]
- refId: ENC[AES256_GCM,data:iw==,iv:ArWnCI1mmiy+fqHo96drlBx6zYlMgARB7MD5ucI4vIw=,tag:ejY5zYfhXILP+8cOTYI9CA==,type:str]
- type: ENC[AES256_GCM,data:LHg2LCfl,iv:Qj4zzGgje9Yk5E3iggJsUZ6i99touiFaUesX7aB8TzU=,tag:C7OYYqP2FsKi0nmBKQQCHQ==,type:str]
- noDataState: OK
- execErrState: Error
- for: 20m
- annotations:
- runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeerrors
- summary: |-
- {{`The persistent volume {{ $labels.persistentvolume }}
- {{ with $labels.cluster - }}
- on Cluster {{ . }}
- {{ - end }}
- has status {{ $labels.phase }}`}}
- .
- isPaused: false
- - uid: cdz3ywkoiwgzka
- title: KubePersistentVolumeInodesFillingUp
- condition: B
- data:
- - refId: ENC[AES256_GCM,data:EQ==,iv:uil4Gx9v13whHs+hfG1o3NnA1vRNCLRDLZDoFJC11OY=,tag:jsR4BHVAm1tPCEUgXEAzVw==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:/0sK,iv:9XRPQcvCEPRU3cOF7Ram6fn2KpCSR9GAGc7TSOawiQo=,tag:qZS02kntypfAVx8931CVcQ==,type:int]
- to: ENC[AES256_GCM,data:yA==,iv:OTgxBtFUG8JtlGv3DdN5tXrD6t2AJkVCdiH1sR4ITzo=,tag:Zc/ZpLfhcnEC8OLw2de+7Q==,type:int]
- datasourceUid: ENC[AES256_GCM,data:7Dq8cjEek8tGdA==,iv:ClEpTtKS3uznKKRHq61ldoMDrrf/0elPbf6jZTiMWcA=,tag:hQM7VhyAWPDRTtXaseoAdA==,type:str]
- model:
- editorMode: ENC[AES256_GCM,data:PKOwlA==,iv:E7tivIJLSBoh2mqcbEAKXD7KHubwNqjITxkjIRYv6GA=,tag:tRoLLMvdd9ABgHIk+WPziw==,type:str]
- expr: ENC[AES256_GCM,data:oGYHVrQ5u3TFeacHgH6Rb97nKhcCCBHgokdZtiFy+8uIDDIhuocAGYZttLnVeGTYuene6sWNU1QEvARqt/CF8CDYK73hRy0+spnvNYEPiwLi641lqCxx8wozwlByGSGf7cTQa7qOrqDpefkMroJICzTGTdy1EHnm3zZMhitPMrzvtrvScxcZisaeljD3dw18HoLwkyn7SVINi1pLL9uWXQO++H6P0MyoL0WDMdbH8WeROTkqunYREox/hKiVaa2sOt3+v2lJJbG05C9TpeiDb4a9+vVoi3q5sqK7UX3fRp02BY8+fkbV9GwxUDirDtvkNbytCgAURgPu40JAtKhPBV9KyvBHSuPgrOQ/XBW4BReWqTe/i3LxOGzgPIB/i54DSYCNsJYIr9L5qIAS94li7UmUh3oWpJB7LpwBSlq2ZXhpZFziv61yr9YHjRwaUIBreY5bfQVH5GtT4xrdTD//NNxGDZxFGvguQEcP7/kTi/hiKx3dmYA/PFLeAEVH1jzClsYfwtTTTZnoUYiy50gQcn8XogJbcI5xnMvHd/C+O7nPlpwD7QmEKYDxGlehIQVZ2CyVd6iKKtNhbmG4F5ZGztlLGJOYzySQYpBMJnxYJ2/vdPDHfnJeCArzva2oSKjA7FLcoD67VKUH6S2U7aur2bLerfQbf7B6H6BFXnQA0qJiQeXRnBPeWOl5ujkYqgdCMl8aRFF5lwh5u3sqkWe/loiudSWD5a3yA4bzq7U3Fhg462jF87Y3pthNwIAYk0P5SfvCeKLxCnyLZE97CKsPSWKVHjAltHwL3Yrbep5FJJLMIt8pi/WmHjf0Xj9ACFO6oV6JAXbzExn+/bL6w5ZAnodXY4XhYluwzZl/pxuxwHUw1NKM0j8+HH/p0p3pAKK8UMIRcrWgkQ==,iv:VOqr3MALLMk+85VJV+T82G7O78btMSkwAnn3hXISUYg=,tag:fq6p5U+S2SdZAwjGng54EA==,type:str]
- instant: ENC[AES256_GCM,data:cOmsmw==,iv:08wwJpQ8B0f57DPqXwTermbiOCfcRxVkzII/n3vz9Rk=,tag:j9VGX5qyUz0hVL7StHbsqQ==,type:bool]
- intervalMs: ENC[AES256_GCM,data:0OtTQA==,iv:8Id6RPl6ROX0zt2q40r6wTKn9np2gm2aVtgtCIj2mpE=,tag:6aIi3RZJ2hiZhLg5VzJCBw==,type:int]
- legendFormat: ENC[AES256_GCM,data:exfm8Ue1,iv:H457H2oKSfHjPOyzBZDJU7XbeLU1a8VOxmv6yZSbOF8=,tag:QWIczO78IKqKNeCYfehbbQ==,type:str]
- maxDataPoints: ENC[AES256_GCM,data:mCEmlnA=,iv:8Eyt3AZER+6Fn99d4hn5Kafsd9nS10sOoXr3Z3xUcdI=,tag:muy4hLnSNZ/YjLR9SS7dmg==,type:int]
- range: ENC[AES256_GCM,data:4n211Q8=,iv:q+0VmabQYpmrQcJwsH+jWYnLoymsoblSXVH8jBuYJNY=,tag:GfJ0Ofje6emZxCjeGocxFQ==,type:bool]
- refId: ENC[AES256_GCM,data:VA==,iv:c1WRaKz8Il1EzBJWbEEaDUba44NA7hkCJjy4EsWVDEs=,tag:KJMi5wBkG4sPHcG0/oBLig==,type:str]
- - refId: ENC[AES256_GCM,data:Tw==,iv:H1PIpTnCsvm5by3rCgfLfMENT+D6Yz7hz9PAThDPQmQ=,tag:nkArkgF2Z79+qPPARIo78Q==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:BChb,iv:RLTVHkUoDw/5FMBbc4170BlJIp+H/2TxUdbUdV3KiX8=,tag:yExrAY0WK8aDVaKWkuf6dg==,type:int]
- to: ENC[AES256_GCM,data:dA==,iv:rD37ixcIZ6B7SE0/I3xtzwsiGiJIGq0nRhEPX3Ua1pk=,tag:m5to9/S3PKiguA9nCbh4CA==,type:int]
- datasourceUid: ENC[AES256_GCM,data:fh1ZymIDgqg=,iv:9qU9DW7/lspxb5dZuDH+L/34VxsTTs2rh6pLWQmb0D4=,tag:qAbakhHuVYTL8cNEku910A==,type:str]
- model:
- conditions:
- - evaluator:
- params: []
- type: ENC[AES256_GCM,data:aj8=,iv:lBcEvKIHV2SJBd4Sj95mWC5cXOaCdc6lFLszMAKDQ80=,tag:ZcF2srg1+fJSJ1HROqewdQ==,type:str]
- operator:
- type: ENC[AES256_GCM,data:HnuN,iv:9AqFsa2uKhlk5T0Y/CxuL/ppleFpUadRVCR8H7PLEjs=,tag:Q6dYWL2SpJHo8MW0EqxUTQ==,type:str]
- query:
- params:
- - ENC[AES256_GCM,data:sg==,iv:1QRq+1u+8Bv/dQd3gtnTNzQSQa4/WiauEp7E3SDs9EE=,tag:XZ0DzbfY2LRASqmLdPyQVw==,type:str]
- reducer:
- params: []
- type: ENC[AES256_GCM,data:Xrdjsg==,iv:mZJLZ2/nI7hDpeZGcr0AVh1P/ay7hudiEoHo+zo3yZA=,tag:kZogJE/4KVydfL3RHD/n6w==,type:str]
- type: ENC[AES256_GCM,data:inMFX+A=,iv:OGfr20yNSf6RJdJJ92zWCuqu6BwcAPiAgfFKL9ajwtY=,tag:jhzjvwyw7V61KfnCbQlcsw==,type:str]
- datasource:
- type: ENC[AES256_GCM,data:8uOLUNjS8No=,iv:ILb5VDlSy1W5bOWWTh/1cvLqz/kP45S+ccpOLeiPQ20=,tag:hHGTMBCRzvlCU1xfxmLw5w==,type:str]
- uid: ENC[AES256_GCM,data:ZGMDRaxNpcg=,iv:TLEilnSFu2DKvvvo/n9tare0K59341/grzvzc3VPlqE=,tag:FXudHiw6+RS9fGwRXGeR2g==,type:str]
- expression: ENC[AES256_GCM,data:LA==,iv:QEBvr/y3jz7Gkj23elQwzctEnMfJQrDW8Aq1gZHxSPQ=,tag:cNBw0FdoYUzuf2Jh5/WNBQ==,type:str]
- intervalMs: ENC[AES256_GCM,data:GOWo1w==,iv:t4PvmZe6Ecja3Q+cX44frrqh2BI2My1wKpJZ5q38/Lk=,tag:QE6PLwnTSGTd2LrM1p/Gjg==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:nena1xk=,iv:gHW+Pj0tRNcDZBGSRubP/wsVDFE5x4ITVdaun+ju7hg=,tag:Akd8QntLKIeX4kBKwxj5cQ==,type:int]
- reducer: ENC[AES256_GCM,data:E3pzkQ==,iv:javPdD0TG/mllRY6PWxPpuHq324IphU0yb8EYgpvp9Q=,tag:KQBnxDY0CINmG6Tgp1aakw==,type:str]
- refId: ENC[AES256_GCM,data:sQ==,iv:TD21gW/fW/psL8rqQxo/osUikjmVNN6wb+6aCkNEW0g=,tag:5VlIsVtvcknrZKgMRHV8Mg==,type:str]
- type: ENC[AES256_GCM,data:FeqfKTi+,iv:spDxQOCvd2VNX/b8QPZ4MNxwaHfAsWfPV2idW5bTLUM=,tag:Yzn5rMhC2kCG1pgh6VjYGQ==,type:str]
- noDataState: OK
- execErrState: Error
- for: 20m
- annotations:
- runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeinodesfillingup
- summary: |-
- {{`Based on recent sampling, the PersistentVolume claimed by {{ $labels.persistentvolumeclaim }}
- in Namespace {{ $labels.namespace }}
- {{ with $labels.cluster - }}
- on Cluster {{ . }}
- {{ - end }}
- is expected to run out of inodes within four days. Currently {{ $value | humanizePercentage }}
- of its inodes are free.`}}
- isPaused: false
- notification_settings:
- receiver: PagerDuty Warning
- - orgId: 1
- name: Kube-system
- folder: Cluster
- interval: 1m
- rules:
- - uid: d2b94d3a-2483-4be4-bf2a-2fd9f9fac406
- title: Coredns Failure
- condition: Thresh
- isPaused: false
- data:
- - refId: ENC[AES256_GCM,data:RS8gIco=,iv:KG+3N2D/4opzPQbYxifBVLnwahiA6TtDCMSXfz54Vyg=,tag:ovyWx9N3IKN4wFN7oPeKWA==,type:str]
- queryType: ENC[AES256_GCM,data:Py+LDCw=,iv:0BwBU+t4a87ysbVcsvBAKflC7JG+JWz/9/Uzy/nAfRw=,tag:S5Cp32UAzPwF0Jvfbc0gwQ==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:8/Wx,iv:5mJ3JDX68c5scSLkyBgPBSpWYlvj4gzO1tVcA5EnEWM=,tag:7yT2+wwnloboe59CA6fiDw==,type:int]
- to: ENC[AES256_GCM,data:OQ==,iv:KwtlCNY96bH/JGg8EayJYtYdubVSncBfo5ZJMSgWJPE=,tag:JAPwax19udWckYC0QJw6QQ==,type:int]
- datasourceUid: ENC[AES256_GCM,data:RyjyRQ==,iv:tv6GX1npp1WUwYgxhyOttN8POMy0M6cZInPg6U8w4DU=,tag:IDTj3ue0fBaWlvGhMf3lpQ==,type:str]
- model:
- datasource:
- type: ENC[AES256_GCM,data:OKVoHg==,iv:vkNUV/pdATtiXVZoC9IAdQ2QMvmuXGcQwfO1FIavsSA=,tag:t/VIZnGbnurzi7e01uF7+A==,type:str]
- uid: ENC[AES256_GCM,data:EuDhuQ==,iv:IO6wW1SGZyYf+1uZOVh3dfoe+qpTR38KqDn/oFgC2D0=,tag:9hqC92rE0Z75LuuXWrZ0dg==,type:str]
- editorMode: ENC[AES256_GCM,data:uLLOcvmvaA==,iv:Le8wQQqWs536N9Q0LWY8qeHlNtyVU7FMgXL2vU7O8pU=,tag:TGAXrortTFIwuxD/X7bYbg==,type:str]
- expr: ENC[AES256_GCM,data:ID1tSoSqphc3Pq/qRh6K5DP2PtXfE8viz6zKglH1Ic/mFm5tbx/AXrzOykl8Ct74lQJZXiqbYXJegUFWZpDI2KEMk19F,iv:xVOPkpC03hxOKD44tBVguiRS1fBPjBFe4KAHbt+ojvY=,tag:Zx9ZpIwFTQWMoYy0ih0EJQ==,type:str]
- hide: ENC[AES256_GCM,data:kIpTwz8=,iv:tu1y5gaQ+RK4oMbOODJczBx/bId/BgndlNdoFZekxTM=,tag:oYMmU/qtpOpr9hTvHGcouQ==,type:bool]
- intervalMs: ENC[AES256_GCM,data:yy1Ccw==,iv:RrU65RAoooZA7gmg9aVIVvjShSc1X0Ud0s83VBdAylo=,tag:8xoIokapKe2ltOUwOCSreQ==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:5g6Jlkw=,iv:ImPxtKwkvzfJurIkhY/lPRDdPx+yIHjwgoEDOupqFKo=,tag:H/mGxegx+IM5hMBjTCC4SA==,type:int]
- queryType: ENC[AES256_GCM,data:IrUEi6o=,iv:56cxT9V7oQfYEYZ6K2TEKonAhWZ8JTXOJyOu+iypHJA=,tag:HjVnuE3QeZQzacPJSjYK4w==,type:str]
- range: ENC[AES256_GCM,data:aB61og==,iv:i9+Iz3fWk6SNPZjOKEYvFAoUh+5Jo3o4mD/jeROBrOM=,tag:H9Z6V7KBZTSnY/+R2/0Vkw==,type:bool]
- refId: ENC[AES256_GCM,data:58hhHH0=,iv:yc45MJ3fBbii7+oT8aRrAytZ7a7SrL1e1e5Q0dDLeBQ=,tag:/ISGCvVKe4hykq09eIa2uw==,type:str]
- - refId: ENC[AES256_GCM,data:2nqS1LQB,iv:Nq1bqHw+d0YjOmo62T1Z5Rgq1wzaw4SUZbRo0D/jbM8=,tag:dYaB+1fySXvpF/0zDdmIqw==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:7PqE,iv:K664fpIcoTZx5pH27+EYMAbJW6I7ts2v7uci8Cz+sU4=,tag:Cwht5e+kdUzdYSlSn2N7gg==,type:int]
- to: ENC[AES256_GCM,data:HQ==,iv:v+zBF+xU4xOdzQ23y5TGGP3d6EiD3w/Sd2j0DODeiSk=,tag:awNSBodnsnZsJgUuw1T5tA==,type:int]
- datasourceUid: ENC[AES256_GCM,data:H90uZtBnP50=,iv:cpqDHg9p8ssQIpUQkAb5ZjUXFwcdtPDzI5kZEAZ5szE=,tag:ecQtRmzf7VU38xEYZhmDiw==,type:str]
- model:
- conditions:
- - evaluator:
- params:
- - ENC[AES256_GCM,data:gg==,iv:J5MLA+EWy9r8S+Fnr8G62EvlRCulR9YeOMocLha5JWA=,tag:MCpViCvrvxMAFH6vXemZFw==,type:int]
- type: ENC[AES256_GCM,data:+is=,iv:pfU9ygml9JuS361hFhnGjyjroRwOV94omuoMFooEqw4=,tag:JtuUj0fHivr7qi5payh8qw==,type:str]
- operator:
- type: ENC[AES256_GCM,data:z8IX,iv:GMaYzU4m+0ABT7G3vgkU98EF/XwEM5x1c7fJZknldaQ=,tag:GIxrJCeuLfMGvcmh/+hsIw==,type:str]
- query:
- params:
- - ENC[AES256_GCM,data:Bg==,iv:9ZCz45zf5kjPj/iEDP9UFZiABWdPJw/d2uaXGBNBh+A=,tag:KJmSMGn19S1ME728E/OZBg==,type:str]
- reducer:
- params: []
- type: ENC[AES256_GCM,data:XbMUCg==,iv:abWC/9VMtAQqWXsn3eBdAtxkcR7357UMKXwyaVWuc3M=,tag:EQBQv2+mMr29tEknal3HkA==,type:str]
- type: ENC[AES256_GCM,data:QmuNOUU=,iv:YqbWlLTuKQOnh8lfCzJbMQOsyUH9hZ+cmwPPEUBE7sU=,tag:FW9oXUCKn7ac2CX13RI2SA==,type:str]
- datasource:
- type: ENC[AES256_GCM,data:SLvP/3eoqDs=,iv:8tqpyCr9nk6ydaPn2fayRqEACfpDnhx8sPqQLEZVAmE=,tag:RNcxWK79Rho5Ayv6TLT7ww==,type:str]
- uid: ENC[AES256_GCM,data:6pHPFSB6K+4=,iv:gFOD/64sMM2e+RunUIBIwSvgUE4EfOrAAMFPD861fJE=,tag:ZWecfz1wSLga+H+Erdxrag==,type:str]
- expression: ENC[AES256_GCM,data:yg==,iv:WTjTbtCE52PJu5zwHwIZgr/odMMjAAApt6OzREXsjG4=,tag:mxHD4dznqU30HGWrz2mxbA==,type:str]
- hide: ENC[AES256_GCM,data:u3IHmhc=,iv:kjHDBR0VKC96vaffAXu3i/Dwc9vAqbpHq+wHOMKNKWQ=,tag:F46kcaka5xEQAamTZZdzEw==,type:bool]
- intervalMs: ENC[AES256_GCM,data:IhEskw==,iv:nXbTa2eStB730JdIohPsmb1I+535GIbVIWQ+zuTOpCA=,tag:CMhg8SrRYYtx+SkO7I6xiQ==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:M0d8aGM=,iv:086Sghi7CUWuaL6N8or3mTHSFMHKX7If/H79yE10u/c=,tag:mQp5jbKwYXK/UWMVly5B1Q==,type:int]
- refId: ENC[AES256_GCM,data:W013Bpvg,iv:ok/Camd4G76sZBUygentAuGzGzkG7Iuq7LkmkvvF+4M=,tag:LbixU1EeYUOyeTKDbkgKwQ==,type:str]
- type: ENC[AES256_GCM,data:/3xgN7KCC+tO,iv:xTuGCCNKcngqViejMSLzhryBtYjrzxvS3DXlfbxIa9c=,tag:iPOYFWA5CxVxXqdX4aj0gg==,type:str]
- - refId: ENC[AES256_GCM,data:aA==,iv:MW4gaxla+QDXeseTc61uuMSHzfxVeWR+s95VEVm+FcA=,tag:VYiviAv58BC43OxVd+59WA==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:tKDr,iv:n0sQOhVRZ8ukNGeF2uQaHTkmVVdZyOFVvP4VLBf1kOg=,tag:DZT4ijAF9wzpFvOx5FjBeA==,type:int]
- to: ENC[AES256_GCM,data:7Q==,iv:8zLn1wdnCp7bphSU10hgYYmdWMB3F9S09UtFX4Lb7yA=,tag:pDN9dFvnGoLfn6PjKn0Urg==,type:int]
- datasourceUid: ENC[AES256_GCM,data:8AvLW/yUY/I=,iv:3lu5g9strmBhgJ4ivzxziipuPvaZMN3feaReMUnif60=,tag:VFfqfmJzJCx5jzvBkaR1bA==,type:str]
- model:
- conditions:
- - evaluator:
- params:
- - ENC[AES256_GCM,data:6A==,iv:Y0stM8IStHoB9N59yswTMNCuY/hf/tndPMuEOCQKkpg=,tag:55sEU48jF0U5uIAgfApbyA==,type:int]
- - ENC[AES256_GCM,data:Vw==,iv:7ApbT0bsM6CSLf2WFLbd4CnHpp4Df0P+XZyn+326MPg=,tag:xflRJZB3BFlRmowamIGtKw==,type:int]
- type: ENC[AES256_GCM,data:Nbw=,iv:fpPFzayjqhg3+6A087R1KHiv5/MHAFQPGP0RXfudW70=,tag:7YIMcJ3wyN8lfXVNAug9QQ==,type:str]
- operator:
- type: ENC[AES256_GCM,data:4rO1,iv:M1TG73q7qfCxsMZkwHmpIpUO8heOPVnCDZrcEzNaHqk=,tag:9KkoIiITaO2TFVgxXGsB/Q==,type:str]
- query:
- params: []
- reducer:
- params: []
- type: ENC[AES256_GCM,data:5Iku,iv:ASY4W326WfqIuKzIZmKbs3OfRMWOW4i7p3x0fHSgIOo=,tag:w3fldmhoh/G3v7JVonqvBQ==,type:str]
- type: ENC[AES256_GCM,data:oGSGNzY=,iv:VFb4Hu1TfVASB7H95gCE13P9tNSnIBb+i77zQgIaD6g=,tag:B9oy9v59wW4Regs5ulNzIg==,type:str]
- datasource:
- name: ENC[AES256_GCM,data:ymY+aWPQs7RkWA==,iv:7IXh1afIEymva3W2f6Ti1Ycrw51NyV1xV0YFsQRM7Fg=,tag:+rW2ynwJkfjSDhBUXeJKGQ==,type:str]
- type: ENC[AES256_GCM,data:sfzsprEWYs4=,iv:+oD/pxJ+DvZ86cp8fohnYZeAKaBoNqM0jkVqc4z7DCg=,tag:5rgQGXOcZYPuEjJ0noXVwQ==,type:str]
- uid: ENC[AES256_GCM,data:fmy+EwE/8Ns=,iv:RacCGmEhSQc03hKb1iQDZ9gxw7a31FsxkTzw32yLiHE=,tag:zg70SFbAyckIz3ioOxYS3g==,type:str]
- expression: ENC[AES256_GCM,data:BfzH9Do=,iv:Y3Rbt+qFHTIegU0UpH0z7+t1cfqV4TW6PBsqdYD7DFM=,tag:z8nhq5PlqcYTH+KTCcqARg==,type:str]
- intervalMs: ENC[AES256_GCM,data:Otda4Q==,iv:dJoy2Rz+E+fYItCIFdJ1qa8IyHxNkgCgm5P90CoRsWc=,tag:gRrsDf5p7WfRJg8v0yxj1g==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:uIjnC/Q=,iv:xFuC2VPhiuK6gMc/hQ9b+CyUy24iA8a0bQQ/mzxqzuI=,tag:sS1IGaKa0NJ23v4VnsblwQ==,type:int]
- reducer: ENC[AES256_GCM,data:VuLckA==,iv:zij2B/RLif/UqakmkpY+Q2aQ4AwVJY/tP9Qyd7Cc1VI=,tag:iLqecnpD3d+7sYZ4eoG3kA==,type:str]
- refId: ENC[AES256_GCM,data:/w==,iv:ucTvc7mtP//N7XOJSsUfmhx7yTxFNhY8gmfFk8SrVL0=,tag:XmwWKMlwtCCYGpG4AHpZBQ==,type:str]
- settings:
- mode: ENC[AES256_GCM,data:9kRAxoyjK5FF,iv:9huEeDSAGmDvSj1jkPnZHdGTmaaz4Prco6ZPKdpuMWQ=,tag:hJ5Cl3Ajd5bnPrmsRr1IEA==,type:str]
- replaceWithValue: ENC[AES256_GCM,data:UQ==,iv:DUVS6b6dcXSb9INhcABzzn7WcBSnXbWFTRtYuBVuzqo=,tag:/v3gHKgb4naMHl+yRSB41Q==,type:int]
- type: ENC[AES256_GCM,data:s96pGXy0,iv:6uekd6vL4C6uIk6Z0r0JxlKiKIqKcI0yvZdfdOtgMBo=,tag:t2HLl/9VHUaa4j8v3pxWig==,type:str]
- noDataState: OK
- execErrState: Error
- for: 2m
- annotations:
- summary: High amount of i/o timeouts in coredns
- contactpoints.yaml:
- apiVersion: 1
- contactPoints:
- - orgId: 1
- name: MidnightThoughts Ops
- receivers:
- - uid: "1"
- name: MidnightThoughts Ops
- type: email
- sendReminder: true
- frequency: 1m
- settings:
- addresses: ops@nordgedanken.dev;mtrnord@nordgedanken.dev;mtrnord1@gmail.com
- - orgId: 1
- name: PagerDuty
- receivers:
- - uid: adz30e8814wshd
- type: pagerduty
- settings:
- integrationKey: ENC[AES256_GCM,data:YsWApwCDCTBowM8idhrE1wJs14dVUaNVxS+UvYwuMFk=,iv:tD5rofx/jTfitpbX/Aj2s24toGpbIbFNwKBU9rLdmH0=,tag:yu/EIJiYcjgQsK7fSrVnMg==,type:str]
- url: https://events.eu.pagerduty.com/v2/enqueue
- disableResolveMessage: false
- - orgId: 1
- name: PagerDuty Warning
- receivers:
- - uid: pg_warning
- type: pagerduty
- settings:
- integrationKey: ENC[AES256_GCM,data:A092wgxNAeKA+MfwUOqeW+edzfsohZ8RXfWPIhNNs8s=,iv:4vB7qvwKBJbbIVkpweyYTcGMrw4MOvLTV35qFEzn6oI=,tag:SpDtDrGlEjYuG7SlfYpRRg==,type:str]
- severity: warning
- url: https://events.eu.pagerduty.com/v2/enqueue
- disableResolveMessage: false
- - orgId: 1
- name: PagerDuty Draupnir4All
- receivers:
- - uid: 3
- type: pagerduty
- settings:
- integrationKey: ENC[AES256_GCM,data:AQJoSgyRugloVU7DuKnWL0HHLEoxUGk5PSErp/7DU3o=,iv:hzg0dqBttUZh+Fm0ZrTTt9WHG9J+lBl46RGt+ExNQB4=,tag:RF0e8ImNGl9m1YWtBSVrZA==,type:str]
- url: https://events.eu.pagerduty.com/v2/enqueue
- disableResolveMessage: false
- - orgId: 1
- name: PagerDuty Draupnir4All Warning
- receivers:
- - uid: de02at943dxxcf
- type: pagerduty
- settings:
- integrationKey: ENC[AES256_GCM,data:W59evCg5tafzzeySBjJogy2AEMcTDAIGuZKy+Icavt8=,iv:UIX/6rAnBDUNnGJTBuiLtYrrNhRpDb34ralk50aGoBE=,tag:b7kOhBNW9RxqDTPkw5vQBg==,type:str]
- severity: warning
- url: https://events.eu.pagerduty.com/v2/enqueue
- disableResolveMessage: false
- policies.yaml:
- apiVersion: 1
- policies:
- - orgId: 1
- receiver: PagerDuty
- group_by:
- - grafana_folder
- - alertname
- routes:
- - receiver: PagerDuty
- object_matchers:
- - - service_id
- - '!='
- - draupnir4all
- - receiver: PagerDuty Draupnir4All
- object_matchers:
- - - service_id
- - =
- - draupnir4all
- - receiver: MidnightThoughts Ops
- plugins:
- - grafana-piechart-panel
- - grafana-worldmap-panel
- #- https://grafana.com/api/plugins/parseable-parseable-datasource/versions/1.0.2/download;parseable-parseable-datasource
- - isovalent-hubble-datasource
- - isovalent-hubbleprocessancestry-panel
- - chaosmeshorg-datasource
- smtp:
- existingSecret: smtp-auth-secret
- extraSecretMounts:
- - name: auth-generic-oauth-secret-mount
- secretName: auth-generic-oauth-secret
- defaultMode: 288
- mountPath: /etc/secrets/auth_generic_oauth
- readOnly: true
- defaultDashboardsTimezone: Europe/Berlin
- datasources:
- datasources.yaml:
- apiVersion: 1
- datasources:
- - name: Prometheus
- type: prometheus
- uid: prometheus
- url: http://vmselect-vm-victoria-metrics-k8s-stack.monitoring.svc:8481/select/0/prometheus
- access: proxy
- - name: ChaosMesh
- type: chaosmeshorg-datasource
- url: http://chaos-dashboard.chaosmesh.svc.cluster.local:2333
- access: proxy
- isDefault: false
- - name: Hubble
- type: isovalent-hubble-datasource
- uid: hubble
- access: proxy
- url: http://hubble-relay.kube-system.svc.cluster.local:80
- isDefault: false
- jsonData:
- serviceMap:
- datasourceUid: prometheus
- prometheusDatasourceUid: prometheus
- - name: Postgres-d4all
- type: postgres
- uid: postgres-d4all
- access: proxy
- url: pg-cluster-v2-ro.postgres-cluster.svc.cluster.local:5432
- database: draupnir_synapse
- user: grafana-ro
- secureJsonData:
- password: ENC[AES256_GCM,data:DETaVGkwVldSFLJOLzchuebhYXoEFaGY8u8cPzpGzNpDAT85obOn1bX++xkWT+BdO+srSqRoKMiSCPoNKzY05A==,iv:QLB2mSDOkHt82nfXf7oaT5IT3g2dHJGlyktagqbh/Y4=,tag:PE23C0LIOPD9k90UmdGBkQ==,type:str]
- isDefault: false
- jsonData:
- sslmode: disable
- maxIdleConnsAuto: true
- timescaledb: false
- maxOpenConns: 10
- maxIdleConns: 10
- - name: Postgres-connectivity-tester
- type: postgres
- uid: postgres-connectivity-tester
- access: proxy
- url: pg-cluster-v2-ro.postgres-cluster.svc.cluster.local:5432
- database: connectivity-tester
- user: connectivity-tester
- secureJsonData:
- password: ENC[AES256_GCM,data:mpOL7F/bXT8bYpvbC6EvMcqsS3SYEpe5oMnDJ0LnJV6H0FLTUZDKknKUMB0y/gz0CQid7CL6HIfsI/udUZrrjg==,iv:0IPq4L4UMhbKYFL7H4EsVoK4J2ynklFLShKpeAirQ5o=,tag:q2UrF0eKEe4PiI2+GbuzQw==,type:str]
- isDefault: false
- jsonData:
- sslmode: disable
- maxIdleConnsAuto: true
- timescaledb: false
- maxOpenConns: 10
- maxIdleConns: 10
- ingress:
- enabled: false
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-dns
- external-dns.alpha.kubernetes.io/hostname: grafana.midnightthoughts.space
- hosts:
- - grafana.midnightthoughts.space
- tls:
- - secretName: grafana.midnightthoughts.space
- hosts:
- - grafana.midnightthoughts.space
- grafana.ini:
- server:
- root_url: https://grafana.midnightthoughts.space
- smtp:
- enabled: true
- host: smtp.fastmail.com:465
- from_address: ops@nordgedanken.dev
- paths:
- data: ENC[AES256_GCM,data:0OSHaJsO0dHAKdoF7LvFbdY=,iv:OuChsJWBnNv6Yr1oUjYtXfN6x3dqj4suD+8thdplekc=,tag:YPwd+QkhKxwj00ISJ0j4ig==,type:str]
- logs: /var/log/grafana
- plugins: /var/lib/grafana/plugins
- provisioning: /etc/grafana/provisioning
- analytics:
- check_for_updates: true
- log:
- mode: console
- grafana_net:
- url: https://grafana.net
- auth:
- signout_redirect_url: https://auth.midnightthoughts.space/application/o/grafana/end-session/
- oauth_auto_login: true
- auth.generic_oauth:
- name: authentik
- enabled: true
- client_id: ENC[AES256_GCM,data:JM89iGq7Wwp2R/uKXuK9iOHuQ/AD/4uFxWdamoSnTTBtNW+BsY20ngJwsdI/KSuFx/A=,iv:lPQH2O2rtqH1McRh4j8NQgYsylFElmGfp4trdhGCvzo=,tag:+nG/Zh0PIDwDUNmuKGwfKw==,type:str]
- client_secret: ENC[AES256_GCM,data:jjCpvUZX3rMZSgojMNJbpYCcJQ78eZaNC14vXlVFLuL4U+zaP7GWwJNAQjCI3lDt98sp1nNP,iv:+RUFEqfA7Mm7etA99TSwkoYpUIEb6eDYfCEy8Gq8P38=,tag:+bp1D3IJL+mMlKIbrkjGNA==,type:str]
- scopes: openid email profile
- auth_url: https://auth.midnightthoughts.space/application/o/authorize/
- token_url: https://auth.midnightthoughts.space/application/o/token/
- api_url: https://auth.midnightthoughts.space/application/o/userinfo/
- role_attribute_path: contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
- imageRenderer:
- enabled: true
- kubeProxy:
- enabled: false
- postRenderers:
- - kustomize:
- patches:
- - target:
- # Ignore these objects from Flux diff as they are mutated from chart hooks
- kind: (ValidatingWebhookConfiguration|MutatingWebhookConfiguration)
- name: kube-prometheus-stack-admission
- patch: |
- - op: add
- path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
- value: disabled
- - target:
- # Ignore these objects from Flux diff as they are mutated at apply time but not at dry-run time
- kind: PrometheusRule
- patch: |
- - op: add
- path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
- value: disabled
+ interval: 5m
+ chart:
+ spec:
+ version: 0.71.x
+ chart: victoria-metrics-k8s-stack
+ sourceRef:
+ kind: HelmRepository
+ name: vm
+ interval: 60m
+ install:
+ crds: CreateReplace
+ upgrade:
+ crds: CreateReplace
+ # Force recreation due to Helm not properly patching Deployment with e.g. added port,
+ # causing spurious drift detection
+ force: true
+ # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
+ values:
+ vmsingle:
+ enabled: false
+ spec:
+ extraArgs:
+ search.maxSeries: "3000000"
+ search.maxConcurrentRequests: "25"
+ search.maxQueryDuration: 60s
+ search.maxLabelsAPIDuration: 60s
+ storage:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
+ vmcluster:
+ enabled: true
+ spec:
+ retentionPeriod: 30d
+ vminsert:
+ replicaCount: 1
+ resources:
+ limits:
+ cpu: "1"
+ memory: 500Mi
+ affinity:
+ podAntiAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: ENC[AES256_GCM,data:oaiM,iv:1/KF+DpK3Z+sabGww8dbOme4E6sTppvCdhR3nIqshQ8=,tag:PYKYx/WC7j9Zcibi4fjYxA==,type:str]
+ operator: In
+ values:
+ - vminsert
+ topologyKey: kubernetes.io/hostname
+ vmselect:
+ extraArgs:
+ search.maxSeries: "3000000"
+ search.maxConcurrentRequests: "15"
+ search.maxQueryDuration: 60s
+ search.maxLabelsAPIDuration: 60s
+ replicaCount: 1
+ resources:
+ limits:
+ cpu: "1"
+ memory: 500Mi
+ storage:
+ volumeClaimTemplate:
+ spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 2Gi
+ affinity:
+ podAntiAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: ENC[AES256_GCM,data:cfbl,iv:cTBVA2YCWsennTnzt8IrNktvcLIy+8KzRho5dd2UzrY=,tag:3bUXy7h1gNo0W8opqDCp8Q==,type:str]
+ operator: In
+ values:
+ - vmselect
+ topologyKey: kubernetes.io/hostname
+ vmstorage:
+ replicaCount: 1
+ extraArgs:
+ search.maxConcurrentRequests: "25"
+ resources:
+ limits:
+ cpu: "1"
+ memory: 2048Mi
+ affinity:
+ podAntiAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: ENC[AES256_GCM,data:PJqU,iv:nC51jS9O10HQbrGFxjvuU+XCExTlHjumkMr7io+Frm8=,tag:C/KYP/uaudN9tL5fKzwaJA==,type:str]
+ operator: In
+ values:
+ - vmstorage
+ topologyKey: kubernetes.io/hostname
+ storage:
+ volumeClaimTemplate:
+ spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
+ victoria-metrics-operator:
+ operator:
+ disable_prometheus_converter: false
+ grafana:
+ sidecar:
+ dashboards:
+ folderAnnotation: grafana_folder
+ provider:
+ foldersFromFilesStructure: true
+ logLevel: WARN
+ watchServerTimeout: 3600
+ enabled: true
+ adminPassword: ENC[AES256_GCM,data:ioUYJMeIay5i4cibExmAtkU+G2r50+Ew58EwuT7QCEbWskQpQ1jK8qAWFCJUOPu9UswHcbiC1ICwsfGE4Y8Ehg==,iv:WSNPXRsrXRdG9NDu5rimj+1uqHl3iLL3Reh9u9TZPnA=,tag:NEbvo5Fqmn44z8MtpllZgg==,type:str]
+ alerting:
+ rules.yaml:
+ apiVersion: 1
+ groups:
+ - orgId: 1
+ name: Ceph
+ folder: Ceph
+ interval: 5m
+ rules:
+ - uid: fef44llxxufpca
+ title: CephOSDNearFull
+ condition: A
+ data:
+ - refId: ENC[AES256_GCM,data:iw==,iv:6nhewBYb7bZDuPIS1sUErR23NOj+m8xvU079o9iYPzM=,tag:fB8iHC5j15bEcsBJgEA+KQ==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:q9Ks,iv:uA1I8hszRmM0pa0RdvYT4lctm5imQxbByRsyVf2/CNU=,tag:KfUEiidOvWJnE/dds5UxnQ==,type:int]
+ to: ENC[AES256_GCM,data:nw==,iv:JOEwe1nLoVCHi8ZQ7loCc7x78t4Tnjs987MCcYpysO4=,tag:fDM2xpAJ9SElmeYQyKTggA==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:cpX8wkknbnmS7X4+4G7Irgs=,iv:9RsFw7x6ye9vR8opu2CpbRW4ANArJc9fXQXIyAio7KM=,tag:gPQZOIB2/8Q3nD6IwL9wlA==,type:str]
+ model:
+ editorMode: ENC[AES256_GCM,data:JfOBrg==,iv:AefNKUyxYvyELXJ38RfH2urHf2O0gAP7SUKVtIhZdlw=,tag:/9dsOh11CITFB7U0KoKgnw==,type:str]
+ expr: ENC[AES256_GCM,data:KnAilAE/V8BYOlyPepN0NpWuEq3ktrvotXofjuf+3No3X9ngtA3NyK+8TS8=,iv:CFdilsgMVK/ux7lv9s/FyQdofO7YxIOJdNjyGmEc5aA=,tag:y8HbKCkg3/PoIBs4quVy8w==,type:str]
+ instant: ENC[AES256_GCM,data:07GJMA==,iv:U5XMuiZCcznEXOauj+7BdW6hNBer9sVv2yHdBP/SCBc=,tag:1l8E6ksExlm6u+D8W8wtEA==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:W3sFng==,iv:5d7hPT0jUBnheAEpqnzaxBNU3hy9gQHI5IDNQc4UPPk=,tag:K+40yhvXd3SdRbCpkZAXWQ==,type:int]
+ legendFormat: ENC[AES256_GCM,data:S48h6wS0,iv:AEJKP4LhwM+VVRPDN0d95r2vXNljY5Ck1LpfR2Rs3e0=,tag:8nNCBY0D5I7+k8Gu/DsBgQ==,type:str]
+ maxDataPoints: ENC[AES256_GCM,data:kRf/zPA=,iv:9/IWWyl4R/s7V7CnY0XgKJwODnrYuqE8VCg7P2ovJqM=,tag:zrWQxQNObp271xn6DvzX9w==,type:int]
+ range: ENC[AES256_GCM,data:XItEUGs=,iv:2eHWsC2Trs2zWFaSx80qvQ7/ppPIVuWZdLWaGOFWwDk=,tag:MHVVIqeCiKaiA55ShOCqkA==,type:bool]
+ refId: ENC[AES256_GCM,data:uQ==,iv:xbblOx4pYlYdqPEbqBSQlLjvKYP/vbRP+OPPc4pMXTg=,tag:/6iZuHmrINF6v+iVuuOAJA==,type:str]
+ dashboardUid: tbO9LAiZK
+ panelId: 7
+ noDataState: OK
+ execErrState: OK
+ for: 5m
+ annotations:
+ __dashboardUid__: tbO9LAiZK
+ __panelId__: "7"
+ description: One or more OSDs have reached the NEARFULL threshold. Use 'ceph health detail' and 'ceph osd df' to identify the problem. To resolve, add capacity to the affected OSD's
+ failure domain, restore down/out OSDs, or delete unwanted data.
