chore(deps): update all-minor-patch-updates

Reviewed-on: #359

README.md

@@ -0,0 +1,37 @@
+# Main Infrastructure: weyma-talos
+
+**Production Kubernetes infrastructure with disaster recovery capabilities**
+
+This repository contains the foundational infrastructure for my Kubernetes homelab, designed with reliability and rapid recovery as core principles.
+
+## Architecture
+
+My infrastructure follows a layered "black start" approach - essential services run outside the Kubernetes cluster to enable cluster bootstrapping and recovery from total failures.
+
+### Black Start Layer
+Static services (Docker Compose on TrueNAS/Proxmox) that provide cluster dependencies:
+- Image cache for faster deployments and offline capability
+- Talos discovery server for node bootstrapping  
+- HashiCorp Vault for secrets management (external to cluster)
+- Future: Self-hosted Sidero Omni server (migrating from SaaS)
+
+### System Apps Layer
+Applications running within Kubernetes that provide core cluster functionality, managed via ArgoCD with GitOps principles.
+
+## Repository Structure
+
+- **`black-start/`** - Docker Compose services for cluster dependencies
+- **`config-patches/`** - Talos Linux configuration patches for cluster and individual machines
+- **`omni/`** - Sidero Omni [cluster template](https://docs.siderolabs.com/omni/reference/cluster-templates)
+- **`system-apps/`** - System applications (ArgoCD projects) - monitoring, ingress, certificates, storage
+
+## Tech Stack
+
+**OS:** Talos Linux | **Orchestration:** Kubernetes | **GitOps:** ArgoCD | **Secrets:** Vault | **Storage:** Rook-Ceph
+
+## Recovery Process
+
+The "black start" architecture enables ~15-20 minute automated recovery from complete infrastructure failure:
+1. Start black-start services → 2. Bootstrap Talos → 3. Deploy system apps → 4. Deploy core apps
+
+For application deployments, see [core-apps](https://git.dubyatp.xyz/core-apps).

black-start/services/prometheus/docker-compose.yaml

@@ -1,15 +0,0 @@
-services:
-  prometheus:
-    image: prom/prometheus:v3.7.3
-    command:
-      - '--config.file=/etc/prometheus/prometheus.yaml'
-      - '--web.config.file=/etc/prometheus/web-config.yaml'
-      - '--web.enable-remote-write-receiver'
-      - '--storage.tsdb.retention.size=35GB'
-    ports:
-      - 9090:9090
-    volumes:
-      - ./.basicauthpass:/etc/prometheus/.basicauthpass
-      - ./prometheus.yaml:/etc/prometheus/prometheus.yaml
-      - ./web-config.yaml:/etc/prometheus/web-config.yaml
-      - /mnt/prometheus-data:/prometheus

black-start/services/prometheus/prometheus.yaml

@@ -1,32 +0,0 @@
-# my global config
-global:
-  scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
-  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
-  # scrape_timeout is set to the global default (10s).
-
-# Alertmanager configuration
-alerting:
-  alertmanagers:
-    - static_configs:
-        - targets:
-          # - alertmanager:9093
-
-# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
-rule_files:
-  # - "first_rules.yml"
-  # - "second_rules.yml"
-
-# A scrape configuration containing exactly one endpoint to scrape:
-# Here it's Prometheus itself.
-scrape_configs:
-  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
-  - job_name: "prometheus"
-
-    # metrics_path defaults to '/metrics'
-    # scheme defaults to 'http'.
-
-    static_configs:
-      - targets: ["localhost:9090"]
-    basic_auth:
-      username: prometheus
-      password_file: /etc/prometheus/.basicauthpass

black-start/services/prometheus/web-config.yaml

@@ -1,2 +0,0 @@
-basic_auth_users:
-  prometheus: <redacted>

black-start/services/talos-discovery/docker-compose.yaml

@@ -2,7 +2,7 @@ version: "3.8"
 services:
   discovery:
     restart: unless-stopped
-    image: ghcr.io/siderolabs/discovery-service:v1.0.11
+    image: ghcr.io/siderolabs/discovery-service:v1.1.0
     ports:
       - 10.105.6.215:3000:3000
       - 10.105.6.215:3001:3001

black-start/services/vault/docker-compose.yaml

@@ -5,7 +5,7 @@ services:
     command: tunnel run weyma-vault
     env_file: ".env"
   vault:
-    image: hashicorp/vault:1.21
+    image: hashicorp/vault:2.0
     env_file: ".env.vault"
     environment:
       VAULT_ADDR: "https://weyma-vault.infra.dubyatp.xyz:8200"