+ runbook_url: https://docs.ceph.com/en/latest/rados/operations/health-checks#osd-nearfull
+ summary: OSD(s) running low on free space (NEARFULL)
+ isPaused: false
+ notification_settings:
+ receiver: PagerDuty
+ - orgId: 1
+ name: CertManager
+ folder: Cluster
+ interval: 5m
+ rules:
+ - uid: ddz3zj028wb28b
+ title: CertManagerHittingRateLimits
+ condition: B
+ data:
+ - refId: ENC[AES256_GCM,data:Hg==,iv:4kSVstGwwjgBpzF03l1nxxbCph9QuAtaaCv18+amw6M=,tag:gkQ1TGeI4tX3wlpaZMfqBg==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:6SsE,iv:E+cs42ZRfWc3eR5SXBp9mCevKxJtVFHFElazzo5wKJk=,tag:JbSyN+G/HjAg1UxNXn1MRw==,type:int]
+ to: ENC[AES256_GCM,data:iw==,iv:81g8zArzlmo74ZzrLx1HTLPevYrbz2d4em1NA4qlkvk=,tag:MfBzRiBRWVEp9EVuAEuTyA==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:k81x9frxCmFpdQ==,iv:AuVcxgxNkPE47pArw4sgTKLBwm54SMkJVggANYAODow=,tag:a2FWnC2j48dr1b6c25JSxA==,type:str]
+ model:
+ editorMode: ENC[AES256_GCM,data:XUt8aA==,iv:iijgCX51Y3jkEi8zEDQPaZVd4xxhHY+qOYr5jBD+BQs=,tag:HetKRu6UAeysm19U6BvPeg==,type:str]
+ expr: ENC[AES256_GCM,data:DutNOqaVDUnKYw4gQUb8qS8yaczhyL32AtdkeRVtDaSir8TAAkGx+vLjRoZaRVJh+jhDgVJnU7dzgqfExPfrFrmYUTB4QrTjeDaTJe9NFEsiY48pJE2SCfDhzZ9I1FL1mKEm2UEyXltL7fS2MGpSk9s4,iv:6miN/HJtkWZNyzPJLTMZllCCp/qpF85zxFHNwDKwDBk=,tag:34XAzyBXp1TwCicsA95A0A==,type:str]
+ instant: ENC[AES256_GCM,data:UEq79g==,iv:Vgu4VE2/6l2UlR6fsOfFpvzSo3TcwV9svmaieiGbruI=,tag:AoBVwe0uFyAfn2iOnb+r2w==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:6PP06Q==,iv:chBco7kF5zbp5Apzvq48bJMt6K7brGcA+GY3bFAxl1Y=,tag:RQAz8OwTX3nUcJUibyaCJQ==,type:int]
+ legendFormat: ENC[AES256_GCM,data:s6/XQnFT,iv:IHheK61vucMV1mv/Hde5xgwHeccYrzHIcxF0dBrHErk=,tag:b5N8hLeyHHpY06xPQw5UIQ==,type:str]
+ maxDataPoints: ENC[AES256_GCM,data:Pq1iGy8=,iv:ojwazGqa9gqGt6gPnzcWPeNnwwO2sFGtgdVii9StY70=,tag:656IEmF1cjnEYddzOrOnYA==,type:int]
+ range: ENC[AES256_GCM,data:HkNe8IM=,iv:1DVoDlwouhZM+1m6kSUwBGgxgB3iV9Pi0pddEe8mPbw=,tag:YxNdSHsyN5KL7lKzRcWPag==,type:bool]
+ refId: ENC[AES256_GCM,data:dw==,iv:3kBazTOK+UJjLuy51lfkZmyqnEnsRDR4pYxXCOWluJw=,tag:lHqqPlYa8n9IXOwok/4swA==,type:str]
+ - refId: ENC[AES256_GCM,data:Og==,iv:P1A6C840z3ntyo8ecU/TWuQF5XI364eO5s1EMIlO+HE=,tag:MItjkxsLgucDlmItcxHK7g==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:gKen,iv:nhQ2/e72N5wcxcIehDEszanAmBEPpB+tU9N1z/WT9tQ=,tag:sDuZP+7sFwhKGQ2pnrJkYw==,type:int]
+ to: ENC[AES256_GCM,data:6Q==,iv:B6bIsUOtkhq2CUOreGIgBD51S5fylTQkeHs3avgE3uY=,tag:ifGU1J/v6RSXOwv1+usDHA==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:tAcQ3fc3qAo=,iv:EuBsu53aFt2zu99Ov/wQQDrfiH/Ol/gtiA6JSbFBpSc=,tag:6mUn1MWhwSOF6EN6hYIRfA==,type:str]
+ model:
+ conditions:
+ - evaluator:
+ params: []
+ type: ENC[AES256_GCM,data:kSw=,iv:BKBZwtgHVE0JHQX52HsCgDXjbYyVDHK74jPtQGZHyZg=,tag:puqrxc2fGLLh+hX6+yip8g==,type:str]
+ operator:
+ type: ENC[AES256_GCM,data:rm9N,iv:FYFXYr4Fl9dZag+LoIN8s13Z7r2ngVbVPGvZNKorMqs=,tag:dGF5rz5+xPjaHAkl6Mq5pQ==,type:str]
+ query:
+ params:
+ - ENC[AES256_GCM,data:vQ==,iv:/+xldPv5c5j0UJ1mCk8vTxWttkVW/hIxpHZv/qsdEvQ=,tag:mztZWWQHGnwHC8F6mYO7QQ==,type:str]
+ reducer:
+ params: []
+ type: ENC[AES256_GCM,data:Vb90cA==,iv:qxAA4yqX0k3hsDLVBMTpMtGqmM9GLbgEdISAq4A+HMY=,tag:cN3auYLwu8xBeH2YewRCKQ==,type:str]
+ type: ENC[AES256_GCM,data:yY4QOcQ=,iv:QDLiy0aaDJ2Og3kQFp+kqKiSdfCjtaDM90egebTqW2E=,tag:3KrRjFkoYPs2GyaVEN3CWQ==,type:str]
+ datasource:
+ type: ENC[AES256_GCM,data:7ompik7mROc=,iv:9nQ7Kzjyr/gEhh4e20QExQ8XfA21sqj/eV2luqP+Wk8=,tag:sXamA6GFMQ7S2tkRXaZC5w==,type:str]
+ uid: ENC[AES256_GCM,data:gM9HDK/66bU=,iv:j35m4HhghIvTaYWXGjhMF6SdmPxyNW5HdWxUXi6kn+c=,tag:7kKENR3W7wGvKeoZAOqJfg==,type:str]
+ expression: ENC[AES256_GCM,data:Pw==,iv:FLjquIGw/F7q1RlvDTvec8VMt4CLNToD6JFIsuGULJA=,tag:wXhMSV0O1SjD2sFKAKhSfQ==,type:str]
+ intervalMs: ENC[AES256_GCM,data:5RvaHQ==,iv:gMCCR8lv/Az2eR4HUIjpADakrwYTuRDyCt1wAld+zEM=,tag:Ovu9UkK4BZEyTQLb0lp8Tw==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:lAQKLBY=,iv:3Ngg+Ol1lpCbgJJi24VxDSJRVPlCxoRAwVFfLETmhc4=,tag:IMv075SUxJaKv8tg8v9GPw==,type:int]
+ reducer: ENC[AES256_GCM,data:etM1EA==,iv:GPeOoQJOcjoDxEDql2/FnTkRho6sLwbslPv0wdF/CGU=,tag:q2Cw7H/p4zq8Ru4snHZvdg==,type:str]
+ refId: ENC[AES256_GCM,data:2Q==,iv:Ivb9W4cSqrHIhZf5IQr8lXZP5/WEuLgAsVrvnhCjzfY=,tag:93WGZKbAQfgOUWNiPIcOgA==,type:str]
+ type: ENC[AES256_GCM,data:X8NgHDJt,iv:zUodvCcmXWARKi2KZcqnwFcxiKsmY59rJX1OuHsPEzU=,tag:xMrx5lfOfFtyhxSLzAHdyA==,type:str]
+ noDataState: OK
+ execErrState: Error
+ for: 5m
+ annotations:
+ description: Depending on the rate limit, cert-manager may be unable to generate certificates for up to a week.
+ summary: Cert manager hitting LetsEncrypt rate limits.
+ labels: {}
+ isPaused: false
+ notification_settings:
+ receiver: PagerDuty Warning
+ - orgId: 1
+ name: Resources
+ folder: Cluster
+ interval: 15m
+ rules:
+ - uid: bdz3y4mow1o1se
+ title: KubePersistentVolumeFillingUp
+ condition: B
+ data:
+ - refId: ENC[AES256_GCM,data:VQ==,iv:seCzN48f4Rx+MVHVBqbQuhlBBcgf4xxJlhFPiqQbHzA=,tag:gtpqeR7TZpDvmsGN/9P6IA==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:Mz2Z,iv:7V/EW/RKb/KfVtARlEv71enNR9Ly2svCijoIu7i0fOo=,tag:tysIqgzjlGwHfu+sr/94YQ==,type:int]
+ to: ENC[AES256_GCM,data:og==,iv:fZFV+WOCaTRvNbjMmpijOJGaVe5GP5tLRU79xR7xGHY=,tag:E3psj0LdmuyseaywZ5SGEg==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:e+byxHieHuNG3Q==,iv:hnNcKEePscR5P0sYGXcDZk8OsqXGysT1AWOQio9dN44=,tag:4HW3j1094mzHm8TD5/khzQ==,type:str]
+ model:
+ datasource:
+ type: ENC[AES256_GCM,data:ZhRg//npyVUUhQ==,iv:uPvckTI05sLs3xBWZMv4Tn7q1++DJLxWi0iweQR8ZkM=,tag:ig/Y5DdcEahlZh5zXqFk6w==,type:str]
+ uid: ENC[AES256_GCM,data:1rxkPKBxxREppw==,iv:19xNtf3RImuBR6WEfzXGiuP3sWBCeaVMDhFDiECrFIc=,tag:nmZvZRB3KC3FcxofsgDxgg==,type:str]
+ editorMode: ENC[AES256_GCM,data:0Hu05Q==,iv:QmhAVbhM4qpQEXUm/ogygjdVxqCUJkh9J9UIEjM/MYI=,tag:5NYIIl0DRkjpkZ/0rni2gA==,type:str]
+ expr: ENC[AES256_GCM,data:2ir3JookEJOwntW1cc+XsVIL1BrxYuibl/AX1O3ou2ZofLSopynqqx5fM30VIXNvMiSAQJV3HxZ0bGFV+EYBx397F7G0Z4/hsgMVohWr+PvJncP8y4rEPHx0MrdsWD8ixPiJKXKBYt1uESf2MfijOyeL0CctNGIRFiZ93H/08fytoFc6+akdBNcErEbVk0Z+6gXtvuVpBsj9OSee/ru1mqgobYwYYHPadIUoF1eaExKxGNM2+DMnRVvfOKXMwa+pkdKJEvJkk61uB0gXzFbKslq19DAJkMWyvx386KKNo3LXz2cmo0HZ7nAForLIdxKhN8WOvK8HzmIkkBI8KKKAMPhSuXeBSDxGN4nU3nvTOkTjHej673KJr3CNVWKFtcUsuC8bVf6/cy9qR7NAxyeeU0YmLxSuUSVebBwPDNwmmzcGj6arHscmk7HEdgzA9F/yVltVc0wgIpoi7yb5D7Pi1FTSD9LkSEkS+EczbvvTyZo+EWNedRlJ5VzlMAMJRmvAL4ajfkY/Y86x7NaCq4KgAcSeETdxAE35jeWM+pyOp2wHen5u3BcKA5o8Fk6PLbyzLOKNQnAjgueY/esSUwBw7710GCisgZE29qR0HCL6Cfff44yNyPPA0n3qHWgZkk6PWSNAiocuha8Av+EvWQu64YIsKnwddxb5LH+bYZYH4akF8g5Q2IbBVnEdOEjC514FpTwDGGUN4dp/t84jr/AwNvrQuDUA9cfYTMwH5fE=,iv:OShYxAuf+EG1B5/33y3dxt7xSKkRktPDZU+Y3F6IWFw=,tag:iZGOXvFTyYNGi+VnggAJfg==,type:str]
+ instant: ENC[AES256_GCM,data:5sRsZw==,iv:HAjDngkx3ek4zWM76RBib6ZR9+ombZcOI3MP3feusVQ=,tag:XThNyxa37uo/PhwLWZwS7g==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:aNrYhg==,iv:Kg3ZfLyE8d8yUTdYkDNKIKrfkxtdazwp8vClGRihz3s=,tag:C7nsNVc+jl828hf6fXnykg==,type:int]
+ legendFormat: ENC[AES256_GCM,data:sHGrLsV6,iv:ZWRzVb5+1SBxo8ruVtu6CkFtScbxS8wTpR/MKq0i8bE=,tag:k+/q/BDx/gMXEM8GzDqz0w==,type:str]
+ maxDataPoints: ENC[AES256_GCM,data:0xRT2Cs=,iv:lJ3ytqIikkBgBhe9DTLdTFTh/LBHjxBsLmbe3pZCvsM=,tag:ryn1JIJ5pUpnVJLP1UhwCA==,type:int]
+ range: ENC[AES256_GCM,data:rJ/mOZI=,iv:dZMHMKbObSuW9KDLKdWQTfMhrN4+be03AhDPkokRbkE=,tag:Bmf3yXCJzZmw3UZA9f0T4Q==,type:bool]
+ refId: ENC[AES256_GCM,data:Rw==,iv:oe4AgAWyq7js3IcP/35pgKfOR1IPvv5q8iYj5IQDBMA=,tag:WZryL3iP5b1gkHiEChddlw==,type:str]
+ - refId: ENC[AES256_GCM,data:cA==,iv:hde51F1IfzxtG0rr8nHgNWw50aShZoJi1Ui07Lub9KI=,tag:Oh/oNMLp7xgKlrHFxmJo4A==,type:str]
+ datasourceUid: ENC[AES256_GCM,data:IpNtpywt2jw=,iv:beoaCef/3mR3Bi/qZNJRrJjA1xe36s2lvigQg/pks9U=,tag:H6x+4i1qGWmvwRxyhZXB8w==,type:str]
+ model:
+ conditions:
+ - evaluator:
+ params:
+ - ENC[AES256_GCM,data:cQ==,iv:2JzRVzgp5c65uOpcxw6QSGb0pO5NQAi0g4nxa8f4iAw=,tag:9jhkO9UaIXRhuSuUI3MWTQ==,type:int]
+ - ENC[AES256_GCM,data:Uw==,iv:c8wt1TkTRFkR8l4+jnAt6Srxh68cFDuHdJjjdPlvb+0=,tag:l9nxu3VCegzUspZg79w39g==,type:int]
+ type: ENC[AES256_GCM,data:kFQ=,iv:Dvyjkdc7nhID4cL4xh4F7a2pgozq4qo/EfFsITDCYcI=,tag:sryWd/aQj28KiMh3KWBdbg==,type:str]
+ operator:
+ type: ENC[AES256_GCM,data:BvuW,iv:DgrFlbICKgOElkDcc0t6kVVNpgUnl1u4K9Wz1ZKeanE=,tag:BbD4PCnVIjW9PyKLOQjSjQ==,type:str]
+ query:
+ params: []
+ reducer:
+ params: []
+ type: ENC[AES256_GCM,data:MuK/,iv:w7PRSjkD3Fk9xodZqxVwQdomKcUqS2HTF/fpq3+t9mI=,tag:pumP+b/NCgl65QCVp7swhw==,type:str]
+ type: ENC[AES256_GCM,data:5lV4JQc=,iv:nM53zY/clddRBtp7nYYko31DbE9wZLWuXmGaffuYUsc=,tag:k2Yh/9RALREwHoNAdO9p/Q==,type:str]
+ datasource:
+ name: ENC[AES256_GCM,data:/B9atxd+GGW9tQ==,iv:Z8YIx4Q1/AG1fiDWqsQogu2tQMCOa5I3MjmDBl8+Hq4=,tag:1fbxy0srCvwPrUHIRvpqrg==,type:str]
+ type: ENC[AES256_GCM,data:SCCjnbo39/g=,iv:81ZM6zJ6nE+Y7EPnGdErLlEZMkp/dAanASG5OhmZHtA=,tag:hEPl2yGVzhOJlVq93V6q+g==,type:str]
+ uid: ENC[AES256_GCM,data:IUynWgnUWFo=,iv:Vt8h0yL4vGgyZ6Nz/2h5m4/kgNpnFcV6uhuESglvSFU=,tag:47vkscNvw+dvS3J/OZ6kZA==,type:str]
+ expression: ENC[AES256_GCM,data:8A==,iv:wWDYs6o8KTHHbPPgpGq3Jds8j/L76tyN61M0jJgD2zk=,tag:X5fqZ2k1CVGOywqLIKreXQ==,type:str]
+ intervalMs: ENC[AES256_GCM,data:BgNxXQ==,iv:PN9UmgRMUAMK/P7ekg3MhqVzsDI0XEC9ys+0YCgabM8=,tag:C4FYKf0YffNCDP7LPRbKaQ==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:B0zWCRY=,iv:NNvA+Y6OmeO3XRo51g2WIIum6kaZvEfmMiilbwbX5Lk=,tag:wmDtXb7fWO1L7yVVpRrBHg==,type:int]
+ reducer: ENC[AES256_GCM,data:XE5HTw==,iv:2SHYuQrFYz/ZXHTL5faCvspfsR3JMXYnpsvDrKCRC9I=,tag:UgoJbhh2HSizwPZyywGSCQ==,type:str]
+ refId: ENC[AES256_GCM,data:fw==,iv:301rKGw8WIG4qwDSGa4yn8xVLRHg73J0LMHbH2yujGQ=,tag:3PrTVYYhu73/ZgL1lLpG/A==,type:str]
+ type: ENC[AES256_GCM,data:7uKgjiwL,iv:x5G4m73KY20JXHSI8l524dnVIDPZLATOkvPN0pEXpEA=,tag:2sGhjxXS6B7UsazvuxrruA==,type:str]
+ noDataState: OK
+ execErrState: Error
+ for: 20m
+ annotations:
+ runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumefillingup
+ summary: |-
+ {{`The PersistentVolume claimed by {{ $labels.persistentvolumeclaim }}
+ in Namespace {{ $labels.namespace }}
+ {{ with $labels.cluster - }}
+ on Cluster {{ . }}
+ {{ - end }}
+ is only {{ $value | humanizePercentage }}
+ free.`}}
+ labels: {}
+ isPaused: false
+ notification_settings:
+ receiver: PagerDuty Warning
+ - uid: cdz3yt59a0miob
+ title: KubePersistentVolumeErrors
+ condition: B
+ data:
+ - refId: ENC[AES256_GCM,data:kg==,iv:u9cu+V/2FNOnSOzLv0i6d704gN1dR1+kVklnlfTK+cE=,tag:QwexyP4WgrZpRaTEMWT8Xw==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:l8WL,iv:UMoJ6jZl0NSkKCcij6axP8b66KbNtZYSagx9m57egTo=,tag:DEfDp1Pa73b5Ohms5Y6B7w==,type:int]
+ to: ENC[AES256_GCM,data:2w==,iv:ZFTml27RryXA+EmlLv38H2LCQX8oXOHzSck/gx6d/6g=,tag:mqn6GobTW8cleMazO3Y+Ew==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:y3vlgdYuEret2g==,iv:RzGrmjCLFi804bk6mv/PxfMGEDHfNUggEn3IWRAniHc=,tag:BL+yk518hYISR8OrhjBkaQ==,type:str]
+ model:
+ editorMode: ENC[AES256_GCM,data:4ffRxg==,iv:eeDscspxTkLFCHfkkfkKqJtOe7eO/+VxuUT/mb6VreA=,tag:JmcMOJXM5Fa0UK04NvmEdA==,type:str]
+ expr: ENC[AES256_GCM,data:8QX1mYvlFsXrZZiMUZhnp1SoU2UmgRyngu4VV3dKaavVEnLKcgaceqa2L4kqzWNjQf7pYOEEQU8aNwWFQVZ/RI1m/gleD+HRKOrh5C43LsoFDXsHN5SDP1TI,iv:EI+ythA4QhLcvhPPEqPCZbPQ49Fehm7NDF8XohYgq6A=,tag:/8JRLc1Um7sSAymrUK+oCw==,type:str]
+ instant: ENC[AES256_GCM,data:KzdXww==,iv:eAV0MIR8eo+H+s3SITpEsSkzy1KjErp5AYik5vOsaUE=,tag:cxuRoqWPLqpSIOWdN1vk2w==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:P9RwdQ==,iv:+zssBiaMTs2n5hpief1yF40/qOZj4ang9RP3aoLdUrs=,tag:vgn+k9EPqZv1Y/gDR5tb+g==,type:int]
+ legendFormat: ENC[AES256_GCM,data:uhZA3JoS,iv:MDUQOODVwuE9stTyGLd4r9o7WT47VNENAlQDuiYydbg=,tag:UGxinMY7CU1/bDvt50g5xA==,type:str]
+ maxDataPoints: ENC[AES256_GCM,data:9QzlycY=,iv:DtFaYMBzdljIcP40Tu2k//YMYXeqdPuR/l51oFt1YX0=,tag:mV7oXH3Y+jCGUppefQM9Gw==,type:int]
+ range: ENC[AES256_GCM,data:ACKlO3A=,iv:numHoxp5mznjxFh20E0K9tTg9e/LLpXJ+gV/P4F1DWw=,tag:6G20rD882rVMuwR+qQDJFA==,type:bool]
+ refId: ENC[AES256_GCM,data:Tw==,iv:VqJlgcey1Cf434f48CZMCsgaS3whOn00O+hMbqlHuvY=,tag:/WYxXPTN1oauYJjWgRkivw==,type:str]
+ - refId: ENC[AES256_GCM,data:oA==,iv:zM2fgPAUWK/V3RE96+3BF+cNI6i5voM/1w8AX8IzhYM=,tag:jdY1Dw3v/zKk0YS2iVGHxA==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:Rf/k,iv:Mkp2H0SeB6GK7G6L0XLG78B0gI0hMy8erf/Md2GUSsQ=,tag:Sr2Yi3aktmMd0hKnIP5NoQ==,type:int]
+ to: ENC[AES256_GCM,data:7g==,iv:foamWpMtreWRFbTyj/rHPuUZXJCpPLeYN6QFTiZb9OY=,tag:n7fexQbjwBPGsgUxEMKfng==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:EXGCblX+1CM=,iv:63/9m9qBc+Q9kCEBLDiwdCq3XfHjQxePRM6Y49YhNUE=,tag:wH+x1STbfZQchFTZiJpD4A==,type:str]
+ model:
+ conditions:
+ - evaluator:
+ params: []
+ type: ENC[AES256_GCM,data:/14=,iv:olM7hkc2+hTJ2+M127l5K2q8Wq4TtAgl8rv6oRtGCYY=,tag:DVlaqJyeiJZOp7AHPs1VsA==,type:str]
+ operator:
+ type: ENC[AES256_GCM,data:9vu/,iv:4tgg+tK6EFUhuNQCJn+EWLfLfZ9jHEz/mZ2cUaLZcwk=,tag:t94wICgmEcKcI8mVjCqCPQ==,type:str]
+ query:
+ params:
+ - ENC[AES256_GCM,data:xA==,iv:bgWhSTNqHMbmGW5E4ZfioWd2Q8BaSdWuRtg4dNiVPds=,tag:PzcbiwJRw1sIeJNYxxnAdA==,type:str]
+ reducer:
+ params: []
+ type: ENC[AES256_GCM,data:/cO66A==,iv:keLqEybSynnZMMA4BwhtJT76GZJ4YoCTKYShcrFRx88=,tag:neU+V2M9qbj/86Hqy6QaUQ==,type:str]
+ type: ENC[AES256_GCM,data:eyCnzWE=,iv:uYjmspV2rlGJaTSbUn+bhcSzwIlaxzLwTnoqlRAzZJc=,tag:8YIzwLSzijZanMOfjx7YMw==,type:str]
+ datasource:
+ type: ENC[AES256_GCM,data:lzvwrH5H69U=,iv:CzV9NRFYn5gO9WFE8MDauivoyyVFdbBFXNGLXfIJyxM=,tag:rGlpjLR67xhsOE0XAhT/yg==,type:str]
+ uid: ENC[AES256_GCM,data:52j/8DTHNkE=,iv:ljxDVw6agT3b4fZBR1rQkwVmBAAAaGfj8CQugx0yksE=,tag:EJgqwCMgsbuMEcR9DWPJog==,type:str]
+ expression: ENC[AES256_GCM,data:Tg==,iv:VKamXk9Tx4vGJg/KsXb8golPJ2U92yu8207A6Wk4EKk=,tag:zgsZcgzR2qpbnT79jjEdOg==,type:str]
+ intervalMs: ENC[AES256_GCM,data:d0XdsQ==,iv:Cr/q+PRRF9QQKMIgWzKAI/v73J2yuXdLEn8EYhg4I7A=,tag:Q3IBHleAuYcln9UhKDY0EQ==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:R2yVlPA=,iv:d3qcTvKXmu88jth9aldMNimvfe/Z0ITn+mJq2Pdklfg=,tag:mDBgNX4Vqx0/vfznophwLA==,type:int]
+ reducer: ENC[AES256_GCM,data:xmCJsQ==,iv:56N6aLGenp9dTiK2c2OWXhz3dejbIaFUuqIDBMIolQI=,tag:qp95Yw03Vp8l/mRjLhC3xA==,type:str]
+ refId: ENC[AES256_GCM,data:iw==,iv:ArWnCI1mmiy+fqHo96drlBx6zYlMgARB7MD5ucI4vIw=,tag:ejY5zYfhXILP+8cOTYI9CA==,type:str]
+ type: ENC[AES256_GCM,data:LHg2LCfl,iv:Qj4zzGgje9Yk5E3iggJsUZ6i99touiFaUesX7aB8TzU=,tag:C7OYYqP2FsKi0nmBKQQCHQ==,type:str]
+ noDataState: OK
+ execErrState: Error
+ for: 20m
+ annotations:
+ runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeerrors
+ summary: |-
+ {{`The persistent volume {{ $labels.persistentvolume }}
+ {{ with $labels.cluster - }}
+ on Cluster {{ . }}
+ {{ - end }}
+ has status {{ $labels.phase }}`}}
+ .
+ isPaused: false
+ - uid: cdz3ywkoiwgzka
+ title: KubePersistentVolumeInodesFillingUp
+ condition: B
+ data:
+ - refId: ENC[AES256_GCM,data:EQ==,iv:uil4Gx9v13whHs+hfG1o3NnA1vRNCLRDLZDoFJC11OY=,tag:jsR4BHVAm1tPCEUgXEAzVw==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:/0sK,iv:9XRPQcvCEPRU3cOF7Ram6fn2KpCSR9GAGc7TSOawiQo=,tag:qZS02kntypfAVx8931CVcQ==,type:int]
+ to: ENC[AES256_GCM,data:yA==,iv:OTgxBtFUG8JtlGv3DdN5tXrD6t2AJkVCdiH1sR4ITzo=,tag:Zc/ZpLfhcnEC8OLw2de+7Q==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:7Dq8cjEek8tGdA==,iv:ClEpTtKS3uznKKRHq61ldoMDrrf/0elPbf6jZTiMWcA=,tag:hQM7VhyAWPDRTtXaseoAdA==,type:str]
+ model:
+ editorMode: ENC[AES256_GCM,data:PKOwlA==,iv:E7tivIJLSBoh2mqcbEAKXD7KHubwNqjITxkjIRYv6GA=,tag:tRoLLMvdd9ABgHIk+WPziw==,type:str]
+ expr: ENC[AES256_GCM,data:oGYHVrQ5u3TFeacHgH6Rb97nKhcCCBHgokdZtiFy+8uIDDIhuocAGYZttLnVeGTYuene6sWNU1QEvARqt/CF8CDYK73hRy0+spnvNYEPiwLi641lqCxx8wozwlByGSGf7cTQa7qOrqDpefkMroJICzTGTdy1EHnm3zZMhitPMrzvtrvScxcZisaeljD3dw18HoLwkyn7SVINi1pLL9uWXQO++H6P0MyoL0WDMdbH8WeROTkqunYREox/hKiVaa2sOt3+v2lJJbG05C9TpeiDb4a9+vVoi3q5sqK7UX3fRp02BY8+fkbV9GwxUDirDtvkNbytCgAURgPu40JAtKhPBV9KyvBHSuPgrOQ/XBW4BReWqTe/i3LxOGzgPIB/i54DSYCNsJYIr9L5qIAS94li7UmUh3oWpJB7LpwBSlq2ZXhpZFziv61yr9YHjRwaUIBreY5bfQVH5GtT4xrdTD//NNxGDZxFGvguQEcP7/kTi/hiKx3dmYA/PFLeAEVH1jzClsYfwtTTTZnoUYiy50gQcn8XogJbcI5xnMvHd/C+O7nPlpwD7QmEKYDxGlehIQVZ2CyVd6iKKtNhbmG4F5ZGztlLGJOYzySQYpBMJnxYJ2/vdPDHfnJeCArzva2oSKjA7FLcoD67VKUH6S2U7aur2bLerfQbf7B6H6BFXnQA0qJiQeXRnBPeWOl5ujkYqgdCMl8aRFF5lwh5u3sqkWe/loiudSWD5a3yA4bzq7U3Fhg462jF87Y3pthNwIAYk0P5SfvCeKLxCnyLZE97CKsPSWKVHjAltHwL3Yrbep5FJJLMIt8pi/WmHjf0Xj9ACFO6oV6JAXbzExn+/bL6w5ZAnodXY4XhYluwzZl/pxuxwHUw1NKM0j8+HH/p0p3pAKK8UMIRcrWgkQ==,iv:VOqr3MALLMk+85VJV+T82G7O78btMSkwAnn3hXISUYg=,tag:fq6p5U+S2SdZAwjGng54EA==,type:str]
+ instant: ENC[AES256_GCM,data:cOmsmw==,iv:08wwJpQ8B0f57DPqXwTermbiOCfcRxVkzII/n3vz9Rk=,tag:j9VGX5qyUz0hVL7StHbsqQ==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:0OtTQA==,iv:8Id6RPl6ROX0zt2q40r6wTKn9np2gm2aVtgtCIj2mpE=,tag:6aIi3RZJ2hiZhLg5VzJCBw==,type:int]
+ legendFormat: ENC[AES256_GCM,data:exfm8Ue1,iv:H457H2oKSfHjPOyzBZDJU7XbeLU1a8VOxmv6yZSbOF8=,tag:QWIczO78IKqKNeCYfehbbQ==,type:str]
+ maxDataPoints: ENC[AES256_GCM,data:mCEmlnA=,iv:8Eyt3AZER+6Fn99d4hn5Kafsd9nS10sOoXr3Z3xUcdI=,tag:muy4hLnSNZ/YjLR9SS7dmg==,type:int]
+ range: ENC[AES256_GCM,data:4n211Q8=,iv:q+0VmabQYpmrQcJwsH+jWYnLoymsoblSXVH8jBuYJNY=,tag:GfJ0Ofje6emZxCjeGocxFQ==,type:bool]
+ refId: ENC[AES256_GCM,data:VA==,iv:c1WRaKz8Il1EzBJWbEEaDUba44NA7hkCJjy4EsWVDEs=,tag:KJMi5wBkG4sPHcG0/oBLig==,type:str]
+ - refId: ENC[AES256_GCM,data:Tw==,iv:H1PIpTnCsvm5by3rCgfLfMENT+D6Yz7hz9PAThDPQmQ=,tag:nkArkgF2Z79+qPPARIo78Q==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:BChb,iv:RLTVHkUoDw/5FMBbc4170BlJIp+H/2TxUdbUdV3KiX8=,tag:yExrAY0WK8aDVaKWkuf6dg==,type:int]
+ to: ENC[AES256_GCM,data:dA==,iv:rD37ixcIZ6B7SE0/I3xtzwsiGiJIGq0nRhEPX3Ua1pk=,tag:m5to9/S3PKiguA9nCbh4CA==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:fh1ZymIDgqg=,iv:9qU9DW7/lspxb5dZuDH+L/34VxsTTs2rh6pLWQmb0D4=,tag:qAbakhHuVYTL8cNEku910A==,type:str]
+ model:
+ conditions:
+ - evaluator:
+ params: []
+ type: ENC[AES256_GCM,data:aj8=,iv:lBcEvKIHV2SJBd4Sj95mWC5cXOaCdc6lFLszMAKDQ80=,tag:ZcF2srg1+fJSJ1HROqewdQ==,type:str]
+ operator:
+ type: ENC[AES256_GCM,data:HnuN,iv:9AqFsa2uKhlk5T0Y/CxuL/ppleFpUadRVCR8H7PLEjs=,tag:Q6dYWL2SpJHo8MW0EqxUTQ==,type:str]
+ query:
+ params:
+ - ENC[AES256_GCM,data:sg==,iv:1QRq+1u+8Bv/dQd3gtnTNzQSQa4/WiauEp7E3SDs9EE=,tag:XZ0DzbfY2LRASqmLdPyQVw==,type:str]
+ reducer:
+ params: []
+ type: ENC[AES256_GCM,data:Xrdjsg==,iv:mZJLZ2/nI7hDpeZGcr0AVh1P/ay7hudiEoHo+zo3yZA=,tag:kZogJE/4KVydfL3RHD/n6w==,type:str]
+ type: ENC[AES256_GCM,data:inMFX+A=,iv:OGfr20yNSf6RJdJJ92zWCuqu6BwcAPiAgfFKL9ajwtY=,tag:jhzjvwyw7V61KfnCbQlcsw==,type:str]
+ datasource:
+ type: ENC[AES256_GCM,data:8uOLUNjS8No=,iv:ILb5VDlSy1W5bOWWTh/1cvLqz/kP45S+ccpOLeiPQ20=,tag:hHGTMBCRzvlCU1xfxmLw5w==,type:str]
+ uid: ENC[AES256_GCM,data:ZGMDRaxNpcg=,iv:TLEilnSFu2DKvvvo/n9tare0K59341/grzvzc3VPlqE=,tag:FXudHiw6+RS9fGwRXGeR2g==,type:str]
+ expression: ENC[AES256_GCM,data:LA==,iv:QEBvr/y3jz7Gkj23elQwzctEnMfJQrDW8Aq1gZHxSPQ=,tag:cNBw0FdoYUzuf2Jh5/WNBQ==,type:str]
+ intervalMs: ENC[AES256_GCM,data:GOWo1w==,iv:t4PvmZe6Ecja3Q+cX44frrqh2BI2My1wKpJZ5q38/Lk=,tag:QE6PLwnTSGTd2LrM1p/Gjg==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:nena1xk=,iv:gHW+Pj0tRNcDZBGSRubP/wsVDFE5x4ITVdaun+ju7hg=,tag:Akd8QntLKIeX4kBKwxj5cQ==,type:int]
+ reducer: ENC[AES256_GCM,data:E3pzkQ==,iv:javPdD0TG/mllRY6PWxPpuHq324IphU0yb8EYgpvp9Q=,tag:KQBnxDY0CINmG6Tgp1aakw==,type:str]
+ refId: ENC[AES256_GCM,data:sQ==,iv:TD21gW/fW/psL8rqQxo/osUikjmVNN6wb+6aCkNEW0g=,tag:5VlIsVtvcknrZKgMRHV8Mg==,type:str]
+ type: ENC[AES256_GCM,data:FeqfKTi+,iv:spDxQOCvd2VNX/b8QPZ4MNxwaHfAsWfPV2idW5bTLUM=,tag:Yzn5rMhC2kCG1pgh6VjYGQ==,type:str]
+ noDataState: OK
+ execErrState: Error
+ for: 20m
+ annotations:
+ runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeinodesfillingup
+ summary: |-
+ {{`Based on recent sampling, the PersistentVolume claimed by {{ $labels.persistentvolumeclaim }}
+ in Namespace {{ $labels.namespace }}
+ {{ with $labels.cluster - }}
+ on Cluster {{ . }}
+ {{ - end }}
+ is expected to run out of inodes within four days. Currently {{ $value | humanizePercentage }}
+ of its inodes are free.`}}
+ isPaused: false
+ notification_settings:
+ receiver: PagerDuty Warning
+ - orgId: 1
+ name: Kube-system
+ folder: Cluster
+ interval: 1m
+ rules:
+ - uid: d2b94d3a-2483-4be4-bf2a-2fd9f9fac406
+ title: Coredns Failure
+ condition: Thresh
+ isPaused: false
+ data:
+ - refId: ENC[AES256_GCM,data:RS8gIco=,iv:KG+3N2D/4opzPQbYxifBVLnwahiA6TtDCMSXfz54Vyg=,tag:ovyWx9N3IKN4wFN7oPeKWA==,type:str]
+ queryType: ENC[AES256_GCM,data:Py+LDCw=,iv:0BwBU+t4a87ysbVcsvBAKflC7JG+JWz/9/Uzy/nAfRw=,tag:S5Cp32UAzPwF0Jvfbc0gwQ==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:8/Wx,iv:5mJ3JDX68c5scSLkyBgPBSpWYlvj4gzO1tVcA5EnEWM=,tag:7yT2+wwnloboe59CA6fiDw==,type:int]
+ to: ENC[AES256_GCM,data:OQ==,iv:KwtlCNY96bH/JGg8EayJYtYdubVSncBfo5ZJMSgWJPE=,tag:JAPwax19udWckYC0QJw6QQ==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:RyjyRQ==,iv:tv6GX1npp1WUwYgxhyOttN8POMy0M6cZInPg6U8w4DU=,tag:IDTj3ue0fBaWlvGhMf3lpQ==,type:str]
+ model:
+ datasource:
+ type: ENC[AES256_GCM,data:OKVoHg==,iv:vkNUV/pdATtiXVZoC9IAdQ2QMvmuXGcQwfO1FIavsSA=,tag:t/VIZnGbnurzi7e01uF7+A==,type:str]
+ uid: ENC[AES256_GCM,data:EuDhuQ==,iv:IO6wW1SGZyYf+1uZOVh3dfoe+qpTR38KqDn/oFgC2D0=,tag:9hqC92rE0Z75LuuXWrZ0dg==,type:str]
+ editorMode: ENC[AES256_GCM,data:uLLOcvmvaA==,iv:Le8wQQqWs536N9Q0LWY8qeHlNtyVU7FMgXL2vU7O8pU=,tag:TGAXrortTFIwuxD/X7bYbg==,type:str]
+ expr: ENC[AES256_GCM,data:ID1tSoSqphc3Pq/qRh6K5DP2PtXfE8viz6zKglH1Ic/mFm5tbx/AXrzOykl8Ct74lQJZXiqbYXJegUFWZpDI2KEMk19F,iv:xVOPkpC03hxOKD44tBVguiRS1fBPjBFe4KAHbt+ojvY=,tag:Zx9ZpIwFTQWMoYy0ih0EJQ==,type:str]
+ hide: ENC[AES256_GCM,data:kIpTwz8=,iv:tu1y5gaQ+RK4oMbOODJczBx/bId/BgndlNdoFZekxTM=,tag:oYMmU/qtpOpr9hTvHGcouQ==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:yy1Ccw==,iv:RrU65RAoooZA7gmg9aVIVvjShSc1X0Ud0s83VBdAylo=,tag:8xoIokapKe2ltOUwOCSreQ==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:5g6Jlkw=,iv:ImPxtKwkvzfJurIkhY/lPRDdPx+yIHjwgoEDOupqFKo=,tag:H/mGxegx+IM5hMBjTCC4SA==,type:int]
+ queryType: ENC[AES256_GCM,data:IrUEi6o=,iv:56cxT9V7oQfYEYZ6K2TEKonAhWZ8JTXOJyOu+iypHJA=,tag:HjVnuE3QeZQzacPJSjYK4w==,type:str]
+ range: ENC[AES256_GCM,data:aB61og==,iv:i9+Iz3fWk6SNPZjOKEYvFAoUh+5Jo3o4mD/jeROBrOM=,tag:H9Z6V7KBZTSnY/+R2/0Vkw==,type:bool]
+ refId: ENC[AES256_GCM,data:58hhHH0=,iv:yc45MJ3fBbii7+oT8aRrAytZ7a7SrL1e1e5Q0dDLeBQ=,tag:/ISGCvVKe4hykq09eIa2uw==,type:str]
+ - refId: ENC[AES256_GCM,data:2nqS1LQB,iv:Nq1bqHw+d0YjOmo62T1Z5Rgq1wzaw4SUZbRo0D/jbM8=,tag:dYaB+1fySXvpF/0zDdmIqw==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:7PqE,iv:K664fpIcoTZx5pH27+EYMAbJW6I7ts2v7uci8Cz+sU4=,tag:Cwht5e+kdUzdYSlSn2N7gg==,type:int]
+ to: ENC[AES256_GCM,data:HQ==,iv:v+zBF+xU4xOdzQ23y5TGGP3d6EiD3w/Sd2j0DODeiSk=,tag:awNSBodnsnZsJgUuw1T5tA==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:H90uZtBnP50=,iv:cpqDHg9p8ssQIpUQkAb5ZjUXFwcdtPDzI5kZEAZ5szE=,tag:ecQtRmzf7VU38xEYZhmDiw==,type:str]
+ model:
+ conditions:
+ - evaluator:
+ params:
+ - ENC[AES256_GCM,data:gg==,iv:J5MLA+EWy9r8S+Fnr8G62EvlRCulR9YeOMocLha5JWA=,tag:MCpViCvrvxMAFH6vXemZFw==,type:int]
+ type: ENC[AES256_GCM,data:+is=,iv:pfU9ygml9JuS361hFhnGjyjroRwOV94omuoMFooEqw4=,tag:JtuUj0fHivr7qi5payh8qw==,type:str]
+ operator:
+ type: ENC[AES256_GCM,data:z8IX,iv:GMaYzU4m+0ABT7G3vgkU98EF/XwEM5x1c7fJZknldaQ=,tag:GIxrJCeuLfMGvcmh/+hsIw==,type:str]
+ query:
+ params:
+ - ENC[AES256_GCM,data:Bg==,iv:9ZCz45zf5kjPj/iEDP9UFZiABWdPJw/d2uaXGBNBh+A=,tag:KJmSMGn19S1ME728E/OZBg==,type:str]
+ reducer:
+ params: []
+ type: ENC[AES256_GCM,data:XbMUCg==,iv:abWC/9VMtAQqWXsn3eBdAtxkcR7357UMKXwyaVWuc3M=,tag:EQBQv2+mMr29tEknal3HkA==,type:str]
+ type: ENC[AES256_GCM,data:QmuNOUU=,iv:YqbWlLTuKQOnh8lfCzJbMQOsyUH9hZ+cmwPPEUBE7sU=,tag:FW9oXUCKn7ac2CX13RI2SA==,type:str]
+ datasource:
+ type: ENC[AES256_GCM,data:SLvP/3eoqDs=,iv:8tqpyCr9nk6ydaPn2fayRqEACfpDnhx8sPqQLEZVAmE=,tag:RNcxWK79Rho5Ayv6TLT7ww==,type:str]
+ uid: ENC[AES256_GCM,data:6pHPFSB6K+4=,iv:gFOD/64sMM2e+RunUIBIwSvgUE4EfOrAAMFPD861fJE=,tag:ZWecfz1wSLga+H+Erdxrag==,type:str]
+ expression: ENC[AES256_GCM,data:yg==,iv:WTjTbtCE52PJu5zwHwIZgr/odMMjAAApt6OzREXsjG4=,tag:mxHD4dznqU30HGWrz2mxbA==,type:str]
+ hide: ENC[AES256_GCM,data:u3IHmhc=,iv:kjHDBR0VKC96vaffAXu3i/Dwc9vAqbpHq+wHOMKNKWQ=,tag:F46kcaka5xEQAamTZZdzEw==,type:bool]
+ intervalMs: ENC[AES256_GCM,data:IhEskw==,iv:nXbTa2eStB730JdIohPsmb1I+535GIbVIWQ+zuTOpCA=,tag:CMhg8SrRYYtx+SkO7I6xiQ==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:M0d8aGM=,iv:086Sghi7CUWuaL6N8or3mTHSFMHKX7If/H79yE10u/c=,tag:mQp5jbKwYXK/UWMVly5B1Q==,type:int]
+ refId: ENC[AES256_GCM,data:W013Bpvg,iv:ok/Camd4G76sZBUygentAuGzGzkG7Iuq7LkmkvvF+4M=,tag:LbixU1EeYUOyeTKDbkgKwQ==,type:str]
+ type: ENC[AES256_GCM,data:/3xgN7KCC+tO,iv:xTuGCCNKcngqViejMSLzhryBtYjrzxvS3DXlfbxIa9c=,tag:iPOYFWA5CxVxXqdX4aj0gg==,type:str]
+ - refId: ENC[AES256_GCM,data:aA==,iv:MW4gaxla+QDXeseTc61uuMSHzfxVeWR+s95VEVm+FcA=,tag:VYiviAv58BC43OxVd+59WA==,type:str]
+ relativeTimeRange:
+ from: ENC[AES256_GCM,data:tKDr,iv:n0sQOhVRZ8ukNGeF2uQaHTkmVVdZyOFVvP4VLBf1kOg=,tag:DZT4ijAF9wzpFvOx5FjBeA==,type:int]
+ to: ENC[AES256_GCM,data:7Q==,iv:8zLn1wdnCp7bphSU10hgYYmdWMB3F9S09UtFX4Lb7yA=,tag:pDN9dFvnGoLfn6PjKn0Urg==,type:int]
+ datasourceUid: ENC[AES256_GCM,data:8AvLW/yUY/I=,iv:3lu5g9strmBhgJ4ivzxziipuPvaZMN3feaReMUnif60=,tag:VFfqfmJzJCx5jzvBkaR1bA==,type:str]
+ model:
+ conditions:
+ - evaluator:
+ params:
+ - ENC[AES256_GCM,data:6A==,iv:Y0stM8IStHoB9N59yswTMNCuY/hf/tndPMuEOCQKkpg=,tag:55sEU48jF0U5uIAgfApbyA==,type:int]
+ - ENC[AES256_GCM,data:Vw==,iv:7ApbT0bsM6CSLf2WFLbd4CnHpp4Df0P+XZyn+326MPg=,tag:xflRJZB3BFlRmowamIGtKw==,type:int]
+ type: ENC[AES256_GCM,data:Nbw=,iv:fpPFzayjqhg3+6A087R1KHiv5/MHAFQPGP0RXfudW70=,tag:7YIMcJ3wyN8lfXVNAug9QQ==,type:str]
+ operator:
+ type: ENC[AES256_GCM,data:4rO1,iv:M1TG73q7qfCxsMZkwHmpIpUO8heOPVnCDZrcEzNaHqk=,tag:9KkoIiITaO2TFVgxXGsB/Q==,type:str]
+ query:
+ params: []
+ reducer:
+ params: []
+ type: ENC[AES256_GCM,data:5Iku,iv:ASY4W326WfqIuKzIZmKbs3OfRMWOW4i7p3x0fHSgIOo=,tag:w3fldmhoh/G3v7JVonqvBQ==,type:str]
+ type: ENC[AES256_GCM,data:oGSGNzY=,iv:VFb4Hu1TfVASB7H95gCE13P9tNSnIBb+i77zQgIaD6g=,tag:B9oy9v59wW4Regs5ulNzIg==,type:str]
+ datasource:
+ name: ENC[AES256_GCM,data:ymY+aWPQs7RkWA==,iv:7IXh1afIEymva3W2f6Ti1Ycrw51NyV1xV0YFsQRM7Fg=,tag:+rW2ynwJkfjSDhBUXeJKGQ==,type:str]
+ type: ENC[AES256_GCM,data:sfzsprEWYs4=,iv:+oD/pxJ+DvZ86cp8fohnYZeAKaBoNqM0jkVqc4z7DCg=,tag:5rgQGXOcZYPuEjJ0noXVwQ==,type:str]
+ uid: ENC[AES256_GCM,data:fmy+EwE/8Ns=,iv:RacCGmEhSQc03hKb1iQDZ9gxw7a31FsxkTzw32yLiHE=,tag:zg70SFbAyckIz3ioOxYS3g==,type:str]
+ expression: ENC[AES256_GCM,data:BfzH9Do=,iv:Y3Rbt+qFHTIegU0UpH0z7+t1cfqV4TW6PBsqdYD7DFM=,tag:z8nhq5PlqcYTH+KTCcqARg==,type:str]
+ intervalMs: ENC[AES256_GCM,data:Otda4Q==,iv:dJoy2Rz+E+fYItCIFdJ1qa8IyHxNkgCgm5P90CoRsWc=,tag:gRrsDf5p7WfRJg8v0yxj1g==,type:int]
+ maxDataPoints: ENC[AES256_GCM,data:uIjnC/Q=,iv:xFuC2VPhiuK6gMc/hQ9b+CyUy24iA8a0bQQ/mzxqzuI=,tag:sS1IGaKa0NJ23v4VnsblwQ==,type:int]
+ reducer: ENC[AES256_GCM,data:VuLckA==,iv:zij2B/RLif/UqakmkpY+Q2aQ4AwVJY/tP9Qyd7Cc1VI=,tag:iLqecnpD3d+7sYZ4eoG3kA==,type:str]
+ refId: ENC[AES256_GCM,data:/w==,iv:ucTvc7mtP//N7XOJSsUfmhx7yTxFNhY8gmfFk8SrVL0=,tag:XmwWKMlwtCCYGpG4AHpZBQ==,type:str]
+ settings:
+ mode: ENC[AES256_GCM,data:9kRAxoyjK5FF,iv:9huEeDSAGmDvSj1jkPnZHdGTmaaz4Prco6ZPKdpuMWQ=,tag:hJ5Cl3Ajd5bnPrmsRr1IEA==,type:str]
+ replaceWithValue: ENC[AES256_GCM,data:UQ==,iv:DUVS6b6dcXSb9INhcABzzn7WcBSnXbWFTRtYuBVuzqo=,tag:/v3gHKgb4naMHl+yRSB41Q==,type:int]
+ type: ENC[AES256_GCM,data:s96pGXy0,iv:6uekd6vL4C6uIk6Z0r0JxlKiKIqKcI0yvZdfdOtgMBo=,tag:t2HLl/9VHUaa4j8v3pxWig==,type:str]
+ noDataState: OK
+ execErrState: Error
+ for: 2m
+ annotations:
+ summary: High amount of i/o timeouts in coredns
+ contactpoints.yaml:
+ apiVersion: 1
+ contactPoints:
+ - orgId: 1
+ name: MidnightThoughts Ops
+ receivers:
+ - uid: "1"
+ name: MidnightThoughts Ops
+ type: email
+ sendReminder: true
+ frequency: 1m
+ settings:
+ addresses: ops@nordgedanken.dev;mtrnord@nordgedanken.dev;mtrnord1@gmail.com
+ - orgId: 1
+ name: PagerDuty
+ receivers:
+ - uid: adz30e8814wshd
+ type: pagerduty
+ settings:
+ integrationKey: ENC[AES256_GCM,data:YsWApwCDCTBowM8idhrE1wJs14dVUaNVxS+UvYwuMFk=,iv:tD5rofx/jTfitpbX/Aj2s24toGpbIbFNwKBU9rLdmH0=,tag:yu/EIJiYcjgQsK7fSrVnMg==,type:str]
+ url: https://events.eu.pagerduty.com/v2/enqueue
+ disableResolveMessage: false
+ - orgId: 1
+ name: PagerDuty Warning
+ receivers:
+ - uid: pg_warning
+ type: pagerduty
+ settings:
+ integrationKey: ENC[AES256_GCM,data:A092wgxNAeKA+MfwUOqeW+edzfsohZ8RXfWPIhNNs8s=,iv:4vB7qvwKBJbbIVkpweyYTcGMrw4MOvLTV35qFEzn6oI=,tag:SpDtDrGlEjYuG7SlfYpRRg==,type:str]
+ severity: warning
+ url: https://events.eu.pagerduty.com/v2/enqueue
+ disableResolveMessage: false
+ - orgId: 1
+ name: PagerDuty Draupnir4All
+ receivers:
+ - uid: 3
+ type: pagerduty
+ settings:
+ integrationKey: ENC[AES256_GCM,data:AQJoSgyRugloVU7DuKnWL0HHLEoxUGk5PSErp/7DU3o=,iv:hzg0dqBttUZh+Fm0ZrTTt9WHG9J+lBl46RGt+ExNQB4=,tag:RF0e8ImNGl9m1YWtBSVrZA==,type:str]
+ url: https://events.eu.pagerduty.com/v2/enqueue
+ disableResolveMessage: false
+ - orgId: 1
+ name: PagerDuty Draupnir4All Warning
+ receivers:
+ - uid: de02at943dxxcf
+ type: pagerduty
+ settings:
+ integrationKey: ENC[AES256_GCM,data:W59evCg5tafzzeySBjJogy2AEMcTDAIGuZKy+Icavt8=,iv:UIX/6rAnBDUNnGJTBuiLtYrrNhRpDb34ralk50aGoBE=,tag:b7kOhBNW9RxqDTPkw5vQBg==,type:str]
+ severity: warning
+ url: https://events.eu.pagerduty.com/v2/enqueue
+ disableResolveMessage: false
+ policies.yaml:
+ apiVersion: 1
+ policies:
+ - orgId: 1
+ receiver: PagerDuty
+ group_by:
+ - grafana_folder
+ - alertname
+ routes:
+ - receiver: PagerDuty
+ object_matchers:
+ - - service_id
+ - '!='
+ - draupnir4all
+ - receiver: PagerDuty Draupnir4All
+ object_matchers:
+ - - service_id
+ - =
+ - draupnir4all
+ - receiver: MidnightThoughts Ops
+ plugins:
+ - grafana-piechart-panel
+ - grafana-worldmap-panel
+ #- https://grafana.com/api/plugins/parseable-parseable-datasource/versions/1.0.2/download;parseable-parseable-datasource
+ - isovalent-hubble-datasource
+ - isovalent-hubbleprocessancestry-panel
+ - chaosmeshorg-datasource
+ smtp:
+ existingSecret: smtp-auth-secret
+ extraSecretMounts:
+ - name: auth-generic-oauth-secret-mount
+ secretName: auth-generic-oauth-secret
+ defaultMode: 288
+ mountPath: /etc/secrets/auth_generic_oauth
+ readOnly: true
+ defaultDashboardsTimezone: Europe/Berlin
+ datasources:
+ datasources.yaml:
+ apiVersion: 1
+ datasources:
+ - name: Prometheus
+ type: prometheus
+ uid: prometheus
+ url: http://vmselect-vm-victoria-metrics-k8s-stack.monitoring.svc:8481/select/0/prometheus
+ access: proxy
+ - name: ChaosMesh
+ type: chaosmeshorg-datasource
+ url: http://chaos-dashboard.chaosmesh.svc.cluster.local:2333
+ access: proxy
+ isDefault: false
+ - name: Hubble
+ type: isovalent-hubble-datasource
+ uid: hubble
+ access: proxy
+ url: http://hubble-relay.kube-system.svc.cluster.local:80
+ isDefault: false
+ jsonData:
+ serviceMap:
+ datasourceUid: prometheus
+ prometheusDatasourceUid: prometheus
+ - name: Postgres-d4all
+ type: postgres
+ uid: postgres-d4all
+ access: proxy
+ url: pg-cluster-v2-ro.postgres-cluster.svc.cluster.local:5432
+ database: draupnir_synapse
+ user: grafana-ro
+ secureJsonData:
+ password: ENC[AES256_GCM,data:DETaVGkwVldSFLJOLzchuebhYXoEFaGY8u8cPzpGzNpDAT85obOn1bX++xkWT+BdO+srSqRoKMiSCPoNKzY05A==,iv:QLB2mSDOkHt82nfXf7oaT5IT3g2dHJGlyktagqbh/Y4=,tag:PE23C0LIOPD9k90UmdGBkQ==,type:str]
+ isDefault: false
+ jsonData:
+ sslmode: disable
+ maxIdleConnsAuto: true
+ timescaledb: false
+ maxOpenConns: 10
+ maxIdleConns: 10
+ - name: Postgres-connectivity-tester
+ type: postgres
+ uid: postgres-connectivity-tester
+ access: proxy
+ url: pg-cluster-v2-ro.postgres-cluster.svc.cluster.local:5432
+ database: connectivity-tester
+ user: connectivity-tester
+ secureJsonData:
+ password: ENC[AES256_GCM,data:mpOL7F/bXT8bYpvbC6EvMcqsS3SYEpe5oMnDJ0LnJV6H0FLTUZDKknKUMB0y/gz0CQid7CL6HIfsI/udUZrrjg==,iv:0IPq4L4UMhbKYFL7H4EsVoK4J2ynklFLShKpeAirQ5o=,tag:q2UrF0eKEe4PiI2+GbuzQw==,type:str]
+ isDefault: false
+ jsonData:
+ sslmode: disable
+ maxIdleConnsAuto: true
+ timescaledb: false
+ maxOpenConns: 10
+ maxIdleConns: 10
+ ingress:
+ enabled: false
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ external-dns.alpha.kubernetes.io/hostname: grafana.midnightthoughts.space
+ hosts:
+ - grafana.midnightthoughts.space
+ tls:
+ - secretName: grafana.midnightthoughts.space
+ hosts:
+ - grafana.midnightthoughts.space
+ grafana.ini:
+ server:
+ root_url: https://grafana.midnightthoughts.space
+ smtp:
+ enabled: true
+ host: smtp.fastmail.com:465
+ from_address: ops@nordgedanken.dev
+ paths:
+ data: ENC[AES256_GCM,data:0OSHaJsO0dHAKdoF7LvFbdY=,iv:OuChsJWBnNv6Yr1oUjYtXfN6x3dqj4suD+8thdplekc=,tag:YPwd+QkhKxwj00ISJ0j4ig==,type:str]
+ logs: /var/log/grafana
+ plugins: /var/lib/grafana/plugins
+ provisioning: /etc/grafana/provisioning
+ analytics:
+ check_for_updates: true
+ log:
+ mode: console
+ grafana_net:
+ url: https://grafana.net
+ auth:
+ signout_redirect_url: https://auth.midnightthoughts.space/application/o/grafana/end-session/
+ oauth_auto_login: true
+ auth.generic_oauth:
+ name: authentik
+ enabled: true
+ client_id: ENC[AES256_GCM,data:JM89iGq7Wwp2R/uKXuK9iOHuQ/AD/4uFxWdamoSnTTBtNW+BsY20ngJwsdI/KSuFx/A=,iv:lPQH2O2rtqH1McRh4j8NQgYsylFElmGfp4trdhGCvzo=,tag:+nG/Zh0PIDwDUNmuKGwfKw==,type:str]
+ client_secret: ENC[AES256_GCM,data:jjCpvUZX3rMZSgojMNJbpYCcJQ78eZaNC14vXlVFLuL4U+zaP7GWwJNAQjCI3lDt98sp1nNP,iv:+RUFEqfA7Mm7etA99TSwkoYpUIEb6eDYfCEy8Gq8P38=,tag:+bp1D3IJL+mMlKIbrkjGNA==,type:str]
+ scopes: openid email profile
+ auth_url: https://auth.midnightthoughts.space/application/o/authorize/
+ token_url: https://auth.midnightthoughts.space/application/o/token/
+ api_url: https://auth.midnightthoughts.space/application/o/userinfo/
+ role_attribute_path: contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
+ imageRenderer:
+ enabled: true
+ kubeProxy:
+ enabled: false
+ postRenderers:
+ - kustomize:
+ patches:
+ - target:
+ # Ignore these objects from Flux diff as they are mutated from chart hooks
+ kind: (ValidatingWebhookConfiguration|MutatingWebhookConfiguration)
+ name: kube-prometheus-stack-admission
+ patch: |
+ - op: add
+ path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+ value: disabled
+ - target:
+ # Ignore these objects from Flux diff as they are mutated at apply time but not at dry-run time
+ kind: PrometheusRule
+ patch: |
+ - op: add
+ path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+ value: disabled
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzWlNpOEZPNXd5N0x2eVRk
- MzUvSDJCOGJxaXhzU2M3eFQ1SUcwcUJxa3pJCjhvZ2dPVW5HYWJTc1QxWDNHMHB2
- U21ybk9wNVJIQzhmbmlzZTQrQTF1bWcKLS0tIGp4bWQ4M21pNDlRc2R0TW5zWmhO
- end3N1ppQnZ4aTZET0lqaThpQUQwRXMKj3E7qE4w36sSdA3YkdoDjVx1hUbxj1py
- DtR8P4IEC7S1rKgveUqRp6tIDvtgfl7gH8V1dAWqbO3emBRL2w9tsg==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-01-17T11:42:58Z"
- mac: ENC[AES256_GCM,data:/VjM9ovpkxDwPIrHYppiLQk4PF43mt7p3VjylvMMHGWCoI8UWIZsORaH0/IY/1WnFKTrRsGzweF2S3I24LT+sxnv2ZNWxpXU1L0nEEKOMhPcj5jeOwam4C0EWWKJitaBERWKtp8oDISFrBzsvWIYdSQCxJnkjcsObI5PmMlSMX4=,iv:E91abaA5iogFznCkPfcP9Y01mDGlbTVM9GsVSBeYUEQ=,tag:Y8hZAJLAp3AnQDQTVTM8xw==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzWlNpOEZPNXd5N0x2eVRk
+ MzUvSDJCOGJxaXhzU2M3eFQ1SUcwcUJxa3pJCjhvZ2dPVW5HYWJTc1QxWDNHMHB2
+ U21ybk9wNVJIQzhmbmlzZTQrQTF1bWcKLS0tIGp4bWQ4M21pNDlRc2R0TW5zWmhO
+ end3N1ppQnZ4aTZET0lqaThpQUQwRXMKj3E7qE4w36sSdA3YkdoDjVx1hUbxj1py
+ DtR8P4IEC7S1rKgveUqRp6tIDvtgfl7gH8V1dAWqbO3emBRL2w9tsg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-01-17T11:42:58Z"
+ mac: ENC[AES256_GCM,data:/VjM9ovpkxDwPIrHYppiLQk4PF43mt7p3VjylvMMHGWCoI8UWIZsORaH0/IY/1WnFKTrRsGzweF2S3I24LT+sxnv2ZNWxpXU1L0nEEKOMhPcj5jeOwam4C0EWWKJitaBERWKtp8oDISFrBzsvWIYdSQCxJnkjcsObI5PmMlSMX4=,iv:E91abaA5iogFznCkPfcP9Y01mDGlbTVM9GsVSBeYUEQ=,tag:Y8hZAJLAp3AnQDQTVTM8xw==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
- name: vm-grafana
- namespace: monitoring
+ name: vm-grafana
+ namespace: monitoring
spec:
- parentRefs:
- - name: envoy-gateway
- namespace: envoy-gateway
- hostnames:
- - grafana.midnightthoughts.space
- rules:
- - backendRefs:
- - name: vm-grafana
- port: 80
- timeouts:
- request: 240s
- backendRequest: 0s
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - grafana.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: vm-grafana
+ port: 80
+ timeouts:
+ request: 240s
+ backendRequest: 0s
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzWlNpOEZPNXd5N0x2eVRk
- MzUvSDJCOGJxaXhzU2M3eFQ1SUcwcUJxa3pJCjhvZ2dPVW5HYWJTc1QxWDNHMHB2
- U21ybk9wNVJIQzhmbmlzZTQrQTF1bWcKLS0tIGp4bWQ4M21pNDlRc2R0TW5zWmhO
- end3N1ppQnZ4aTZET0lqaThpQUQwRXMKj3E7qE4w36sSdA3YkdoDjVx1hUbxj1py
- DtR8P4IEC7S1rKgveUqRp6tIDvtgfl7gH8V1dAWqbO3emBRL2w9tsg==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-01-17T11:42:58Z"
- mac: ENC[AES256_GCM,data:/VjM9ovpkxDwPIrHYppiLQk4PF43mt7p3VjylvMMHGWCoI8UWIZsORaH0/IY/1WnFKTrRsGzweF2S3I24LT+sxnv2ZNWxpXU1L0nEEKOMhPcj5jeOwam4C0EWWKJitaBERWKtp8oDISFrBzsvWIYdSQCxJnkjcsObI5PmMlSMX4=,iv:E91abaA5iogFznCkPfcP9Y01mDGlbTVM9GsVSBeYUEQ=,tag:Y8hZAJLAp3AnQDQTVTM8xw==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzWlNpOEZPNXd5N0x2eVRk
+ MzUvSDJCOGJxaXhzU2M3eFQ1SUcwcUJxa3pJCjhvZ2dPVW5HYWJTc1QxWDNHMHB2
+ U21ybk9wNVJIQzhmbmlzZTQrQTF1bWcKLS0tIGp4bWQ4M21pNDlRc2R0TW5zWmhO
+ end3N1ppQnZ4aTZET0lqaThpQUQwRXMKj3E7qE4w36sSdA3YkdoDjVx1hUbxj1py
+ DtR8P4IEC7S1rKgveUqRp6tIDvtgfl7gH8V1dAWqbO3emBRL2w9tsg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-01-17T11:42:58Z"
+ mac: ENC[AES256_GCM,data:/VjM9ovpkxDwPIrHYppiLQk4PF43mt7p3VjylvMMHGWCoI8UWIZsORaH0/IY/1WnFKTrRsGzweF2S3I24LT+sxnv2ZNWxpXU1L0nEEKOMhPcj5jeOwam4C0EWWKJitaBERWKtp8oDISFrBzsvWIYdSQCxJnkjcsObI5PmMlSMX4=,iv:E91abaA5iogFznCkPfcP9Y01mDGlbTVM9GsVSBeYUEQ=,tag:Y8hZAJLAp3AnQDQTVTM8xw==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/namespaces/clickstack.yaml b/apps/talos_cluster/namespaces/clickstack.yaml
@@ -5,4 +5,4 @@ metadata:
labels:
pod-security.kubernetes.io/audit: privileged
pod-security.kubernetes.io/enforce: privileged
- pod-security.kubernetes.io/warn: privileged
-\ No newline at end of file
+ pod-security.kubernetes.io/warn: privileged
diff --git a/apps/talos_cluster/namespaces/sentry.yaml b/apps/talos_cluster/namespaces/sentry.yaml
@@ -1,4 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
- name: sentry
-\ No newline at end of file
+ name: sentry
diff --git a/apps/talos_cluster/ntfy/release.yaml b/apps/talos_cluster/ntfy/release.yaml
@@ -30,8 +30,7 @@ spec:
- CHOWN
- FOWNER
- DAC_OVERRIDE
- command:
- ["sh", "-c", "chown -R 1000:1000 /opt/docker/ntfy/cache /etc/ntfy"]
+ command: ["sh", "-c", "chown -R 1000:1000 /opt/docker/ntfy/cache /etc/ntfy"]
volumeMounts:
- name: ntfy-cache
mountPath: /opt/docker/ntfy/cache
diff --git a/apps/talos_cluster/peertube/deployment.yaml b/apps/talos_cluster/peertube/deployment.yaml
@@ -91,7 +91,7 @@ spec:
image: nginxinc/nginx-unprivileged:1.27-alpine
securityContext:
allowPrivilegeEscalation: false
- readOnlyRootFilesystem: false # envsubst template processing writes to /etc/nginx/conf.d/
+ readOnlyRootFilesystem: false # envsubst template processing writes to /etc/nginx/conf.d/
runAsNonRoot: true
runAsUser: 101
runAsGroup: 101
diff --git a/apps/talos_cluster/peertube/secret.yaml b/apps/talos_cluster/peertube/secret.yaml
@@ -1,43 +1,43 @@
apiVersion: v1
kind: Secret
metadata:
- name: peertube-secrets
- namespace: peertube
+ name: peertube-secrets
+ namespace: peertube
type: Opaque
stringData:
- #ENC[AES256_GCM,data:x5GTGfLM1X2OTh4ROERmyfPo6MfDxPrVIlekqoVxf5RtEvE8brA60uO9PlyhHCerUWFmAFb9,iv:Z1cu5L9Xot0EjDh8Ca2DgncHEGdhNT+9D+VEQH1oEHE=,tag:WO5M2G1ALwXtcIJB3PJkaQ==,type:comment]
- PEERTUBE_SECRET: ENC[AES256_GCM,data:2AOadpq3ArxzzMcOFpWJMnCV23tKvIT9S6zbwu4P0ZvXClTLx+fHueN0e1atXW6GEptMDAGOkQjbN8pyFMCt/Q==,iv:GuOVzJWe1koB8SM/2syO5oRNO7arjlxNdhYqwooLNHg=,tag:aigMJZnD0/PhITTmbneBfA==,type:str]
- #ENC[AES256_GCM,data:0krcszGeYWC3/0c5KMgfLA6IALJLRBk4T4oa93AzcNW4z9M7kox0h28uWN7SmVt63cb2U5fRvXXmyh8tKVIcISTV9Dqxxo7J19yHdss=,iv:fHQqbO0ZGCVxO/5g9pMBZ31sro5PZ+p1L9NKjDFHME4=,tag:bEdPLPM1L9FPIXk66Yc81w==,type:comment]
- POSTGRES_PASSWORD: ENC[AES256_GCM,data:5YeR3Uu+ODd96qnmroN9S+VC2Ie/Kbiq8k5xupXnEzCYxDYvQrg3xKU/xxBk4NzQ6GfpB8cUcNrve7E9Srl9,iv:x7XiiqyopyXHbZT27+YHVd6Q+WmCw7pmhIoWSuweKnU=,tag:aa6AaBfVOJH/6vyWkXy3Tw==,type:str]
- #ENC[AES256_GCM,data:SMTQUokPK3kx+ZNkLI8iLK2bBrzE0a+3Co0aKX5afV/fYfcEx6h3JQE3,iv:CL+0HFMJv8RTkwkh7sWf9GeS+q4rhqifTsnRd5zwO3M=,tag:38Y2uvmxavd7hAr/0U+Rxw==,type:comment]
- SMTP_USERNAME: ENC[AES256_GCM,data:afePsswXPFK0tsKGkfAaS9lEOvpfryo5/o8SMhI1,iv:xr6g18NWPzVnAbAHkD8bBZh+XueSMwPpIbWT0P4/O1Y=,tag:mdnl02VaUE72RmySfC7lWg==,type:str]
- SMTP_PASSWORD: ENC[AES256_GCM,data:U8aWsBZMcD2Ec9n0BIGi42odB9qpj6beL/6Hq5hBL6JxiKDtI1vSlrwdoBtn954gsON+Xu2IaWpKXcVijr7vPA==,iv:QfTzIl3JCrGzNyuJdDGV9BWY1cj1Fp5zltgHXOxy9qU=,tag:4t5XlnK2OSNKY/G88ah9JA==,type:str]
- #ENC[AES256_GCM,data:qkQxHNk1f7LxXuNCeweTDrOT5bh0nQ13ufHucKxW9cf2Sa8X/Nal3A==,iv:cg8fXasy261RfLrVvneQ3rVxfh95EBpOh9Naxemp90I=,tag:KvuVIN9je48jsKHt/W21GQ==,type:comment]
- #ENC[AES256_GCM,data:t/JqW5WvfXoH+ZjAdvjO4SXTl0ggSFrZfEhrwcI5xdfE6qQrpIIfxVoivN5VDvin02Hy3P9jDy8Gj9Gq6d3ydQ==,iv:zlSOPWVV8nlP+hYENf8VB6iM1S7DXW/k0dDm3iGIcNE=,tag:zOOzKDxTQfkTXp8LKMSwMQ==,type:comment]
- S3_ENDPOINT: ENC[AES256_GCM,data:8V7LcQHkRisqLpcrTJecoRKE5aJdaaYMvoA+/qo89zbGTQQ=,iv:IKkVAuAc36aKS2EblED+0uICM589IHIL4+NgEC9Fev4=,tag:6vU6zRxnH6Uz94eEi4gJtA==,type:str]
- #ENC[AES256_GCM,data:fLgSFxHMpUxVVAR8BFgS698VTXR+YYDxIpAvEviNOTYZmo2tY27dOrToBHnrgQ4h/pPf0mXw8AUcLyigtLI=,iv:Mzdm1b5OFQIOFk47pdWzu++YY2/F5wjfutUrCVqMHXM=,tag:jfuRPiVp/j+Aj+kFT289Bg==,type:comment]
- S3_HOST: ENC[AES256_GCM,data:3hw2lRBbDg+gOrx9i0E29Dms4Ft7DNIs9djvijj1bWqb4WSemhwgks2EvRo=,iv:A8R9yEldwsALAEWwBjTonlzSkKkqwOCPHlJYsKvhqyI=,tag:x3jzKkHonHf5DcKl7UkcSQ==,type:str]
- S3_REGION: ENC[AES256_GCM,data:JCcxfA==,iv:611n91/fxaKF+6l/c+sPOF/iQpUYmBob0lT6LzhqPVQ=,tag:iAn0Z5nWWHdc8u9PooCGsA==,type:str]
- S3_BUCKET_NAME: ENC[AES256_GCM,data:7EY7t9cPlREmVUHn4u/2Vg==,iv:oYos47/HI6M6umx81LEMYaBk0kV5IqbU5AuuW1/5gBg=,tag:YbQJnUXYssc4p8ex7YRfkA==,type:str]
- S3_ACCESS_KEY_ID: ENC[AES256_GCM,data:0wSX9rDvDyAAhVZkkSEHjG7kTds=,iv:NnuuP5uh8Ox2nnbW9utt+k0M4dXqyZIN58jldsNmPds=,tag:/bzMM6y4fWkybjyEQdh5YA==,type:str]
- S3_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:aNivAmpg0C/dt+XA8l6rmnPdDOxFuOvWUF1LcUcMepR1OsUnLIqLqQ==,iv:scUeY1wCUazQ6dCY4FPdg48gSsRfI+BpWLzuo8H9M38=,tag:X08Et2ovTw5EkOjO+baZMA==,type:str]
+ #ENC[AES256_GCM,data:x5GTGfLM1X2OTh4ROERmyfPo6MfDxPrVIlekqoVxf5RtEvE8brA60uO9PlyhHCerUWFmAFb9,iv:Z1cu5L9Xot0EjDh8Ca2DgncHEGdhNT+9D+VEQH1oEHE=,tag:WO5M2G1ALwXtcIJB3PJkaQ==,type:comment]
+ PEERTUBE_SECRET: ENC[AES256_GCM,data:2AOadpq3ArxzzMcOFpWJMnCV23tKvIT9S6zbwu4P0ZvXClTLx+fHueN0e1atXW6GEptMDAGOkQjbN8pyFMCt/Q==,iv:GuOVzJWe1koB8SM/2syO5oRNO7arjlxNdhYqwooLNHg=,tag:aigMJZnD0/PhITTmbneBfA==,type:str]
+ #ENC[AES256_GCM,data:0krcszGeYWC3/0c5KMgfLA6IALJLRBk4T4oa93AzcNW4z9M7kox0h28uWN7SmVt63cb2U5fRvXXmyh8tKVIcISTV9Dqxxo7J19yHdss=,iv:fHQqbO0ZGCVxO/5g9pMBZ31sro5PZ+p1L9NKjDFHME4=,tag:bEdPLPM1L9FPIXk66Yc81w==,type:comment]
+ POSTGRES_PASSWORD: ENC[AES256_GCM,data:5YeR3Uu+ODd96qnmroN9S+VC2Ie/Kbiq8k5xupXnEzCYxDYvQrg3xKU/xxBk4NzQ6GfpB8cUcNrve7E9Srl9,iv:x7XiiqyopyXHbZT27+YHVd6Q+WmCw7pmhIoWSuweKnU=,tag:aa6AaBfVOJH/6vyWkXy3Tw==,type:str]
+ #ENC[AES256_GCM,data:SMTQUokPK3kx+ZNkLI8iLK2bBrzE0a+3Co0aKX5afV/fYfcEx6h3JQE3,iv:CL+0HFMJv8RTkwkh7sWf9GeS+q4rhqifTsnRd5zwO3M=,tag:38Y2uvmxavd7hAr/0U+Rxw==,type:comment]
+ SMTP_USERNAME: ENC[AES256_GCM,data:afePsswXPFK0tsKGkfAaS9lEOvpfryo5/o8SMhI1,iv:xr6g18NWPzVnAbAHkD8bBZh+XueSMwPpIbWT0P4/O1Y=,tag:mdnl02VaUE72RmySfC7lWg==,type:str]
+ SMTP_PASSWORD: ENC[AES256_GCM,data:U8aWsBZMcD2Ec9n0BIGi42odB9qpj6beL/6Hq5hBL6JxiKDtI1vSlrwdoBtn954gsON+Xu2IaWpKXcVijr7vPA==,iv:QfTzIl3JCrGzNyuJdDGV9BWY1cj1Fp5zltgHXOxy9qU=,tag:4t5XlnK2OSNKY/G88ah9JA==,type:str]
+ #ENC[AES256_GCM,data:qkQxHNk1f7LxXuNCeweTDrOT5bh0nQ13ufHucKxW9cf2Sa8X/Nal3A==,iv:cg8fXasy261RfLrVvneQ3rVxfh95EBpOh9Naxemp90I=,tag:KvuVIN9je48jsKHt/W21GQ==,type:comment]
+ #ENC[AES256_GCM,data:t/JqW5WvfXoH+ZjAdvjO4SXTl0ggSFrZfEhrwcI5xdfE6qQrpIIfxVoivN5VDvin02Hy3P9jDy8Gj9Gq6d3ydQ==,iv:zlSOPWVV8nlP+hYENf8VB6iM1S7DXW/k0dDm3iGIcNE=,tag:zOOzKDxTQfkTXp8LKMSwMQ==,type:comment]
+ S3_ENDPOINT: ENC[AES256_GCM,data:8V7LcQHkRisqLpcrTJecoRKE5aJdaaYMvoA+/qo89zbGTQQ=,iv:IKkVAuAc36aKS2EblED+0uICM589IHIL4+NgEC9Fev4=,tag:6vU6zRxnH6Uz94eEi4gJtA==,type:str]
+ #ENC[AES256_GCM,data:fLgSFxHMpUxVVAR8BFgS698VTXR+YYDxIpAvEviNOTYZmo2tY27dOrToBHnrgQ4h/pPf0mXw8AUcLyigtLI=,iv:Mzdm1b5OFQIOFk47pdWzu++YY2/F5wjfutUrCVqMHXM=,tag:jfuRPiVp/j+Aj+kFT289Bg==,type:comment]
+ S3_HOST: ENC[AES256_GCM,data:3hw2lRBbDg+gOrx9i0E29Dms4Ft7DNIs9djvijj1bWqb4WSemhwgks2EvRo=,iv:A8R9yEldwsALAEWwBjTonlzSkKkqwOCPHlJYsKvhqyI=,tag:x3jzKkHonHf5DcKl7UkcSQ==,type:str]
+ S3_REGION: ENC[AES256_GCM,data:JCcxfA==,iv:611n91/fxaKF+6l/c+sPOF/iQpUYmBob0lT6LzhqPVQ=,tag:iAn0Z5nWWHdc8u9PooCGsA==,type:str]
+ S3_BUCKET_NAME: ENC[AES256_GCM,data:7EY7t9cPlREmVUHn4u/2Vg==,iv:oYos47/HI6M6umx81LEMYaBk0kV5IqbU5AuuW1/5gBg=,tag:YbQJnUXYssc4p8ex7YRfkA==,type:str]
+ S3_ACCESS_KEY_ID: ENC[AES256_GCM,data:0wSX9rDvDyAAhVZkkSEHjG7kTds=,iv:NnuuP5uh8Ox2nnbW9utt+k0M4dXqyZIN58jldsNmPds=,tag:/bzMM6y4fWkybjyEQdh5YA==,type:str]
+ S3_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:aNivAmpg0C/dt+XA8l6rmnPdDOxFuOvWUF1LcUcMepR1OsUnLIqLqQ==,iv:scUeY1wCUazQ6dCY4FPdg48gSsRfI+BpWLzuo8H9M38=,tag:X08Et2ovTw5EkOjO+baZMA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBicmJZQWVZRFlZNkQwamlw
- TXBDMjdxWjdpOS9YWEU0OFJhR1JUN3VsZG5RCnc0cG13UUt1ZXpJbHdaUDVlNVRN
- dEdGOWhpNXlSSGU4QVkvMGhicWMyaHcKLS0tIDh4QSsvM0lqOThGc2l4NmM0ZU9Y
- MFlKYnhuYjVMU29ES05rM294cUN5TWcKzjgLbVM6baupM7DwELuofeAlXtltL68A
- BCyn+w1vzj3CmhVSEx+u8dshlpF1u8NeZe1m20BEDYChg/eNoGFHWg==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-01T17:36:57Z"
- mac: ENC[AES256_GCM,data:HGvlYWK9VbvmHh/SfruCX/ZiV8V8QS6e+KzrsAnnkGrEYckPbe/IB7NF3RJmDK/fb/B+Y6y1qdrXMygXax6y3tiUyu42H/97Kj6mjDFzTjO0TWbodK68vmLrLM2775IDdz2WMAV0cq03ddVUPkIHI6roRI0QrA1AZAk4xyw2Feg=,iv:eS5MwiWuyottGkqlJOcZtLeWHjnqwOxUg/M3wG58ZpY=,tag:SwFFGZ2rBnuQIEWot+2JPA==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBicmJZQWVZRFlZNkQwamlw
+ TXBDMjdxWjdpOS9YWEU0OFJhR1JUN3VsZG5RCnc0cG13UUt1ZXpJbHdaUDVlNVRN
+ dEdGOWhpNXlSSGU4QVkvMGhicWMyaHcKLS0tIDh4QSsvM0lqOThGc2l4NmM0ZU9Y
+ MFlKYnhuYjVMU29ES05rM294cUN5TWcKzjgLbVM6baupM7DwELuofeAlXtltL68A
+ BCyn+w1vzj3CmhVSEx+u8dshlpF1u8NeZe1m20BEDYChg/eNoGFHWg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-01T17:36:57Z"
+ mac: ENC[AES256_GCM,data:HGvlYWK9VbvmHh/SfruCX/ZiV8V8QS6e+KzrsAnnkGrEYckPbe/IB7NF3RJmDK/fb/B+Y6y1qdrXMygXax6y3tiUyu42H/97Kj6mjDFzTjO0TWbodK68vmLrLM2775IDdz2WMAV0cq03ddVUPkIHI6roRI0QrA1AZAk4xyw2Feg=,iv:eS5MwiWuyottGkqlJOcZtLeWHjnqwOxUg/M3wG58ZpY=,tag:SwFFGZ2rBnuQIEWot+2JPA==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/persephone/config.yaml b/apps/talos_cluster/persephone/config.yaml
@@ -1,27 +1,27 @@
apiVersion: v1
kind: ConfigMap
metadata:
- name: persephone-config
- namespace: persephone
+ name: persephone-config
+ namespace: persephone
data:
- config.yaml: ENC[AES256_GCM,data:NNAtKaEHrLncFX0XdEdvxxI6jCWY/dRjGuQZpfuIas+byc+47fL2QFZHQeEleDvCgbU/WB3x35OKm0TG3SXwjyz/NwsN7ZjoR8puH4K16JrH6+mU653utJtJoB9Q0Z8jZbuty+tL8aZ7+Fkj5PG3qs/NVz0r1hLPa757VjqzSdYrIapOgaljnPOvR34KyiVNbhNKP9fFpKyl4zJ7tppqdOiilXlkXPtGa4qHIXabTAfCkl938XtNetqILfKgqliYaGGuifCnDjgPLQiwfFtYrg0hnKasel2rqcOWtSdU20OzvezlevwDp9SeWrG3mvJOyodgvjcmnr8kzUYMjyqoTRgflDY6XEuF02oPOEdA4QbieCUWvyjNe+II+jsYYVxisFcHd/uoHEO3si+kjCjM2lw2sKV6PJetz3cl0hQGNAhTf6tKnpYNu5/qI3bXAJfW3lbie+yxH957P7xzPNQQpksRfcZU4IhWHVbSOg==,iv:oqGz8SLm341NJmoKZm1LZQVFAEZbDVf2R6V6fCKbuGA=,tag:Fu/0ZuJ+1aGu5WHY+Y7W2Q==,type:str]
+ config.yaml: ENC[AES256_GCM,data:NNAtKaEHrLncFX0XdEdvxxI6jCWY/dRjGuQZpfuIas+byc+47fL2QFZHQeEleDvCgbU/WB3x35OKm0TG3SXwjyz/NwsN7ZjoR8puH4K16JrH6+mU653utJtJoB9Q0Z8jZbuty+tL8aZ7+Fkj5PG3qs/NVz0r1hLPa757VjqzSdYrIapOgaljnPOvR34KyiVNbhNKP9fFpKyl4zJ7tppqdOiilXlkXPtGa4qHIXabTAfCkl938XtNetqILfKgqliYaGGuifCnDjgPLQiwfFtYrg0hnKasel2rqcOWtSdU20OzvezlevwDp9SeWrG3mvJOyodgvjcmnr8kzUYMjyqoTRgflDY6XEuF02oPOEdA4QbieCUWvyjNe+II+jsYYVxisFcHd/uoHEO3si+kjCjM2lw2sKV6PJetz3cl0hQGNAhTf6tKnpYNu5/qI3bXAJfW3lbie+yxH957P7xzPNQQpksRfcZU4IhWHVbSOg==,iv:oqGz8SLm341NJmoKZm1LZQVFAEZbDVf2R6V6fCKbuGA=,tag:Fu/0ZuJ+1aGu5WHY+Y7W2Q==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwZWxScU5obEExNzRwTk4y
- WTZ0NFNwSG1sSEdqa0JTdjZvMTR2K2YwNFNZCm9sNnhKcDcraEY2TlQ5eDFSMHhZ
- QS8xelgzQXhzNnlYTzMyWFdoeUJXbEEKLS0tIHFBc3FaVkE1TnBFU1NSK2lBYlhG
- c2tvYUVEUm42Vi9uV2xTSXVLb2lueFkKMFfA6ifC10MzY7Iuc0+ii50spxARkJoD
- DipGPM4x2GUMW4/nKPlnYEtdtR+YWOrnDTSZwlfti0is9Rqoz1A+Aw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T20:40:18Z"
- mac: ENC[AES256_GCM,data:HM3Dq9Kjt/+pS031r+Mo1SGpvgm8SgRDU9a+spnKAjGIDcBrBXbqz/WjziQCPHe75q3GFab77p9Yb8QECiH5lMW39TIk0ldqsAi8Sj0yjtZ1Ii6X3uXyxcldRCXI3IVDiqUEvsrCmlQpOoiDbZtUg2tXuzlZEVlwQnPNG+8dN1Y=,iv:Z2675OR3adfnVK6hptSdrL+CFpk+Hj+nJDXwp3Y+l4A=,tag:efQue3buKjkaaPj59k8ypQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwZWxScU5obEExNzRwTk4y
+ WTZ0NFNwSG1sSEdqa0JTdjZvMTR2K2YwNFNZCm9sNnhKcDcraEY2TlQ5eDFSMHhZ
+ QS8xelgzQXhzNnlYTzMyWFdoeUJXbEEKLS0tIHFBc3FaVkE1TnBFU1NSK2lBYlhG
+ c2tvYUVEUm42Vi9uV2xTSXVLb2lueFkKMFfA6ifC10MzY7Iuc0+ii50spxARkJoD
+ DipGPM4x2GUMW4/nKPlnYEtdtR+YWOrnDTSZwlfti0is9Rqoz1A+Aw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T20:40:18Z"
+ mac: ENC[AES256_GCM,data:HM3Dq9Kjt/+pS031r+Mo1SGpvgm8SgRDU9a+spnKAjGIDcBrBXbqz/WjziQCPHe75q3GFab77p9Yb8QECiH5lMW39TIk0ldqsAi8Sj0yjtZ1Ii6X3uXyxcldRCXI3IVDiqUEvsrCmlQpOoiDbZtUg2tXuzlZEVlwQnPNG+8dN1Y=,iv:Z2675OR3adfnVK6hptSdrL+CFpk+Hj+nJDXwp3Y+l4A=,tag:efQue3buKjkaaPj59k8ypQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/persephone/deployment.yaml b/apps/talos_cluster/persephone/deployment.yaml
@@ -26,7 +26,7 @@ spec:
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
- readOnlyRootFilesystem: false # app writes to ./uploads/tmp/ relative to workdir
+ readOnlyRootFilesystem: false # app writes to ./uploads/tmp/ relative to workdir
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
diff --git a/clusters/talos_cluster/flux-system/gotk-components.yaml b/clusters/talos_cluster/flux-system/gotk-components.yaml
@@ -1,5 +1,5 @@
# This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.7.5
+# Flux Version: v2.8.0
# Components: source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller
apiVersion: v1
kind: Namespace
@@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/warn-version: latest
name: flux-system
@@ -18,7 +18,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: allow-egress
namespace: flux-system
spec:
@@ -38,7 +38,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: allow-scraping
namespace: flux-system
spec:
@@ -58,7 +58,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: allow-webhooks
namespace: flux-system
spec:
@@ -77,7 +77,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: critical-pods-flux-system
namespace: flux-system
spec:
@@ -97,7 +97,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: crd-controller-flux-system
rules:
- apiGroups:
@@ -203,7 +203,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
name: flux-edit-flux-system
@@ -230,7 +230,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -256,7 +256,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: cluster-reconciler-flux-system
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -276,7 +276,7 @@ metadata:
labels:
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: crd-controller-flux-system
roleRef:
apiGroup: rbac.authorization.k8s.io
@@ -314,7 +314,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: buckets.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -680,10 +680,28 @@ spec:
storage: true
subresources:
status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.19.0
+ labels:
+ app.kubernetes.io/component: source-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ name: externalartifacts.source.toolkit.fluxcd.io
+spec:
+ group: source.toolkit.fluxcd.io
+ names:
+ kind: ExternalArtifact
+ listKind: ExternalArtifactList
+ plural: externalartifacts
+ singular: externalartifact
+ scope: Namespaced
+ versions:
- additionalPrinterColumns:
- - jsonPath: .spec.endpoint
- name: Endpoint
- type: string
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
@@ -693,12 +711,13 @@ spec:
- jsonPath: .status.conditions[?(@.type=="Ready")].message
name: Status
type: string
- deprecated: true
- deprecationWarning: v1beta2 Bucket is deprecated, upgrade to v1
- name: v1beta2
+ - jsonPath: .spec.sourceRef.name
+ name: Source
+ type: string
+ name: v1
schema:
openAPIV3Schema:
- description: Bucket is the Schema for the buckets API.