config-patches/cluster/weyma-bootstrap-metrics.yaml

@@ -1,8 +1,213 @@
 cluster:
   extraManifests:
     - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
-    - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
   inlineManifests:
+    - name: metrics-server
+      contents: |-
+        apiVersion: v1
+        kind: ServiceAccount
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: metrics-server
+          namespace: kube-system
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          labels:
+            k8s-app: metrics-server
+            rbac.authorization.k8s.io/aggregate-to-admin: "true"
+            rbac.authorization.k8s.io/aggregate-to-edit: "true"
+            rbac.authorization.k8s.io/aggregate-to-view: "true"
+          name: system:aggregated-metrics-reader
+        rules:
+        - apiGroups:
+          - metrics.k8s.io
+          resources:
+          - pods
+          - nodes
+          verbs:
+          - get
+          - list
+          - watch
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: system:metrics-server
+        rules:
+        - apiGroups:
+          - ""
+          resources:
+          - nodes/metrics
+          verbs:
+          - get
+        - apiGroups:
+          - ""
+          resources:
+          - pods
+          - nodes
+          verbs:
+          - get
+          - list
+          - watch
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: RoleBinding
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: metrics-server-auth-reader
+          namespace: kube-system
+        roleRef:
+          apiGroup: rbac.authorization.k8s.io
+          kind: Role
+          name: extension-apiserver-authentication-reader
+        subjects:
+        - kind: ServiceAccount
+          name: metrics-server
+          namespace: kube-system
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: metrics-server:system:auth-delegator
+        roleRef:
+          apiGroup: rbac.authorization.k8s.io
+          kind: ClusterRole
+          name: system:auth-delegator
+        subjects:
+        - kind: ServiceAccount
+          name: metrics-server
+          namespace: kube-system
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: system:metrics-server
+        roleRef:
+          apiGroup: rbac.authorization.k8s.io
+          kind: ClusterRole
+          name: system:metrics-server
+        subjects:
+        - kind: ServiceAccount
+          name: metrics-server
+          namespace: kube-system
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: metrics-server
+          namespace: kube-system
+        spec:
+          ports:
+          - appProtocol: https
+            name: https
+            port: 443
+            protocol: TCP
+            targetPort: https
+          selector:
+            k8s-app: metrics-server
+        ---
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: metrics-server
+          namespace: kube-system
+        spec:
+          selector:
+            matchLabels:
+              k8s-app: metrics-server
+          strategy:
+            rollingUpdate:
+              maxUnavailable: 0
+          template:
+            metadata:
+              labels:
+                k8s-app: metrics-server
+            spec:
+              containers:
+              - args:
+                - --cert-dir=/tmp
+                - --secure-port=10250
+                - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+                - --kubelet-use-node-status-port
+                - --metric-resolution=15s
+                - --kubelet-insecure-tls
+                image: registry.k8s.io/metrics-server/metrics-server:v0.8.0
+                imagePullPolicy: IfNotPresent
+                livenessProbe:
+                  failureThreshold: 3
+                  httpGet:
+                    path: /livez
+                    port: https
+                    scheme: HTTPS
+                  periodSeconds: 10
+                name: metrics-server
+                ports:
+                - containerPort: 10250
+                  name: https
+                  protocol: TCP
+                readinessProbe:
+                  failureThreshold: 3
+                  httpGet:
+                    path: /readyz
+                    port: https
+                    scheme: HTTPS
+                  initialDelaySeconds: 20
+                  periodSeconds: 10
+                resources:
+                  requests:
+                    cpu: 100m
+                    memory: 200Mi
+                securityContext:
+                  allowPrivilegeEscalation: false
+                  capabilities:
+                    drop:
+                    - ALL
+                  readOnlyRootFilesystem: true
+                  runAsNonRoot: true
+                  runAsUser: 1000
+                  seccompProfile:
+                    type: RuntimeDefault
+                volumeMounts:
+                - mountPath: /tmp
+                  name: tmp-dir
+              nodeSelector:
+                kubernetes.io/os: linux
+              priorityClassName: system-cluster-critical
+              serviceAccountName: metrics-server
+              volumes:
+              - emptyDir: {}
+                name: tmp-dir
+        ---
+        apiVersion: apiregistration.k8s.io/v1
+        kind: APIService
+        metadata:
+          labels:
+            k8s-app: metrics-server
+          name: v1beta1.metrics.k8s.io
+        spec:
+          group: metrics.k8s.io
+          groupPriorityMinimum: 100
+          insecureSkipTLSVerify: true
+          service:
+            name: metrics-server
+            namespace: kube-system
+          version: v1beta1
+          versionPriority: 100
+
     - name: metrics-lb
       contents: |-
         apiVersion: v1
@@ -10,6 +215,8 @@ cluster:
         metadata:
           name: metrics-lb
           namespace: kube-system
+          annotations:
+            metallb.io/ip-allocated-from-pool: test-pool
         spec:
           type: LoadBalancer
           ports:
@@ -19,4 +226,3 @@ cluster:
             targetPort: https
           selector:
             k8s-app: metrics-server
-        