+ description: ExternalArtifact is the Schema for the external artifacts API
properties:
apiVersion:
description: |-
@@ -718,215 +737,35 @@ spec:
metadata:
type: object
spec:
- description: |-
- BucketSpec specifies the required configuration to produce an Artifact for
- an object storage bucket.
+ description: ExternalArtifactSpec defines the desired state of ExternalArtifact
properties:
- accessFrom:
- description: |-
- AccessFrom specifies an Access Control List for allowing cross-namespace
- references to this object.
- NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
- properties:
- namespaceSelectors:
- description: |-
- NamespaceSelectors is the list of namespace selectors to which this ACL applies.
- Items in this list are evaluated using a logical OR operation.
- items:
- description: |-
- NamespaceSelector selects the namespaces to which this ACL applies.
- An empty map of MatchLabels matches all namespaces in a cluster.
- properties:
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- type: array
- required:
- - namespaceSelectors
- type: object
- bucketName:
- description: BucketName is the name of the object storage bucket.
- type: string
- certSecretRef:
+ sourceRef:
description: |-
- CertSecretRef can be given the name of a Secret containing
- either or both of
-
- - a PEM-encoded client certificate (`tls.crt`) and private
- key (`tls.key`);
- - a PEM-encoded CA certificate (`ca.crt`)
-
- and whichever are supplied, will be used for connecting to the
- bucket. The client cert and key are useful if you are
- authenticating with a certificate; the CA cert is useful if
- you are using a self-signed server certificate. The Secret must
- be of type `Opaque` or `kubernetes.io/tls`.
-
- This field is only supported for the `generic` provider.
+ SourceRef points to the Kubernetes custom resource for
+ which the artifact is generated.
properties:
- name:
- description: Name of the referent.
+ apiVersion:
+ description: API version of the referent, if not specified the Kubernetes preferred version will be used.
type: string
- required:
- - name
- type: object
- endpoint:
- description: Endpoint is the object storage address the BucketName is located at.
- type: string
- ignore:
- description: |-
- Ignore overrides the set of excluded patterns in the .sourceignore format
- (which is the same as .gitignore). If not provided, a default will be used,
- consult the documentation for your version to find out what those are.
- type: string
- insecure:
- description: Insecure allows connecting to a non-TLS HTTP Endpoint.
- type: boolean
- interval:
- description: |-
- Interval at which the Bucket Endpoint is checked for updates.
- This interval is approximate and may be subject to jitter to ensure
- efficient use of resources.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- prefix:
- description: Prefix to use for server-side filtering of files in the Bucket.
- type: string
- provider:
- default: generic
- description: |-
- Provider of the object storage bucket.
- Defaults to 'generic', which expects an S3 (API) compatible object
- storage.
- enum:
- - generic
- - aws
- - gcp
- - azure
- type: string
- proxySecretRef:
- description: |-
- ProxySecretRef specifies the Secret containing the proxy configuration
- to use while communicating with the Bucket server.
- properties:
- name:
- description: Name of the referent.
+ kind:
+ description: Kind of the referent.
type: string
- required:
- - name
- type: object
- region:
- description: Region of the Endpoint where the BucketName is located in.
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Secret containing authentication credentials
- for the Bucket.
- properties:
name:
description: Name of the referent.
type: string
- required:
- - name
- type: object
- sts:
- description: |-
- STS specifies the required configuration to use a Security Token
- Service for fetching temporary credentials to authenticate in a
- Bucket provider.
-
- This field is only supported for the `aws` and `generic` providers.
- properties:
- certSecretRef:
- description: |-
- CertSecretRef can be given the name of a Secret containing
- either or both of
-
- - a PEM-encoded client certificate (`tls.crt`) and private
- key (`tls.key`);
- - a PEM-encoded CA certificate (`ca.crt`)
-
- and whichever are supplied, will be used for connecting to the
- STS endpoint. The client cert and key are useful if you are
- authenticating with a certificate; the CA cert is useful if
- you are using a self-signed server certificate. The Secret must
- be of type `Opaque` or `kubernetes.io/tls`.
-
- This field is only supported for the `ldap` provider.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- endpoint:
- description: |-
- Endpoint is the HTTP/S endpoint of the Security Token Service from
- where temporary credentials will be fetched.
- pattern: ^(http|https)://.*$
- type: string
- provider:
- description: Provider of the Security Token Service.
- enum:
- - aws
- - ldap
+ namespace:
+ description: Namespace of the referent, when not specified it acts as LocalObjectReference.
type: string
- secretRef:
- description: |-
- SecretRef specifies the Secret containing authentication credentials
- for the STS endpoint. This Secret must contain the fields `username`
- and `password` and is supported only for the `ldap` provider.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
required:
- - endpoint
- - provider
+ - kind
+ - name
type: object
- suspend:
- description: |-
- Suspend tells the controller to suspend the reconciliation of this
- Bucket.
- type: boolean
- timeout:
- default: 60s
- description: Timeout for fetch operations, defaults to 60s.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
- type: string
- required:
- - bucketName
- - endpoint
- - interval
type: object
- x-kubernetes-validations:
- - message: STS configuration is only supported for the 'aws' and 'generic' Bucket providers
- rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)
- - message: '''aws'' is the only supported STS provider for the ''aws'' Bucket provider'
- rule: self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'
- - message: '''ldap'' is the only supported STS provider for the ''generic'' Bucket provider'
- rule: self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'
- - message: spec.sts.secretRef is not required for the 'aws' STS provider
- rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.secretRef)'
- - message: spec.sts.certSecretRef is not required for the 'aws' STS provider
- rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.certSecretRef)'
status:
- default:
- observedGeneration: -1
- description: BucketStatus records the observed state of a Bucket.
+ description: ExternalArtifactStatus defines the observed state of ExternalArtifact
properties:
artifact:
- description: Artifact represents the last successful Bucket reconciliation.
+ description: Artifact represents the output of an ExternalArtifact reconciliation.
properties:
digest:
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
@@ -972,220 +811,7 @@ spec:
- url
type: object
conditions:
- description: Conditions holds the conditions for the Bucket.
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: ObservedGeneration is the last observed generation of the Bucket object.
- format: int64
- type: integer
- observedIgnore:
- description: |-
- ObservedIgnore is the observed exclusion patterns used for constructing
- the source artifact.
- type: string
- url:
- description: |-
- URL is the dynamic fetch link for the latest Artifact.
- It is provided on a "best effort" basis, and using the precise
- BucketStatus.Artifact data is recommended.
- type: string
- type: object
- type: object
- served: true
- storage: false
- subresources:
- status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- controller-gen.kubebuilder.io/version: v0.19.0
- labels:
- app.kubernetes.io/component: source-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: externalartifacts.source.toolkit.fluxcd.io
-spec:
- group: source.toolkit.fluxcd.io
- names:
- kind: ExternalArtifact
- listKind: ExternalArtifactList
- plural: externalartifacts
- singular: externalartifact
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- - jsonPath: .spec.sourceRef.name
- name: Source
- type: string
- name: v1
- schema:
- openAPIV3Schema:
- description: ExternalArtifact is the Schema for the external artifacts API
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: ExternalArtifactSpec defines the desired state of ExternalArtifact
- properties:
- sourceRef:
- description: |-
- SourceRef points to the Kubernetes custom resource for
- which the artifact is generated.
- properties:
- apiVersion:
- description: API version of the referent, if not specified the Kubernetes preferred version will be used.
- type: string
- kind:
- description: Kind of the referent.
- type: string
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: Namespace of the referent, when not specified it acts as LocalObjectReference.
- type: string
- required:
- - kind
- - name
- type: object
- type: object
- status:
- description: ExternalArtifactStatus defines the observed state of ExternalArtifact
- properties:
- artifact:
- description: Artifact represents the output of an ExternalArtifact reconciliation.
- properties:
- digest:
- description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
- pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
- type: string
- lastUpdateTime:
- description: |-
- LastUpdateTime is the timestamp corresponding to the last update of the
- Artifact.
- format: date-time
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata holds upstream information such as OCI annotations.
- type: object
- path:
- description: |-
- Path is the relative file path of the Artifact. It can be used to locate
- the file in the root of the Artifact storage on the local file system of
- the controller managing the Source.
- type: string
- revision:
- description: |-
- Revision is a human-readable identifier traceable in the origin source
- system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
- type: string
- size:
- description: Size is the number of bytes in the file.
- format: int64
- type: integer
- url:
- description: |-
- URL is the HTTP address of the Artifact as exposed by the controller
- managing the Source. It can be used to retrieve the Artifact for
- consumption, e.g. by another controller applying the Artifact contents.
- type: string
- required:
- - digest
- - lastUpdateTime
- - path
- - revision
- - url
- type: object
- conditions:
- description: Conditions holds the conditions for the ExternalArtifact.
+ description: Conditions holds the conditions for the ExternalArtifact.
items:
description: Condition contains details for one aspect of the current state of this API Resource.
properties:
@@ -1256,7 +882,7 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: gitrepositories.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
@@ -1724,9 +1350,41 @@ spec:
storage: true
subresources:
status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.19.0
+ labels:
+ app.kubernetes.io/component: source-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ name: helmcharts.source.toolkit.fluxcd.io
+spec:
+ group: source.toolkit.fluxcd.io
+ names:
+ kind: HelmChart
+ listKind: HelmChartList
+ plural: helmcharts
+ shortNames:
+ - hc
+ singular: helmchart
+ scope: Namespaced
+ versions:
- additionalPrinterColumns:
- - jsonPath: .spec.url
- name: URL
+ - jsonPath: .spec.chart
+ name: Chart
+ type: string
+ - jsonPath: .spec.version
+ name: Version
+ type: string
+ - jsonPath: .spec.sourceRef.kind
+ name: Source Kind
+ type: string
+ - jsonPath: .spec.sourceRef.name
+ name: Source Name
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
@@ -1737,12 +1395,10 @@ spec:
- jsonPath: .status.conditions[?(@.type=="Ready")].message
name: Status
type: string
- deprecated: true
- deprecationWarning: v1beta2 GitRepository is deprecated, upgrade to v1
- name: v1beta2
+ name: v1
schema:
openAPIV3Schema:
- description: GitRepository is the Schema for the gitrepositories API.
+ description: HelmChart is the Schema for the helmcharts API.
properties:
apiVersion:
description: |-
@@ -1762,170 +1418,120 @@ spec:
metadata:
type: object
spec:
- description: |-
- GitRepositorySpec specifies the required configuration to produce an
- Artifact for a Git repository.
+ description: HelmChartSpec specifies the desired state of a Helm chart.
properties:
- accessFrom:
+ chart:
description: |-
- AccessFrom specifies an Access Control List for allowing cross-namespace
- references to this object.
- NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
- properties:
- namespaceSelectors:
- description: |-
- NamespaceSelectors is the list of namespace selectors to which this ACL applies.
- Items in this list are evaluated using a logical OR operation.
- items:
- description: |-
- NamespaceSelector selects the namespaces to which this ACL applies.
- An empty map of MatchLabels matches all namespaces in a cluster.
- properties:
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- type: array
- required:
- - namespaceSelectors
- type: object
- gitImplementation:
- default: go-git
- description: |-
- GitImplementation specifies which Git client library implementation to
- use. Defaults to 'go-git', valid values are ('go-git', 'libgit2').
- Deprecated: gitImplementation is deprecated now that 'go-git' is the
- only supported implementation.
- enum:
- - go-git
- - libgit2
- type: string
- ignore:
- description: |-
- Ignore overrides the set of excluded patterns in the .sourceignore format
- (which is the same as .gitignore). If not provided, a default will be used,
- consult the documentation for your version to find out what those are.
+ Chart is the name or path the Helm chart is available at in the
+ SourceRef.
type: string
- include:
+ ignoreMissingValuesFiles:
description: |-
- Include specifies a list of GitRepository resources which Artifacts
- should be included in the Artifact produced for this GitRepository.
- items:
- description: |-
- GitRepositoryInclude specifies a local reference to a GitRepository which
- Artifact (sub-)contents must be included, and where they should be placed.
- properties:
- fromPath:
- description: |-
- FromPath specifies the path to copy contents from, defaults to the root
- of the Artifact.
- type: string
- repository:
- description: |-
- GitRepositoryRef specifies the GitRepository which Artifact contents
- must be included.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- toPath:
- description: |-
- ToPath specifies the path to copy contents to, defaults to the name of
- the GitRepositoryRef.
- type: string
- required:
- - repository
- type: object
- type: array
+ IgnoreMissingValuesFiles controls whether to silently ignore missing values
+ files rather than failing.
+ type: boolean
interval:
- description: Interval at which to check the GitRepository for updates.
+ description: |-
+ Interval at which the HelmChart SourceRef is checked for updates.
+ This interval is approximate and may be subject to jitter to ensure
+ efficient use of resources.
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
type: string
- recurseSubmodules:
- description: |-
- RecurseSubmodules enables the initialization of all submodules within
- the GitRepository as cloned from the URL, using their default settings.
- type: boolean
- ref:
+ reconcileStrategy:
+ default: ChartVersion
description: |-
- Reference specifies the Git reference to resolve and monitor for
- changes, defaults to the 'master' branch.
+ ReconcileStrategy determines what enables the creation of a new artifact.
+ Valid values are ('ChartVersion', 'Revision').
+ See the documentation of the values for an explanation on their behavior.
+ Defaults to ChartVersion when omitted.
+ enum:
+ - ChartVersion
+ - Revision
+ type: string
+ sourceRef:
+ description: SourceRef is the reference to the Source the chart is available at.
properties:
- branch:
- description: Branch to check out, defaults to 'master' if no other field is defined.
- type: string
- commit:
- description: |-
- Commit SHA to check out, takes precedence over all reference fields.
-
- This can be combined with Branch to shallow clone the branch, in which
- the commit is expected to exist.
+ apiVersion:
+ description: APIVersion of the referent.
type: string
- name:
+ kind:
description: |-
- Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
-
- It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
- Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
- type: string
- semver:
- description: SemVer tag expression to check out, takes precedence over Tag.
- type: string
- tag:
- description: Tag to check out, takes precedence over Branch.
+ Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
+ 'Bucket').
+ enum:
+ - HelmRepository
+ - GitRepository
+ - Bucket
type: string
- type: object
- secretRef:
- description: |-
- SecretRef specifies the Secret containing authentication credentials for
- the GitRepository.
- For HTTPS repositories the Secret must contain 'username' and 'password'
- fields for basic auth or 'bearerToken' field for token auth.
- For SSH repositories the Secret must contain 'identity'
- and 'known_hosts' fields.
- properties:
name:
description: Name of the referent.
type: string
required:
+ - kind
- name
type: object
suspend:
description: |-
Suspend tells the controller to suspend the reconciliation of this
- GitRepository.
+ source.
type: boolean
- timeout:
- default: 60s
- description: Timeout for Git operations like cloning, defaults to 60s.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
- type: string
- url:
- description: URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
- pattern: ^(http|https|ssh)://.*$
- type: string
+ valuesFiles:
+ description: |-
+ ValuesFiles is an alternative list of values files to use as the chart
+ values (values.yaml is not included by default), expected to be a
+ relative path in the SourceRef.
+ Values files are merged in the order of this list with the last file
+ overriding the first. Ignored when omitted.
+ items:
+ type: string
+ type: array
verify:
description: |-
- Verification specifies the configuration to verify the Git commit
- signature(s).
+ Verify contains the secret name containing the trusted public keys
+ used to verify the signature and specifies which provider to use to check
+ whether OCI image is authentic.
+ This field is only supported when using HelmRepository source with spec.type 'oci'.
+ Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
properties:
- mode:
- description: Mode specifies what Git object should be verified, currently ('head').
+ matchOIDCIdentity:
+ description: |-
+ MatchOIDCIdentity specifies the identity matching criteria to use
+ while verifying an OCI artifact which was signed using Cosign keyless
+ signing. The artifact's identity is deemed to be verified if any of the
+ specified matchers match against the identity.
+ items:
+ description: |-
+ OIDCIdentityMatch specifies options for verifying the certificate identity,
+ i.e. the issuer and the subject of the certificate.
+ properties:
+ issuer:
+ description: |-
+ Issuer specifies the regex pattern to match against to verify
+ the OIDC issuer in the Fulcio certificate. The pattern must be a
+ valid Go regular expression.
+ type: string
+ subject:
+ description: |-
+ Subject specifies the regex pattern to match against to verify
+ the identity subject in the Fulcio certificate. The pattern must
+ be a valid Go regular expression.
+ type: string
+ required:
+ - issuer
+ - subject
+ type: object
+ type: array
+ provider:
+ default: cosign
+ description: Provider specifies the technology used to sign the OCI Artifact.
enum:
- - head
+ - cosign
+ - notation
type: string
secretRef:
description: |-
- SecretRef specifies the Secret containing the public keys of trusted Git
- authors.
+ SecretRef specifies the Kubernetes Secret containing the
+ trusted public keys.
properties:
name:
description: Name of the referent.
@@ -1934,20 +1540,29 @@ spec:
- name
type: object
required:
- - mode
- - secretRef
+ - provider
type: object
+ version:
+ default: '*'
+ description: |-
+ Version is the chart version semver expression, ignored for charts from
+ GitRepository and Bucket sources. Defaults to latest when omitted.
+ type: string
required:
+ - chart
- interval
- - url
+ - sourceRef
type: object
+ x-kubernetes-validations:
+ - message: spec.verify is only supported when spec.sourceRef.kind is 'HelmRepository'
+ rule: '!has(self.verify) || self.sourceRef.kind == ''HelmRepository'''
status:
default:
observedGeneration: -1
- description: GitRepositoryStatus records the observed state of a Git repository.
+ description: HelmChartStatus records the observed state of the HelmChart.
properties:
artifact:
- description: Artifact represents the last successful GitRepository reconciliation.
+ description: Artifact represents the output of the last successful reconciliation.
properties:
digest:
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
@@ -1993,7 +1608,7 @@ spec:
- url
type: object
conditions:
- description: Conditions holds the conditions for the GitRepository.
+ description: Conditions holds the conditions for the HelmChart.
items:
description: Condition contains details for one aspect of the current state of this API Resource.
properties:
@@ -2048,138 +1663,46 @@ spec:
- type
type: object
type: array
- contentConfigChecksum:
- description: |-
- ContentConfigChecksum is a checksum of all the configurations related to
- the content of the source artifact:
- - .spec.ignore
- - .spec.recurseSubmodules
- - .spec.included and the checksum of the included artifacts
- observed in .status.observedGeneration version of the object. This can
- be used to determine if the content of the included repository has
- changed.
- It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
-
- Deprecated: Replaced with explicit fields for observed artifact content
- config in the status.
+ lastHandledReconcileAt:
+ description: |-
+ LastHandledReconcileAt holds the value of the most recent
+ reconcile request value, so a change of the annotation value
+ can be detected.
type: string
- includedArtifacts:
+ observedChartName:
description: |-
- IncludedArtifacts contains a list of the last successfully included
- Artifacts as instructed by GitRepositorySpec.Include.
+ ObservedChartName is the last observed chart name as specified by the
+ resolved chart reference.
+ type: string
+ observedGeneration:
+ description: |-
+ ObservedGeneration is the last observed generation of the HelmChart
+ object.
+ format: int64
+ type: integer
+ observedSourceArtifactRevision:
+ description: |-
+ ObservedSourceArtifactRevision is the last observed Artifact.Revision
+ of the HelmChartSpec.SourceRef.
+ type: string
+ observedValuesFiles:
+ description: |-
+ ObservedValuesFiles are the observed value files of the last successful
+ reconciliation.
+ It matches the chart in the last successfully reconciled artifact.
items:
- description: Artifact represents the output of a Source reconciliation.
- properties:
- digest:
- description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
- pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
- type: string
- lastUpdateTime:
- description: |-
- LastUpdateTime is the timestamp corresponding to the last update of the
- Artifact.
- format: date-time
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata holds upstream information such as OCI annotations.
- type: object
- path:
- description: |-
- Path is the relative file path of the Artifact. It can be used to locate
- the file in the root of the Artifact storage on the local file system of
- the controller managing the Source.
- type: string
- revision:
- description: |-
- Revision is a human-readable identifier traceable in the origin source
- system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
- type: string
- size:
- description: Size is the number of bytes in the file.
- format: int64
- type: integer
- url:
- description: |-
- URL is the HTTP address of the Artifact as exposed by the controller
- managing the Source. It can be used to retrieve the Artifact for
- consumption, e.g. by another controller applying the Artifact contents.
- type: string
- required:
- - digest
- - lastUpdateTime
- - path
- - revision
- - url
- type: object
- type: array
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: |-
- ObservedGeneration is the last observed generation of the GitRepository
- object.
- format: int64
- type: integer
- observedIgnore:
- description: |-
- ObservedIgnore is the observed exclusion patterns used for constructing
- the source artifact.
- type: string
- observedInclude:
- description: |-
- ObservedInclude is the observed list of GitRepository resources used to
- to produce the current Artifact.
- items:
- description: |-
- GitRepositoryInclude specifies a local reference to a GitRepository which
- Artifact (sub-)contents must be included, and where they should be placed.
- properties:
- fromPath:
- description: |-
- FromPath specifies the path to copy contents from, defaults to the root
- of the Artifact.
- type: string
- repository:
- description: |-
- GitRepositoryRef specifies the GitRepository which Artifact contents
- must be included.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- toPath:
- description: |-
- ToPath specifies the path to copy contents to, defaults to the name of
- the GitRepositoryRef.
- type: string
- required:
- - repository
- type: object
+ type: string
type: array
- observedRecurseSubmodules:
- description: |-
- ObservedRecurseSubmodules is the observed resource submodules
- configuration used to produce the current Artifact.
- type: boolean
url:
description: |-
URL is the dynamic fetch link for the latest Artifact.
It is provided on a "best effort" basis, and using the precise
- GitRepositoryStatus.Artifact data is recommended.
+ BucketStatus.Artifact data is recommended.
type: string
type: object
type: object
served: true
- storage: false
+ storage: true
subresources:
status: {}
---
@@ -2192,31 +1715,22 @@ metadata:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: helmcharts.source.toolkit.fluxcd.io
+ app.kubernetes.io/version: v2.8.0
+ name: helmrepositories.source.toolkit.fluxcd.io
spec:
group: source.toolkit.fluxcd.io
names:
- kind: HelmChart
- listKind: HelmChartList
- plural: helmcharts
+ kind: HelmRepository
+ listKind: HelmRepositoryList
+ plural: helmrepositories
shortNames:
- - hc
- singular: helmchart
+ - helmrepo
+ singular: helmrepository
scope: Namespaced
versions:
- additionalPrinterColumns:
- - jsonPath: .spec.chart
- name: Chart
- type: string
- - jsonPath: .spec.version
- name: Version
- type: string
- - jsonPath: .spec.sourceRef.kind
- name: Source Kind
- type: string
- - jsonPath: .spec.sourceRef.name
- name: Source Name
+ - jsonPath: .spec.url
+ name: URL
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
@@ -2230,7 +1744,7 @@ spec:
name: v1
schema:
openAPIV3Schema:
- description: HelmChart is the Schema for the helmcharts API.
+ description: HelmRepository is the Schema for the helmrepositories API.
properties:
apiVersion:
description: |-
@@ -2250,148 +1764,147 @@ spec:
metadata:
type: object
spec:
- description: HelmChartSpec specifies the desired state of a Helm chart.
+ description: |-
+ HelmRepositorySpec specifies the required configuration to produce an
+ Artifact for a Helm repository index YAML.
properties:
- chart:
+ accessFrom:
description: |-
- Chart is the name or path the Helm chart is available at in the
- SourceRef.
- type: string
- ignoreMissingValuesFiles:
+ AccessFrom specifies an Access Control List for allowing cross-namespace
+ references to this object.
+ NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+ properties:
+ namespaceSelectors:
+ description: |-
+ NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+ Items in this list are evaluated using a logical OR operation.
+ items:
+ description: |-
+ NamespaceSelector selects the namespaces to which this ACL applies.
+ An empty map of MatchLabels matches all namespaces in a cluster.
+ properties:
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ type: array
+ required:
+ - namespaceSelectors
+ type: object
+ certSecretRef:
description: |-
- IgnoreMissingValuesFiles controls whether to silently ignore missing values
- files rather than failing.
+ CertSecretRef can be given the name of a Secret containing
+ either or both of
+
+ - a PEM-encoded client certificate (`tls.crt`) and private
+ key (`tls.key`);
+ - a PEM-encoded CA certificate (`ca.crt`)
+
+ and whichever are supplied, will be used for connecting to the
+ registry. The client cert and key are useful if you are
+ authenticating with a certificate; the CA cert is useful if
+ you are using a self-signed server certificate. The Secret must
+ be of type `Opaque` or `kubernetes.io/tls`.
+
+ It takes precedence over the values specified in the Secret referred
+ to by `.spec.secretRef`.
+ properties:
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ Insecure allows connecting to a non-TLS HTTP container registry.
+ This field is only taken into account if the .spec.type field is set to 'oci'.
type: boolean
interval:
description: |-
- Interval at which the HelmChart SourceRef is checked for updates.
+ Interval at which the HelmRepository URL is checked for updates.
This interval is approximate and may be subject to jitter to ensure
efficient use of resources.
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
type: string
- reconcileStrategy:
- default: ChartVersion
+ passCredentials:
description: |-
- ReconcileStrategy determines what enables the creation of a new artifact.
- Valid values are ('ChartVersion', 'Revision').
- See the documentation of the values for an explanation on their behavior.
- Defaults to ChartVersion when omitted.
+ PassCredentials allows the credentials from the SecretRef to be passed
+ on to a host that does not match the host as defined in URL.
+ This may be required if the host of the advertised chart URLs in the
+ index differ from the defined URL.
+ Enabling this should be done with caution, as it can potentially result
+ in credentials getting stolen in a MITM-attack.
+ type: boolean
+ provider:
+ default: generic
+ description: |-
+ Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
+ This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
+ When not specified, defaults to 'generic'.
enum:
- - ChartVersion
- - Revision
+ - generic
+ - aws
+ - azure
+ - gcp
type: string
- sourceRef:
- description: SourceRef is the reference to the Source the chart is available at.
+ secretRef:
+ description: |-
+ SecretRef specifies the Secret containing authentication credentials
+ for the HelmRepository.
+ For HTTP/S basic auth the secret must contain 'username' and 'password'
+ fields.
+ Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
+ keys is deprecated. Please use `.spec.certSecretRef` instead.
properties:
- apiVersion:
- description: APIVersion of the referent.
- type: string
- kind:
- description: |-
- Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
- 'Bucket').
- enum:
- - HelmRepository
- - GitRepository
- - Bucket
- type: string
name:
description: Name of the referent.
type: string
required:
- - kind
- name
type: object
suspend:
description: |-
Suspend tells the controller to suspend the reconciliation of this
- source.
+ HelmRepository.
type: boolean
- valuesFiles:
+ timeout:
description: |-
- ValuesFiles is an alternative list of values files to use as the chart
- values (values.yaml is not included by default), expected to be a
- relative path in the SourceRef.
- Values files are merged in the order of this list with the last file
- overriding the first. Ignored when omitted.
- items:
- type: string
- type: array
- verify:
+ Timeout is used for the index fetch operation for an HTTPS helm repository,
+ and for remote OCI Repository operations like pulling for an OCI helm
+ chart by the associated HelmChart.
+ Its default value is 60s.
+ pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
+ type: string
+ type:
description: |-
- Verify contains the secret name containing the trusted public keys
- used to verify the signature and specifies which provider to use to check
- whether OCI image is authentic.
- This field is only supported when using HelmRepository source with spec.type 'oci'.
- Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
- properties:
- matchOIDCIdentity:
- description: |-
- MatchOIDCIdentity specifies the identity matching criteria to use
- while verifying an OCI artifact which was signed using Cosign keyless
- signing. The artifact's identity is deemed to be verified if any of the
- specified matchers match against the identity.
- items:
- description: |-
- OIDCIdentityMatch specifies options for verifying the certificate identity,
- i.e. the issuer and the subject of the certificate.
- properties:
- issuer:
- description: |-
- Issuer specifies the regex pattern to match against to verify
- the OIDC issuer in the Fulcio certificate. The pattern must be a
- valid Go regular expression.
- type: string
- subject:
- description: |-
- Subject specifies the regex pattern to match against to verify
- the identity subject in the Fulcio certificate. The pattern must
- be a valid Go regular expression.
- type: string
- required:
- - issuer
- - subject
- type: object
- type: array
- provider:
- default: cosign
- description: Provider specifies the technology used to sign the OCI Artifact.
- enum:
- - cosign
- - notation
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Kubernetes Secret containing the
- trusted public keys.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- required:
- - provider
- type: object
- version:
- default: '*'
+ Type of the HelmRepository.
+ When this field is set to "oci", the URL field value must be prefixed with "oci://".
+ enum:
+ - default
+ - oci
+ type: string
+ url:
description: |-
- Version is the chart version semver expression, ignored for charts from
- GitRepository and Bucket sources. Defaults to latest when omitted.
+ URL of the Helm repository, a valid URL contains at least a protocol and
+ host.
+ pattern: ^(http|https|oci)://.*$
type: string
required:
- - chart
- - interval
- - sourceRef
+ - url
type: object
status:
default:
observedGeneration: -1
- description: HelmChartStatus records the observed state of the HelmChart.
+ description: HelmRepositoryStatus records the observed state of the HelmRepository.
properties:
artifact:
- description: Artifact represents the output of the last successful reconciliation.
+ description: Artifact represents the last successful HelmRepository reconciliation.
properties:
digest:
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
@@ -2437,7 +1950,7 @@ spec:
- url
type: object
conditions:
- description: Conditions holds the conditions for the HelmChart.
+ description: Conditions holds the conditions for the HelmRepository.
items:
description: Condition contains details for one aspect of the current state of this API Resource.
properties:
@@ -2498,35 +2011,17 @@ spec:
reconcile request value, so a change of the annotation value
can be detected.
type: string
- observedChartName:
- description: |-
- ObservedChartName is the last observed chart name as specified by the
- resolved chart reference.
- type: string
observedGeneration:
description: |-
- ObservedGeneration is the last observed generation of the HelmChart
+ ObservedGeneration is the last observed generation of the HelmRepository
object.
format: int64
type: integer
- observedSourceArtifactRevision:
- description: |-
- ObservedSourceArtifactRevision is the last observed Artifact.Revision
- of the HelmChartSpec.SourceRef.
- type: string
- observedValuesFiles:
- description: |-
- ObservedValuesFiles are the observed value files of the last successful
- reconciliation.
- It matches the chart in the last successfully reconciled artifact.
- items:
- type: string
- type: array
url:
description: |-
URL is the dynamic fetch link for the latest Artifact.
It is provided on a "best effort" basis, and using the precise
- BucketStatus.Artifact data is recommended.
+ HelmRepositoryStatus.Artifact data is recommended.
type: string
type: object
type: object
@@ -2534,34 +2029,46 @@ spec:
storage: true
subresources:
status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.19.0
+ labels:
+ app.kubernetes.io/component: source-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ name: ocirepositories.source.toolkit.fluxcd.io
+spec:
+ group: source.toolkit.fluxcd.io
+ names:
+ kind: OCIRepository
+ listKind: OCIRepositoryList
+ plural: ocirepositories
+ shortNames:
+ - ocirepo
+ singular: ocirepository
+ scope: Namespaced
+ versions:
- additionalPrinterColumns:
- - jsonPath: .spec.chart
- name: Chart
- type: string
- - jsonPath: .spec.version
- name: Version
- type: string
- - jsonPath: .spec.sourceRef.kind
- name: Source Kind
- type: string
- - jsonPath: .spec.sourceRef.name
- name: Source Name
+ - jsonPath: .spec.url
+ name: URL
type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- jsonPath: .status.conditions[?(@.type=="Ready")].message
name: Status
type: string
- deprecated: true
- deprecationWarning: v1beta2 HelmChart is deprecated, upgrade to v1
- name: v1beta2
+ - jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
schema:
openAPIV3Schema:
- description: HelmChart is the Schema for the helmcharts API.
+ description: OCIRepository is the Schema for the ocirepositories API
properties:
apiVersion:
description: |-
@@ -2581,115 +2088,148 @@ spec:
metadata:
type: object
spec:
- description: HelmChartSpec specifies the desired state of a Helm chart.
+ description: OCIRepositorySpec defines the desired state of OCIRepository
properties:
- accessFrom:
+ certSecretRef:
description: |-
- AccessFrom specifies an Access Control List for allowing cross-namespace
- references to this object.
- NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+ CertSecretRef can be given the name of a Secret containing
+ either or both of
+
+ - a PEM-encoded client certificate (`tls.crt`) and private
+ key (`tls.key`);
+ - a PEM-encoded CA certificate (`ca.crt`)
+
+ and whichever are supplied, will be used for connecting to the
+ registry. The client cert and key are useful if you are
+ authenticating with a certificate; the CA cert is useful if
+ you are using a self-signed server certificate. The Secret must
+ be of type `Opaque` or `kubernetes.io/tls`.
properties:
- namespaceSelectors:
- description: |-
- NamespaceSelectors is the list of namespace selectors to which this ACL applies.
- Items in this list are evaluated using a logical OR operation.
- items:
- description: |-
- NamespaceSelector selects the namespaces to which this ACL applies.
- An empty map of MatchLabels matches all namespaces in a cluster.
- properties:
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- type: array
+ name:
+ description: Name of the referent.
+ type: string
required:
- - namespaceSelectors
+ - name
type: object
- chart:
+ ignore:
description: |-
- Chart is the name or path the Helm chart is available at in the
- SourceRef.
+ Ignore overrides the set of excluded patterns in the .sourceignore format
+ (which is the same as .gitignore). If not provided, a default will be used,
+ consult the documentation for your version to find out what those are.
type: string
- ignoreMissingValuesFiles:
- description: |-
- IgnoreMissingValuesFiles controls whether to silently ignore missing values
- files rather than failing.
+ insecure:
+ description: Insecure allows connecting to a non-TLS HTTP container registry.
type: boolean
interval:
description: |-
- Interval at which the HelmChart SourceRef is checked for updates.
+ Interval at which the OCIRepository URL is checked for updates.
This interval is approximate and may be subject to jitter to ensure
efficient use of resources.
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
type: string
- reconcileStrategy:
- default: ChartVersion
+ layerSelector:
description: |-
- ReconcileStrategy determines what enables the creation of a new artifact.
- Valid values are ('ChartVersion', 'Revision').
- See the documentation of the values for an explanation on their behavior.
- Defaults to ChartVersion when omitted.
- enum:
- - ChartVersion
- - Revision
- type: string
- sourceRef:
- description: SourceRef is the reference to the Source the chart is available at.
+ LayerSelector specifies which layer should be extracted from the OCI artifact.
+ When not specified, the first layer found in the artifact is selected.
properties:
- apiVersion:
- description: APIVersion of the referent.
+ mediaType:
+ description: |-
+ MediaType specifies the OCI media type of the layer
+ which should be extracted from the OCI Artifact. The
+ first layer matching this type is selected.
type: string
- kind:
+ operation:
description: |-
- Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
- 'Bucket').
+ Operation specifies how the selected layer should be processed.
+ By default, the layer compressed content is extracted to storage.
+ When the operation is set to 'copy', the layer compressed content
+ is persisted to storage as it is.
enum:
- - HelmRepository
- - GitRepository
- - Bucket
+ - extract
+ - copy
type: string
+ type: object
+ provider:
+ default: generic
+ description: |-
+ The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
+ When not specified, defaults to 'generic'.
+ enum:
+ - generic
+ - aws
+ - azure
+ - gcp
+ type: string
+ proxySecretRef:
+ description: |-
+ ProxySecretRef specifies the Secret containing the proxy configuration
+ to use while communicating with the container registry.
+ properties:
name:
description: Name of the referent.
type: string
required:
- - kind
- name
type: object
- suspend:
+ ref:
description: |-
- Suspend tells the controller to suspend the reconciliation of this
- source.
- type: boolean
- valuesFile:
+ The OCI reference to pull and monitor for changes,
+ defaults to the latest tag.
+ properties:
+ digest:
+ description: |-
+ Digest is the image digest to pull, takes precedence over SemVer.
+ The value should be in the format 'sha256:<HASH>'.
+ type: string
+ semver:
+ description: |-
+ SemVer is the range of tags to pull selecting the latest within
+ the range, takes precedence over Tag.
+ type: string
+ semverFilter:
+ description: SemverFilter is a regex pattern to filter the tags within the SemVer range.
+ type: string
+ tag:
+ description: Tag is the image tag to pull, defaults to latest.
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef contains the secret name containing the registry login
+ credentials to resolve image metadata.
+ The secret must be of type kubernetes.io/dockerconfigjson.
+ properties:
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - name
+ type: object
+ serviceAccountName:
description: |-
- ValuesFile is an alternative values file to use as the default chart
- values, expected to be a relative path in the SourceRef. Deprecated in
- favor of ValuesFiles, for backwards compatibility the file specified here
- is merged before the ValuesFiles items. Ignored when omitted.
+ ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
+ the image pull if the service account has attached pull secrets. For more information:
+ https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
type: string
- valuesFiles:
+ suspend:
+ description: This flag tells the controller to suspend the reconciliation of this source.
+ type: boolean
+ timeout:
+ default: 60s
+ description: The timeout for remote OCI Repository operations like pulling, defaults to 60s.
+ pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
+ type: string
+ url:
description: |-
- ValuesFiles is an alternative list of values files to use as the chart
- values (values.yaml is not included by default), expected to be a
- relative path in the SourceRef.
- Values files are merged in the order of this list with the last file
- overriding the first. Ignored when omitted.
- items:
- type: string
- type: array
+ URL is a reference to an OCI artifact repository hosted
+ on a remote container registry.
+ pattern: ^oci://.*$
+ type: string
verify:
description: |-
Verify contains the secret name containing the trusted public keys
used to verify the signature and specifies which provider to use to check
whether OCI image is authentic.
- This field is only supported when using HelmRepository source with spec.type 'oci'.
- Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
properties:
matchOIDCIdentity:
description: |-
@@ -2740,24 +2280,17 @@ spec:
required:
- provider
type: object
- version:
- default: '*'
- description: |-
- Version is the chart version semver expression, ignored for charts from
- GitRepository and Bucket sources. Defaults to latest when omitted.
- type: string
required:
- - chart
- interval
- - sourceRef
+ - url
type: object
status:
default:
observedGeneration: -1
- description: HelmChartStatus records the observed state of the HelmChart.
+ description: OCIRepositoryStatus defines the observed state of OCIRepository
properties:
artifact:
- description: Artifact represents the output of the last successful reconciliation.
+ description: Artifact represents the output of the last successful OCI Repository sync.
properties:
digest:
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
@@ -2803,7 +2336,7 @@ spec:
- url
type: object
conditions:
- description: Conditions holds the conditions for the HelmChart.
+ description: Conditions holds the conditions for the OCIRepository.
items:
description: Condition contains details for one aspect of the current state of this API Resource.
properties:
@@ -2864,4054 +2397,719 @@ spec:
reconcile request value, so a change of the annotation value
can be detected.
type: string
- observedChartName:
- description: |-
- ObservedChartName is the last observed chart name as specified by the
- resolved chart reference.
- type: string
observedGeneration:
- description: |-
- ObservedGeneration is the last observed generation of the HelmChart
- object.
+ description: ObservedGeneration is the last observed generation.
format: int64
type: integer
- observedSourceArtifactRevision:
+ observedIgnore:
description: |-
- ObservedSourceArtifactRevision is the last observed Artifact.Revision
- of the HelmChartSpec.SourceRef.
+ ObservedIgnore is the observed exclusion patterns used for constructing
+ the source artifact.
type: string
- observedValuesFiles:
+ observedLayerSelector:
description: |-
- ObservedValuesFiles are the observed value files of the last successful
- reconciliation.
- It matches the chart in the last successfully reconciled artifact.
- items:
- type: string
- type: array
+ ObservedLayerSelector is the observed layer selector used for constructing
+ the source artifact.
+ properties:
+ mediaType:
+ description: |-
+ MediaType specifies the OCI media type of the layer
+ which should be extracted from the OCI Artifact. The
+ first layer matching this type is selected.
+ type: string
+ operation:
+ description: |-
+ Operation specifies how the selected layer should be processed.
+ By default, the layer compressed content is extracted to storage.
+ When the operation is set to 'copy', the layer compressed content
+ is persisted to storage as it is.
+ enum:
+ - extract
+ - copy
+ type: string
+ type: object
url:
- description: |-
- URL is the dynamic fetch link for the latest Artifact.
- It is provided on a "best effort" basis, and using the precise
- BucketStatus.Artifact data is recommended.
+ description: URL is the download link for the artifact output of the last OCI Repository sync.
type: string
type: object
type: object
served: true
- storage: false
+ storage: true
subresources:
status: {}
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
+apiVersion: v1
+kind: ServiceAccount
metadata:
- annotations:
- controller-gen.kubebuilder.io/version: v0.19.0
labels:
app.kubernetes.io/component: source-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: helmrepositories.source.toolkit.fluxcd.io
+ app.kubernetes.io/version: v2.8.0
+ name: source-controller
+ namespace: flux-system
+---
+apiVersion: v1
+kind: Service
+metadata:
+ labels:
+ app.kubernetes.io/component: source-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ control-plane: controller
+ name: source-controller
+ namespace: flux-system
spec:
- group: source.toolkit.fluxcd.io
- names:
- kind: HelmRepository
- listKind: HelmRepositoryList
- plural: helmrepositories
- shortNames:
- - helmrepo
- singular: helmrepository
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.url
- name: URL
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- name: v1
- schema:
- openAPIV3Schema:
- description: HelmRepository is the Schema for the helmrepositories API.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: |-
- HelmRepositorySpec specifies the required configuration to produce an
- Artifact for a Helm repository index YAML.
- properties:
- accessFrom:
- description: |-
- AccessFrom specifies an Access Control List for allowing cross-namespace
- references to this object.
- NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
- properties:
- namespaceSelectors:
- description: |-
- NamespaceSelectors is the list of namespace selectors to which this ACL applies.
- Items in this list are evaluated using a logical OR operation.
- items:
- description: |-
- NamespaceSelector selects the namespaces to which this ACL applies.
- An empty map of MatchLabels matches all namespaces in a cluster.
- properties:
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- type: array
- required:
- - namespaceSelectors
- type: object
- certSecretRef:
- description: |-
- CertSecretRef can be given the name of a Secret containing
- either or both of
-
- - a PEM-encoded client certificate (`tls.crt`) and private
- key (`tls.key`);
- - a PEM-encoded CA certificate (`ca.crt`)
-
- and whichever are supplied, will be used for connecting to the
- registry. The client cert and key are useful if you are
- authenticating with a certificate; the CA cert is useful if
- you are using a self-signed server certificate. The Secret must
- be of type `Opaque` or `kubernetes.io/tls`.
-
- It takes precedence over the values specified in the Secret referred
- to by `.spec.secretRef`.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- insecure:
- description: |-
- Insecure allows connecting to a non-TLS HTTP container registry.
- This field is only taken into account if the .spec.type field is set to 'oci'.
- type: boolean
- interval:
- description: |-
- Interval at which the HelmRepository URL is checked for updates.
- This interval is approximate and may be subject to jitter to ensure
- efficient use of resources.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- passCredentials:
- description: |-
- PassCredentials allows the credentials from the SecretRef to be passed
- on to a host that does not match the host as defined in URL.
- This may be required if the host of the advertised chart URLs in the
- index differ from the defined URL.
- Enabling this should be done with caution, as it can potentially result
- in credentials getting stolen in a MITM-attack.
- type: boolean
- provider:
- default: generic
- description: |-
- Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
- This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
- When not specified, defaults to 'generic'.
- enum:
- - generic
- - aws
- - azure
- - gcp
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Secret containing authentication credentials
- for the HelmRepository.
- For HTTP/S basic auth the secret must contain 'username' and 'password'
- fields.
- Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
- keys is deprecated. Please use `.spec.certSecretRef` instead.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- suspend:
- description: |-
- Suspend tells the controller to suspend the reconciliation of this
- HelmRepository.
- type: boolean
- timeout:
- description: |-
- Timeout is used for the index fetch operation for an HTTPS helm repository,
- and for remote OCI Repository operations like pulling for an OCI helm
- chart by the associated HelmChart.
- Its default value is 60s.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
- type: string
- type:
- description: |-
- Type of the HelmRepository.
- When this field is set to "oci", the URL field value must be prefixed with "oci://".
- enum:
- - default
- - oci
- type: string
- url:
- description: |-
- URL of the Helm repository, a valid URL contains at least a protocol and
- host.
- pattern: ^(http|https|oci)://.*$
- type: string
- required:
- - url
- type: object
- status:
- default:
- observedGeneration: -1
- description: HelmRepositoryStatus records the observed state of the HelmRepository.
- properties:
- artifact:
- description: Artifact represents the last successful HelmRepository reconciliation.
- properties:
- digest:
- description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
- pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
- type: string
- lastUpdateTime:
- description: |-
- LastUpdateTime is the timestamp corresponding to the last update of the
- Artifact.
- format: date-time
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata holds upstream information such as OCI annotations.
- type: object
- path:
- description: |-
- Path is the relative file path of the Artifact. It can be used to locate
- the file in the root of the Artifact storage on the local file system of
- the controller managing the Source.
- type: string
- revision:
- description: |-
- Revision is a human-readable identifier traceable in the origin source
- system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
- type: string
- size:
- description: Size is the number of bytes in the file.
- format: int64
- type: integer
- url:
- description: |-
- URL is the HTTP address of the Artifact as exposed by the controller
- managing the Source. It can be used to retrieve the Artifact for
- consumption, e.g. by another controller applying the Artifact contents.
- type: string
- required:
- - digest
- - lastUpdateTime
- - path
- - revision
- - url
- type: object
- conditions:
- description: Conditions holds the conditions for the HelmRepository.
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: |-
- ObservedGeneration is the last observed generation of the HelmRepository
- object.
- format: int64
- type: integer
- url:
- description: |-
- URL is the dynamic fetch link for the latest Artifact.
- It is provided on a "best effort" basis, and using the precise
- HelmRepositoryStatus.Artifact data is recommended.
- type: string
- type: object
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.url
- name: URL
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- deprecated: true
- deprecationWarning: v1beta2 HelmRepository is deprecated, upgrade to v1
- name: v1beta2
- schema:
- openAPIV3Schema:
- description: HelmRepository is the Schema for the helmrepositories API.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: |-
- HelmRepositorySpec specifies the required configuration to produce an
- Artifact for a Helm repository index YAML.
- properties:
- accessFrom:
- description: |-
- AccessFrom specifies an Access Control List for allowing cross-namespace
- references to this object.
- NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
- properties:
- namespaceSelectors:
- description: |-
- NamespaceSelectors is the list of namespace selectors to which this ACL applies.
- Items in this list are evaluated using a logical OR operation.
- items:
- description: |-
- NamespaceSelector selects the namespaces to which this ACL applies.
- An empty map of MatchLabels matches all namespaces in a cluster.
- properties:
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- type: array
- required:
- - namespaceSelectors
- type: object
- certSecretRef:
- description: |-
- CertSecretRef can be given the name of a Secret containing
- either or both of
-
- - a PEM-encoded client certificate (`tls.crt`) and private
- key (`tls.key`);
- - a PEM-encoded CA certificate (`ca.crt`)
-
- and whichever are supplied, will be used for connecting to the
- registry. The client cert and key are useful if you are
- authenticating with a certificate; the CA cert is useful if
- you are using a self-signed server certificate. The Secret must
- be of type `Opaque` or `kubernetes.io/tls`.
-
- It takes precedence over the values specified in the Secret referred
- to by `.spec.secretRef`.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- insecure:
- description: |-
- Insecure allows connecting to a non-TLS HTTP container registry.
- This field is only taken into account if the .spec.type field is set to 'oci'.
- type: boolean
- interval:
- description: |-
- Interval at which the HelmRepository URL is checked for updates.
- This interval is approximate and may be subject to jitter to ensure
- efficient use of resources.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- passCredentials:
- description: |-
- PassCredentials allows the credentials from the SecretRef to be passed
- on to a host that does not match the host as defined in URL.
- This may be required if the host of the advertised chart URLs in the
- index differ from the defined URL.
- Enabling this should be done with caution, as it can potentially result
- in credentials getting stolen in a MITM-attack.
- type: boolean
- provider:
- default: generic
- description: |-
- Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
- This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
- When not specified, defaults to 'generic'.
- enum:
- - generic
- - aws
- - azure
- - gcp
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Secret containing authentication credentials
- for the HelmRepository.
- For HTTP/S basic auth the secret must contain 'username' and 'password'
- fields.
- Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
- keys is deprecated. Please use `.spec.certSecretRef` instead.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- suspend:
- description: |-
- Suspend tells the controller to suspend the reconciliation of this
- HelmRepository.
- type: boolean
- timeout:
- description: |-
- Timeout is used for the index fetch operation for an HTTPS helm repository,
- and for remote OCI Repository operations like pulling for an OCI helm
- chart by the associated HelmChart.
- Its default value is 60s.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
- type: string
- type:
- description: |-
- Type of the HelmRepository.
- When this field is set to "oci", the URL field value must be prefixed with "oci://".
- enum:
- - default
- - oci
- type: string
- url:
- description: |-
- URL of the Helm repository, a valid URL contains at least a protocol and
- host.
- pattern: ^(http|https|oci)://.*$
- type: string
- required:
- - url
- type: object
- status:
- default:
- observedGeneration: -1
- description: HelmRepositoryStatus records the observed state of the HelmRepository.
- properties:
- artifact:
- description: Artifact represents the last successful HelmRepository reconciliation.
- properties:
- digest:
- description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
- pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
- type: string
- lastUpdateTime:
- description: |-
- LastUpdateTime is the timestamp corresponding to the last update of the
- Artifact.
- format: date-time
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata holds upstream information such as OCI annotations.
- type: object
- path:
- description: |-
- Path is the relative file path of the Artifact. It can be used to locate
- the file in the root of the Artifact storage on the local file system of
- the controller managing the Source.
- type: string
- revision:
- description: |-
- Revision is a human-readable identifier traceable in the origin source
- system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
- type: string
- size:
- description: Size is the number of bytes in the file.
- format: int64
- type: integer
- url:
- description: |-
- URL is the HTTP address of the Artifact as exposed by the controller
- managing the Source. It can be used to retrieve the Artifact for
- consumption, e.g. by another controller applying the Artifact contents.
- type: string
- required:
- - digest
- - lastUpdateTime
- - path
- - revision
- - url
- type: object
- conditions:
- description: Conditions holds the conditions for the HelmRepository.
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: |-
- ObservedGeneration is the last observed generation of the HelmRepository
- object.
- format: int64
- type: integer
- url:
- description: |-
- URL is the dynamic fetch link for the latest Artifact.
- It is provided on a "best effort" basis, and using the precise
- HelmRepositoryStatus.Artifact data is recommended.
- type: string
- type: object
- type: object
- served: true
- storage: false
- subresources:
- status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- controller-gen.kubebuilder.io/version: v0.19.0
- labels:
- app.kubernetes.io/component: source-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: ocirepositories.source.toolkit.fluxcd.io
-spec:
- group: source.toolkit.fluxcd.io
- names:
- kind: OCIRepository
- listKind: OCIRepositoryList
- plural: ocirepositories
- shortNames:
- - ocirepo
- singular: ocirepository
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.url
- name: URL
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: OCIRepository is the Schema for the ocirepositories API
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: OCIRepositorySpec defines the desired state of OCIRepository
- properties:
- certSecretRef:
- description: |-
- CertSecretRef can be given the name of a Secret containing
- either or both of
-
- - a PEM-encoded client certificate (`tls.crt`) and private
- key (`tls.key`);
- - a PEM-encoded CA certificate (`ca.crt`)
-
- and whichever are supplied, will be used for connecting to the
- registry. The client cert and key are useful if you are
- authenticating with a certificate; the CA cert is useful if
- you are using a self-signed server certificate. The Secret must
- be of type `Opaque` or `kubernetes.io/tls`.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- ignore:
- description: |-
- Ignore overrides the set of excluded patterns in the .sourceignore format
- (which is the same as .gitignore). If not provided, a default will be used,
- consult the documentation for your version to find out what those are.
- type: string
- insecure:
- description: Insecure allows connecting to a non-TLS HTTP container registry.
- type: boolean
- interval:
- description: |-
- Interval at which the OCIRepository URL is checked for updates.
- This interval is approximate and may be subject to jitter to ensure
- efficient use of resources.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- layerSelector:
- description: |-
- LayerSelector specifies which layer should be extracted from the OCI artifact.
- When not specified, the first layer found in the artifact is selected.
- properties:
- mediaType:
- description: |-
- MediaType specifies the OCI media type of the layer
- which should be extracted from the OCI Artifact. The
- first layer matching this type is selected.
- type: string
- operation:
- description: |-
- Operation specifies how the selected layer should be processed.
- By default, the layer compressed content is extracted to storage.
- When the operation is set to 'copy', the layer compressed content
- is persisted to storage as it is.
- enum:
- - extract
- - copy
- type: string
- type: object
- provider:
- default: generic
- description: |-
- The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
- When not specified, defaults to 'generic'.
- enum:
- - generic
- - aws
- - azure
- - gcp
- type: string
- proxySecretRef:
- description: |-
- ProxySecretRef specifies the Secret containing the proxy configuration
- to use while communicating with the container registry.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- ref:
- description: |-
- The OCI reference to pull and monitor for changes,
- defaults to the latest tag.
- properties:
- digest:
- description: |-
- Digest is the image digest to pull, takes precedence over SemVer.
- The value should be in the format 'sha256:<HASH>'.
- type: string
- semver:
- description: |-
- SemVer is the range of tags to pull selecting the latest within
- the range, takes precedence over Tag.
- type: string
- semverFilter:
- description: SemverFilter is a regex pattern to filter the tags within the SemVer range.
- type: string
- tag:
- description: Tag is the image tag to pull, defaults to latest.
- type: string
- type: object
- secretRef:
- description: |-
- SecretRef contains the secret name containing the registry login
- credentials to resolve image metadata.
- The secret must be of type kubernetes.io/dockerconfigjson.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- serviceAccountName:
- description: |-
- ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
- the image pull if the service account has attached pull secrets. For more information:
- https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
- type: string
- suspend:
- description: This flag tells the controller to suspend the reconciliation of this source.
- type: boolean
- timeout:
- default: 60s
- description: The timeout for remote OCI Repository operations like pulling, defaults to 60s.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
- type: string
- url:
- description: |-
- URL is a reference to an OCI artifact repository hosted
- on a remote container registry.
- pattern: ^oci://.*$
- type: string
- verify:
- description: |-
- Verify contains the secret name containing the trusted public keys
- used to verify the signature and specifies which provider to use to check
- whether OCI image is authentic.
- properties:
- matchOIDCIdentity:
- description: |-
- MatchOIDCIdentity specifies the identity matching criteria to use
- while verifying an OCI artifact which was signed using Cosign keyless
- signing. The artifact's identity is deemed to be verified if any of the
- specified matchers match against the identity.
- items:
- description: |-
- OIDCIdentityMatch specifies options for verifying the certificate identity,
- i.e. the issuer and the subject of the certificate.
- properties:
- issuer:
- description: |-
- Issuer specifies the regex pattern to match against to verify
- the OIDC issuer in the Fulcio certificate. The pattern must be a
- valid Go regular expression.
- type: string
- subject:
- description: |-
- Subject specifies the regex pattern to match against to verify
- the identity subject in the Fulcio certificate. The pattern must
- be a valid Go regular expression.
- type: string
- required:
- - issuer
- - subject
- type: object
- type: array
- provider:
- default: cosign
- description: Provider specifies the technology used to sign the OCI Artifact.
- enum:
- - cosign
- - notation
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Kubernetes Secret containing the
- trusted public keys.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- required:
- - provider
- type: object
- required:
- - interval
- - url
- type: object
- status:
- default:
- observedGeneration: -1
- description: OCIRepositoryStatus defines the observed state of OCIRepository
- properties:
- artifact:
- description: Artifact represents the output of the last successful OCI Repository sync.
- properties:
- digest:
- description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
- pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
- type: string
- lastUpdateTime:
- description: |-
- LastUpdateTime is the timestamp corresponding to the last update of the
- Artifact.
- format: date-time
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata holds upstream information such as OCI annotations.
- type: object
- path:
- description: |-
- Path is the relative file path of the Artifact. It can be used to locate
- the file in the root of the Artifact storage on the local file system of
- the controller managing the Source.
- type: string
- revision:
- description: |-
- Revision is a human-readable identifier traceable in the origin source
- system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
- type: string
- size:
- description: Size is the number of bytes in the file.
- format: int64
- type: integer
- url:
- description: |-
- URL is the HTTP address of the Artifact as exposed by the controller
- managing the Source. It can be used to retrieve the Artifact for
- consumption, e.g. by another controller applying the Artifact contents.
- type: string
- required:
- - digest
- - lastUpdateTime
- - path
- - revision
- - url
- type: object
- conditions:
- description: Conditions holds the conditions for the OCIRepository.
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: ObservedGeneration is the last observed generation.
- format: int64
- type: integer
- observedIgnore:
- description: |-
- ObservedIgnore is the observed exclusion patterns used for constructing
- the source artifact.
- type: string
- observedLayerSelector:
- description: |-
- ObservedLayerSelector is the observed layer selector used for constructing
- the source artifact.
- properties:
- mediaType:
- description: |-
- MediaType specifies the OCI media type of the layer
- which should be extracted from the OCI Artifact. The
- first layer matching this type is selected.
- type: string
- operation:
- description: |-
- Operation specifies how the selected layer should be processed.
- By default, the layer compressed content is extracted to storage.
- When the operation is set to 'copy', the layer compressed content
- is persisted to storage as it is.
- enum:
- - extract
- - copy
- type: string
- type: object
- url:
- description: URL is the download link for the artifact output of the last OCI Repository sync.
- type: string
- type: object
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.url
- name: URL
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- deprecated: true
- deprecationWarning: v1beta2 OCIRepository is deprecated, upgrade to v1
- name: v1beta2
- schema:
- openAPIV3Schema:
- description: OCIRepository is the Schema for the ocirepositories API
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: OCIRepositorySpec defines the desired state of OCIRepository
- properties:
- certSecretRef:
- description: |-
- CertSecretRef can be given the name of a Secret containing
- either or both of
-
- - a PEM-encoded client certificate (`tls.crt`) and private
- key (`tls.key`);
- - a PEM-encoded CA certificate (`ca.crt`)
-
- and whichever are supplied, will be used for connecting to the
- registry. The client cert and key are useful if you are
- authenticating with a certificate; the CA cert is useful if
- you are using a self-signed server certificate. The Secret must
- be of type `Opaque` or `kubernetes.io/tls`.
-
- Note: Support for the `caFile`, `certFile` and `keyFile` keys have
- been deprecated.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- ignore:
- description: |-
- Ignore overrides the set of excluded patterns in the .sourceignore format
- (which is the same as .gitignore). If not provided, a default will be used,
- consult the documentation for your version to find out what those are.
- type: string
- insecure:
- description: Insecure allows connecting to a non-TLS HTTP container registry.
- type: boolean
- interval:
- description: |-
- Interval at which the OCIRepository URL is checked for updates.
- This interval is approximate and may be subject to jitter to ensure
- efficient use of resources.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- layerSelector:
- description: |-
- LayerSelector specifies which layer should be extracted from the OCI artifact.
- When not specified, the first layer found in the artifact is selected.
- properties:
- mediaType:
- description: |-
- MediaType specifies the OCI media type of the layer
- which should be extracted from the OCI Artifact. The
- first layer matching this type is selected.
- type: string
- operation:
- description: |-
- Operation specifies how the selected layer should be processed.
- By default, the layer compressed content is extracted to storage.
- When the operation is set to 'copy', the layer compressed content
- is persisted to storage as it is.
- enum:
- - extract
- - copy
- type: string
- type: object
- provider:
- default: generic
- description: |-
- The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
- When not specified, defaults to 'generic'.
- enum:
- - generic
- - aws
- - azure
- - gcp
- type: string
- proxySecretRef:
- description: |-
- ProxySecretRef specifies the Secret containing the proxy configuration
- to use while communicating with the container registry.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- ref:
- description: |-
- The OCI reference to pull and monitor for changes,
- defaults to the latest tag.
- properties:
- digest:
- description: |-
- Digest is the image digest to pull, takes precedence over SemVer.
- The value should be in the format 'sha256:<HASH>'.
- type: string
- semver:
- description: |-
- SemVer is the range of tags to pull selecting the latest within
- the range, takes precedence over Tag.
- type: string
- semverFilter:
- description: SemverFilter is a regex pattern to filter the tags within the SemVer range.
- type: string
- tag:
- description: Tag is the image tag to pull, defaults to latest.
- type: string
- type: object
- secretRef:
- description: |-
- SecretRef contains the secret name containing the registry login
- credentials to resolve image metadata.
- The secret must be of type kubernetes.io/dockerconfigjson.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- serviceAccountName:
- description: |-
- ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
- the image pull if the service account has attached pull secrets. For more information:
- https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
- type: string
- suspend:
- description: This flag tells the controller to suspend the reconciliation of this source.
- type: boolean
- timeout:
- default: 60s
- description: The timeout for remote OCI Repository operations like pulling, defaults to 60s.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
- type: string
- url:
- description: |-
- URL is a reference to an OCI artifact repository hosted
- on a remote container registry.
- pattern: ^oci://.*$
- type: string
- verify:
- description: |-
- Verify contains the secret name containing the trusted public keys
- used to verify the signature and specifies which provider to use to check
- whether OCI image is authentic.
- properties:
- matchOIDCIdentity:
- description: |-
- MatchOIDCIdentity specifies the identity matching criteria to use
- while verifying an OCI artifact which was signed using Cosign keyless
- signing. The artifact's identity is deemed to be verified if any of the
- specified matchers match against the identity.
- items:
- description: |-
- OIDCIdentityMatch specifies options for verifying the certificate identity,
- i.e. the issuer and the subject of the certificate.
- properties:
- issuer:
- description: |-
- Issuer specifies the regex pattern to match against to verify
- the OIDC issuer in the Fulcio certificate. The pattern must be a
- valid Go regular expression.
- type: string
- subject:
- description: |-
- Subject specifies the regex pattern to match against to verify
- the identity subject in the Fulcio certificate. The pattern must
- be a valid Go regular expression.
- type: string
- required:
- - issuer
- - subject
- type: object
- type: array
- provider:
- default: cosign
- description: Provider specifies the technology used to sign the OCI Artifact.
- enum:
- - cosign
- - notation
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Kubernetes Secret containing the
- trusted public keys.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- required:
- - provider
- type: object
- required:
- - interval
- - url
- type: object
- status:
- default:
- observedGeneration: -1
- description: OCIRepositoryStatus defines the observed state of OCIRepository
- properties:
- artifact:
- description: Artifact represents the output of the last successful OCI Repository sync.
- properties:
- digest:
- description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
- pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
- type: string
- lastUpdateTime:
- description: |-
- LastUpdateTime is the timestamp corresponding to the last update of the
- Artifact.
- format: date-time
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata holds upstream information such as OCI annotations.
- type: object
- path:
- description: |-
- Path is the relative file path of the Artifact. It can be used to locate
- the file in the root of the Artifact storage on the local file system of
- the controller managing the Source.
- type: string
- revision:
- description: |-
- Revision is a human-readable identifier traceable in the origin source
- system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
- type: string
- size:
- description: Size is the number of bytes in the file.
- format: int64
- type: integer
- url:
- description: |-
- URL is the HTTP address of the Artifact as exposed by the controller
- managing the Source. It can be used to retrieve the Artifact for
- consumption, e.g. by another controller applying the Artifact contents.
- type: string
- required:
- - digest
- - lastUpdateTime
- - path
- - revision
- - url
- type: object
- conditions:
- description: Conditions holds the conditions for the OCIRepository.
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- contentConfigChecksum:
- description: |-
- ContentConfigChecksum is a checksum of all the configurations related to
- the content of the source artifact:
- - .spec.ignore
- - .spec.layerSelector
- observed in .status.observedGeneration version of the object. This can
- be used to determine if the content configuration has changed and the
- artifact needs to be rebuilt.
- It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
-
- Deprecated: Replaced with explicit fields for observed artifact content
- config in the status.
- type: string
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: ObservedGeneration is the last observed generation.
- format: int64
- type: integer
- observedIgnore:
- description: |-
- ObservedIgnore is the observed exclusion patterns used for constructing
- the source artifact.
- type: string
- observedLayerSelector:
- description: |-
- ObservedLayerSelector is the observed layer selector used for constructing
- the source artifact.
- properties:
- mediaType:
- description: |-
- MediaType specifies the OCI media type of the layer
- which should be extracted from the OCI Artifact. The
- first layer matching this type is selected.
- type: string
- operation:
- description: |-
- Operation specifies how the selected layer should be processed.
- By default, the layer compressed content is extracted to storage.
- When the operation is set to 'copy', the layer compressed content
- is persisted to storage as it is.
- enum:
- - extract
- - copy
- type: string
- type: object
- url:
- description: URL is the download link for the artifact output of the last OCI Repository sync.
- type: string
- type: object
- type: object
- served: true
- storage: false
- subresources:
- status: {}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
- labels:
- app.kubernetes.io/component: source-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: source-controller
- namespace: flux-system
----
-apiVersion: v1
-kind: Service
-metadata:
- labels:
- app.kubernetes.io/component: source-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- control-plane: controller
- name: source-controller
- namespace: flux-system
-spec:
- ports:
- - name: http
- port: 80
- protocol: TCP
- targetPort: http
- selector:
- app: source-controller
- type: ClusterIP
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- labels:
- app.kubernetes.io/component: source-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- control-plane: controller
- name: source-controller
- namespace: flux-system
-spec:
- replicas: 1
- selector:
- matchLabels:
- app: source-controller
- strategy:
- type: Recreate
- template:
- metadata:
- annotations:
- prometheus.io/port: "8080"
- prometheus.io/scrape: "true"
- labels:
- app: source-controller
- app.kubernetes.io/component: source-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- spec:
- containers:
- - args:
- - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
- - --watch-all-namespaces=true
- - --log-level=info
- - --log-encoding=json
- - --enable-leader-election
- - --storage-path=/data
- - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.
- env:
- - name: RUNTIME_NAMESPACE
- valueFrom:
- fieldRef:
- fieldPath: metadata.namespace
- - name: TUF_ROOT
- value: /tmp/.sigstore
- - name: GOMEMLIMIT
- valueFrom:
- resourceFieldRef:
- containerName: manager
- resource: limits.memory
- image: ghcr.io/fluxcd/source-controller:v1.7.4
- imagePullPolicy: IfNotPresent
- livenessProbe:
- httpGet:
- path: /healthz
- port: healthz
- name: manager
- ports:
- - containerPort: 9090
- name: http
- protocol: TCP
- - containerPort: 8080
- name: http-prom
- protocol: TCP
- - containerPort: 9440
- name: healthz
- protocol: TCP
- readinessProbe:
- httpGet:
- path: /
- port: http
- resources:
- limits:
- cpu: 1000m
- memory: 1Gi
- requests:
- cpu: 50m
- memory: 64Mi
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- seccompProfile:
- type: RuntimeDefault
- volumeMounts:
- - mountPath: /data
- name: data
- - mountPath: /tmp
- name: tmp
- nodeSelector:
- kubernetes.io/os: linux
- priorityClassName: system-cluster-critical
- securityContext:
- fsGroup: 1337
- serviceAccountName: source-controller
- terminationGracePeriodSeconds: 10
- volumes:
- - emptyDir: {}
- name: data
- - emptyDir: {}
- name: tmp
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- controller-gen.kubebuilder.io/version: v0.19.0
- labels:
- app.kubernetes.io/component: kustomize-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: kustomizations.kustomize.toolkit.fluxcd.io
-spec:
- group: kustomize.toolkit.fluxcd.io
- names:
- kind: Kustomization
- listKind: KustomizationList
- plural: kustomizations
- shortNames:
- - ks
- singular: kustomization
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- name: v1
- schema:
- openAPIV3Schema:
- description: Kustomization is the Schema for the kustomizations API.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: |-
- KustomizationSpec defines the configuration to calculate the desired state
- from a Source using Kustomize.
- properties:
- commonMetadata:
- description: |-
- CommonMetadata specifies the common labels and annotations that are
- applied to all resources. Any existing label or annotation will be
- overridden if its key matches a common one.
- properties:
- annotations:
- additionalProperties:
- type: string
- description: Annotations to be added to the object's metadata.
- type: object
- labels:
- additionalProperties:
- type: string
- description: Labels to be added to the object's metadata.
- type: object
- type: object
- components:
- description: Components specifies relative paths to kustomize Components.
- items:
- type: string
- type: array
- decryption:
- description: Decrypt Kubernetes secrets before applying them on the cluster.
- properties:
- provider:
- description: Provider is the name of the decryption engine.
- enum:
- - sops
- type: string
- secretRef:
- description: |-
- The secret name containing the private OpenPGP keys used for decryption.
- A static credential for a cloud provider defined inside the Secret
- takes priority to secret-less authentication with the ServiceAccountName
- field.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- serviceAccountName:
- description: |-
- ServiceAccountName is the name of the service account used to
- authenticate with KMS services from cloud providers. If a
- static credential for a given cloud provider is defined
- inside the Secret referenced by SecretRef, that static
- credential takes priority.
- type: string
- required:
- - provider
- type: object
- deletionPolicy:
- description: |-
- DeletionPolicy can be used to control garbage collection when this
- Kustomization is deleted. Valid values are ('MirrorPrune', 'Delete',
- 'WaitForTermination', 'Orphan'). 'MirrorPrune' mirrors the Prune field
- (orphan if false, delete if true). Defaults to 'MirrorPrune'.
- enum:
- - MirrorPrune
- - Delete
- - WaitForTermination
- - Orphan
- type: string
- dependsOn:
- description: |-
- DependsOn may contain a DependencyReference slice
- with references to Kustomization resources that must be ready before this
- Kustomization can be reconciled.
- items:
- description: DependencyReference defines a Kustomization dependency on another Kustomization resource.
- properties:
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: |-
- Namespace of the referent, defaults to the namespace of the Kustomization
- resource object that contains the reference.
- type: string
- readyExpr:
- description: |-
- ReadyExpr is a CEL expression that can be used to assess the readiness
- of a dependency. When specified, the built-in readiness check
- is replaced by the logic defined in the CEL expression.
- To make the CEL expression additive to the built-in readiness check,
- the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
- type: string
- required:
- - name
- type: object
- type: array
- force:
- default: false
- description: |-
- Force instructs the controller to recreate resources
- when patching fails due to an immutable field change.
- type: boolean
- healthCheckExprs:
- description: |-
- HealthCheckExprs is a list of healthcheck expressions for evaluating the
- health of custom resources using Common Expression Language (CEL).
- The expressions are evaluated only when Wait or HealthChecks are specified.
- items:
- description: CustomHealthCheck defines the health check for custom resources.
- properties:
- apiVersion:
- description: APIVersion of the custom resource under evaluation.
- type: string
- current:
- description: |-
- Current is the CEL expression that determines if the status
- of the custom resource has reached the desired state.
- type: string
- failed:
- description: |-
- Failed is the CEL expression that determines if the status
- of the custom resource has failed to reach the desired state.
- type: string
- inProgress:
- description: |-
- InProgress is the CEL expression that determines if the status
- of the custom resource has not yet reached the desired state.
- type: string
- kind:
- description: Kind of the custom resource under evaluation.
- type: string
- required:
- - apiVersion
- - current
- - kind
- type: object
- type: array
- healthChecks:
- description: A list of resources to be included in the health assessment.
- items:
- description: |-
- NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object
- in any namespace.
- properties:
- apiVersion:
- description: API version of the referent, if not specified the Kubernetes preferred version will be used.
- type: string
- kind:
- description: Kind of the referent.
- type: string
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: Namespace of the referent, when not specified it acts as LocalObjectReference.
- type: string
- required:
- - kind
- - name
- type: object
- type: array
- ignoreMissingComponents:
- description: |-
- IgnoreMissingComponents instructs the controller to ignore Components paths
- not found in source by removing them from the generated kustomization.yaml
- before running kustomize build.
- type: boolean
- images:
- description: |-
- Images is a list of (image name, new name, new tag or digest)
- for changing image names, tags or digests. This can also be achieved with a
- patch, but this operator is simpler to specify.
- items:
- description: Image contains an image name, a new name, a new tag or digest, which will replace the original name and tag.
- properties:
- digest:
- description: |-
- Digest is the value used to replace the original image tag.
- If digest is present NewTag value is ignored.
- type: string
- name:
- description: Name is a tag-less image name.
- type: string
- newName:
- description: NewName is the value used to replace the original name.
- type: string
- newTag:
- description: NewTag is the value used to replace the original tag.
- type: string
- required:
- - name
- type: object
- type: array
- interval:
- description: |-
- The interval at which to reconcile the Kustomization.
- This interval is approximate and may be subject to jitter to ensure
- efficient use of resources.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- kubeConfig:
- description: |-
- The KubeConfig for reconciling the Kustomization on a remote cluster.
- When used in combination with KustomizationSpec.ServiceAccountName,
- forces the controller to act on behalf of that Service Account at the
- target cluster.
- If the --default-service-account flag is set, its value will be used as
- a controller level fallback for when KustomizationSpec.ServiceAccountName
- is empty.
- properties:
- configMapRef:
- description: |-
- ConfigMapRef holds an optional name of a ConfigMap that contains
- the following keys:
-
- - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
- `generic`. Required.
- - `cluster`: the fully qualified resource name of the Kubernetes
- cluster in the cloud provider API. Not used by the `generic`
- provider. Required when one of `address` or `ca.crt` is not set.
- - `address`: the address of the Kubernetes API server. Required
- for `generic`. For the other providers, if not specified, the
- first address in the cluster resource will be used, and if
- specified, it must match one of the addresses in the cluster
- resource.
- If audiences is not set, will be used as the audience for the
- `generic` provider.
- - `ca.crt`: the optional PEM-encoded CA certificate for the
- Kubernetes API server. If not set, the controller will use the
- CA certificate from the cluster resource.
- - `audiences`: the optional audiences as a list of
- line-break-separated strings for the Kubernetes ServiceAccount
- token. Defaults to the `address` for the `generic` provider, or
- to specific values for the other providers depending on the
- provider.
- - `serviceAccountName`: the optional name of the Kubernetes
- ServiceAccount in the same namespace that should be used
- for authentication. If not specified, the controller
- ServiceAccount will be used.
-
- Mutually exclusive with SecretRef.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- secretRef:
- description: |-
- SecretRef holds an optional name of a secret that contains a key with
- the kubeconfig file as the value. If no key is set, the key will default
- to 'value'. Mutually exclusive with ConfigMapRef.
- It is recommended that the kubeconfig is self-contained, and the secret
- is regularly updated if credentials such as a cloud-access-token expire.
- Cloud specific `cmd-path` auth helpers will not function without adding
- binaries and credentials to the Pod that is responsible for reconciling
- Kubernetes resources. Supported only for the generic provider.
- properties:
- key:
- description: Key in the Secret, when not specified an implementation-specific default key is used.
- type: string
- name:
- description: Name of the Secret.
- type: string
- required:
- - name
- type: object
- type: object
- x-kubernetes-validations:
- - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
- rule: has(self.configMapRef) || has(self.secretRef)
- - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
- rule: '!has(self.configMapRef) || !has(self.secretRef)'
- namePrefix:
- description: NamePrefix will prefix the names of all managed resources.
- maxLength: 200
- minLength: 1
- type: string
- nameSuffix:
- description: NameSuffix will suffix the names of all managed resources.
- maxLength: 200
- minLength: 1
- type: string
- patches:
- description: |-
- Strategic merge and JSON patches, defined as inline YAML objects,
- capable of targeting objects based on kind, label and annotation selectors.
- items:
- description: |-
- Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should
- be applied to.
- properties:
- patch:
- description: |-
- Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
- an array of operation objects.
- type: string
- target:
- description: Target points to the resources that the patch document should be applied to.
- properties:
- annotationSelector:
- description: |-
- AnnotationSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource annotations.
- type: string
- group:
- description: |-
- Group is the API group to select resources from.
- Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- kind:
- description: |-
- Kind of the API Group to select resources from.
- Together with Group and Version it is capable of unambiguously
- identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- labelSelector:
- description: |-
- LabelSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource labels.
- type: string
- name:
- description: Name to match resources with.
- type: string
- namespace:
- description: Namespace to select resources from.
- type: string
- version:
- description: |-
- Version of the API Group to select resources from.
- Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- type: object
- required:
- - patch
- type: object
- type: array
- path:
- description: |-
- Path to the directory containing the kustomization.yaml file, or the
- set of plain YAMLs a kustomization.yaml should be generated for.
- Defaults to 'None', which translates to the root path of the SourceRef.
- type: string
- postBuild:
- description: |-
- PostBuild describes which actions to perform on the YAML manifest
- generated by building the kustomize overlay.
- properties:
- substitute:
- additionalProperties:
- type: string
- description: |-
- Substitute holds a map of key/value pairs.
- The variables defined in your YAML manifests that match any of the keys
- defined in the map will be substituted with the set value.
- Includes support for bash string replacement functions
- e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.
- type: object
- substituteFrom:
- description: |-
- SubstituteFrom holds references to ConfigMaps and Secrets containing
- the variables and their values to be substituted in the YAML manifests.
- The ConfigMap and the Secret data keys represent the var names, and they
- must match the vars declared in the manifests for the substitution to
- happen.
- items:
- description: |-
- SubstituteReference contains a reference to a resource containing
- the variables name and value.
- properties:
- kind:
- description: Kind of the values referent, valid values are ('Secret', 'ConfigMap').
- enum:
- - Secret
- - ConfigMap
- type: string
- name:
- description: |-
- Name of the values referent. Should reside in the same namespace as the
- referring resource.
- maxLength: 253
- minLength: 1
- type: string
- optional:
- default: false
- description: |-
- Optional indicates whether the referenced resource must exist, or whether to
- tolerate its absence. If true and the referenced resource is absent, proceed
- as if the resource was present but empty, without any variables defined.
- type: boolean
- required:
- - kind
- - name
- type: object
- type: array
- type: object
- prune:
- description: Prune enables garbage collection.
- type: boolean
- retryInterval:
- description: |-
- The interval at which to retry a previously failed reconciliation.
- When not specified, the controller uses the KustomizationSpec.Interval
- value to retry failures.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- serviceAccountName:
- description: |-
- The name of the Kubernetes service account to impersonate
- when reconciling this Kustomization.
- type: string
- sourceRef:
- description: Reference of the source where the kustomization file is.
- properties:
- apiVersion:
- description: API version of the referent.
- type: string
- kind:
- description: Kind of the referent.
- enum:
- - OCIRepository
- - GitRepository
- - Bucket
- - ExternalArtifact
- type: string
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: |-
- Namespace of the referent, defaults to the namespace of the Kubernetes
- resource object that contains the reference.
- type: string
- required:
- - kind
- - name
- type: object
- suspend:
- description: |-
- This flag tells the controller to suspend subsequent kustomize executions,
- it does not apply to already started executions. Defaults to false.
- type: boolean
- targetNamespace:
- description: |-
- TargetNamespace sets or overrides the namespace in the
- kustomization.yaml file.
- maxLength: 63
- minLength: 1
- type: string
- timeout:
- description: |-
- Timeout for validation, apply and health checking operations.
- Defaults to 'Interval' duration.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- wait:
- description: |-
- Wait instructs the controller to check the health of all the reconciled
- resources. When enabled, the HealthChecks are ignored. Defaults to false.
- type: boolean
- required:
- - interval
- - prune
- - sourceRef
- type: object
- status:
- default:
- observedGeneration: -1
- description: KustomizationStatus defines the observed state of a kustomization.
- properties:
- conditions:
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- history:
- description: |-
- History contains a set of snapshots of the last reconciliation attempts
- tracking the revision, the state and the duration of each attempt.
- items:
- description: |-
- Snapshot represents a point-in-time record of a group of resources reconciliation,
- including timing information, status, and a unique digest identifier.
- properties:
- digest:
- description: Digest is the checksum in the format `<algo>:<hex>` of the resources in this snapshot.
- type: string
- firstReconciled:
- description: FirstReconciled is the time when this revision was first reconciled to the cluster.
- format: date-time
- type: string
- lastReconciled:
- description: LastReconciled is the time when this revision was last reconciled to the cluster.
- format: date-time
- type: string
- lastReconciledDuration:
- description: LastReconciledDuration is time it took to reconcile the resources in this revision.
- type: string
- lastReconciledStatus:
- description: LastReconciledStatus is the status of the last reconciliation.
- type: string
- metadata:
- additionalProperties:
- type: string
- description: Metadata contains additional information about the snapshot.
- type: object
- totalReconciliations:
- description: TotalReconciliations is the total number of reconciliations that have occurred for this snapshot.
- format: int64
- type: integer
- required:
- - digest
- - firstReconciled
- - lastReconciled
- - lastReconciledDuration
- - lastReconciledStatus
- - totalReconciliations
- type: object
- type: array
- inventory:
- description: |-
- Inventory contains the list of Kubernetes resource object references that
- have been successfully applied.
- properties:
- entries:
- description: Entries of Kubernetes resource object references.
- items:
- description: ResourceRef contains the information necessary to locate a resource within a cluster.
- properties:
- id:
- description: |-
- ID is the string representation of the Kubernetes resource object's metadata,
- in the format '<namespace>_<name>_<group>_<kind>'.
- type: string
- v:
- description: Version is the API version of the Kubernetes resource object's kind.
- type: string
- required:
- - id
- - v
- type: object
- type: array
- required:
- - entries
- type: object
- lastAppliedOriginRevision:
- description: |-
- The last successfully applied origin revision.
- Equals the origin revision of the applied Artifact from the referenced Source.
- Usually present on the Metadata of the applied Artifact and depends on the
- Source type, e.g. for OCI it's the value associated with the key
- "org.opencontainers.image.revision".
- type: string
- lastAppliedRevision:
- description: |-
- The last successfully applied revision.
- Equals the Revision of the applied Artifact from the referenced Source.
- type: string
- lastAttemptedRevision:
- description: LastAttemptedRevision is the revision of the last reconciliation attempt.
- type: string
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: ObservedGeneration is the last reconciled generation.
- format: int64
- type: integer
- type: object
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- deprecated: true
- deprecationWarning: v1beta2 Kustomization is deprecated, upgrade to v1
- name: v1beta2
- schema:
- openAPIV3Schema:
- description: Kustomization is the Schema for the kustomizations API.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: KustomizationSpec defines the configuration to calculate the desired state from a Source using Kustomize.
- properties:
- commonMetadata:
- description: |-
- CommonMetadata specifies the common labels and annotations that are applied to all resources.
- Any existing label or annotation will be overridden if its key matches a common one.
- properties:
- annotations:
- additionalProperties:
- type: string
- description: Annotations to be added to the object's metadata.
- type: object
- labels:
- additionalProperties:
- type: string
- description: Labels to be added to the object's metadata.