omni/weyma-talos.yaml

@@ -0,0 +1,532 @@
+kind: Cluster
+name: weyma-talos
+kubernetes:
+  version: v1.35.4
+talos:
+  version: v1.12.7
+features:
+  backupConfiguration:
+    interval: 6h0m0s
+patches:
+  - idOverride: 500-5100c0c3-f72e-45f5-8cde-4a1c3b6f72a8
+    annotations:
+      description: pod-svc-subnets
+      name: User defined patch
+    inline:
+      cluster:
+        network:
+          podSubnets:
+            - 10.244.0.0/16
+          serviceSubnets:
+            - 10.112.0.0/12
+  - idOverride: 500-7c228773-8b44-40b0-8b4c-30f617668af0
+    annotations:
+      description: weyma-image-cache
+      name: User defined patch
+    inline:
+      machine:
+        registries:
+          mirrors:
+            docker.io:
+              endpoints:
+                - http://10.105.6.215:6000
+            factory.talos.dev:
+              endpoints:
+                - http://10.105.6.215:6004
+            gcr.io:
+              endpoints:
+                - http://10.105.6.215:6002
+            ghcr.io:
+              endpoints:
+                - http://10.105.6.215:6003
+            registry.k8s.io:
+              endpoints:
+                - http://10.105.6.215:6001
+  - idOverride: 500-f198cacc-280b-4874-a410-252c160621a7
+    annotations:
+      name: weyma-bind-addr
+    inline:
+      cluster:
+        controllerManager:
+          extraArgs:
+            bind-address: 0.0.0.0
+        proxy:
+          extraArgs:
+            proxy-mode: ipvs
+            metrics-bind-address: 0.0.0.0:10249
+        scheduler:
+          extraArgs:
+            bind-address: 0.0.0.0
+  - idOverride: 500-fc113705-0777-4b52-8df0-7cee67fcc68e
+    annotations:
+      name: weyma-bootstrap-metrics
+    inline:
+      cluster:
+        extraManifests:
+          - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
+        inlineManifests:
+          - contents: |-
+              apiVersion: v1
+              kind: ServiceAccount
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: metrics-server
+                namespace: kube-system
+              ---
+              apiVersion: rbac.authorization.k8s.io/v1
+              kind: ClusterRole
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                  rbac.authorization.k8s.io/aggregate-to-admin: "true"
+                  rbac.authorization.k8s.io/aggregate-to-edit: "true"
+                  rbac.authorization.k8s.io/aggregate-to-view: "true"
+                name: system:aggregated-metrics-reader
+              rules:
+              - apiGroups:
+                - metrics.k8s.io
+                resources:
+                - pods
+                - nodes
+                verbs:
+                - get
+                - list
+                - watch
+              ---
+              apiVersion: rbac.authorization.k8s.io/v1
+              kind: ClusterRole
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: system:metrics-server
+              rules:
+              - apiGroups:
+                - ""
+                resources:
+                - nodes/metrics
+                verbs:
+                - get
+              - apiGroups:
+                - ""
+                resources:
+                - pods
+                - nodes
+                verbs:
+                - get
+                - list
+                - watch
+              ---
+              apiVersion: rbac.authorization.k8s.io/v1
+              kind: RoleBinding
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: metrics-server-auth-reader
+                namespace: kube-system
+              roleRef:
+                apiGroup: rbac.authorization.k8s.io
+                kind: Role
+                name: extension-apiserver-authentication-reader
+              subjects:
+              - kind: ServiceAccount
+                name: metrics-server
+                namespace: kube-system
+              ---
+              apiVersion: rbac.authorization.k8s.io/v1
+              kind: ClusterRoleBinding
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: metrics-server:system:auth-delegator
+              roleRef:
+                apiGroup: rbac.authorization.k8s.io
+                kind: ClusterRole
+                name: system:auth-delegator
+              subjects:
+              - kind: ServiceAccount
+                name: metrics-server
+                namespace: kube-system
+              ---
+              apiVersion: rbac.authorization.k8s.io/v1
+              kind: ClusterRoleBinding
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: system:metrics-server
+              roleRef:
+                apiGroup: rbac.authorization.k8s.io
+                kind: ClusterRole
+                name: system:metrics-server
+              subjects:
+              - kind: ServiceAccount
+                name: metrics-server
+                namespace: kube-system
+              ---
+              apiVersion: v1
+              kind: Service
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: metrics-server
+                namespace: kube-system
+              spec:
+                ports:
+                - appProtocol: https
+                  name: https
+                  port: 443
+                  protocol: TCP
+                  targetPort: https
+                selector:
+                  k8s-app: metrics-server
+              ---
+              apiVersion: apps/v1
+              kind: Deployment
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: metrics-server
+                namespace: kube-system
+              spec:
+                selector:
+                  matchLabels:
+                    k8s-app: metrics-server
+                strategy:
+                  rollingUpdate:
+                    maxUnavailable: 0
+                template:
+                  metadata:
+                    labels:
+                      k8s-app: metrics-server
+                  spec:
+                    containers:
+                    - args:
+                      - --cert-dir=/tmp
+                      - --secure-port=10250
+                      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+                      - --kubelet-use-node-status-port
+                      - --metric-resolution=15s
+                      - --kubelet-insecure-tls
+                      image: registry.k8s.io/metrics-server/metrics-server:v0.8.0
+                      imagePullPolicy: IfNotPresent
+                      livenessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                          path: /livez
+                          port: https
+                          scheme: HTTPS
+                        periodSeconds: 10
+                      name: metrics-server
+                      ports:
+                      - containerPort: 10250
+                        name: https
+                        protocol: TCP
+                      readinessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                          path: /readyz
+                          port: https
+                          scheme: HTTPS
+                        initialDelaySeconds: 20
+                        periodSeconds: 10
+                      resources:
+                        requests:
+                          cpu: 100m
+                          memory: 200Mi
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                          drop:
+                          - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                          type: RuntimeDefault
+                      volumeMounts:
+                      - mountPath: /tmp
+                        name: tmp-dir
+                    nodeSelector:
+                      kubernetes.io/os: linux
+                    priorityClassName: system-cluster-critical
+                    serviceAccountName: metrics-server
+                    volumes:
+                    - emptyDir: {}
+                      name: tmp-dir
+              ---
+              apiVersion: apiregistration.k8s.io/v1
+              kind: APIService
+              metadata:
+                labels:
+                  k8s-app: metrics-server
+                name: v1beta1.metrics.k8s.io
+              spec:
+                group: metrics.k8s.io
+                groupPriorityMinimum: 100
+                insecureSkipTLSVerify: true
+                service:
+                  name: metrics-server
+                  namespace: kube-system
+                version: v1beta1
+                versionPriority: 100
+            name: metrics-server
+          - contents: |-
+              apiVersion: v1
+              kind: Service
+              metadata:
+                name: metrics-lb
+                namespace: kube-system
+                annotations:
+                  metallb.io/ip-allocated-from-pool: test-pool
+              spec:
+                type: LoadBalancer
+                ports:
+                - name: https
+                  port: 443
+                  protocol: TCP
+                  targetPort: https
+                selector:
+                  k8s-app: metrics-server
+            name: metrics-lb
+          - contents: |-
+              apiVersion: v1
+              data:
+                  Corefile: |
+                      .:53 {
+                          errors
+                          health {
+                              lameduck 5s
+                          }
+                          ready
+                          log . {
+                              class error
+                          }
+                          prometheus :9153
+
+                          kubernetes cluster.local in-addr.arpa ip6.arpa {
+                              pods insecure
+                              fallthrough in-addr.arpa ip6.arpa
+                              ttl 30
+                          }
+
+                          rewrite name git.dubyatp.xyz traefik-local.traefik.svc.cluster.local
+                          
+                          forward . /etc/resolv.conf {
+                            max_concurrent 1000
+                          }
+                          cache 30 {
+                            disable success cluster.local
+                            disable denial cluster.local
+                          }
+                          loop
+                          reload
+                          loadbalance
+                      }
+              kind: ConfigMap
+              metadata:
+                  name: coredns
+                  namespace: kube-system
+            name: coredns-config
+---
+kind: ControlPlane
+machines:
+  - 20b4c826-e699-43b3-826d-73eb5173680b
+  - 5fdea709-56ad-45f2-966d-5e344dbe4fdf
+  - 30303031-3030-3030-6335-303731636600
+---
+kind: Workers
+machines:
+  - 02c02200-f403-11ef-9372-70f446672600
+  - 03000200-0400-0500-0006-000700080009
+  - 1006b91a-ecbf-11ea-aed4-046ba1ee3700
+  - 5f0cd701-0784-4fcc-8e52-3b3304049972
+  - da507021-8912-4337-86a3-94a05bd1cf05
+---
+kind: Machine
+name: 02c02200-f403-11ef-9372-70f446672600
+patches:
+  - idOverride: 400-cm-02c02200-f403-11ef-9372-70f446672600
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-w02
+          interfaces:
+            - deviceSelector:
+                driver: igc
+                hardwareAddr: e8:ff:1e:d4:b8:89
+              dhcp: true
+              vlans:
+                - dhcp: false
+                  vlanId: 50
+            - deviceSelector:
+                hardwareAddr: e8:ff:1e:d4:b8:8a
+              dhcp: true
+              mtu: 9000
+            - bridge:
+                interfaces:
+                  - enp1s0.50
+              dhcp: false
+              interface: br0
+---
+kind: Machine
+name: 03000200-0400-0500-0006-000700080009
+patches:
+  - idOverride: 400-cm-03000200-0400-0500-0006-000700080009
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-testw01
+          interfaces:
+            - deviceSelector:
+                driver: igc
+                hardwareAddr: e8:ff:1e:d5:f8:22
+              dhcp: true
+              vlans:
+                - dhcp: false
+                  vlanId: 50
+            - deviceSelector:
+                hardwareAddr: e8:ff:1e:d5:f8:21
+              dhcp: true
+              mtu: 9000
+            - bridge:
+                interfaces:
+                  - enp2s0.50
+              dhcp: false
+              interface: br0
+---
+kind: Machine
+name: 1006b91a-ecbf-11ea-aed4-046ba1ee3700
+patches:
+  - idOverride: 400-cm-1006b91a-ecbf-11ea-aed4-046ba1ee3700
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-testw04
+          interfaces:
+            - deviceSelector:
+                driver: mlx4_core
+                hardwareAddr: f4:52:14:60:5e:30
+              dhcp: true
+              vlans:
+                - dhcp: false
+                  vlanId: 50
+            - deviceSelector:
+                hardwareAddr: f4:52:14:60:5e:31
+              dhcp: true
+              mtu: 9000
+            - bridge:
+                interfaces:
+                  - eno1.50
+              dhcp: false
+              interface: br0
+---
+kind: Machine
+name: 30303031-3030-3030-6335-303731636600
+patches:
+  - idOverride: 400-cm-30303031-3030-3030-6335-303731636600
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-cp04
+          interfaces:
+            - deviceSelector:
+                hardwareAddr: dc:a6:32:95:0f:cb
+              dhcp: true
+---
+kind: Machine
+name: 20b4c826-e699-43b3-826d-73eb5173680b
+patches:
+  - idOverride: 400-cm-20b4c826-e699-43b3-826d-73eb5173680b
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-cp02
+          interfaces:
+            - deviceSelector:
+                driver: virtio*
+                hardwareAddr: 00:16:3e:9c:01:27
+              dhcp: true
+---
+kind: Machine
+name: 5f0cd701-0784-4fcc-8e52-3b3304049972
+patches:
+  - idOverride: 400-cm-5f0cd701-0784-4fcc-8e52-3b3304049972
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-testw05
+          interfaces:
+            - deviceSelector:
+                hardwareAddr: 00:16:3e:b3:dd:f8
+              dhcp: true
+            - deviceSelector:
+                hardwareAddr: 00:16:3e:e5:79:0a
+              dhcp: true
+              mtu: 9000
+            - deviceSelector:
+                hardwareAddr: 00:16:3e:6b:1c:1d
+              dhcp: false
+            - bridge:
+                interfaces:
+                  - enx00163e6b1c1d
+              dhcp: false
+              interface: br0
+---
+kind: Machine
+systemExtensions:
+  - siderolabs/nut-client
+  - siderolabs/qemu-guest-agent
+name: 5fdea709-56ad-45f2-966d-5e344dbe4fdf
+patches:
+  - idOverride: 400-cm-5fdea709-56ad-45f2-966d-5e344dbe4fdf
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-cp01
+          interfaces:
+            - deviceSelector:
+                driver: virtio*
+                hardwareAddr: bc:24:11:e6:ff:7b
+              dhcp: true
+---
+kind: Machine
+name: da507021-8912-4337-86a3-94a05bd1cf05
+patches:
+  - idOverride: 400-cm-da507021-8912-4337-86a3-94a05bd1cf05
+    annotations:
+      name: ""
+    inline:
+      machine:
+        network:
+          hostname: weyma-talos-w03
+          interfaces:
+            - deviceSelector:
+                driver: virtio*
+                hardwareAddr: bc:24:11:be:6c:08
+              dhcp: true
+            - deviceSelector:
+                driver: virtio*
+                hardwareAddr: bc:24:11:f8:4a:92
+              dhcp: true
+              mtu: 8996
+            - deviceSelector:
+                driver: virtio*
+                hardwareAddr: bc:24:11:93:02:0e
+              dhcp: false
+            - bridge:
+                interfaces:
+                  - enxbc241193020e
+              dhcp: false
+              interface: br0