- type: object
- type: object
- components:
- description: Components specifies relative paths to specifications of other Components.
- items:
- type: string
- type: array
- decryption:
- description: Decrypt Kubernetes secrets before applying them on the cluster.
- properties:
- provider:
- description: Provider is the name of the decryption engine.
- enum:
- - sops
- type: string
- secretRef:
- description: The secret name containing the private OpenPGP keys used for decryption.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- required:
- - provider
- type: object
- dependsOn:
- description: |-
- DependsOn may contain a meta.NamespacedObjectReference slice
- with references to Kustomization resources that must be ready before this
- Kustomization can be reconciled.
- items:
- description: |-
- NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any
- namespace.
- properties:
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: Namespace of the referent, when not specified it acts as LocalObjectReference.
- type: string
- required:
- - name
- type: object
- type: array
- force:
- default: false
- description: |-
- Force instructs the controller to recreate resources
- when patching fails due to an immutable field change.
- type: boolean
- healthChecks:
- description: A list of resources to be included in the health assessment.
- items:
- description: |-
- NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object
- in any namespace.
- properties:
- apiVersion:
- description: API version of the referent, if not specified the Kubernetes preferred version will be used.
- type: string
- kind:
- description: Kind of the referent.
- type: string
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: Namespace of the referent, when not specified it acts as LocalObjectReference.
- type: string
- required:
- - kind
- - name
- type: object
- type: array
- images:
- description: |-
- Images is a list of (image name, new name, new tag or digest)
- for changing image names, tags or digests. This can also be achieved with a
- patch, but this operator is simpler to specify.
- items:
- description: Image contains an image name, a new name, a new tag or digest, which will replace the original name and tag.
- properties:
- digest:
- description: |-
- Digest is the value used to replace the original image tag.
- If digest is present NewTag value is ignored.
- type: string
- name:
- description: Name is a tag-less image name.
- type: string
- newName:
- description: NewName is the value used to replace the original name.
- type: string
- newTag:
- description: NewTag is the value used to replace the original tag.
- type: string
- required:
- - name
- type: object
- type: array
- interval:
- description: The interval at which to reconcile the Kustomization.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- kubeConfig:
- description: |-
- The KubeConfig for reconciling the Kustomization on a remote cluster.
- When used in combination with KustomizationSpec.ServiceAccountName,
- forces the controller to act on behalf of that Service Account at the
- target cluster.
- If the --default-service-account flag is set, its value will be used as
- a controller level fallback for when KustomizationSpec.ServiceAccountName
- is empty.
- properties:
- configMapRef:
- description: |-
- ConfigMapRef holds an optional name of a ConfigMap that contains
- the following keys:
-
- - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
- `generic`. Required.
- - `cluster`: the fully qualified resource name of the Kubernetes
- cluster in the cloud provider API. Not used by the `generic`
- provider. Required when one of `address` or `ca.crt` is not set.
- - `address`: the address of the Kubernetes API server. Required
- for `generic`. For the other providers, if not specified, the
- first address in the cluster resource will be used, and if
- specified, it must match one of the addresses in the cluster
- resource.
- If audiences is not set, will be used as the audience for the
- `generic` provider.
- - `ca.crt`: the optional PEM-encoded CA certificate for the
- Kubernetes API server. If not set, the controller will use the
- CA certificate from the cluster resource.
- - `audiences`: the optional audiences as a list of
- line-break-separated strings for the Kubernetes ServiceAccount
- token. Defaults to the `address` for the `generic` provider, or
- to specific values for the other providers depending on the
- provider.
- - `serviceAccountName`: the optional name of the Kubernetes
- ServiceAccount in the same namespace that should be used
- for authentication. If not specified, the controller
- ServiceAccount will be used.
-
- Mutually exclusive with SecretRef.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- secretRef:
- description: |-
- SecretRef holds an optional name of a secret that contains a key with
- the kubeconfig file as the value. If no key is set, the key will default
- to 'value'. Mutually exclusive with ConfigMapRef.
- It is recommended that the kubeconfig is self-contained, and the secret
- is regularly updated if credentials such as a cloud-access-token expire.
- Cloud specific `cmd-path` auth helpers will not function without adding
- binaries and credentials to the Pod that is responsible for reconciling
- Kubernetes resources. Supported only for the generic provider.
- properties:
- key:
- description: Key in the Secret, when not specified an implementation-specific default key is used.
- type: string
- name:
- description: Name of the Secret.
- type: string
- required:
- - name
- type: object
- type: object
- x-kubernetes-validations:
- - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
- rule: has(self.configMapRef) || has(self.secretRef)
- - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
- rule: '!has(self.configMapRef) || !has(self.secretRef)'
- patches:
- description: |-
- Strategic merge and JSON patches, defined as inline YAML objects,
- capable of targeting objects based on kind, label and annotation selectors.
- items:
- description: |-
- Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should
- be applied to.
- properties:
- patch:
- description: |-
- Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
- an array of operation objects.
- type: string
- target:
- description: Target points to the resources that the patch document should be applied to.
- properties:
- annotationSelector:
- description: |-
- AnnotationSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource annotations.
- type: string
- group:
- description: |-
- Group is the API group to select resources from.
- Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- kind:
- description: |-
- Kind of the API Group to select resources from.
- Together with Group and Version it is capable of unambiguously
- identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- labelSelector:
- description: |-
- LabelSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource labels.
- type: string
- name:
- description: Name to match resources with.
- type: string
- namespace:
- description: Namespace to select resources from.
- type: string
- version:
- description: |-
- Version of the API Group to select resources from.
- Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- type: object
- required:
- - patch
- type: object
- type: array
- patchesJson6902:
- description: |-
- JSON 6902 patches, defined as inline YAML objects.
- Deprecated: Use Patches instead.
- items:
- description: JSON6902Patch contains a JSON6902 patch and the target the patch should be applied to.
- properties:
- patch:
- description: Patch contains the JSON6902 patch document with an array of operation objects.
- items:
- description: |-
- JSON6902 is a JSON6902 operation object.
- https://datatracker.ietf.org/doc/html/rfc6902#section-4
- properties:
- from:
- description: |-
- From contains a JSON-pointer value that references a location within the target document where the operation is
- performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.
- type: string
- op:
- description: |-
- Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or
- "test".
- https://datatracker.ietf.org/doc/html/rfc6902#section-4
- enum:
- - test
- - remove
- - add
- - replace
- - move
- - copy
- type: string
- path:
- description: |-
- Path contains the JSON-pointer value that references a location within the target document where the operation
- is performed. The meaning of the value depends on the value of Op.
- type: string
- value:
- description: |-
- Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into
- account by all operations.
- x-kubernetes-preserve-unknown-fields: true
- required:
- - op
- - path
- type: object
- type: array
- target:
- description: Target points to the resources that the patch document should be applied to.
- properties:
- annotationSelector:
- description: |-
- AnnotationSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource annotations.
- type: string
- group:
- description: |-
- Group is the API group to select resources from.
- Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- kind:
- description: |-
- Kind of the API Group to select resources from.
- Together with Group and Version it is capable of unambiguously
- identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- labelSelector:
- description: |-
- LabelSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource labels.
- type: string
- name:
- description: Name to match resources with.
- type: string
- namespace:
- description: Namespace to select resources from.
- type: string
- version:
- description: |-
- Version of the API Group to select resources from.
- Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- type: object
- required:
- - patch
- - target
- type: object
- type: array
- patchesStrategicMerge:
- description: |-
- Strategic merge patches, defined as inline YAML objects.
- Deprecated: Use Patches instead.
- items:
- x-kubernetes-preserve-unknown-fields: true
- type: array
- path:
- description: |-
- Path to the directory containing the kustomization.yaml file, or the
- set of plain YAMLs a kustomization.yaml should be generated for.
- Defaults to 'None', which translates to the root path of the SourceRef.
- type: string
- postBuild:
- description: |-
- PostBuild describes which actions to perform on the YAML manifest
- generated by building the kustomize overlay.
- properties:
- substitute:
- additionalProperties:
- type: string
- description: |-
- Substitute holds a map of key/value pairs.
- The variables defined in your YAML manifests
- that match any of the keys defined in the map
- will be substituted with the set value.
- Includes support for bash string replacement functions
- e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.
- type: object
- substituteFrom:
- description: |-
- SubstituteFrom holds references to ConfigMaps and Secrets containing
- the variables and their values to be substituted in the YAML manifests.
- The ConfigMap and the Secret data keys represent the var names and they
- must match the vars declared in the manifests for the substitution to happen.
- items:
- description: |-
- SubstituteReference contains a reference to a resource containing
- the variables name and value.
- properties:
- kind:
- description: Kind of the values referent, valid values are ('Secret', 'ConfigMap').
- enum:
- - Secret
- - ConfigMap
- type: string
- name:
- description: |-
- Name of the values referent. Should reside in the same namespace as the
- referring resource.
- maxLength: 253
- minLength: 1
- type: string
- optional:
- default: false
- description: |-
- Optional indicates whether the referenced resource must exist, or whether to
- tolerate its absence. If true and the referenced resource is absent, proceed
- as if the resource was present but empty, without any variables defined.
- type: boolean
- required:
- - kind
- - name
- type: object
- type: array
- type: object
- prune:
- description: Prune enables garbage collection.
- type: boolean
- retryInterval:
- description: |-
- The interval at which to retry a previously failed reconciliation.
- When not specified, the controller uses the KustomizationSpec.Interval
- value to retry failures.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- serviceAccountName:
- description: |-
- The name of the Kubernetes service account to impersonate
- when reconciling this Kustomization.
- type: string
- sourceRef:
- description: Reference of the source where the kustomization file is.
- properties:
- apiVersion:
- description: API version of the referent.
- type: string
- kind:
- description: Kind of the referent.
- enum:
- - OCIRepository
- - GitRepository
- - Bucket
- type: string
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: Namespace of the referent, defaults to the namespace of the Kubernetes resource object that contains the reference.
- type: string
- required:
- - kind
- - name
- type: object
- suspend:
- description: |-
- This flag tells the controller to suspend subsequent kustomize executions,
- it does not apply to already started executions. Defaults to false.
- type: boolean
- targetNamespace:
- description: |-
- TargetNamespace sets or overrides the namespace in the
- kustomization.yaml file.
- maxLength: 63
- minLength: 1
- type: string
- timeout:
- description: |-
- Timeout for validation, apply and health checking operations.
- Defaults to 'Interval' duration.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- validation:
- description: 'Deprecated: Not used in v1beta2.'
- enum:
- - none
- - client
- - server
- type: string
- wait:
- description: |-
- Wait instructs the controller to check the health of all the reconciled resources.
- When enabled, the HealthChecks are ignored. Defaults to false.
- type: boolean
- required:
- - interval
- - prune
- - sourceRef
- type: object
- status:
- default:
- observedGeneration: -1
- description: KustomizationStatus defines the observed state of a kustomization.
- properties:
- conditions:
- items:
- description: Condition contains details for one aspect of the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- inventory:
- description: Inventory contains the list of Kubernetes resource object references that have been successfully applied.
- properties:
- entries:
- description: Entries of Kubernetes resource object references.
- items:
- description: ResourceRef contains the information necessary to locate a resource within a cluster.
- properties:
- id:
- description: |-
- ID is the string representation of the Kubernetes resource object's metadata,
- in the format '<namespace>_<name>_<group>_<kind>'.
- type: string
- v:
- description: Version is the API version of the Kubernetes resource object's kind.
- type: string
- required:
- - id
- - v
- type: object
- type: array
- required:
- - entries
- type: object
- lastAppliedRevision:
- description: |-
- The last successfully applied revision.
- Equals the Revision of the applied Artifact from the referenced Source.
- type: string
- lastAttemptedRevision:
- description: LastAttemptedRevision is the revision of the last reconciliation attempt.
- type: string
- lastHandledReconcileAt:
- description: |-
- LastHandledReconcileAt holds the value of the most recent
- reconcile request value, so a change of the annotation value
- can be detected.
- type: string
- observedGeneration:
- description: ObservedGeneration is the last reconciled generation.
- format: int64
- type: integer
- type: object
- type: object
- served: true
- storage: false
- subresources:
- status: {}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
- labels:
- app.kubernetes.io/component: kustomize-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: kustomize-controller
- namespace: flux-system
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- labels:
- app.kubernetes.io/component: kustomize-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- control-plane: controller
- name: kustomize-controller
- namespace: flux-system
-spec:
- replicas: 1
- selector:
- matchLabels:
- app: kustomize-controller
- template:
- metadata:
- annotations:
- prometheus.io/port: "8080"
- prometheus.io/scrape: "true"
- labels:
- app: kustomize-controller
- app.kubernetes.io/component: kustomize-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- spec:
- containers:
- - args:
- - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
- - --watch-all-namespaces=true
- - --log-level=info
- - --log-encoding=json
- - --enable-leader-election
- env:
- - name: RUNTIME_NAMESPACE
- valueFrom:
- fieldRef:
- fieldPath: metadata.namespace
- - name: GOMEMLIMIT
- valueFrom:
- resourceFieldRef:
- containerName: manager
- resource: limits.memory
- image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
- imagePullPolicy: IfNotPresent
- livenessProbe:
- httpGet:
- path: /healthz
- port: healthz
- name: manager
- ports:
- - containerPort: 8080
- name: http-prom
- protocol: TCP
- - containerPort: 9440
- name: healthz
- protocol: TCP
- readinessProbe:
- httpGet:
- path: /readyz
- port: healthz
- resources:
- limits:
- cpu: 1000m
- memory: 1Gi
- requests:
- cpu: 100m
- memory: 64Mi
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- seccompProfile:
- type: RuntimeDefault
- volumeMounts:
- - mountPath: /tmp
- name: temp
- nodeSelector:
- kubernetes.io/os: linux
- priorityClassName: system-cluster-critical
- securityContext:
- fsGroup: 1337
- serviceAccountName: kustomize-controller
- terminationGracePeriodSeconds: 60
- volumes:
- - emptyDir: {}
- name: temp
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- controller-gen.kubebuilder.io/version: v0.19.0
- labels:
- app.kubernetes.io/component: helm-controller
- app.kubernetes.io/instance: flux-system
- app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
- name: helmreleases.helm.toolkit.fluxcd.io
-spec:
- group: helm.toolkit.fluxcd.io
- names:
- kind: HelmRelease
- listKind: HelmReleaseList
- plural: helmreleases
- shortNames:
- - hr
- singular: helmrelease
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- type: string
- name: v2
- schema:
- openAPIV3Schema:
- description: HelmRelease is the Schema for the helmreleases API
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: HelmReleaseSpec defines the desired state of a Helm release.
- properties:
- chart:
- description: |-
- Chart defines the template of the v1.HelmChart that should be created
- for this HelmRelease.
- properties:
- metadata:
- description: ObjectMeta holds the template for metadata like labels and annotations.
- properties:
- annotations:
- additionalProperties:
- type: string
- description: |-
- Annotations is an unstructured key value map stored with a resource that may be
- set by external tools to store and retrieve arbitrary metadata. They are not
- queryable and should be preserved when modifying objects.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
- type: object
- labels:
- additionalProperties:
- type: string
- description: |-
- Map of string keys and values that can be used to organize and categorize
- (scope and select) objects.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
- type: object
- type: object
- spec:
- description: Spec holds the template for the v1.HelmChartSpec for this HelmRelease.
- properties:
- chart:
- description: The name or path the Helm chart is available at in the SourceRef.
- maxLength: 2048
- minLength: 1
- type: string
- ignoreMissingValuesFiles:
- description: IgnoreMissingValuesFiles controls whether to silently ignore missing values files rather than failing.
- type: boolean
- interval:
- description: |-
- Interval at which to check the v1.Source for updates. Defaults to
- 'HelmReleaseSpec.Interval'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- reconcileStrategy:
- default: ChartVersion
- description: |-
- Determines what enables the creation of a new artifact. Valid values are
- ('ChartVersion', 'Revision').
- See the documentation of the values for an explanation on their behavior.
- Defaults to ChartVersion when omitted.
- enum:
- - ChartVersion
- - Revision
- type: string
- sourceRef:
- description: The name and namespace of the v1.Source the chart is available at.
- properties:
- apiVersion:
- description: APIVersion of the referent.
- type: string
- kind:
- description: Kind of the referent.
- enum:
- - HelmRepository
- - GitRepository
- - Bucket
- type: string
- name:
- description: Name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: Namespace of the referent.
- maxLength: 63
- minLength: 1
- type: string
- required:
- - kind
- - name
- type: object
- valuesFiles:
- description: |-
- Alternative list of values files to use as the chart values (values.yaml
- is not included by default), expected to be a relative path in the SourceRef.
- Values files are merged in the order of this list with the last file overriding
- the first. Ignored when omitted.
- items:
- type: string
- type: array
- verify:
- description: |-
- Verify contains the secret name containing the trusted public keys
- used to verify the signature and specifies which provider to use to check
- whether OCI image is authentic.
- This field is only supported for OCI sources.
- Chart dependencies, which are not bundled in the umbrella chart artifact,
- are not verified.
- properties:
- provider:
- default: cosign
- description: Provider specifies the technology used to sign the OCI Helm chart.
- enum:
- - cosign
- - notation
- type: string
- secretRef:
- description: |-
- SecretRef specifies the Kubernetes Secret containing the
- trusted public keys.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
- type: object
- required:
- - provider
- type: object
- version:
- default: '*'
- description: |-
- Version semver expression, ignored for charts from v1.GitRepository and
- v1beta2.Bucket sources. Defaults to latest when omitted.
- type: string
- required:
- - chart
- - sourceRef
- type: object
- required:
- - spec
- type: object
- chartRef:
- description: |-
- ChartRef holds a reference to a source controller resource containing the
- Helm chart artifact.
- properties:
- apiVersion:
- description: APIVersion of the referent.
- type: string
- kind:
- description: Kind of the referent.
- enum:
- - OCIRepository
- - HelmChart
- - ExternalArtifact
- type: string
- name:
- description: Name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace of the referent, defaults to the namespace of the Kubernetes
- resource object that contains the reference.
- maxLength: 63
- minLength: 1
- type: string
- required:
- - kind
- - name
- type: object
- commonMetadata:
- description: |-
- CommonMetadata specifies the common labels and annotations that are
- applied to all resources. Any existing label or annotation will be
- overridden if its key matches a common one.
- properties:
- annotations:
- additionalProperties:
- type: string
- description: Annotations to be added to the object's metadata.
- type: object
- labels:
- additionalProperties:
- type: string
- description: Labels to be added to the object's metadata.
- type: object
- type: object
- dependsOn:
- description: |-
- DependsOn may contain a DependencyReference slice with
- references to HelmRelease resources that must be ready before this HelmRelease
- can be reconciled.
- items:
- description: DependencyReference defines a HelmRelease dependency on another HelmRelease resource.
- properties:
- name:
- description: Name of the referent.
- type: string
- namespace:
- description: |-
- Namespace of the referent, defaults to the namespace of the HelmRelease
- resource object that contains the reference.
- type: string
- readyExpr:
- description: |-
- ReadyExpr is a CEL expression that can be used to assess the readiness
- of a dependency. When specified, the built-in readiness check
- is replaced by the logic defined in the CEL expression.
- To make the CEL expression additive to the built-in readiness check,
- the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
- type: string
- required:
- - name
- type: object
- type: array
- driftDetection:
- description: |-
- DriftDetection holds the configuration for detecting and handling
- differences between the manifest in the Helm storage and the resources
- currently existing in the cluster.
- properties:
- ignore:
- description: |-
- Ignore contains a list of rules for specifying which changes to ignore
- during diffing.
- items:
- description: |-
- IgnoreRule defines a rule to selectively disregard specific changes during
- the drift detection process.
- properties:
- paths:
- description: |-
- Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from
- consideration in a Kubernetes object.
- items:
- type: string
- type: array
- target:
- description: |-
- Target is a selector for specifying Kubernetes objects to which this
- rule applies.
- If Target is not set, the Paths will be ignored for all Kubernetes
- objects within the manifest of the Helm release.
- properties:
- annotationSelector:
- description: |-
- AnnotationSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource annotations.
- type: string
- group:
- description: |-
- Group is the API group to select resources from.
- Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- kind:
- description: |-
- Kind of the API Group to select resources from.
- Together with Group and Version it is capable of unambiguously
- identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- labelSelector:
- description: |-
- LabelSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource labels.
- type: string
- name:
- description: Name to match resources with.
- type: string
- namespace:
- description: Namespace to select resources from.
- type: string
- version:
- description: |-
- Version of the API Group to select resources from.
- Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- type: object
- required:
- - paths
- type: object
- type: array
- mode:
- description: |-
- Mode defines how differences should be handled between the Helm manifest
- and the manifest currently applied to the cluster.
- If not explicitly set, it defaults to DiffModeDisabled.
- enum:
- - enabled
- - warn
- - disabled
- type: string
- type: object
- install:
- description: Install holds the configuration for Helm install actions for this HelmRelease.
- properties:
- crds:
- description: |-
- CRDs upgrade CRDs from the Helm Chart's crds directory according
- to the CRD upgrade policy provided here. Valid values are `Skip`,
- `Create` or `CreateReplace`. Default is `Create` and if omitted
- CRDs are installed but not updated.
-
- Skip: do neither install nor replace (update) any CRDs.
-
- Create: new CRDs are created, existing CRDs are neither updated nor deleted.
-
- CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
- but not deleted.
-
- By default, CRDs are applied (installed) during Helm install action.
- With this option users can opt in to CRD replace existing CRDs on Helm
- install actions, which is not (yet) natively supported by Helm.
- https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
- enum:
- - Skip
- - Create
- - CreateReplace
- type: string
- createNamespace:
- description: |-
- CreateNamespace tells the Helm install action to create the
- HelmReleaseSpec.TargetNamespace if it does not exist yet.
- On uninstall, the namespace will not be garbage collected.
- type: boolean
- disableHooks:
- description: DisableHooks prevents hooks from running during the Helm install action.
- type: boolean
- disableOpenAPIValidation:
- description: |-
- DisableOpenAPIValidation prevents the Helm install action from validating
- rendered templates against the Kubernetes OpenAPI Schema.
- type: boolean
- disableSchemaValidation:
- description: |-
- DisableSchemaValidation prevents the Helm install action from validating
- the values against the JSON Schema.
- type: boolean
- disableTakeOwnership:
- description: |-
- DisableTakeOwnership disables taking ownership of existing resources
- during the Helm install action. Defaults to false.
- type: boolean
- disableWait:
- description: |-
- DisableWait disables the waiting for resources to be ready after a Helm
- install has been performed.
- type: boolean
- disableWaitForJobs:
- description: |-
- DisableWaitForJobs disables waiting for jobs to complete after a Helm
- install has been performed.
- type: boolean
- remediation:
- description: |-
- Remediation holds the remediation configuration for when the Helm install
- action for the HelmRelease fails. The default is to not perform any action.
- properties:
- ignoreTestFailures:
- description: |-
- IgnoreTestFailures tells the controller to skip remediation when the Helm
- tests are run after an install action but fail. Defaults to
- 'Test.IgnoreFailures'.
- type: boolean
- remediateLastFailure:
- description: |-
- RemediateLastFailure tells the controller to remediate the last failure, when
- no retries remain. Defaults to 'false'.
- type: boolean
- retries:
- description: |-
- Retries is the number of retries that should be attempted on failures before
- bailing. Remediation, using an uninstall, is performed between each attempt.
- Defaults to '0', a negative integer equals to unlimited retries.
- type: integer
- type: object
- replace:
- description: |-
- Replace tells the Helm install action to re-use the 'ReleaseName', but only
- if that name is a deleted release which remains in the history.
- type: boolean
- skipCRDs:
- description: |-
- SkipCRDs tells the Helm install action to not install any CRDs. By default,
- CRDs are installed if not already present.
-
- Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.
- type: boolean
- strategy:
- description: |-
- Strategy defines the install strategy to use for this HelmRelease.
- Defaults to 'RemediateOnFailure'.
- properties:
- name:
- description: Name of the install strategy.
- enum:
- - RemediateOnFailure
- - RetryOnFailure
- type: string
- retryInterval:
- description: |-
- RetryInterval is the interval at which to retry a failed install.
- Can be used only when Name is set to RetryOnFailure.
- Defaults to '5m'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: .retryInterval cannot be set when .name is 'RemediateOnFailure'
- rule: '!has(self.retryInterval) || self.name != ''RemediateOnFailure'''
- timeout:
- description: |-
- Timeout is the time to wait for any individual Kubernetes operation (like
- Jobs for hooks) during the performance of a Helm install action. Defaults to
- 'HelmReleaseSpec.Timeout'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- type: object
- interval:
- description: Interval at which to reconcile the Helm release.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- kubeConfig:
+ ports:
+ - name: http
+ port: 80
+ protocol: TCP
+ targetPort: http
+ selector:
+ app: source-controller
+ type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ labels:
+ app.kubernetes.io/component: source-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ control-plane: controller
+ name: source-controller
+ namespace: flux-system
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: source-controller
+ strategy:
+ type: Recreate
+ template:
+ metadata:
+ annotations:
+ prometheus.io/port: "8080"
+ prometheus.io/scrape: "true"
+ labels:
+ app: source-controller
+ app.kubernetes.io/component: source-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ spec:
+ containers:
+ - args:
+ - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
+ - --watch-all-namespaces=true
+ - --log-level=info
+ - --log-encoding=json
+ - --enable-leader-election
+ - --storage-path=/data
+ - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.
+ env:
+ - name: RUNTIME_NAMESPACE
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.namespace
+ - name: TUF_ROOT
+ value: /tmp/.sigstore
+ - name: GOMEMLIMIT
+ valueFrom:
+ resourceFieldRef:
+ containerName: manager
+ resource: limits.memory
+ image: ghcr.io/fluxcd/source-controller:v1.8.0
+ imagePullPolicy: IfNotPresent
+ livenessProbe:
+ httpGet:
+ path: /healthz
+ port: healthz
+ name: manager
+ ports:
+ - containerPort: 9090
+ name: http
+ protocol: TCP
+ - containerPort: 8080
+ name: http-prom
+ protocol: TCP
+ - containerPort: 9440
+ name: healthz
+ protocol: TCP
+ readinessProbe:
+ httpGet:
+ path: /
+ port: http
+ resources:
+ limits:
+ cpu: 1000m
+ memory: 1Gi
+ requests:
+ cpu: 50m
+ memory: 64Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
+ volumeMounts:
+ - mountPath: /data
+ name: data
+ - mountPath: /tmp
+ name: tmp
+ nodeSelector:
+ kubernetes.io/os: linux
+ priorityClassName: system-cluster-critical
+ securityContext:
+ fsGroup: 1337
+ serviceAccountName: source-controller
+ terminationGracePeriodSeconds: 10
+ volumes:
+ - emptyDir: {}
+ name: data
+ - emptyDir: {}
+ name: tmp
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.19.0
+ labels:
+ app.kubernetes.io/component: kustomize-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ name: kustomizations.kustomize.toolkit.fluxcd.io
+spec:
+ group: kustomize.toolkit.fluxcd.io
+ names:
+ kind: Kustomization
+ listKind: KustomizationList
+ plural: kustomizations
+ shortNames:
+ - ks
+ singular: kustomization
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].message
+ name: Status
+ type: string
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: Kustomization is the Schema for the kustomizations API.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ KustomizationSpec defines the configuration to calculate the desired state
+ from a Source using Kustomize.
+ properties:
+ commonMetadata:
description: |-
- KubeConfig for reconciling the HelmRelease on a remote cluster.
- When used in combination with HelmReleaseSpec.ServiceAccountName,
- forces the controller to act on behalf of that Service Account at the
- target cluster.
- If the --default-service-account flag is set, its value will be used as
- a controller level fallback for when HelmReleaseSpec.ServiceAccountName
- is empty.
+ CommonMetadata specifies the common labels and annotations that are
+ applied to all resources. Any existing label or annotation will be
+ overridden if its key matches a common one.
properties:
- configMapRef:
- description: |-
- ConfigMapRef holds an optional name of a ConfigMap that contains
- the following keys:
-
- - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
- `generic`. Required.
- - `cluster`: the fully qualified resource name of the Kubernetes
- cluster in the cloud provider API. Not used by the `generic`
- provider. Required when one of `address` or `ca.crt` is not set.
- - `address`: the address of the Kubernetes API server. Required
- for `generic`. For the other providers, if not specified, the
- first address in the cluster resource will be used, and if
- specified, it must match one of the addresses in the cluster
- resource.
- If audiences is not set, will be used as the audience for the
- `generic` provider.
- - `ca.crt`: the optional PEM-encoded CA certificate for the
- Kubernetes API server. If not set, the controller will use the
- CA certificate from the cluster resource.
- - `audiences`: the optional audiences as a list of
- line-break-separated strings for the Kubernetes ServiceAccount
- token. Defaults to the `address` for the `generic` provider, or
- to specific values for the other providers depending on the
- provider.
- - `serviceAccountName`: the optional name of the Kubernetes
- ServiceAccount in the same namespace that should be used
- for authentication. If not specified, the controller
- ServiceAccount will be used.
-
- Mutually exclusive with SecretRef.
- properties:
- name:
- description: Name of the referent.
- type: string
- required:
- - name
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations to be added to the object's metadata.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels to be added to the object's metadata.
type: object
+ type: object
+ components:
+ description: Components specifies relative paths to kustomize Components.
+ items:
+ type: string
+ type: array
+ decryption:
+ description: Decrypt Kubernetes secrets before applying them on the cluster.
+ properties:
+ provider:
+ description: Provider is the name of the decryption engine.
+ enum:
+ - sops
+ type: string
secretRef:
description: |-
- SecretRef holds an optional name of a secret that contains a key with
- the kubeconfig file as the value. If no key is set, the key will default
- to 'value'. Mutually exclusive with ConfigMapRef.
- It is recommended that the kubeconfig is self-contained, and the secret
- is regularly updated if credentials such as a cloud-access-token expire.
- Cloud specific `cmd-path` auth helpers will not function without adding
- binaries and credentials to the Pod that is responsible for reconciling
- Kubernetes resources. Supported only for the generic provider.
+ The secret name containing the private OpenPGP keys used for decryption.
+ A static credential for a cloud provider defined inside the Secret
+ takes priority to secret-less authentication with the ServiceAccountName
+ field.
properties:
- key:
- description: Key in the Secret, when not specified an implementation-specific default key is used.
- type: string
name:
- description: Name of the Secret.
+ description: Name of the referent.
type: string
required:
- name
type: object
- type: object
- x-kubernetes-validations:
- - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
- rule: has(self.configMapRef) || has(self.secretRef)
- - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
- rule: '!has(self.configMapRef) || !has(self.secretRef)'
- maxHistory:
- description: |-
- MaxHistory is the number of revisions saved by Helm for this HelmRelease.
- Use '0' for an unlimited number of revisions; defaults to '5'.
- type: integer
- persistentClient:
- description: |-
- PersistentClient tells the controller to use a persistent Kubernetes
- client for this release. When enabled, the client will be reused for the
- duration of the reconciliation, instead of being created and destroyed
- for each (step of a) Helm action.
-
- This can improve performance, but may cause issues with some Helm charts
- that for example do create Custom Resource Definitions during installation
- outside Helm's CRD lifecycle hooks, which are then not observed to be
- available by e.g. post-install hooks.
-
- If not set, it defaults to true.
- type: boolean
- postRenderers:
- description: |-
- PostRenderers holds an array of Helm PostRenderers, which will be applied in order
- of their definition.
- items:
- description: PostRenderer contains a Helm PostRenderer specification.
- properties:
- kustomize:
- description: Kustomization to apply as PostRenderer.
- properties:
- images:
- description: |-
- Images is a list of (image name, new name, new tag or digest)
- for changing image names, tags or digests. This can also be achieved with a
- patch, but this operator is simpler to specify.
- items:
- description: Image contains an image name, a new name, a new tag or digest, which will replace the original name and tag.
- properties:
- digest:
- description: |-
- Digest is the value used to replace the original image tag.
- If digest is present NewTag value is ignored.
- type: string
- name:
- description: Name is a tag-less image name.
- type: string
- newName:
- description: NewName is the value used to replace the original name.
- type: string
- newTag:
- description: NewTag is the value used to replace the original tag.
- type: string
- required:
- - name
- type: object
- type: array
- patches:
- description: |-
- Strategic merge and JSON patches, defined as inline YAML objects,
- capable of targeting objects based on kind, label and annotation selectors.
- items:
- description: |-
- Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should
- be applied to.
- properties:
- patch:
- description: |-
- Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
- an array of operation objects.
- type: string
- target:
- description: Target points to the resources that the patch document should be applied to.
- properties:
- annotationSelector:
- description: |-
- AnnotationSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource annotations.
- type: string
- group:
- description: |-
- Group is the API group to select resources from.
- Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- kind:
- description: |-
- Kind of the API Group to select resources from.
- Together with Group and Version it is capable of unambiguously
- identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- labelSelector:
- description: |-
- LabelSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource labels.
- type: string
- name:
- description: Name to match resources with.
- type: string
- namespace:
- description: Namespace to select resources from.
- type: string
- version:
- description: |-
- Version of the API Group to select resources from.
- Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- type: object
- required:
- - patch
- type: object
- type: array
- type: object
- type: object
- type: array
- releaseName:
- description: |-
- ReleaseName used for the Helm release. Defaults to a composition of
- '[TargetNamespace-]Name'.
- maxLength: 53
- minLength: 1
- type: string
- rollback:
- description: Rollback holds the configuration for Helm rollback actions for this HelmRelease.
- properties:
- cleanupOnFail:
- description: |-
- CleanupOnFail allows deletion of new resources created during the Helm
- rollback action when it fails.
- type: boolean
- disableHooks:
- description: DisableHooks prevents hooks from running during the Helm rollback action.
- type: boolean
- disableWait:
- description: |-
- DisableWait disables the waiting for resources to be ready after a Helm
- rollback has been performed.
- type: boolean
- disableWaitForJobs:
- description: |-
- DisableWaitForJobs disables waiting for jobs to complete after a Helm
- rollback has been performed.
- type: boolean
- force:
- description: Force forces resource updates through a replacement strategy.
- type: boolean
- recreate:
- description: Recreate performs pod restarts for the resource if applicable.
- type: boolean
- timeout:
+ serviceAccountName:
description: |-
- Timeout is the time to wait for any individual Kubernetes operation (like
- Jobs for hooks) during the performance of a Helm rollback action. Defaults to
- 'HelmReleaseSpec.Timeout'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ ServiceAccountName is the name of the service account used to
+ authenticate with KMS services from cloud providers. If a
+ static credential for a given cloud provider is defined
+ inside the Secret referenced by SecretRef, that static
+ credential takes priority.
type: string
+ required:
+ - provider
type: object
- serviceAccountName:
+ deletionPolicy:
description: |-
- The name of the Kubernetes service account to impersonate
- when reconciling this HelmRelease.
- maxLength: 253
- minLength: 1
+ DeletionPolicy can be used to control garbage collection when this
+ Kustomization is deleted. Valid values are ('MirrorPrune', 'Delete',
+ 'WaitForTermination', 'Orphan'). 'MirrorPrune' mirrors the Prune field
+ (orphan if false, delete if true). Defaults to 'MirrorPrune'.
+ enum:
+ - MirrorPrune
+ - Delete
+ - WaitForTermination
+ - Orphan
type: string
- storageNamespace:
+ dependsOn:
description: |-
- StorageNamespace used for the Helm storage.
- Defaults to the namespace of the HelmRelease.
- maxLength: 63
- minLength: 1
- type: string
- suspend:
+ DependsOn may contain a DependencyReference slice
+ with references to Kustomization resources that must be ready before this
+ Kustomization can be reconciled.
+ items:
+ description: DependencyReference defines a Kustomization dependency on another Kustomization resource.
+ properties:
+ name:
+ description: Name of the referent.
+ type: string
+ namespace:
+ description: |-
+ Namespace of the referent, defaults to the namespace of the Kustomization
+ resource object that contains the reference.
+ type: string
+ readyExpr:
+ description: |-
+ ReadyExpr is a CEL expression that can be used to assess the readiness
+ of a dependency. When specified, the built-in readiness check
+ is replaced by the logic defined in the CEL expression.
+ To make the CEL expression additive to the built-in readiness check,
+ the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ force:
+ default: false
description: |-
- Suspend tells the controller to suspend reconciliation for this HelmRelease,
- it does not apply to already started reconciliations. Defaults to false.
+ Force instructs the controller to recreate resources
+ when patching fails due to an immutable field change.
type: boolean
- targetNamespace:
+ healthCheckExprs:
description: |-
- TargetNamespace to target when performing operations for the HelmRelease.
- Defaults to the namespace of the HelmRelease.
- maxLength: 63
- minLength: 1
- type: string
- test:
- description: Test holds the configuration for Helm test actions for this HelmRelease.
- properties:
- enable:
- description: |-
- Enable enables Helm test actions for this HelmRelease after an Helm install
- or upgrade action has been performed.
- type: boolean
- filters:
- description: Filters is a list of tests to run or exclude from running.
- items:
- description: Filter holds the configuration for individual Helm test filters.
- properties:
- exclude:
- description: Exclude specifies whether the named test should be excluded.
- type: boolean
- name:
- description: Name is the name of the test.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - name
- type: object
- type: array
- ignoreFailures:
- description: |-
- IgnoreFailures tells the controller to skip remediation when the Helm tests
- are run but fail. Can be overwritten for tests run after install or upgrade
- actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'.
- type: boolean
- timeout:
- description: |-
- Timeout is the time to wait for any individual Kubernetes operation during
- the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- type: object
- timeout:
+ HealthCheckExprs is a list of healthcheck expressions for evaluating the
+ health of custom resources using Common Expression Language (CEL).
+ The expressions are evaluated only when Wait or HealthChecks are specified.
+ items:
+ description: CustomHealthCheck defines the health check for custom resources.
+ properties:
+ apiVersion:
+ description: APIVersion of the custom resource under evaluation.
+ type: string
+ current:
+ description: |-
+ Current is the CEL expression that determines if the status
+ of the custom resource has reached the desired state.
+ type: string
+ failed:
+ description: |-
+ Failed is the CEL expression that determines if the status
+ of the custom resource has failed to reach the desired state.
+ type: string
+ inProgress:
+ description: |-
+ InProgress is the CEL expression that determines if the status
+ of the custom resource has not yet reached the desired state.
+ type: string
+ kind:
+ description: Kind of the custom resource under evaluation.
+ type: string
+ required:
+ - apiVersion
+ - current
+ - kind
+ type: object
+ type: array
+ healthChecks:
+ description: A list of resources to be included in the health assessment.
+ items:
+ description: |-
+ NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object
+ in any namespace.
+ properties:
+ apiVersion:
+ description: API version of the referent, if not specified the Kubernetes preferred version will be used.
+ type: string
+ kind:
+ description: Kind of the referent.
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ namespace:
+ description: Namespace of the referent, when not specified it acts as LocalObjectReference.
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ type: array
+ ignoreMissingComponents:
description: |-
- Timeout is the time to wait for any individual Kubernetes operation (like Jobs
- for hooks) during the performance of a Helm action. Defaults to '5m0s'.
+ IgnoreMissingComponents instructs the controller to ignore Components paths
+ not found in source by removing them from the generated kustomization.yaml
+ before running kustomize build.
+ type: boolean
+ images:
+ description: |-
+ Images is a list of (image name, new name, new tag or digest)
+ for changing image names, tags or digests. This can also be achieved with a
+ patch, but this operator is simpler to specify.
+ items:
+ description: Image contains an image name, a new name, a new tag or digest, which will replace the original name and tag.
+ properties:
+ digest:
+ description: |-
+ Digest is the value used to replace the original image tag.
+ If digest is present NewTag value is ignored.
+ type: string
+ name:
+ description: Name is a tag-less image name.
+ type: string
+ newName:
+ description: NewName is the value used to replace the original name.
+ type: string
+ newTag:
+ description: NewTag is the value used to replace the original tag.
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ interval:
+ description: |-
+ The interval at which to reconcile the Kustomization.
+ This interval is approximate and may be subject to jitter to ensure
+ efficient use of resources.
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
type: string
- uninstall:
- description: Uninstall holds the configuration for Helm uninstall actions for this HelmRelease.
- properties:
- deletionPropagation:
- default: background
- description: |-
- DeletionPropagation specifies the deletion propagation policy when
- a Helm uninstall is performed.
- enum:
- - background
- - foreground
- - orphan
- type: string
- disableHooks:
- description: DisableHooks prevents hooks from running during the Helm rollback action.
- type: boolean
- disableWait:
- description: |-
- DisableWait disables waiting for all the resources to be deleted after
- a Helm uninstall is performed.
- type: boolean
- keepHistory:
- description: |-
- KeepHistory tells Helm to remove all associated resources and mark the
- release as deleted, but retain the release history.
- type: boolean
- timeout:
- description: |-
- Timeout is the time to wait for any individual Kubernetes operation (like
- Jobs for hooks) during the performance of a Helm uninstall action. Defaults
- to 'HelmReleaseSpec.Timeout'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
- type: string
- type: object
- upgrade:
- description: Upgrade holds the configuration for Helm upgrade actions for this HelmRelease.
- properties:
- cleanupOnFail:
- description: |-
- CleanupOnFail allows deletion of new resources created during the Helm
- upgrade action when it fails.
- type: boolean
- crds:
+ kubeConfig:
+ description: |-
+ The KubeConfig for reconciling the Kustomization on a remote cluster.
+ When used in combination with KustomizationSpec.ServiceAccountName,
+ forces the controller to act on behalf of that Service Account at the
+ target cluster.
+ If the --default-service-account flag is set, its value will be used as
+ a controller level fallback for when KustomizationSpec.ServiceAccountName
+ is empty.
+ properties:
+ configMapRef:
description: |-
- CRDs upgrade CRDs from the Helm Chart's crds directory according
- to the CRD upgrade policy provided here. Valid values are `Skip`,
- `Create` or `CreateReplace`. Default is `Skip` and if omitted
- CRDs are neither installed nor upgraded.
-
- Skip: do neither install nor replace (update) any CRDs.
-
- Create: new CRDs are created, existing CRDs are neither updated nor deleted.
+ ConfigMapRef holds an optional name of a ConfigMap that contains
+ the following keys:
- CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
- but not deleted.
+ - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
+ `generic`. Required.
+ - `cluster`: the fully qualified resource name of the Kubernetes
+ cluster in the cloud provider API. Not used by the `generic`
+ provider. Required when one of `address` or `ca.crt` is not set.
+ - `address`: the address of the Kubernetes API server. Required
+ for `generic`. For the other providers, if not specified, the
+ first address in the cluster resource will be used, and if
+ specified, it must match one of the addresses in the cluster
+ resource.
+ If audiences is not set, will be used as the audience for the
+ `generic` provider.
+ - `ca.crt`: the optional PEM-encoded CA certificate for the
+ Kubernetes API server. If not set, the controller will use the
+ CA certificate from the cluster resource.
+ - `audiences`: the optional audiences as a list of
+ line-break-separated strings for the Kubernetes ServiceAccount
+ token. Defaults to the `address` for the `generic` provider, or
+ to specific values for the other providers depending on the
+ provider.