renovate.json

@@ -14,6 +14,11 @@
     }
   ],
   "packageRules": [
+    {
+      "description": "Consolidate patch and minor updates to one PR",
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "all-minor-patch-updates"
+    },
     {
       "description": "Rook Ceph - auto-update minor and patch versions only",
       "matchDatasources": ["docker"],

system-apps/argocd/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: argo-cd
-  version: 9.1.4
+  version: 10.2.1
   repository: https://argoproj.github.io/argo-helm

system-apps/argocd/values.yaml

@@ -56,18 +56,6 @@ argo-cd:
                Argo CD has not reported any applications data for the past 15 minutes which
                means that it must be down or not functioning properly.  This needs to be
                resolved for this cloud to continue to maintain state.
-         - alert: ArgoAppNotSynced
-           expr: |
-             argocd_app_info{sync_status!="Synced"} == 1
-           for: 12h
-           labels:
-             severity: warning
-           annotations:
-             summary: "[{{`{{$labels.name}}`}}] Application not synchronized"
-             description: >
-               The application [{{`{{$labels.name}}`}} has not been synchronized for over
-               12 hours which means that the state of this cloud has drifted away from the
-               state inside Git.
   server:
     ingress:
       enabled: true
@@ -140,18 +128,34 @@ argo-cd:
           remoteRef:
             key: argo-cd
             property: webhook.gitea.secret
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: admin.password
           remoteRef:
             key: argo-cd
             property: admin.password
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: admin.passwordMtime
           remoteRef:
             key: argo-cd
             property: admin.passwordMtime
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: dex.authentik.clientSecret
           remoteRef:
             key: argo-cd
             property: dex.authentik.clientSecret
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
@@ -172,14 +176,26 @@ argo-cd:
           remoteRef:
             key: argo-cd-git
             property: sshPrivateKey
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: type
           remoteRef:
             key: argo-cd-git
             property: type
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: url
           remoteRef:
             key: argo-cd-git
             property: url.core-apps
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
@@ -200,14 +216,26 @@ argo-cd:
           remoteRef:
             key: argo-cd-git
             property: sshPrivateKey
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: type
           remoteRef:
             key: argo-cd-git
             property: type
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: url
           remoteRef:
             key: argo-cd-git
             property: url.weyma-talos
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
@@ -228,14 +256,26 @@ argo-cd:
           remoteRef:
             key: argo-cd-git
             property: sshPrivateKey
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: type
           remoteRef:
             key: argo-cd-git
             property: type
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: url
           remoteRef:
             key: argo-cd-git
             property: url.williamp-sites
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
@@ -256,11 +296,23 @@ argo-cd:
           remoteRef:
             key: argo-cd-git
             property: sshPrivateKey
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: type
           remoteRef:
             key: argo-cd-git
             property: type
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore
         - secretKey: url
           remoteRef:
             key: argo-cd-git
             property: url.db-operators
+            conversionStrategy: Default
+            decodingStrategy: None
+            metadataPolicy: None
+            nullBytePolicy: Ignore

system-apps/cert-manager/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: cert-manager
-  version: v1.19.1
+  version: v1.21.0
   repository: https://charts.jetstack.io

system-apps/cert-manager/config/ReferenceGrants/argocd.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: argocd
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: argocd
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/attic.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: attic
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: attic
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/authentik.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: authentik
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: authentik
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/duby-blog.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: duby-blog
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: duby-blog
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/dubyatp-xyz.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: dubyatp-xyz
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: dubyatp-xyz
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/frenworld-archive.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: frenworld-archive
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: frenworld-archive
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-frenworld-archive-io

system-apps/cert-manager/config/ReferenceGrants/gitea.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gitea
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: gitea
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/grafana.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: grafana
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: grafana
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/jellyfin.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: jellyfin
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: jellyfin
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/kite.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: kite
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: kite
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/lumfao-dubyatp-xyz.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: lumfao-dubyatp-xyz
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: lumfao-dubyatp-xyz
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/netmaker.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: netmaker
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: netmaker
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/nextcloud.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: nextcloud
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: nextcloud
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/rook-ceph.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: rook-ceph
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: rook-ceph
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/test.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: test-dubyatp-xyz
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: default
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/traefik.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: traefik
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: traefik
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/vaultwarden.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: vaultwarden
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: vaultwarden
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/whatismyip.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: whatismyip
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: whatismyip
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-dubyatp-xyz

system-apps/cert-manager/config/ReferenceGrants/williamtpeebles-com.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: williamtpeebles-com
+  namespace: cert-manager
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: williamtpeebles-com
+  to:
+  - group: ""
+    kind: Secret
+    name: cert-williamtpeebles-com

system-apps/external-secrets/chart/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: external-secrets
-  version: 1.1.0
+  version: 2.8.0
   repository: https://charts.external-secrets.io

system-apps/guestbook/guestbook-ui-deployment.yaml

@@ -1,21 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: guestbook-ui
-  namespace: guestbook-ui
-spec:
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app: guestbook-ui
-  template:
-    metadata:
-      labels:
-        app: guestbook-ui
-    spec:
-      containers:
-      - image: gcr.io/heptio-images/ks-guestbook-demo:0.2
-        name: guestbook-ui
-        ports:
-        - containerPort: 80

system-apps/guestbook/guestbook-ui-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name:  guestbook-ui

system-apps/guestbook/guestbook-ui-svc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: guestbook-ui
-  namespace: guestbook-ui
-spec:
-  ports:
-  - port: 80
-    targetPort: 80
-  selector:
-    app: guestbook-ui

system-apps/kite/Chart.yaml

@@ -0,0 +1,28 @@
+apiVersion: v2
+name: kite
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: "1.0"
+
+dependencies:
+- name: kite
+  version: 0.14.1
+  repository: https://zxh326.github.io/kite

system-apps/kite/templates/secrets.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: kite-secret
+  namespace: {{ .Release.Namespace }}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: weyma-vault
+    kind: ClusterSecretStore
+  target:
+    name: kite-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: JWT_SECRET
+    remoteRef:
+      key: kite
+      property: JWT_SECRET
+  - secretKey: KITE_ENCRYPT_KEY
+    remoteRef:
+      key: kite
+      property: KITE_ENCRYPT_KEY
+  - secretKey: KITE_PASSWORD
+    remoteRef:
+      key: kite
+      property: KITE_PASSWORD
+  - secretKey: KITE_USERNAME
+    remoteRef:
+      key: kite
+      property: KITE_USERNAME

system-apps/kite/values.yaml

@@ -0,0 +1,22 @@
+kite:
+  host: "https://weyma-kite.infra.dubyatp.xyz"
+  deploymentStrategy:
+    type: Recreate
+  secret:
+    create: false
+    existingSecret: kite-secret
+  db:
+    sqlite:
+      persistence:
+        pvc:
+          enabled: true
+  ingress:
+    enabled: true
+    className: "traefik"
+    hosts:
+      - host: weyma-kite.infra.dubyatp.xyz
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+  podAnnotations:
+    backup.velero.io/backup-volumes: kite-storage

system-apps/kubernetes-replicator/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: kubernetes-replicator
-  version: 2.12.2
+  version: 2.12.4
   repository: https://helm.mittwald.de

system-apps/metallb/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: metallb
-  version: 0.15.2
+  version: 0.16.1
   repository: https://metallb.github.io/metallb

system-apps/metallb/values.yaml

@@ -1,4 +1,6 @@
 metallb:
+  frrk8s:
+    enabled: false
   prometheus:
     rbacPrometheus: false
     podMonitor:

system-apps/monitoring/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: kube-prometheus-stack
-  version: 79.8.2
+  version: 87.19.1
   repository: https://prometheus-community.github.io/helm-charts

system-apps/monitoring/templates/discord-webhook-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: discord-webhook
+  namespace: {{ .Release.Namespace }}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: weyma-vault
+    kind: ClusterSecretStore
+  target:
+    name: discord-webhook
+    creationPolicy: Owner
+  data:
+  - secretKey: webhook
+    remoteRef:
+      conversionStrategy: Default
+      decodingStrategy: None
+      metadataPolicy: None
+      nullBytePolicy: Ignore
+      key: monitoring
+      property: discord_webhook

system-apps/monitoring/templates/discord.yaml

@@ -0,0 +1,67 @@
+{{- if .Values.discord.enabled }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alertmanager-discord
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: alertmanager-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: alertmanager-discord
+  template:
+    metadata:
+      labels:
+        app: alertmanager-discord
+    spec:
+      containers:
+        - name: alertmanager-discord
+          image: {{ .Values.discord.image | default "ghcr.io/rogerrum/alertmanager-discord:1.0.7" }}
+          ports:
+            - containerPort: 9094
+          env:
+            - name: LISTEN_ADDRESS
+              value: "0.0.0.0:9094"
+            - name: DISCORD_WEBHOOK
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.discord.secret.name | quote }}
+                  key: {{ .Values.discord.secret.key | quote }}
+            {{- if .Values.discord.username }}
+            - name: DISCORD_USERNAME
+              value: {{ .Values.discord.username | quote }}
+            {{- end }}
+            {{- if .Values.discord.avatar_url }}
+            - name: DISCORD_AVATAR_URL
+              value: {{ .Values.discord.avatar_url | quote }}
+            {{- end }}
+            {{- if .Values.discord.verbose }}
+            - name: VERBOSE
+              value: "ON"
+            {{- end }}
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "500m"
+            limits:
+              memory: "512Mi"
+              cpu: "1"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: alertmanager-discord
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: alertmanager-discord
+  ports:
+    - port: 9094
+      targetPort: 9094
+      protocol: TCP
+{{- end }}

system-apps/monitoring/values.yaml

@@ -1,5 +1,23 @@
 kube-prometheus-stack:
   alertmanager:
+    config:
+      route:
+        group_by: ['namespace']
+        group_wait: 30s
+        group_interval: 5m
+        repeat_interval: 12h
+        receiver: 'null'
+        routes:
+        - receiver: "discord_webhook"
+          matchers:
+            - severity = "critical"
+          continue: false
+        - receiver: 'null'
+      receivers:
+      - name: "null"
+      - name: "discord_webhook"
+        webhook_configs:
+          - url: "http://alertmanager-discord:9094"
     alertmanagerSpec:
       storage:
         volumeClaimTemplate:
@@ -9,6 +27,19 @@ kube-prometheus-stack:
             resources:
               requests:
                 storage: 50Gi
+  additionalPrometheusRulesMap:
+    rule-name:
+      groups:
+        - name: AdditionalAlerts
+          rules:
+            - alert: ExcessiveWarnings
+              expr: count(ALERTS{severity="warning",alertstate="firing"}) >= 5
+              for: 1m
+              labels:
+                severity: critical
+              annotations:
+                summary: Excessive 'warning' alerts are firing in the cluster
+                description: "{{ $value }} alerts with 'warning' severity are firing and could be a sign of catastrophic failure in the cluster"
   prometheusOperator:
     admissionWebhooks:
       certManager:
@@ -40,3 +71,10 @@ kube-prometheus-stack:
                 storage: 50Gi
   grafana:
     enabled: false # Grafana is instead deployed in its own namespace in the core-apps repo
+discord:
+  enabled: true
+  secret:
+    name: discord-webhook
+    key: webhook
+  username: "Alertmanager"
+  verbose: true