+ - `serviceAccountName`: the optional name of the Kubernetes
+ ServiceAccount in the same namespace that should be used
+ for authentication. If not specified, the controller
+ ServiceAccount will be used.
- By default, CRDs are not applied during Helm upgrade action. With this
- option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.
- https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
- enum:
- - Skip
- - Create
- - CreateReplace
- type: string
- disableHooks:
- description: DisableHooks prevents hooks from running during the Helm upgrade action.
- type: boolean
- disableOpenAPIValidation:
- description: |-
- DisableOpenAPIValidation prevents the Helm upgrade action from validating
- rendered templates against the Kubernetes OpenAPI Schema.
- type: boolean
- disableSchemaValidation:
- description: |-
- DisableSchemaValidation prevents the Helm upgrade action from validating
- the values against the JSON Schema.
- type: boolean
- disableTakeOwnership:
- description: |-
- DisableTakeOwnership disables taking ownership of existing resources
- during the Helm upgrade action. Defaults to false.
- type: boolean
- disableWait:
- description: |-
- DisableWait disables the waiting for resources to be ready after a Helm
- upgrade has been performed.
- type: boolean
- disableWaitForJobs:
- description: |-
- DisableWaitForJobs disables waiting for jobs to complete after a Helm
- upgrade has been performed.
- type: boolean
- force:
- description: Force forces resource updates through a replacement strategy.
- type: boolean
- preserveValues:
- description: |-
- PreserveValues will make Helm reuse the last release's values and merge in
- overrides from 'Values'. Setting this flag makes the HelmRelease
- non-declarative.
- type: boolean
- remediation:
- description: |-
- Remediation holds the remediation configuration for when the Helm upgrade
- action for the HelmRelease fails. The default is to not perform any action.
+ Mutually exclusive with SecretRef.
properties:
- ignoreTestFailures:
- description: |-
- IgnoreTestFailures tells the controller to skip remediation when the Helm
- tests are run after an upgrade action but fail.
- Defaults to 'Test.IgnoreFailures'.
- type: boolean
- remediateLastFailure:
- description: |-
- RemediateLastFailure tells the controller to remediate the last failure, when
- no retries remain. Defaults to 'false' unless 'Retries' is greater than 0.
- type: boolean
- retries:
- description: |-
- Retries is the number of retries that should be attempted on failures before
- bailing. Remediation, using 'Strategy', is performed between each attempt.
- Defaults to '0', a negative integer equals to unlimited retries.
- type: integer
- strategy:
- description: Strategy to use for failure remediation. Defaults to 'rollback'.
- enum:
- - rollback
- - uninstall
+ name:
+ description: Name of the referent.
type: string
+ required:
+ - name
type: object
- strategy:
+ secretRef:
description: |-
- Strategy defines the upgrade strategy to use for this HelmRelease.
- Defaults to 'RemediateOnFailure'.
+ SecretRef holds an optional name of a secret that contains a key with
+ the kubeconfig file as the value. If no key is set, the key will default
+ to 'value'. Mutually exclusive with ConfigMapRef.
+ It is recommended that the kubeconfig is self-contained, and the secret
+ is regularly updated if credentials such as a cloud-access-token expire.
+ Cloud specific `cmd-path` auth helpers will not function without adding
+ binaries and credentials to the Pod that is responsible for reconciling
+ Kubernetes resources. Supported only for the generic provider.
properties:
- name:
- description: Name of the upgrade strategy.
- enum:
- - RemediateOnFailure
- - RetryOnFailure
+ key:
+ description: Key in the Secret, when not specified an implementation-specific default key is used.
type: string
- retryInterval:
- description: |-
- RetryInterval is the interval at which to retry a failed upgrade.
- Can be used only when Name is set to RetryOnFailure.
- Defaults to '5m'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ name:
+ description: Name of the Secret.
type: string
required:
- name
type: object
- x-kubernetes-validations:
- - message: .retryInterval can only be set when .name is 'RetryOnFailure'
- rule: '!has(self.retryInterval) || self.name == ''RetryOnFailure'''
- timeout:
+ type: object
+ x-kubernetes-validations:
+ - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
+ rule: has(self.configMapRef) || has(self.secretRef)
+ - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified
+ rule: '!has(self.configMapRef) || !has(self.secretRef)'
+ namePrefix:
+ description: NamePrefix will prefix the names of all managed resources.
+ maxLength: 200
+ minLength: 1
+ type: string
+ nameSuffix:
+ description: NameSuffix will suffix the names of all managed resources.
+ maxLength: 200
+ minLength: 1
+ type: string
+ patches:
+ description: |-
+ Strategic merge and JSON patches, defined as inline YAML objects,
+ capable of targeting objects based on kind, label and annotation selectors.
+ items:
+ description: |-
+ Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should
+ be applied to.
+ properties:
+ patch:
+ description: |-
+ Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
+ an array of operation objects.
+ type: string
+ target:
+ description: Target points to the resources that the patch document should be applied to.
+ properties:
+ annotationSelector:
+ description: |-
+ AnnotationSelector is a string that follows the label selection expression
+ https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
+ It matches with the resource annotations.
+ type: string
+ group:
+ description: |-
+ Group is the API group to select resources from.
+ Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
+ https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+ type: string
+ kind:
+ description: |-
+ Kind of the API Group to select resources from.
+ Together with Group and Version it is capable of unambiguously
+ identifying and/or selecting resources.
+ https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+ type: string
+ labelSelector:
+ description: |-
+ LabelSelector is a string that follows the label selection expression
+ https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
+ It matches with the resource labels.
+ type: string
+ name:
+ description: Name to match resources with.
+ type: string
+ namespace:
+ description: Namespace to select resources from.
+ type: string
+ version:
+ description: |-
+ Version of the API Group to select resources from.
+ Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
+ https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+ type: string
+ type: object
+ required:
+ - patch
+ type: object
+ type: array
+ path:
+ description: |-
+ Path to the directory containing the kustomization.yaml file, or the
+ set of plain YAMLs a kustomization.yaml should be generated for.
+ Defaults to 'None', which translates to the root path of the SourceRef.
+ type: string
+ postBuild:
+ description: |-
+ PostBuild describes which actions to perform on the YAML manifest
+ generated by building the kustomize overlay.
+ properties:
+ substitute:
+ additionalProperties:
+ type: string
+ description: |-
+ Substitute holds a map of key/value pairs.
+ The variables defined in your YAML manifests that match any of the keys
+ defined in the map will be substituted with the set value.
+ Includes support for bash string replacement functions
+ e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.
+ type: object
+ substituteFrom:
+ description: |-
+ SubstituteFrom holds references to ConfigMaps and Secrets containing
+ the variables and their values to be substituted in the YAML manifests.
+ The ConfigMap and the Secret data keys represent the var names, and they
+ must match the vars declared in the manifests for the substitution to
+ happen.
+ items:
+ description: |-
+ SubstituteReference contains a reference to a resource containing
+ the variables name and value.
+ properties:
+ kind:
+ description: Kind of the values referent, valid values are ('Secret', 'ConfigMap').
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ name:
+ description: |-
+ Name of the values referent. Should reside in the same namespace as the
+ referring resource.
+ maxLength: 253
+ minLength: 1
+ type: string
+ optional:
+ default: false
+ description: |-
+ Optional indicates whether the referenced resource must exist, or whether to
+ tolerate its absence. If true and the referenced resource is absent, proceed
+ as if the resource was present but empty, without any variables defined.
+ type: boolean
+ required:
+ - kind
+ - name
+ type: object
+ type: array
+ type: object
+ prune:
+ description: Prune enables garbage collection.
+ type: boolean
+ retryInterval:
+ description: |-
+ The interval at which to retry a previously failed reconciliation.
+ When not specified, the controller uses the KustomizationSpec.Interval
+ value to retry failures.
+ pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ type: string
+ serviceAccountName:
+ description: |-
+ The name of the Kubernetes service account to impersonate
+ when reconciling this Kustomization.
+ type: string
+ sourceRef:
+ description: Reference of the source where the kustomization file is.
+ properties:
+ apiVersion:
+ description: API version of the referent.
+ type: string
+ kind:
+ description: Kind of the referent.
+ enum:
+ - OCIRepository
+ - GitRepository
+ - Bucket
+ - ExternalArtifact
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ namespace:
description: |-
- Timeout is the time to wait for any individual Kubernetes operation (like
- Jobs for hooks) during the performance of a Helm upgrade action. Defaults to
- 'HelmReleaseSpec.Timeout'.
- pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ Namespace of the referent, defaults to the namespace of the Kubernetes
+ resource object that contains the reference.
type: string
+ required:
+ - kind
+ - name
type: object
- values:
- description: Values holds the values for this Helm release.
- x-kubernetes-preserve-unknown-fields: true
- valuesFrom:
+ suspend:
description: |-
- ValuesFrom holds references to resources containing Helm values for this HelmRelease,
- and information about how they should be merged.
- items:
- description: |-
- ValuesReference contains a reference to a resource containing Helm values,
- and optionally the key they can be found at.
- properties:
- kind:
- description: Kind of the values referent, valid values are ('Secret', 'ConfigMap').
- enum:
- - Secret
- - ConfigMap
- type: string
- name:
- description: |-
- Name of the values referent. Should reside in the same namespace as the
- referring resource.
- maxLength: 253
- minLength: 1
- type: string
- optional:
- description: |-
- Optional marks this ValuesReference as optional. When set, a not found error
- for the values reference is ignored, but any ValuesKey, TargetPath or
- transient error will still result in a reconciliation failure.
- type: boolean
- targetPath:
- description: |-
- TargetPath is the YAML dot notation path the value should be merged at. When
- set, the ValuesKey is expected to be a single flat value. Defaults to 'None',
- which results in the values getting merged at the root.
- maxLength: 250
- pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$
- type: string
- valuesKey:
- description: |-
- ValuesKey is the data key where the values.yaml or a specific value can be
- found at. Defaults to 'values.yaml'.
- maxLength: 253
- pattern: ^[\-._a-zA-Z0-9]+$
- type: string
- required:
- - kind
- - name
- type: object
- type: array
+ This flag tells the controller to suspend subsequent kustomize executions,
+ it does not apply to already started executions. Defaults to false.
+ type: boolean
+ targetNamespace:
+ description: |-
+ TargetNamespace sets or overrides the namespace in the
+ kustomization.yaml file.
+ maxLength: 63
+ minLength: 1
+ type: string
+ timeout:
+ description: |-
+ Timeout for validation, apply and health checking operations.
+ Defaults to 'Interval' duration.
+ pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ type: string
+ wait:
+ description: |-
+ Wait instructs the controller to check the health of all the reconciled
+ resources. When enabled, the HealthChecks are ignored. Defaults to false.
+ type: boolean
required:
- interval
+ - prune
+ - sourceRef
type: object
- x-kubernetes-validations:
- - message: either chart or chartRef must be set
- rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart) && has(self.chartRef))
status:
default:
observedGeneration: -1
- description: HelmReleaseStatus defines the observed state of a HelmRelease.
+ description: KustomizationStatus defines the observed state of a kustomization.
properties:
conditions:
- description: Conditions holds the conditions for the HelmRelease.
items:
description: Condition contains details for one aspect of the current state of this API Resource.
properties:
@@ -6966,170 +3164,91 @@ spec:
- type
type: object
type: array
- failures:
- description: |-
- Failures is the reconciliation failure count against the latest desired
- state. It is reset after a successful reconciliation.
- format: int64
- type: integer
- helmChart:
- description: |-
- HelmChart is the namespaced name of the HelmChart resource created by
- the controller for the HelmRelease.
- type: string
history:
description: |-
- History holds the history of Helm releases performed for this HelmRelease
- up to the last successfully completed release.
+ History contains a set of snapshots of the last reconciliation attempts
+ tracking the revision, the state and the duration of each attempt.
items:
description: |-
- Snapshot captures a point-in-time copy of the status information for a Helm release,
- as managed by the controller.
+ Snapshot represents a point-in-time record of a group of resources reconciliation,
+ including timing information, status, and a unique digest identifier.
properties:
- apiVersion:
- description: |-
- APIVersion is the API version of the Snapshot.
- Provisional: when the calculation method of the Digest field is changed,
- this field will be used to distinguish between the old and new methods.
- type: string
- appVersion:
- description: AppVersion is the chart app version of the release object in storage.
- type: string
- chartName:
- description: ChartName is the chart name of the release object in storage.
- type: string
- chartVersion:
- description: |-
- ChartVersion is the chart version of the release object in
- storage.
- type: string
- configDigest:
- description: |-
- ConfigDigest is the checksum of the config (better known as
- "values") of the release object in storage.
- It has the format of `<algo>:<checksum>`.
- type: string
- deleted:
- description: Deleted is when the release was deleted.
- format: date-time
- type: string
digest:
- description: |-
- Digest is the checksum of the release object in storage.
- It has the format of `<algo>:<checksum>`.
+ description: Digest is the checksum in the format `<algo>:<hex>` of the resources in this snapshot.
type: string
- firstDeployed:
- description: FirstDeployed is when the release was first deployed.
+ firstReconciled:
+ description: FirstReconciled is the time when this revision was first reconciled to the cluster.
format: date-time
type: string
- lastDeployed:
- description: LastDeployed is when the release was last deployed.
+ lastReconciled:
+ description: LastReconciled is the time when this revision was last reconciled to the cluster.
format: date-time
type: string
- name:
- description: Name is the name of the release.
- type: string
- namespace:
- description: Namespace is the namespace the release is deployed to.
- type: string
- ociDigest:
- description: OCIDigest is the digest of the OCI artifact associated with the release.
+ lastReconciledDuration:
+ description: LastReconciledDuration is time it took to reconcile the resources in this revision.
type: string
- status:
- description: Status is the current state of the release.
+ lastReconciledStatus:
+ description: LastReconciledStatus is the status of the last reconciliation.
type: string
- testHooks:
+ metadata:
additionalProperties:
- description: |-
- TestHookStatus holds the status information for a test hook as observed
- to be run by the controller.
- properties:
- lastCompleted:
- description: LastCompleted is the time the test hook last completed.
- format: date-time
- type: string
- lastStarted:
- description: LastStarted is the time the test hook was last started.
- format: date-time
- type: string
- phase:
- description: Phase the test hook was observed to be in.
- type: string
- type: object
- description: |-
- TestHooks is the list of test hooks for the release as observed to be
- run by the controller.
+ type: string
+ description: Metadata contains additional information about the snapshot.
type: object
- version:
- description: Version is the version of the release object in storage.
+ totalReconciliations:
+ description: TotalReconciliations is the total number of reconciliations that have occurred for this snapshot.
+ format: int64
type: integer
required:
- - chartName
- - chartVersion
- - configDigest
- digest
- - firstDeployed
- - lastDeployed
- - name
- - namespace
- - status
- - version
+ - firstReconciled
+ - lastReconciled
+ - lastReconciledDuration
+ - lastReconciledStatus
+ - totalReconciliations
type: object
type: array
- installFailures:
- description: |-
- InstallFailures is the install failure count against the latest desired
- state. It is reset after a successful reconciliation.
- format: int64
- type: integer
- lastAttemptedConfigDigest:
- description: |-
- LastAttemptedConfigDigest is the digest for the config (better known as
- "values") of the last reconciliation attempt.
- type: string
- lastAttemptedGeneration:
+ inventory:
description: |-
- LastAttemptedGeneration is the last generation the controller attempted
- to reconcile.
- format: int64
- type: integer
- lastAttemptedReleaseAction:
+ Inventory contains the list of Kubernetes resource object references that
+ have been successfully applied.
+ properties:
+ entries:
+ description: Entries of Kubernetes resource object references.
+ items:
+ description: ResourceRef contains the information necessary to locate a resource within a cluster.
+ properties:
+ id:
+ description: |-
+ ID is the string representation of the Kubernetes resource object's metadata,
+ in the format '<namespace>_<name>_<group>_<kind>'.
+ type: string
+ v:
+ description: Version is the API version of the Kubernetes resource object's kind.
+ type: string
+ required:
+ - id
+ - v
+ type: object
+ type: array
+ required:
+ - entries
+ type: object
+ lastAppliedOriginRevision:
description: |-
- LastAttemptedReleaseAction is the last release action performed for this
- HelmRelease. It is used to determine the active retry or remediation
- strategy.
- enum:
- - install
- - upgrade
+ The last successfully applied origin revision.
+ Equals the origin revision of the applied Artifact from the referenced Source.
+ Usually present on the Metadata of the applied Artifact and depends on the
+ Source type, e.g. for OCI it's the value associated with the key
+ "org.opencontainers.image.revision".
type: string
- lastAttemptedReleaseActionDuration:
+ lastAppliedRevision:
description: |-
- LastAttemptedReleaseActionDuration is the duration of the last
- release action performed for this HelmRelease.
+ The last successfully applied revision.
+ Equals the Revision of the applied Artifact from the referenced Source.
type: string
lastAttemptedRevision:
- description: |-
- LastAttemptedRevision is the Source revision of the last reconciliation
- attempt. For OCIRepository sources, the 12 first characters of the digest are
- appended to the chart version e.g. "1.2.3+1234567890ab".
- type: string
- lastAttemptedRevisionDigest:
- description: |-
- LastAttemptedRevisionDigest is the digest of the last reconciliation attempt.
- This is only set for OCIRepository sources.
- type: string
- lastAttemptedValuesChecksum:
- description: |-
- LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last
- reconciliation attempt.
-
- Deprecated: Use LastAttemptedConfigDigest instead.
- type: string
- lastHandledForceAt:
- description: |-
- LastHandledForceAt holds the value of the most recent
- force request value, so a change of the annotation value
- can be detected.
+ description: LastAttemptedRevision is the revision of the last reconciliation attempt.
type: string
lastHandledReconcileAt:
description: |-
@@ -7137,42 +3256,8 @@ spec:
reconcile request value, so a change of the annotation value
can be detected.
type: string
- lastHandledResetAt:
- description: |-
- LastHandledResetAt holds the value of the most recent reset request
- value, so a change of the annotation value can be detected.
- type: string
- lastReleaseRevision:
- description: |-
- LastReleaseRevision is the revision of the last successful Helm release.
-
- Deprecated: Use History instead.
- type: integer
- observedCommonMetadataDigest:
- description: |-
- ObservedCommonMetadataDigest is the digest for the common metadata of
- the last successful reconciliation attempt.
- type: string
observedGeneration:
- description: ObservedGeneration is the last observed generation.
- format: int64
- type: integer
- observedPostRenderersDigest:
- description: |-
- ObservedPostRenderersDigest is the digest for the post-renderers of
- the last successful reconciliation attempt.
- type: string
- storageNamespace:
- description: |-
- StorageNamespace is the namespace of the Helm release storage for the
- current release.
- maxLength: 63
- minLength: 1
- type: string
- upgradeFailures:
- description: |-
- UpgradeFailures is the upgrade failure count against the latest desired
- state. It is reset after a successful reconciliation.
+ description: ObservedGeneration is the last reconciled generation.
format: int64
type: integer
type: object
@@ -7181,6 +3266,133 @@ spec:
storage: true
subresources:
status: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ labels:
+ app.kubernetes.io/component: kustomize-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ name: kustomize-controller
+ namespace: flux-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ labels:
+ app.kubernetes.io/component: kustomize-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ control-plane: controller
+ name: kustomize-controller
+ namespace: flux-system
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: kustomize-controller
+ template:
+ metadata:
+ annotations:
+ prometheus.io/port: "8080"
+ prometheus.io/scrape: "true"
+ labels:
+ app: kustomize-controller
+ app.kubernetes.io/component: kustomize-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ spec:
+ containers:
+ - args:
+ - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
+ - --watch-all-namespaces=true
+ - --log-level=info
+ - --log-encoding=json
+ - --enable-leader-election
+ env:
+ - name: RUNTIME_NAMESPACE
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.namespace
+ - name: GOMEMLIMIT
+ valueFrom:
+ resourceFieldRef:
+ containerName: manager
+ resource: limits.memory
+ image: ghcr.io/fluxcd/kustomize-controller:v1.8.0
+ imagePullPolicy: IfNotPresent
+ livenessProbe:
+ httpGet:
+ path: /healthz
+ port: healthz
+ name: manager
+ ports:
+ - containerPort: 8080
+ name: http-prom
+ protocol: TCP
+ - containerPort: 9440
+ name: healthz
+ protocol: TCP
+ readinessProbe:
+ httpGet:
+ path: /readyz
+ port: healthz
+ resources:
+ limits:
+ cpu: 1000m
+ memory: 1Gi
+ requests:
+ cpu: 100m
+ memory: 64Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
+ volumeMounts:
+ - mountPath: /tmp
+ name: temp
+ nodeSelector:
+ kubernetes.io/os: linux
+ priorityClassName: system-cluster-critical
+ securityContext:
+ fsGroup: 1337
+ serviceAccountName: kustomize-controller
+ terminationGracePeriodSeconds: 60
+ volumes:
+ - emptyDir: {}
+ name: temp
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.19.0
+ labels:
+ app.kubernetes.io/component: helm-controller
+ app.kubernetes.io/instance: flux-system
+ app.kubernetes.io/part-of: flux
+ app.kubernetes.io/version: v2.8.0
+ name: helmreleases.helm.toolkit.fluxcd.io
+spec:
+ group: helm.toolkit.fluxcd.io
+ names:
+ kind: HelmRelease
+ listKind: HelmReleaseList
+ plural: helmreleases
+ shortNames:
+ - hr
+ singular: helmrelease
+ scope: Namespaced
+ versions:
- additionalPrinterColumns:
- jsonPath: .metadata.creationTimestamp
name: Age
@@ -7191,9 +3403,7 @@ spec:
- jsonPath: .status.conditions[?(@.type=="Ready")].message
name: Status
type: string
- deprecated: true
- deprecationWarning: v2beta2 HelmRelease is deprecated, upgrade to v2
- name: v2beta2
+ name: v2
schema:
openAPIV3Schema:
description: HelmRelease is the Schema for the helmreleases API
@@ -7220,7 +3430,7 @@ spec:
properties:
chart:
description: |-
- Chart defines the template of the v1beta2.HelmChart that should be created
+ Chart defines the template of the v1.HelmChart that should be created
for this HelmRelease.
properties:
metadata:
@@ -7245,7 +3455,7 @@ spec:
type: object
type: object
spec:
- description: Spec holds the template for the v1beta2.HelmChartSpec for this HelmRelease.
+ description: Spec holds the template for the v1.HelmChartSpec for this HelmRelease.
properties:
chart:
description: The name or path the Helm chart is available at in the SourceRef.
@@ -7299,13 +3509,6 @@ spec:
- kind
- name
type: object
- valuesFile:
- description: |-
- Alternative values file to use as the default chart values, expected to
- be a relative path in the SourceRef. Deprecated in favor of ValuesFiles,
- for backwards compatibility the file defined here is merged before the
- ValuesFiles items. Ignored when omitted.
- type: string
valuesFiles:
description: |-
Alternative list of values files to use as the chart values (values.yaml
@@ -7348,7 +3551,7 @@ spec:
version:
default: '*'
description: |-
- Version semver expression, ignored for charts from v1beta2.GitRepository and
+ Version semver expression, ignored for charts from v1.GitRepository and
v1beta2.Bucket sources. Defaults to latest when omitted.
type: string
required:
@@ -7362,9 +3565,6 @@ spec:
description: |-
ChartRef holds a reference to a source controller resource containing the
Helm chart artifact.
-
- Note: this field is provisional to the v2 API, and not actively used
- by v2beta2 HelmReleases.
properties:
apiVersion:
description: APIVersion of the referent.
@@ -7374,6 +3574,7 @@ spec:
enum:
- OCIRepository
- HelmChart
+ - ExternalArtifact
type: string
name:
description: Name of the referent.
@@ -7391,21 +3592,46 @@ spec:
- kind
- name
type: object
+ commonMetadata:
+ description: |-
+ CommonMetadata specifies the common labels and annotations that are
+ applied to all resources. Any existing label or annotation will be
+ overridden if its key matches a common one.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations to be added to the object's metadata.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels to be added to the object's metadata.
+ type: object
+ type: object
dependsOn:
description: |-
- DependsOn may contain a meta.NamespacedObjectReference slice with
+ DependsOn may contain a DependencyReference slice with
references to HelmRelease resources that must be ready before this HelmRelease
can be reconciled.
items:
- description: |-
- NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any
- namespace.
+ description: DependencyReference defines a HelmRelease dependency on another HelmRelease resource.
properties:
name:
description: Name of the referent.
type: string
namespace:
- description: Namespace of the referent, when not specified it acts as LocalObjectReference.
+ description: |-
+ Namespace of the referent, defaults to the namespace of the HelmRelease
+ resource object that contains the reference.
+ type: string
+ readyExpr:
+ description: |-
+ ReadyExpr is a CEL expression that can be used to assess the readiness
+ of a dependency. When specified, the built-in readiness check
+ is replaced by the logic defined in the CEL expression.
+ To make the CEL expression additive to the built-in readiness check,
+ the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
type: string
required:
- name
@@ -7493,6 +3719,43 @@ spec:
- disabled
type: string
type: object
+ healthCheckExprs:
+ description: |-
+ HealthCheckExprs is a list of healthcheck expressions for evaluating the
+ health of custom resources using Common Expression Language (CEL).
+ The expressions are evaluated only when the specific Helm action
+ taking place has wait enabled, i.e. DisableWait is false, and the
+ 'poller' WaitStrategy is used.
+ items:
+ description: CustomHealthCheck defines the health check for custom resources.
+ properties:
+ apiVersion:
+ description: APIVersion of the custom resource under evaluation.
+ type: string
+ current:
+ description: |-
+ Current is the CEL expression that determines if the status
+ of the custom resource has reached the desired state.
+ type: string
+ failed:
+ description: |-
+ Failed is the CEL expression that determines if the status
+ of the custom resource has failed to reach the desired state.
+ type: string
+ inProgress:
+ description: |-
+ InProgress is the CEL expression that determines if the status
+ of the custom resource has not yet reached the desired state.
+ type: string
+ kind:
+ description: Kind of the custom resource under evaluation.
+ type: string
+ required:
+ - apiVersion
+ - current
+ - kind
+ type: object
+ type: array
install:
description: Install holds the configuration for Helm install actions for this HelmRelease.
properties:
@@ -7533,6 +3796,16 @@ spec:
DisableOpenAPIValidation prevents the Helm install action from validating
rendered templates against the Kubernetes OpenAPI Schema.
type: boolean
+ disableSchemaValidation:
+ description: |-
+ DisableSchemaValidation prevents the Helm install action from validating
+ the values against the JSON Schema.
+ type: boolean
+ disableTakeOwnership:
+ description: |-
+ DisableTakeOwnership disables taking ownership of existing resources
+ during the Helm install action. Defaults to false.
+ type: boolean
disableWait:
description: |-
DisableWait disables the waiting for resources to be ready after a Helm
@@ -7571,6 +3844,11 @@ spec:
Replace tells the Helm install action to re-use the 'ReleaseName', but only
if that name is a deleted release which remains in the history.
type: boolean
+ serverSideApply:
+ description: |-
+ ServerSideApply enables server-side apply for resources during install.
+ Defaults to true (or false when UseHelm3Defaults feature gate is enabled).
+ type: boolean
skipCRDs:
description: |-
SkipCRDs tells the Helm install action to not install any CRDs. By default,
@@ -7578,6 +3856,30 @@ spec:
Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.
type: boolean
+ strategy:
+ description: |-
+ Strategy defines the install strategy to use for this HelmRelease.
+ Defaults to 'RemediateOnFailure'.
+ properties:
+ name:
+ description: Name of the install strategy.
+ enum:
+ - RemediateOnFailure
+ - RetryOnFailure
+ type: string
+ retryInterval:
+ description: |-
+ RetryInterval is the interval at which to retry a failed install.
+ Can be used only when Name is set to RetryOnFailure.
+ Defaults to '5m'.
+ pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ type: string
+ required:
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: .retryInterval cannot be set when .name is 'RemediateOnFailure'
+ rule: '!has(self.retryInterval) || self.name != ''RemediateOnFailure'''
timeout:
description: |-
Timeout is the time to wait for any individual Kubernetes operation (like
@@ -7778,108 +4080,6 @@ spec:
- patch
type: object
type: array
- patchesJson6902:
- description: |-
- JSON 6902 patches, defined as inline YAML objects.
-
- Deprecated: use Patches instead.
- items:
- description: JSON6902Patch contains a JSON6902 patch and the target the patch should be applied to.
- properties:
- patch:
- description: Patch contains the JSON6902 patch document with an array of operation objects.
- items:
- description: |-
- JSON6902 is a JSON6902 operation object.
- https://datatracker.ietf.org/doc/html/rfc6902#section-4
- properties:
- from:
- description: |-
- From contains a JSON-pointer value that references a location within the target document where the operation is
- performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.
- type: string
- op:
- description: |-
- Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or
- "test".
- https://datatracker.ietf.org/doc/html/rfc6902#section-4
- enum:
- - test
- - remove
- - add
- - replace
- - move
- - copy
- type: string
- path:
- description: |-
- Path contains the JSON-pointer value that references a location within the target document where the operation
- is performed. The meaning of the value depends on the value of Op.
- type: string
- value:
- description: |-
- Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into
- account by all operations.
- x-kubernetes-preserve-unknown-fields: true
- required:
- - op
- - path
- type: object
- type: array
- target:
- description: Target points to the resources that the patch document should be applied to.
- properties:
- annotationSelector:
- description: |-
- AnnotationSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource annotations.
- type: string
- group:
- description: |-
- Group is the API group to select resources from.
- Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- kind:
- description: |-
- Kind of the API Group to select resources from.
- Together with Group and Version it is capable of unambiguously
- identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- labelSelector:
- description: |-
- LabelSelector is a string that follows the label selection expression
- https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
- It matches with the resource labels.
- type: string
- name:
- description: Name to match resources with.
- type: string
- namespace:
- description: Namespace to select resources from.
- type: string
- version:
- description: |-
- Version of the API Group to select resources from.
- Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
- https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
- type: string
- type: object
- required:
- - patch
- - target
- type: object
- type: array
- patchesStrategicMerge:
- description: |-
- Strategic merge patches, defined as inline YAML objects.
-
- Deprecated: use Patches instead.
- items:
- x-kubernetes-preserve-unknown-fields: true
- type: array
type: object
type: object
type: array
@@ -7915,8 +4115,28 @@ spec:
description: Force forces resource updates through a replacement strategy.
type: boolean
recreate:
- description: Recreate performs pod restarts for the resource if applicable.
+ description: |-
+ Recreate performs pod restarts for any managed workloads.
+
+ Deprecated: This behavior was deprecated in Helm 3:
+ - Deprecation: https://github.com/helm/helm/pull/6463
+ - Removal: https://github.com/helm/helm/pull/31023
+ After helm-controller was upgraded to the Helm 4 SDK,
+ this field is no longer functional and will print a
+ warning if set to true. It will also be removed in a
+ future release.
type: boolean
+ serverSideApply:
+ description: |-
+ ServerSideApply enables server-side apply for resources during rollback.
+ Can be "enabled", "disabled", or "auto".
+ When "auto", server-side apply usage will be based on the release's previous usage.
+ Defaults to "auto".
+ enum:
+ - enabled
+ - disabled
+ - auto
+ type: string
timeout:
description: |-
Timeout is the time to wait for any individual Kubernetes operation (like
@@ -8067,6 +4287,16 @@ spec:
DisableOpenAPIValidation prevents the Helm upgrade action from validating
rendered templates against the Kubernetes OpenAPI Schema.
type: boolean
+ disableSchemaValidation:
+ description: |-
+ DisableSchemaValidation prevents the Helm upgrade action from validating
+ the values against the JSON Schema.
+ type: boolean
+ disableTakeOwnership:
+ description: |-
+ DisableTakeOwnership disables taking ownership of existing resources
+ during the Helm upgrade action. Defaults to false.
+ type: boolean
disableWait:
description: |-
DisableWait disables the waiting for resources to be ready after a Helm
@@ -8115,6 +4345,41 @@ spec:
- uninstall
type: string
type: object
+ serverSideApply:
+ description: |-
+ ServerSideApply enables server-side apply for resources during upgrade.
+ Can be "enabled", "disabled", or "auto".
+ When "auto", server-side apply usage will be based on the release's previous usage.
+ Defaults to "auto".
+ enum:
+ - enabled
+ - disabled
+ - auto
+ type: string
+ strategy:
+ description: |-
+ Strategy defines the upgrade strategy to use for this HelmRelease.
+ Defaults to 'RemediateOnFailure'.
+ properties:
+ name:
+ description: Name of the upgrade strategy.
+ enum:
+ - RemediateOnFailure
+ - RetryOnFailure
+ type: string
+ retryInterval:
+ description: |-
+ RetryInterval is the interval at which to retry a failed upgrade.
+ Can be used only when Name is set to RetryOnFailure.
+ Defaults to '5m'.
+ pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+ type: string
+ required:
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: .retryInterval can only be set when .name is 'RetryOnFailure'
+ rule: '!has(self.retryInterval) || self.name == ''RetryOnFailure'''
timeout:
description: |-
Timeout is the time to wait for any individual Kubernetes operation (like
@@ -8174,6 +4439,26 @@ spec:
- name
type: object
type: array
+ waitStrategy:
+ description: |-
+ WaitStrategy defines Helm's wait strategy for waiting for applied
+ resources to become ready.
+ properties:
+ name:
+ description: |-
+ Name is Helm's wait strategy for waiting for applied resources to
+ become ready. One of 'poller' or 'legacy'. The 'poller' strategy uses
+ kstatus to poll resource statuses, while the 'legacy' strategy uses
+ Helm v3's waiting logic.
+ Defaults to 'poller', or to 'legacy' when UseHelm3Defaults feature
+ gate is enabled.
+ enum:
+ - poller
+ - legacy
+ type: string
+ required:
+ - name
+ type: object
required:
- interval
type: object
@@ -8261,11 +4546,14 @@ spec:
Snapshot captures a point-in-time copy of the status information for a Helm release,
as managed by the controller.
properties:
+ action:
+ description: Action is the action that resulted in this snapshot being created.
+ type: string
apiVersion:
description: |-
APIVersion is the API version of the Snapshot.
- Provisional: when the calculation method of the Digest field is changed,
- this field will be used to distinguish between the old and new methods.
+ When the calculation method of the Digest field is changed, this
+ field will be used to distinguish between the old and new methods.
type: string
appVersion:
description: AppVersion is the chart app version of the release object in storage.
@@ -8357,13 +4645,32 @@ spec:
state. It is reset after a successful reconciliation.
format: int64
type: integer
- lastAppliedRevision:
+ inventory:
description: |-
- LastAppliedRevision is the revision of the last successfully applied
- source.
-
- Deprecated: the revision can now be found in the History.
- type: string
+ Inventory contains the list of Kubernetes resource object references
+ that have been applied for this release.
+ properties:
+ entries:
+ description: Entries of Kubernetes resource object references.
+ items:
+ description: ResourceRef contains the information necessary to locate a resource within a cluster.
+ properties:
+ id:
+ description: |-
+ ID is the string representation of the Kubernetes resource object's metadata,
+ in the format '<namespace>_<name>_<group>_<kind>'.
+ type: string
+ v:
+ description: Version is the API version of the Kubernetes resource object's kind.
+ type: string
+ required:
+ - id
+ - v
+ type: object
+ type: array
+ required:
+ - entries
+ type: object
lastAttemptedConfigDigest:
description: |-
LastAttemptedConfigDigest is the digest for the config (better known as
@@ -8378,11 +4685,17 @@ spec:
lastAttemptedReleaseAction:
description: |-
LastAttemptedReleaseAction is the last release action performed for this
- HelmRelease. It is used to determine the active remediation strategy.
+ HelmRelease. It is used to determine the active retry or remediation
+ strategy.
enum:
- install
- upgrade
type: string
+ lastAttemptedReleaseActionDuration:
+ description: |-
+ LastAttemptedReleaseActionDuration is the duration of the last
+ release action performed for this HelmRelease.
+ type: string
lastAttemptedRevision:
description: |-
LastAttemptedRevision is the Source revision of the last reconciliation
@@ -8403,8 +4716,9 @@ spec:
type: string
lastHandledForceAt:
description: |-
- LastHandledForceAt holds the value of the most recent force request
- value, so a change of the annotation value can be detected.
+ LastHandledForceAt holds the value of the most recent
+ force request value, so a change of the annotation value
+ can be detected.
type: string
lastHandledReconcileAt:
description: |-
@@ -8423,6 +4737,11 @@ spec:
Deprecated: Use History instead.
type: integer
+ observedCommonMetadataDigest:
+ description: |-
+ ObservedCommonMetadataDigest is the digest for the common metadata of
+ the last successful reconciliation attempt.