system-apps/multus/daemonset.yaml

@@ -35,10 +35,10 @@ spec:
           resources:
             requests:
               cpu: "100m"
-              memory: "50Mi"
+              memory: "64Mi"
             limits:
-              cpu: "100m"
+              cpu: "200m"
-              memory: "50Mi"
+              memory: "256Mi"
           securityContext:
             privileged: true
           terminationMessagePolicy: FallbackToLogsOnError

system-apps/rook-ceph/clusters/cluster.yaml

@@ -21,7 +21,7 @@ spec:
     # versions running within the cluster. See tags available at https://hub.docker.com/r/ceph/ceph/tags/.
     # If you want to be more precise, you can always use a timestamp tag such as quay.io/ceph/ceph:v19.2.1-20250202
     # This tag might not contain a new Ceph version, just security fixes from the underlying operating system, which will reduce vulnerabilities
-    image: quay.io/ceph/ceph:v19.2.3-20250717
+    image: quay.io/ceph/ceph:v20.2.0-20251104
     # Whether to allow unsupported versions of Ceph. Currently Reef and Squid are supported.
     # Future versions such as Tentacle (v20) would require this to be set to `true`.
     # Do not set to true in production.

system-apps/rook-ceph/operator/Chart.yaml

@@ -24,5 +24,8 @@ appVersion: "1.0"
 
 dependencies:
 - name: rook-ceph
-  version: v1.18.7
+  version: v1.20.2
   repository: https://charts.rook.io/release
+- name: ceph-csi-drivers
+  version: 1.0.4
+  repository: https://ceph.github.io/ceph-csi-operator

system-apps/rook-ceph/operator/templates/rules.yaml

@@ -497,61 +497,6 @@ spec:
             oid: "1.3.6.1.4.1.50495.1.2.1.8.1"
             severity: "critical"
             type: "ceph_default"
-        - alert: "CephNodeNetworkPacketDrops"
-          annotations:
-            description: "Node {{ "{{" }} $labels.instance {{ "}}" }} experiences packet drop > 0.5% or > 10 packets/s on interface {{ "{{" }} $labels.device {{ "}}" }}."
-            summary: "One or more NICs reports packet drops"
-          expr: |
-            (
-              rate(node_network_receive_drop_total{device!="lo"}[1m]) +
-              rate(node_network_transmit_drop_total{device!="lo"}[1m])
-            ) / (
-              rate(node_network_receive_packets_total{device!="lo"}[1m]) +
-              rate(node_network_transmit_packets_total{device!="lo"}[1m])
-            ) >= 0.0050000000000000001 and (
-              rate(node_network_receive_drop_total{device!="lo"}[1m]) +
-              rate(node_network_transmit_drop_total{device!="lo"}[1m])
-            ) >= 10
-          labels:
-            oid: "1.3.6.1.4.1.50495.1.2.1.8.2"
-            severity: "warning"
-            type: "ceph_default"
-        - alert: "CephNodeNetworkPacketErrors"
-          annotations:
-            description: "Node {{ "{{" }} $labels.instance {{ "}}" }} experiences packet errors > 0.01% or > 10 packets/s on interface {{ "{{" }} $labels.device {{ "}}" }}."
-            summary: "One or more NICs reports packet errors"
-          expr: |
-            (
-              rate(node_network_receive_errs_total{device!="lo"}[1m]) +
-              rate(node_network_transmit_errs_total{device!="lo"}[1m])
-            ) / (
-              rate(node_network_receive_packets_total{device!="lo"}[1m]) +
-              rate(node_network_transmit_packets_total{device!="lo"}[1m])
-            ) >= 0.0001 or (
-              rate(node_network_receive_errs_total{device!="lo"}[1m]) +
-              rate(node_network_transmit_errs_total{device!="lo"}[1m])
-            ) >= 10
-          labels:
-            oid: "1.3.6.1.4.1.50495.1.2.1.8.3"
-            severity: "warning"
-            type: "ceph_default"
-        - alert: "CephNodeNetworkBondDegraded"
-          annotations:
-            description: "Bond {{ "{{" }} $labels.master {{ "}}" }} is degraded on Node {{ "{{" }} $labels.instance {{ "}}" }}."
-            summary: "Degraded Bond on Node {{ "{{" }} $labels.instance {{ "}}" }}"
-          expr: |
-            node_bonding_slaves - node_bonding_active != 0
-          labels:
-            severity: "warning"
-            type: "ceph_default"
-        - alert: "CephNodeInconsistentMTU"
-          annotations:
-            description: "Node {{ "{{" }} $labels.instance {{ "}}" }} has a different MTU size ({{ "{{" }} $value {{ "}}" }}) than the median of devices named {{ "{{" }} $labels.device {{ "}}" }}."
-            summary: "MTU settings across Ceph hosts are inconsistent"
-          expr: "node_network_mtu_bytes * (node_network_up{device!=\"lo\"} > 0) ==  scalar(    max by (device) (node_network_mtu_bytes * (node_network_up{device!=\"lo\"} > 0)) !=      quantile by (device) (.5, node_network_mtu_bytes * (node_network_up{device!=\"lo\"} > 0))  )or node_network_mtu_bytes * (node_network_up{device!=\"lo\"} > 0) ==  scalar(    min by (device) (node_network_mtu_bytes * (node_network_up{device!=\"lo\"} > 0)) !=      quantile by (device) (.5, node_network_mtu_bytes * (node_network_up{device!=\"lo\"} > 0))  )"
-          labels:
-            severity: "warning"
-            type: "ceph_default"
     - name: "pools"
       rules:
         - alert: "CephPoolGrowthWarning"

system-apps/rook-ceph/operator/values.yaml

@@ -1,2 +1,12 @@
 monitoring:
   enabled: true
+ceph-csi-drivers:
+  drivers:
+    rbd:
+      name: rook-ceph.rbd.csi.ceph.com
+    cephfs:
+      name: rook-ceph.cephfs.csi.ceph.com
+    nvmeof:
+      enabled: false
+    nfs:
+      enabled: false

system-apps/traefik/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: traefik
-  version: 37.4.0
+  version: 41.0.2
   repository: https://traefik.github.io/charts

system-apps/traefik/values.yaml

@@ -4,18 +4,17 @@ traefik:
     - --entryPoints.websecure.transport.respondingTimeouts.readTimeout=0
   ports:
     web:
-      redirections:
+      http:
-        entryPoint:
+        redirections:
-          to: websecure
+          entryPoint:
-          scheme: https
+            to: websecure
-          permanent: true
+            scheme: https
+            permanent: true
     gitssh:
       port: 2222
       exposedPort: 22
       expose:
         default: true
-      tls:
-        passthrough: true
   metrics:
     prometheus:
       service:
@@ -30,7 +29,7 @@ traefik:
             for: 5m
             labels:
               context: traefik
-              severity: warning
+              severity: critical
             annotations:
               summary: "Traefik Down"
               description: "{{ $labels.pod }} on {{ $labels.nodename }} is down"
@@ -38,7 +37,7 @@ traefik:
     kind: DaemonSet
     additionalContainers:
     - name: cloudflared
-      image: cloudflare/cloudflared:2025.11.1
+      image: cloudflare/cloudflared:2026.7.3
       command:
         - cloudflared
         - tunnel
@@ -70,10 +69,12 @@ traefik:
     dashboard:
       enabled: true
   providers:
+    kubernetesGateway:
+      enabled: true
     file:
       enabled: true
       watch: true
-      content: |
+      content:
         http:
           middlewares:
             cloudflarewarp:
@@ -81,6 +82,19 @@ traefik:
                 traefik-real-ip:
                   excludednets:
                     - "1.1.1.1/24"
+          routers:
+            dispatcharr:
+              entryPoints:
+              - websecure
+              service: dispatcharr
+              tls:
+                options: default
+              rule: 'Host(`dispatcharr.dubyatp.xyz`) && PathPrefix(`/`)'
+          services:
+            dispatcharr:
+              loadBalancer:
+                servers:
+                - url: http://10.105.15.20:9191
   service:
     spec:
       externalTrafficPolicy: Local
@@ -117,3 +131,26 @@ traefik:
     data:
       tls.crt: ""
       tls.key: ""
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: traefik-local
+    spec:
+      sessionAffinity: ClientIP
+      sessionAffinityConfig:
+        clientIP:
+          timeoutSeconds: 3600
+      selector:
+        app.kubernetes.io/name: traefik
+        app.kubernetes.io/instance: traefik-traefik
+      ports:
+      - name: gitssh
+        port: 22
+        targetPort: gitssh
+      - name: web
+        port: 80
+        targetPort: web
+      - name: websecure
+        port: 443
+        targetPort: websecure
+      type: ClusterIP

system-apps/velero/Chart.yaml

@@ -24,5 +24,5 @@ appVersion: "1.0"
 
 dependencies:
 - name: velero
-  version: 11.2.0
+  version: 12.1.0
   repository: https://vmware-tanzu.github.io/helm-charts

system-apps/velero/values.yaml

@@ -2,8 +2,48 @@ velero:
   backupsEnabled: true
   snapshotsEnabled: false
   metrics:
-    labels:
+    serviceMonitor:
-      metrics_enabled: "true"
+      enabled: true
+    prometheusRule:
+      enabled: true
+      spec:
+      - alert: VeleroBackupFailed
+        annotations:
+          message: Velero backup {{ $labels.schedule }} has failed
+        expr: |-
+          velero_backup_last_status{schedule!=""} != 1
+        for: 15m
+        labels:
+          severity: warning
+      - alert: VeleroBackupFailing
+        annotations:
+          message: Velero backup {{ $labels.schedule }} has been failing for the last 12h
+        expr: |-
+          velero_backup_last_status{schedule!=""} != 1
+        for: 12h
+        labels:
+          severity: critical
+      - alert: VeleroNoNewBackup
+        annotations:
+          message: Velero backup {{ $labels.schedule }} has not run successfully in the last 25h
+        expr: |-
+          (
+          (time() - velero_backup_last_successful_timestamp{schedule!=""}) >bool (25 * 3600)
+          or
+          absent(velero_backup_last_successful_timestamp{schedule!=""})
+          ) == 1
+        for: 1h
+        labels:
+          severity: critical
+      - alert: VeleroBackupPartialFailures
+        annotations:
+          message: Velero backup {{ $labels.schedule }} has {{ $value | humanizePercentage }} partialy failed backups
+        expr: |-
+          rate(velero_backup_partial_failure_total{schedule!=""}[25m])
+            / rate(velero_backup_attempt_total{schedule!=""}[25m]) > 0.5
+        for: 15m
+        labels:
+          severity: warning
   configuration:
     backupStorageLocation:
     - name: weyma-truenas
@@ -19,7 +59,7 @@ velero:
         insecureSkipTLSVerify: "true"
   initContainers:
   - name: velero-plugin-for-aws
-    image: velero/velero-plugin-for-aws:v1.13.1
+    image: velero/velero-plugin-for-aws:v1.14.2
     imagePullPolicy: IfNotPresent
     volumeMounts:
       - mountPath: /target