+ type: string
observedGeneration:
description: ObservedGeneration is the last observed generation.
format: int64
@@ -8448,7 +4767,7 @@ spec:
type: object
type: object
served: true
- storage: false
+ storage: true
subresources:
status: {}
---
@@ -8459,7 +4778,7 @@ metadata:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: helm-controller
namespace: flux-system
---
@@ -8470,7 +4789,7 @@ metadata:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
control-plane: controller
name: helm-controller
namespace: flux-system
@@ -8489,7 +4808,7 @@ spec:
app.kubernetes.io/component: helm-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
spec:
containers:
- args:
@@ -8508,7 +4827,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
- image: ghcr.io/fluxcd/helm-controller:v1.4.5
+ image: ghcr.io/fluxcd/helm-controller:v1.5.0
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -8565,7 +4884,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: alerts.notification.toolkit.fluxcd.io
spec:
group: notification.toolkit.fluxcd.io
@@ -8657,6 +4976,8 @@ spec:
- ImagePolicy
- ImageUpdateAutomation
- OCIRepository
+ - ArtifactGenerator
+ - ExternalArtifact
type: string
matchLabels:
additionalProperties:
@@ -8870,6 +5191,8 @@ spec:
- ImagePolicy
- ImageUpdateAutomation
- OCIRepository
+ - ArtifactGenerator
+ - ExternalArtifact
type: string
matchLabels:
additionalProperties:
@@ -8949,7 +5272,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: providers.notification.toolkit.fluxcd.io
spec:
group: notification.toolkit.fluxcd.io
@@ -9309,6 +5632,7 @@ spec:
- github
- gitlab
- gitea
+ - giteapullrequestcomment
- bitbucketserver
- bitbucket
- azuredevops
@@ -9324,6 +5648,8 @@ spec:
- alertmanager
- grafana
- githubdispatch
+ - githubpullrequestcomment
+ - gitlabmergerequestcomment
- pagerduty
- datadog
- nats
@@ -9354,7 +5680,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: receivers.notification.toolkit.fluxcd.io
spec:
group: notification.toolkit.fluxcd.io
@@ -9445,6 +5771,8 @@ spec:
- ImagePolicy
- ImageUpdateAutomation
- OCIRepository
+ - ArtifactGenerator
+ - ExternalArtifact
type: string
matchLabels:
additionalProperties:
@@ -9664,6 +5992,8 @@ spec:
- ImagePolicy
- ImageUpdateAutomation
- OCIRepository
+ - ArtifactGenerator
+ - ExternalArtifact
type: string
matchLabels:
additionalProperties:
@@ -9825,7 +6155,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: notification-controller
namespace: flux-system
---
@@ -9836,7 +6166,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
control-plane: controller
name: notification-controller
namespace: flux-system
@@ -9857,7 +6187,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
control-plane: controller
name: webhook-receiver
namespace: flux-system
@@ -9878,7 +6208,7 @@ metadata:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
control-plane: controller
name: notification-controller
namespace: flux-system
@@ -9897,7 +6227,7 @@ spec:
app.kubernetes.io/component: notification-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
spec:
containers:
- args:
@@ -9915,7 +6245,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
- image: ghcr.io/fluxcd/notification-controller:v1.7.5
+ image: ghcr.io/fluxcd/notification-controller:v1.8.0
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -9977,7 +6307,7 @@ metadata:
app.kubernetes.io/component: image-reflector-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: imagepolicies.image.toolkit.fluxcd.io
spec:
group: image.toolkit.fluxcd.io
@@ -10553,7 +6883,7 @@ metadata:
app.kubernetes.io/component: image-reflector-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: imagerepositories.image.toolkit.fluxcd.io
spec:
group: image.toolkit.fluxcd.io
@@ -11157,7 +7487,7 @@ metadata:
app.kubernetes.io/component: image-reflector-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: image-reflector-controller
namespace: flux-system
---
@@ -11168,7 +7498,7 @@ metadata:
app.kubernetes.io/component: image-reflector-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
control-plane: controller
name: image-reflector-controller
namespace: flux-system
@@ -11187,7 +7517,7 @@ spec:
app.kubernetes.io/component: image-reflector-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
spec:
containers:
- args:
@@ -11206,7 +7536,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
- image: ghcr.io/fluxcd/image-reflector-controller:v1.0.4
+ image: ghcr.io/fluxcd/image-reflector-controller:v1.1.0
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@@ -11266,7 +7596,7 @@ metadata:
app.kubernetes.io/component: image-automation-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: imageupdateautomations.image.toolkit.fluxcd.io
spec:
group: image.toolkit.fluxcd.io
@@ -12073,7 +8403,7 @@ metadata:
app.kubernetes.io/component: image-automation-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
name: image-automation-controller
namespace: flux-system
---
@@ -12084,7 +8414,7 @@ metadata:
app.kubernetes.io/component: image-automation-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
control-plane: controller
name: image-automation-controller
namespace: flux-system
@@ -12103,7 +8433,7 @@ spec:
app.kubernetes.io/component: image-automation-controller
app.kubernetes.io/instance: flux-system
app.kubernetes.io/part-of: flux
- app.kubernetes.io/version: v2.7.5
+ app.kubernetes.io/version: v2.8.0
spec:
containers:
- args:
@@ -12122,7 +8452,7 @@ spec:
resourceFieldRef:
containerName: manager
resource: limits.memory
- image: ghcr.io/fluxcd/image-automation-controller:v1.0.4
+ image: ghcr.io/fluxcd/image-automation-controller:v1.1.0
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
diff --git a/infrastructure_talos/configs/pg-secrets.yaml b/infrastructure_talos/configs/pg-secrets.yaml
@@ -1,899 +1,899 @@
apiVersion: v1
kind: Secret
metadata:
- name: authentik
- namespace: postgres-cluster
+ name: authentik
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:AgrAqCiy7DAJ,iv:jL2e0NL3kx3OU+YnHm0geZAea4YhJU2z5ItLemmIRGQ=,tag:i/8D0+CwaKwSg6pAdtjGqg==,type:str]
- password: ENC[AES256_GCM,data:HMja2TBEFk2kLb73M2ZAoL0yowjrOna91NoA3QNITOeCGJGWu4KKwHnglfJmrMBQhuMrRiE9pRDmVvNoJuTKXg==,iv:ldLw5GY52VZohfeRYomqOldQdrkoYQXf//NT5Dm65T4=,tag:kqzD1KomOEt9nMDGhFYE7Q==,type:str]
+ username: ENC[AES256_GCM,data:AgrAqCiy7DAJ,iv:jL2e0NL3kx3OU+YnHm0geZAea4YhJU2z5ItLemmIRGQ=,tag:i/8D0+CwaKwSg6pAdtjGqg==,type:str]
+ password: ENC[AES256_GCM,data:HMja2TBEFk2kLb73M2ZAoL0yowjrOna91NoA3QNITOeCGJGWu4KKwHnglfJmrMBQhuMrRiE9pRDmVvNoJuTKXg==,iv:ldLw5GY52VZohfeRYomqOldQdrkoYQXf//NT5Dm65T4=,tag:kqzD1KomOEt9nMDGhFYE7Q==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: cachet
- namespace: postgres-cluster
+ name: cachet
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:mbaNhM5F,iv:+XMWs2pWH74FE1NLG74Tu3WlKWppm4ebX0cs1l7KWqc=,tag:+4HSqW120N07YHNBr77AEg==,type:str]
- password: ENC[AES256_GCM,data:Z3T65tGBlUvU/ksVy3avDRk5ZFojvlkALwuKGS7uAZ6mtBJcfWeLYReKvaMGKUIlmXNtOZ3scPkDHIaWYVUAaw==,iv:0atRwb1sx2LbdYYI6vm7T8+nElyG87hNTNHg/UGk4qY=,tag:YKUYBDKxu2ToZQ17YIN4zA==,type:str]
+ username: ENC[AES256_GCM,data:mbaNhM5F,iv:+XMWs2pWH74FE1NLG74Tu3WlKWppm4ebX0cs1l7KWqc=,tag:+4HSqW120N07YHNBr77AEg==,type:str]
+ password: ENC[AES256_GCM,data:Z3T65tGBlUvU/ksVy3avDRk5ZFojvlkALwuKGS7uAZ6mtBJcfWeLYReKvaMGKUIlmXNtOZ3scPkDHIaWYVUAaw==,iv:0atRwb1sx2LbdYYI6vm7T8+nElyG87hNTNHg/UGk4qY=,tag:YKUYBDKxu2ToZQ17YIN4zA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: coder
- namespace: postgres-cluster
+ name: coder
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:MH6SeaA=,iv:uQQFLNZvN3MxKOf18g2Kstp5VdzL+5r8o8D+tYOqxRY=,tag:fyHKKeOhMByDDFjb3iCwMg==,type:str]
- password: ENC[AES256_GCM,data:jgk6ziVwt+O2GQno/vH1lUlaew1Ow5Wqz9tFRIlIrXCD45gkws+9W0ePrIRJqcsFZ4LEzG2AC0CxKfZRKRXrag==,iv:8xoypCxKfMXf0EocAwluqUwfXLFVBl4ddeK+qrMGp5g=,tag:hRiUoX73ebeI6p/QJbmgkw==,type:str]
+ username: ENC[AES256_GCM,data:MH6SeaA=,iv:uQQFLNZvN3MxKOf18g2Kstp5VdzL+5r8o8D+tYOqxRY=,tag:fyHKKeOhMByDDFjb3iCwMg==,type:str]
+ password: ENC[AES256_GCM,data:jgk6ziVwt+O2GQno/vH1lUlaew1Ow5Wqz9tFRIlIrXCD45gkws+9W0ePrIRJqcsFZ4LEzG2AC0CxKfZRKRXrag==,iv:8xoypCxKfMXf0EocAwluqUwfXLFVBl4ddeK+qrMGp5g=,tag:hRiUoX73ebeI6p/QJbmgkw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: draupnir-synapse
- namespace: postgres-cluster
+ name: draupnir-synapse
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:PB18Vb4oSVkNAmih9IZXwA==,iv:UQZuOm++/2ia9N6wm0axIqOkNNhtevuiemZv+Uf4itM=,tag:1jrCJiaPp/gPe42e3DmOHw==,type:str]
- password: ENC[AES256_GCM,data:NCcM9xd6AKWrRVxSsXzKBVaWpfvaWHnaVhVlAqI283sAyuUtiZUyuSN1UTOFOeu3xq98H4kSbkLqBMo+GPdaPQ==,iv:zCRmVDBijc2cXpZEBEn//YP5lAIAN06BQE6rnCCpfho=,tag:whxZvNKqvfKFE9tIWbQjTQ==,type:str]
+ username: ENC[AES256_GCM,data:PB18Vb4oSVkNAmih9IZXwA==,iv:UQZuOm++/2ia9N6wm0axIqOkNNhtevuiemZv+Uf4itM=,tag:1jrCJiaPp/gPe42e3DmOHw==,type:str]
+ password: ENC[AES256_GCM,data:NCcM9xd6AKWrRVxSsXzKBVaWpfvaWHnaVhVlAqI283sAyuUtiZUyuSN1UTOFOeu3xq98H4kSbkLqBMo+GPdaPQ==,iv:zCRmVDBijc2cXpZEBEn//YP5lAIAN06BQE6rnCCpfho=,tag:whxZvNKqvfKFE9tIWbQjTQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: ejabberd
- namespace: postgres-cluster
+ name: ejabberd
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:KkLq1kTZcW8=,iv:ijBtYzzocI+J/nVsNneuGuRZDucYph9F2/dbsEoFSWY=,tag:eE0Jinh6mtkVLsRkcdvdMQ==,type:str]
- password: ENC[AES256_GCM,data:HQ71ZOd7n+4aYvVXrCrutqODmCPRp2oFrt1J8KdjixBGi0eczcZUH47TN/IZ43GLw6ZeoakeQKGWvPR1q17TOA==,iv:I5mlkd24EDar/mXCplRRjVSOQGSVLVlgnsnmwUWxMUU=,tag:HbX/bTmXwAITZYrQzQjwdQ==,type:str]
+ username: ENC[AES256_GCM,data:KkLq1kTZcW8=,iv:ijBtYzzocI+J/nVsNneuGuRZDucYph9F2/dbsEoFSWY=,tag:eE0Jinh6mtkVLsRkcdvdMQ==,type:str]
+ password: ENC[AES256_GCM,data:HQ71ZOd7n+4aYvVXrCrutqODmCPRp2oFrt1J8KdjixBGi0eczcZUH47TN/IZ43GLw6ZeoakeQKGWvPR1q17TOA==,iv:I5mlkd24EDar/mXCplRRjVSOQGSVLVlgnsnmwUWxMUU=,tag:HbX/bTmXwAITZYrQzQjwdQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: mastodon
- namespace: postgres-cluster
+ name: mastodon
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:kKI8V5eWf8I=,iv:3mfNmgSv/b8dv9Y3BpRY0ZKIlVO28oPupl1XQqkxsJ0=,tag:jEGR9kJkOLh/fjrkwRlh+Q==,type:str]
- password: ENC[AES256_GCM,data:r+mSR0is8b+lU+Eapy4gFj87C/oRH96QYOrqkefoygSGZ/xlZPlQBNuEjETDE0B2syHl4DL1zDqnbDPvXc2nuQ==,iv:aVHOUliL95MvAo+Rs043FEU2ER9uoZEMy1GK70UI3iw=,tag:0s1aRmtw9SapA0C/LqJiJQ==,type:str]
+ username: ENC[AES256_GCM,data:kKI8V5eWf8I=,iv:3mfNmgSv/b8dv9Y3BpRY0ZKIlVO28oPupl1XQqkxsJ0=,tag:jEGR9kJkOLh/fjrkwRlh+Q==,type:str]
+ password: ENC[AES256_GCM,data:r+mSR0is8b+lU+Eapy4gFj87C/oRH96QYOrqkefoygSGZ/xlZPlQBNuEjETDE0B2syHl4DL1zDqnbDPvXc2nuQ==,iv:aVHOUliL95MvAo+Rs043FEU2ER9uoZEMy1GK70UI3iw=,tag:0s1aRmtw9SapA0C/LqJiJQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: matrix-auth
- namespace: postgres-cluster
+ name: matrix-auth
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:pPCHz+wo6T7HZpo=,iv:vdn8wpXgGw44X9bY7DxLP0TB+OzYKJ6q+ClUYdYd7JM=,tag:uLgBw5Q/MzW39iS7qBSRnQ==,type:str]
- password: ENC[AES256_GCM,data:oWsKLNNAuYAYpsBcM384eTLHQlWdqEflrpi1MDrBAAJRy4YhPg/wu842deOpEZufIg/3xkNpCZoPjBa9K4mpSw==,iv:ksF+pJiz0kbu6jjMgD7O+kRt4oxFOmE8mehNyOysUFI=,tag:i2+19hdjhtn9wOvfMdfFOQ==,type:str]
+ username: ENC[AES256_GCM,data:pPCHz+wo6T7HZpo=,iv:vdn8wpXgGw44X9bY7DxLP0TB+OzYKJ6q+ClUYdYd7JM=,tag:uLgBw5Q/MzW39iS7qBSRnQ==,type:str]
+ password: ENC[AES256_GCM,data:oWsKLNNAuYAYpsBcM384eTLHQlWdqEflrpi1MDrBAAJRy4YhPg/wu842deOpEZufIg/3xkNpCZoPjBa9K4mpSw==,iv:ksF+pJiz0kbu6jjMgD7O+kRt4oxFOmE8mehNyOysUFI=,tag:i2+19hdjhtn9wOvfMdfFOQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: openproject
- namespace: postgres-cluster
+ name: openproject
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:PbgE084UuM0UXLA=,iv:bxllaVTF5Z743MH50QE+Scx/XiuSKOsqycxaZAXPP5A=,tag:3G9KdBzZ738wIZmLgo+veA==,type:str]
- password: ENC[AES256_GCM,data:kqF3IdDRuQHFH2xHyr9apxRjg4hEEleFE7hpzc/Jr4dRfRFHCcfiOaRPBFsH08Q1wETzim5/hpVjqYNJeSXrug==,iv:ta+8cCwVP9bPr09PKw36siMv21cOhfI2IeMx2y9MgQ0=,tag:P9zxKMV7j9pKET72l+QI7g==,type:str]
+ username: ENC[AES256_GCM,data:PbgE084UuM0UXLA=,iv:bxllaVTF5Z743MH50QE+Scx/XiuSKOsqycxaZAXPP5A=,tag:3G9KdBzZ738wIZmLgo+veA==,type:str]
+ password: ENC[AES256_GCM,data:kqF3IdDRuQHFH2xHyr9apxRjg4hEEleFE7hpzc/Jr4dRfRFHCcfiOaRPBFsH08Q1wETzim5/hpVjqYNJeSXrug==,iv:ta+8cCwVP9bPr09PKw36siMv21cOhfI2IeMx2y9MgQ0=,tag:P9zxKMV7j9pKET72l+QI7g==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: plausible
- namespace: postgres-cluster
+ name: plausible
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:X9zFzhUPAUwl,iv:frQpGT/rt2S0QQwI49oqkmvcj09rwrL2cANmEOOBDzE=,tag:rRZoo56Cjf9iNWIdWHZQxw==,type:str]
- password: ENC[AES256_GCM,data:tD1BKwKMhbj4j3AiTPFr+yKVRDlzFMnA871h1tbl8x4FRH6YqKXgrH4nPG5WhjqCA60StUqknK7vHVzvtEt/Lg==,iv:08vlNQSrGEWUh4swO0q2IffinEOFpMa3mhiPUWk/dtQ=,tag:f+EuCV0pB9XdGkrj9ZRy0g==,type:str]
+ username: ENC[AES256_GCM,data:X9zFzhUPAUwl,iv:frQpGT/rt2S0QQwI49oqkmvcj09rwrL2cANmEOOBDzE=,tag:rRZoo56Cjf9iNWIdWHZQxw==,type:str]
+ password: ENC[AES256_GCM,data:tD1BKwKMhbj4j3AiTPFr+yKVRDlzFMnA871h1tbl8x4FRH6YqKXgrH4nPG5WhjqCA60StUqknK7vHVzvtEt/Lg==,iv:08vlNQSrGEWUh4swO0q2IffinEOFpMa3mhiPUWk/dtQ=,tag:f+EuCV0pB9XdGkrj9ZRy0g==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: synapse
- namespace: postgres-cluster
+ name: synapse
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:t20aVhi8PQ==,iv:s1dcUYnfh36lDWL1U81aSAmNMG82eKXntvupH0gQQE4=,tag:1U66AVur3N4JeQOyubVeyQ==,type:str]
- password: ENC[AES256_GCM,data:5Xkv9ry8peufhFh4MCLkiyB/iW1Z3noWjXOeLfZ9+2k+RoeCwKgRjPw1L/AOtZIChPgn8hXwfjK2Chc5bqdcnA==,iv:RBPsu2pJw3gt7M0FSpBbQnlgnGl6xDFSvpVVg/dBiSo=,tag:gRx/d6cZJHXwz1p1j4Ceog==,type:str]
+ username: ENC[AES256_GCM,data:t20aVhi8PQ==,iv:s1dcUYnfh36lDWL1U81aSAmNMG82eKXntvupH0gQQE4=,tag:1U66AVur3N4JeQOyubVeyQ==,type:str]
+ password: ENC[AES256_GCM,data:5Xkv9ry8peufhFh4MCLkiyB/iW1Z3noWjXOeLfZ9+2k+RoeCwKgRjPw1L/AOtZIChPgn8hXwfjK2Chc5bqdcnA==,iv:RBPsu2pJw3gt7M0FSpBbQnlgnGl6xDFSvpVVg/dBiSo=,tag:gRx/d6cZJHXwz1p1j4Ceog==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: vaultwarden
- namespace: postgres-cluster
+ name: vaultwarden
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:a13bWZSxKhmaksU=,iv:yg+7eVDZLBpE0657wGJIiYF8qbZ/vEd6cKgyui4DiRI=,tag:P/4zAf4iX9/vpCQcCnXJkw==,type:str]
- password: ENC[AES256_GCM,data:eOMnJV1QXCFw2blY1eSSYviY8pAsuCRiqWW4UaBS6xBfy7w9Z1IQOje2W4A91esJIcTk1lS5+Uf5ExhmXcEzqg==,iv:1Es2izArwaLq+whcwlDdg/zYQFT4VlKanWX4L4vkNCc=,tag:jxmd3isY7JWL6MS5WwG9SQ==,type:str]
+ username: ENC[AES256_GCM,data:a13bWZSxKhmaksU=,iv:yg+7eVDZLBpE0657wGJIiYF8qbZ/vEd6cKgyui4DiRI=,tag:P/4zAf4iX9/vpCQcCnXJkw==,type:str]
+ password: ENC[AES256_GCM,data:eOMnJV1QXCFw2blY1eSSYviY8pAsuCRiqWW4UaBS6xBfy7w9Z1IQOje2W4A91esJIcTk1lS5+Uf5ExhmXcEzqg==,iv:1Es2izArwaLq+whcwlDdg/zYQFT4VlKanWX4L4vkNCc=,tag:jxmd3isY7JWL6MS5WwG9SQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: docuseal
- namespace: postgres-cluster
+ name: docuseal
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:2fGNpotB50U=,iv:+efSBURsZg9JWybP8bGY2vk7pAr1S357El75F2sTsc8=,tag:e29HaKOWjpbDRXRZ+9zynA==,type:str]
- password: ENC[AES256_GCM,data:aFT0COjLf1opSyuUEz4MwzFTvTxDDfinFKyLzuMlf5nftzeBau4nzQ4gflm6SjigkbrOOHRD/ARF5Ds94FMw5Q==,iv:ZQGqprGCX8hJsk/O7eOvPBIzfZST0AGhzzulLli/yqI=,tag:QZeqdm8t50luDcxAlSwSNw==,type:str]
+ username: ENC[AES256_GCM,data:2fGNpotB50U=,iv:+efSBURsZg9JWybP8bGY2vk7pAr1S357El75F2sTsc8=,tag:e29HaKOWjpbDRXRZ+9zynA==,type:str]
+ password: ENC[AES256_GCM,data:aFT0COjLf1opSyuUEz4MwzFTvTxDDfinFKyLzuMlf5nftzeBau4nzQ4gflm6SjigkbrOOHRD/ARF5Ds94FMw5Q==,iv:ZQGqprGCX8hJsk/O7eOvPBIzfZST0AGhzzulLli/yqI=,tag:QZeqdm8t50luDcxAlSwSNw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: bugzilla
- namespace: postgres-cluster
+ name: bugzilla
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:/HwewQZUSlg=,iv:wTN2EjEaruXsta454R1LGwEl8WBsZX7TVl5UE6qvqUc=,tag:1TVBOn12Pi4FyUtHLF0oNw==,type:str]
- password: ENC[AES256_GCM,data:ywE/0/nNkkwLfPaSYZkdW+ifF6BD9AUeLULNmSIhIPNEfxeXSEqBRuxzKIT2zo0pUMS850leacsmb7V86onT3w==,iv:bV2chcYxnWS5SDe9ckJns1xI1UYWSfW0pvq1oR96pJk=,tag:NcXcbu6eg649l0OJhqSsdw==,type:str]
+ username: ENC[AES256_GCM,data:/HwewQZUSlg=,iv:wTN2EjEaruXsta454R1LGwEl8WBsZX7TVl5UE6qvqUc=,tag:1TVBOn12Pi4FyUtHLF0oNw==,type:str]
+ password: ENC[AES256_GCM,data:ywE/0/nNkkwLfPaSYZkdW+ifF6BD9AUeLULNmSIhIPNEfxeXSEqBRuxzKIT2zo0pUMS850leacsmb7V86onT3w==,iv:bV2chcYxnWS5SDe9ckJns1xI1UYWSfW0pvq1oR96pJk=,tag:NcXcbu6eg649l0OJhqSsdw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: rundeck
- namespace: postgres-cluster
+ name: rundeck
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:FKMAf//3rA==,iv:/q38kmi3dpA2xGLG5C9X2fllDhGXVrFXp5Uy1B0Vndo=,tag:epOjrcnROiHXvgVBxLwilQ==,type:str]
- password: ENC[AES256_GCM,data:QoRldhd1FiGFCQlXc1vmvfOKAZ16m0iTgVmLoFoWfrJMq5ozyM3vD8gkf39dZ1/CgpLY/L7p0MN8ZAh8cyK8ug==,iv:nd98bSIMLhnqFi2l29cXXtlnOy9SBCI4ugjvuc/ibrk=,tag:psPD3QnWnhIi9yo/GlrGnA==,type:str]
+ username: ENC[AES256_GCM,data:FKMAf//3rA==,iv:/q38kmi3dpA2xGLG5C9X2fllDhGXVrFXp5Uy1B0Vndo=,tag:epOjrcnROiHXvgVBxLwilQ==,type:str]
+ password: ENC[AES256_GCM,data:QoRldhd1FiGFCQlXc1vmvfOKAZ16m0iTgVmLoFoWfrJMq5ozyM3vD8gkf39dZ1/CgpLY/L7p0MN8ZAh8cyK8ug==,iv:nd98bSIMLhnqFi2l29cXXtlnOy9SBCI4ugjvuc/ibrk=,tag:psPD3QnWnhIi9yo/GlrGnA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: plane
- namespace: postgres-cluster
+ name: plane
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:rIpkYk8=,iv:JnjLLiXnni1TasVj4dXLSembjmv+XCQyFvuWso+wF2A=,tag:B+nlqGIXgvrjHDTQauHF0g==,type:str]
- password: ENC[AES256_GCM,data:Ha5RQDxIHRmnAfu2a7ElmyIm+XShnh/sX1k9L3K5JgAcgSQiTOXRIPe97fnwCV+KCszwXjLsU28QAnptrjp04Q==,iv:5QKthqfWlPIl71ZRqeNOHY9AIqf3vNsdbTfw+kTFBuc=,tag:DlFCTErFEk84Z1tjVaRSEw==,type:str]
+ username: ENC[AES256_GCM,data:rIpkYk8=,iv:JnjLLiXnni1TasVj4dXLSembjmv+XCQyFvuWso+wF2A=,tag:B+nlqGIXgvrjHDTQauHF0g==,type:str]
+ password: ENC[AES256_GCM,data:Ha5RQDxIHRmnAfu2a7ElmyIm+XShnh/sX1k9L3K5JgAcgSQiTOXRIPe97fnwCV+KCszwXjLsU28QAnptrjp04Q==,iv:5QKthqfWlPIl71ZRqeNOHY9AIqf3vNsdbTfw+kTFBuc=,tag:DlFCTErFEk84Z1tjVaRSEw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: meowlnir
- namespace: postgres-cluster
+ name: meowlnir
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:GdGQMq7R6nU=,iv:lkySDejU5Ui3MKorn55ZH3TMQJC0U6hldYM7RM4T4gw=,tag:L4K3Lt1fe6E6g1O5/hHnOw==,type:str]
- password: ENC[AES256_GCM,data:JSudB27FIRLVjGXtaZaoZkMMYAZxFdMIG/WoZV+eCpKltbNIT9ycw1wiYtLx3hg3vQkiOZOcFs03B0OMfhGB1Q==,iv:yVZxriBA3iBawsa29fUFpsBvzLGwN3ZPLNQt+nI4ECo=,tag:LR1IwbGbOupUjzS8PKkKYA==,type:str]
+ username: ENC[AES256_GCM,data:GdGQMq7R6nU=,iv:lkySDejU5Ui3MKorn55ZH3TMQJC0U6hldYM7RM4T4gw=,tag:L4K3Lt1fe6E6g1O5/hHnOw==,type:str]
+ password: ENC[AES256_GCM,data:JSudB27FIRLVjGXtaZaoZkMMYAZxFdMIG/WoZV+eCpKltbNIT9ycw1wiYtLx3hg3vQkiOZOcFs03B0OMfhGB1Q==,iv:yVZxriBA3iBawsa29fUFpsBvzLGwN3ZPLNQt+nI4ECo=,tag:LR1IwbGbOupUjzS8PKkKYA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: connectivity-tester-stage
- namespace: postgres-cluster
+ name: connectivity-tester-stage
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:hK2pMvWoBBkmBkxN29iMXBra5LWkmmNSrw==,iv:EaQTRl8aUO67gAE/dzikSElpIJphijXAvF+eSXr4A8Y=,tag:rY4ZYyjoO9DDudLogn3kgg==,type:str]
- password: ENC[AES256_GCM,data:0RhrMbCcJMo2jwIB6ATWaS3FoK9x7NvWB8mrMcU68XIhJjjZWbnyB019Pbs8E7wa1MAaXJ0QalwBTL8M85Ez8A==,iv:w2okqnBU2ZcloxGfBChDmdYbDkyG94wH6Ui8RwqH60I=,tag:l1rbVKeQFR609EmYCLhvKQ==,type:str]
+ username: ENC[AES256_GCM,data:hK2pMvWoBBkmBkxN29iMXBra5LWkmmNSrw==,iv:EaQTRl8aUO67gAE/dzikSElpIJphijXAvF+eSXr4A8Y=,tag:rY4ZYyjoO9DDudLogn3kgg==,type:str]
+ password: ENC[AES256_GCM,data:0RhrMbCcJMo2jwIB6ATWaS3FoK9x7NvWB8mrMcU68XIhJjjZWbnyB019Pbs8E7wa1MAaXJ0QalwBTL8M85Ez8A==,iv:w2okqnBU2ZcloxGfBChDmdYbDkyG94wH6Ui8RwqH60I=,tag:l1rbVKeQFR609EmYCLhvKQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: connectivity-tester
- namespace: postgres-cluster
+ name: connectivity-tester
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:PYxBlnTrnmCqrJ7u0peZsX3uXg==,iv:GZ4lZQgMkyXGCBG4yLCIRBmub0UWVK46xMZ8TbYgJE0=,tag:nkeWTATW65HguevS4UvMuA==,type:str]
- password: ENC[AES256_GCM,data:Dkq9Yca+S82bdncFFr/rkDG86ADF5iB+SjAyBk6IgbcmsjGErB9Zl0jMqmu6vhVG3VmB4oUSLvADgLOPK9nLlQ==,iv:6g/APXuPbjTneaoEj5hv/cezNwuzoBYtNOuZNaMKZE0=,tag:4y1qHjA1gMXXEXRUTxg+nw==,type:str]
+ username: ENC[AES256_GCM,data:PYxBlnTrnmCqrJ7u0peZsX3uXg==,iv:GZ4lZQgMkyXGCBG4yLCIRBmub0UWVK46xMZ8TbYgJE0=,tag:nkeWTATW65HguevS4UvMuA==,type:str]
+ password: ENC[AES256_GCM,data:Dkq9Yca+S82bdncFFr/rkDG86ADF5iB+SjAyBk6IgbcmsjGErB9Zl0jMqmu6vhVG3VmB4oUSLvADgLOPK9nLlQ==,iv:6g/APXuPbjTneaoEj5hv/cezNwuzoBYtNOuZNaMKZE0=,tag:4y1qHjA1gMXXEXRUTxg+nw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: freshrss
- namespace: postgres-cluster
+ name: freshrss
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:i0tL3LIL6pc=,iv:XbFHFQ21bPoQO+jyvwbLazCGbl5f0UNycMT82KDiBsI=,tag:e/B7o4V9ggaqEz6BDT98ww==,type:str]
- password: ENC[AES256_GCM,data:5W6/fDBv2Mgp5v3xEUrZUecNFgtKJn5H1HPqYegVdACf3sxMDiP662s5UzSrAP1Vsk2e3Qa/D0/hIZOYNHtghg==,iv:liTpEEGEGa7lHOCncloSRYzecjPVQ38RMXLP7b+avi0=,tag:zlidQeFqiNRQO2ozzXJaUg==,type:str]
+ username: ENC[AES256_GCM,data:i0tL3LIL6pc=,iv:XbFHFQ21bPoQO+jyvwbLazCGbl5f0UNycMT82KDiBsI=,tag:e/B7o4V9ggaqEz6BDT98ww==,type:str]
+ password: ENC[AES256_GCM,data:5W6/fDBv2Mgp5v3xEUrZUecNFgtKJn5H1HPqYegVdACf3sxMDiP662s5UzSrAP1Vsk2e3Qa/D0/hIZOYNHtghg==,iv:liTpEEGEGa7lHOCncloSRYzecjPVQ38RMXLP7b+avi0=,tag:zlidQeFqiNRQO2ozzXJaUg==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: gotosocial
- namespace: postgres-cluster
+ name: gotosocial
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:zCuGuHQj4SA+GA==,iv:RhewBLZwjJcm8zxPLPORCwX/YbPjd/7QOUzK3Hab1+M=,tag:lfAKlYo/dWnlrWrbtCedqw==,type:str]
- password: ENC[AES256_GCM,data:rdxbSmGh4zmQmFhIaW6IosJ9JPRI7HUrvv8EIHO1fRWqZSN4IoHMLbxSxJLbHzwRsqbHaKAg0VMBv0lddBPl1Q==,iv:5iIiaNRchgHJ/RN6hJx7w/g40NIeAA3IQ3z6/1krc2M=,tag:zLRn/2Lq0y+okp4PqdN5fw==,type:str]
+ username: ENC[AES256_GCM,data:zCuGuHQj4SA+GA==,iv:RhewBLZwjJcm8zxPLPORCwX/YbPjd/7QOUzK3Hab1+M=,tag:lfAKlYo/dWnlrWrbtCedqw==,type:str]
+ password: ENC[AES256_GCM,data:rdxbSmGh4zmQmFhIaW6IosJ9JPRI7HUrvv8EIHO1fRWqZSN4IoHMLbxSxJLbHzwRsqbHaKAg0VMBv0lddBPl1Q==,iv:5iIiaNRchgHJ/RN6hJx7w/g40NIeAA3IQ3z6/1krc2M=,tag:zLRn/2Lq0y+okp4PqdN5fw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: grafana-ro
- namespace: postgres-cluster
+ name: grafana-ro
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:89W9IaHWNcV/sA==,iv:yuf3eMzb+zRlfSvG2vTrpVglMmw984Okn5I9TIH/ZPg=,tag:JCWfgoxIeDmWrZkOkB9YmA==,type:str]
- password: ENC[AES256_GCM,data:C6OV0ywCmaLZhae2aXxIe+wCKPXHRE9p5S9WaYDDFFhO6yrgQ/vP3sIOWOL/YrD7jARoHtRTjcBT1O9yNoUsOw==,iv:20NKZwTvpwfdx+CaIuQW1k4jD8A0q3yt3Y2wvIl2+m4=,tag:Qv1k+s+GUCeBF3dsjl3vrw==,type:str]
+ username: ENC[AES256_GCM,data:89W9IaHWNcV/sA==,iv:yuf3eMzb+zRlfSvG2vTrpVglMmw984Okn5I9TIH/ZPg=,tag:JCWfgoxIeDmWrZkOkB9YmA==,type:str]
+ password: ENC[AES256_GCM,data:C6OV0ywCmaLZhae2aXxIe+wCKPXHRE9p5S9WaYDDFFhO6yrgQ/vP3sIOWOL/YrD7jARoHtRTjcBT1O9yNoUsOw==,iv:20NKZwTvpwfdx+CaIuQW1k4jD8A0q3yt3Y2wvIl2+m4=,tag:Qv1k+s+GUCeBF3dsjl3vrw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: mailman
- namespace: postgres-cluster
+ name: mailman
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:j2xUmcR3dQ==,iv:83oUXzK3jfkQj7PZM/Iz4tBAr65RhhSWch80amZbB8A=,tag:K2VdrKNDpOtbzrVQZ06pNA==,type:str]
- password: ENC[AES256_GCM,data:T1zjFdbfnrK5blPCaMO/ojRPKuER3bk2+n2IkxhTs34u5KqwMXMOplwixKYBwibRS7J/H/ehrHmQtIualQLFdQ==,iv:AjIbvnmQeicnkLR4+RY0GRy21MWyGxy1ALQWKiaIu/M=,tag:XAP3rfjqK9+LjJD7MIZIDA==,type:str]
+ username: ENC[AES256_GCM,data:j2xUmcR3dQ==,iv:83oUXzK3jfkQj7PZM/Iz4tBAr65RhhSWch80amZbB8A=,tag:K2VdrKNDpOtbzrVQZ06pNA==,type:str]
+ password: ENC[AES256_GCM,data:T1zjFdbfnrK5blPCaMO/ojRPKuER3bk2+n2IkxhTs34u5KqwMXMOplwixKYBwibRS7J/H/ehrHmQtIualQLFdQ==,iv:AjIbvnmQeicnkLR4+RY0GRy21MWyGxy1ALQWKiaIu/M=,tag:XAP3rfjqK9+LjJD7MIZIDA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: bookwyrm
- namespace: postgres-cluster
+ name: bookwyrm
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:kTFz748T36I=,iv:n568DiaP/l9xbBNOO/pE5qx228vNBx/GcVKx3iMD23A=,tag:jz/512HibVc9Bx0on2pLaA==,type:str]
- password: ENC[AES256_GCM,data:dwJapPb7kDRTrLKoOFc8+UTmGUW7c54kC8LpbCMzLx7/0qiRs2xRR7e/6Ls60jyPqFwnS9fUwqV1I7fjl3eZNA==,iv:KxEJyfTJkA3lnCrM93Ocmj6y2qw/jRPeIEs4PD5D3ZA=,tag:IySOAcOdmAknWwebX8ICNQ==,type:str]
+ username: ENC[AES256_GCM,data:kTFz748T36I=,iv:n568DiaP/l9xbBNOO/pE5qx228vNBx/GcVKx3iMD23A=,tag:jz/512HibVc9Bx0on2pLaA==,type:str]
+ password: ENC[AES256_GCM,data:dwJapPb7kDRTrLKoOFc8+UTmGUW7c54kC8LpbCMzLx7/0qiRs2xRR7e/6Ls60jyPqFwnS9fUwqV1I7fjl3eZNA==,iv:KxEJyfTJkA3lnCrM93Ocmj6y2qw/jRPeIEs4PD5D3ZA=,tag:IySOAcOdmAknWwebX8ICNQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: concourse
- namespace: postgres-cluster
+ name: concourse
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:erk/xaTbIuUy,iv:n9Z6Pe0nh+xJE1w8Vsf7op2QFHkqUlV9czmlLlCUoJ0=,tag:3bAG2TlGFk/JjDvjLYvCUg==,type:str]
- password: ENC[AES256_GCM,data:ceeJ6cLB/LDRBCVT1/5YXmVsHFq4dbosb3ZbsJwx2pPkbHawUF3BNAkebG5RQBLZ4KJmyWrk0xmBoy9RvtD6Eg==,iv:B1I21r+NxGspQsHzeyfGANAMebTPOhbHW4k5iwjzGkc=,tag:A7/tYhydLlcwLa522KpmZQ==,type:str]
+ username: ENC[AES256_GCM,data:erk/xaTbIuUy,iv:n9Z6Pe0nh+xJE1w8Vsf7op2QFHkqUlV9czmlLlCUoJ0=,tag:3bAG2TlGFk/JjDvjLYvCUg==,type:str]
+ password: ENC[AES256_GCM,data:ceeJ6cLB/LDRBCVT1/5YXmVsHFq4dbosb3ZbsJwx2pPkbHawUF3BNAkebG5RQBLZ4KJmyWrk0xmBoy9RvtD6Eg==,iv:B1I21r+NxGspQsHzeyfGANAMebTPOhbHW4k5iwjzGkc=,tag:A7/tYhydLlcwLa522KpmZQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: weblate
- namespace: postgres-cluster
+ name: weblate
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:709+e0t6Yw==,iv:I+B3xj7T9EYnjIMhLtDtHj2FiFcYteImBPIRiGQeOqM=,tag:miugoA5SIpSaaFT14031Qg==,type:str]
- password: ENC[AES256_GCM,data:yP0DSbri0VpXpWX7Jv8of3kI6yxjPdhmdLkBi2oYG/KOXb1dwkghgPk3I3V7S2HkSxHIKvUOi20BfYGYRVrk5A==,iv:PNJhZqtIpnZIwo7tmlTFgKueS8v1yPNM5TNobC+jtlg=,tag:MfyAFhh3fvvEuSIz1JgyyA==,type:str]
+ username: ENC[AES256_GCM,data:709+e0t6Yw==,iv:I+B3xj7T9EYnjIMhLtDtHj2FiFcYteImBPIRiGQeOqM=,tag:miugoA5SIpSaaFT14031Qg==,type:str]
+ password: ENC[AES256_GCM,data:yP0DSbri0VpXpWX7Jv8of3kI6yxjPdhmdLkBi2oYG/KOXb1dwkghgPk3I3V7S2HkSxHIKvUOi20BfYGYRVrk5A==,iv:PNJhZqtIpnZIwo7tmlTFgKueS8v1yPNM5TNobC+jtlg=,tag:MfyAFhh3fvvEuSIz1JgyyA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: sentry
- namespace: postgres-cluster
+ name: sentry
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:Xec8sytj,iv:2OCnBfhmajS8catalmtNaV31a3faPfItwZEwJ5jhPfA=,tag:E8ISv9xMiq2y30mwfa1+VQ==,type:str]
- password: ENC[AES256_GCM,data:a6lNGjqwQL+HC908YXCgfNY813HiQJ3/3W90bBAn+qbl+VI9tba6ELZIGweO1vLKfnY5ODwb0FME8/NOIGrH7A==,iv:PbaLy4ZMrcbzfiVBFOJ69N5WrWKFeC4FiNiVnoVLw8o=,tag:Xuou3kyqSrigN+lTH9f3RA==,type:str]
+ username: ENC[AES256_GCM,data:Xec8sytj,iv:2OCnBfhmajS8catalmtNaV31a3faPfItwZEwJ5jhPfA=,tag:E8ISv9xMiq2y30mwfa1+VQ==,type:str]
+ password: ENC[AES256_GCM,data:a6lNGjqwQL+HC908YXCgfNY813HiQJ3/3W90bBAn+qbl+VI9tba6ELZIGweO1vLKfnY5ODwb0FME8/NOIGrH7A==,iv:PbaLy4ZMrcbzfiVBFOJ69N5WrWKFeC4FiNiVnoVLw8o=,tag:Xuou3kyqSrigN+lTH9f3RA==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: immich
- namespace: postgres-cluster
+ name: immich
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:X4e3uxPq,iv:h/Wp0jnfp9WpbS7WUvbwynPgN+DsZBjctUOD3AqAqCU=,tag:NXcOgGRoFj7ujzeYyq3pVg==,type:str]
- password: ENC[AES256_GCM,data:NQccS8dfLw/85EKiwZNs+tuKcPDiC9+rZ9Qz2VpAtkkrf7lqxIQdt+4ToYT7TLTliJUlPR3ucrMhEE4lrVlroA==,iv:QcmcWoXexIv3JClkV6GJ7+8innqvh0TFFDOBZqOKEFQ=,tag:oEvSHH1jgSGcfI/xdhhiew==,type:str]
+ username: ENC[AES256_GCM,data:X4e3uxPq,iv:h/Wp0jnfp9WpbS7WUvbwynPgN+DsZBjctUOD3AqAqCU=,tag:NXcOgGRoFj7ujzeYyq3pVg==,type:str]
+ password: ENC[AES256_GCM,data:NQccS8dfLw/85EKiwZNs+tuKcPDiC9+rZ9Qz2VpAtkkrf7lqxIQdt+4ToYT7TLTliJUlPR3ucrMhEE4lrVlroA==,iv:QcmcWoXexIv3JClkV6GJ7+8innqvh0TFFDOBZqOKEFQ=,tag:oEvSHH1jgSGcfI/xdhhiew==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: convex
- namespace: postgres-cluster
+ name: convex
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:ZwL/Xv+s,iv:ZPF/AqSqkyjdm7DOCOqh+QuCVj+X8zRC2MmFo3qmzGk=,tag:NUHCLPQwpcI7+5fphxZIrw==,type:str]
- password: ENC[AES256_GCM,data:6JNIi5HOkApmYk1Z2vuueizaMTctGJkKEv2SDJGrNbzEjaUkfE0fkdGhhK9iQQ1jCHxVxiZ2NPz+Tq8Lf395uA==,iv:pgR6ELoBhyWIWL9gRJX5794A+Im/nioQe55+pgnirZo=,tag:hGL+v4Rj3L+G7+Qygvu6gQ==,type:str]
+ username: ENC[AES256_GCM,data:ZwL/Xv+s,iv:ZPF/AqSqkyjdm7DOCOqh+QuCVj+X8zRC2MmFo3qmzGk=,tag:NUHCLPQwpcI7+5fphxZIrw==,type:str]
+ password: ENC[AES256_GCM,data:6JNIi5HOkApmYk1Z2vuueizaMTctGJkKEv2SDJGrNbzEjaUkfE0fkdGhhK9iQQ1jCHxVxiZ2NPz+Tq8Lf395uA==,iv:pgR6ELoBhyWIWL9gRJX5794A+Im/nioQe55+pgnirZo=,tag:hGL+v4Rj3L+G7+Qygvu6gQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: peertube
- namespace: postgres-cluster
+ name: peertube
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:wekCax7uXKQ=,iv:2PKsBZsbYdbNe29m5joGi2rWjqhwfjGqy+BeiJFLtSA=,tag:LjqduKbjfNn+E4EDtKBiEg==,type:str]
- password: ENC[AES256_GCM,data:CjfZIFKrQMZluuhyREPg0SU7dtqu5LmKHNNKqufAsPiLc5liunirB9duVQmnG+Y8NMGkGDhhdaETUj+5RTFd,iv:q5VfRjV3ixIIwS9cizdhnm7CYQc0eEHPItBng5cCrTA=,tag:QFGsQQF4cKfPPRuNZveANQ==,type:str]
+ username: ENC[AES256_GCM,data:wekCax7uXKQ=,iv:2PKsBZsbYdbNe29m5joGi2rWjqhwfjGqy+BeiJFLtSA=,tag:LjqduKbjfNn+E4EDtKBiEg==,type:str]
+ password: ENC[AES256_GCM,data:CjfZIFKrQMZluuhyREPg0SU7dtqu5LmKHNNKqufAsPiLc5liunirB9duVQmnG+Y8NMGkGDhhdaETUj+5RTFd,iv:q5VfRjV3ixIIwS9cizdhnm7CYQc0eEHPItBng5cCrTA=,tag:QFGsQQF4cKfPPRuNZveANQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
---
apiVersion: v1
kind: Secret
metadata:
- name: persephone
- namespace: postgres-cluster
+ name: persephone
+ namespace: postgres-cluster
type: Opaque
stringData:
- username: ENC[AES256_GCM,data:WuwqaA+Iga9A6g==,iv:tB4pp3jFs0Ry5M9I6MHwAiGLFolSTcIf06WaB/nzdis=,tag:mve/cUeQkqxqnPj/w/hzZQ==,type:str]
- password: ENC[AES256_GCM,data:eeB+cTqHI0kBrRLaTElPBtY8fkNHyoyWVBFUADctr4vpJAvBNXsIZ7WzkoDjPmKuXzr2gU62+7mXxQXRfgVE,iv:VjuKhebQcv4EXak6RN0fTX73A1TDIJpsA6anA4Zz46Q=,tag:PIQ9+b8u0+yWZ+lYA14gnQ==,type:str]
+ username: ENC[AES256_GCM,data:WuwqaA+Iga9A6g==,iv:tB4pp3jFs0Ry5M9I6MHwAiGLFolSTcIf06WaB/nzdis=,tag:mve/cUeQkqxqnPj/w/hzZQ==,type:str]
+ password: ENC[AES256_GCM,data:eeB+cTqHI0kBrRLaTElPBtY8fkNHyoyWVBFUADctr4vpJAvBNXsIZ7WzkoDjPmKuXzr2gU62+7mXxQXRfgVE,iv:VjuKhebQcv4EXak6RN0fTX73A1TDIJpsA6anA4Zz46Q=,tag:PIQ9+b8u0+yWZ+lYA14gnQ==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
- dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
- TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
- Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
- OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-02-09T16:11:20Z"
- mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMWxVY1hPMmlkQWgvUXJi
+ dk1KM1k5eCs5MnFWdDUybHdha1dSbGdSV1hBCk53eHZYLzJPS1cydTJwdkFmRklL
+ TTlNR2NmZlprdjMzNUtzVWE1VHR6N0UKLS0tICtFdHZxVVlqRlhVUjdialQ3Tk1k
+ Z3Y3VWhBSEZwWGExOGJ3K2RuMmZ6QmcKFOokxQB9F5jgarhPDCQQCFAdn/AY/6SW
+ OR7frjPN4XmgiT5O5ysdc5cnxKbhSFGydCOlZ84lDkuNV6oFanfRoQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-09T16:11:20Z"
+ mac: ENC[AES256_GCM,data:+rLDnpqEdcLsT0pe1Zwwn4Zy7DSK4GTggyMBFgkErVkyeGmRK+SEIm6dhoyQK7ZUac/DwlqIkWdITFEBhq4pLpNbAJFGN+sZXSQ8ds7hOJDKtoBENCp3EAsWNUKJGoCsdQs9WVX6y3pfiGq/8+ASSRf+mVfRrxu78weXJJ5Gi1c=,iv:9KG0ReLAfEwh5idNenqz8u7TB7MV4XRHqVMsgXA64BI=,tag:0fywa2GreWlZGg96chWmnQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
