From 5a591f145d305d2732b7fb4e49a17c87d6b21696 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Mon, 1 Jun 2026 10:14:17 +0200 Subject: [PATCH] Reset git history for making manifests public --- README.md | 182 + argocd/applications/arrstack.yaml | 23 + argocd/applications/authentik.yaml | 23 + argocd/applications/bentopdf.yaml | 21 + argocd/applications/databasus.yaml | 20 + argocd/applications/ddns.yaml | 20 + argocd/applications/excalidraw.yaml | 23 + argocd/applications/gitea.yaml | 29 + argocd/applications/gotify.yaml | 28 + argocd/applications/immich.yaml | 24 + argocd/applications/infisical.yaml | 25 + argocd/applications/intel-gpu.yaml | 20 + argocd/applications/intel-nfd-rules.yaml | 20 + argocd/applications/intel-nfd.yaml | 22 + argocd/applications/it-tools.yaml | 24 + argocd/applications/jellyfin.yaml | 20 + argocd/applications/minio-aistor.yaml | 20 + argocd/applications/netbootxyz.yaml | 21 + argocd/applications/passbolt.yaml | 22 + argocd/applications/proxmox.yaml | 21 + argocd/applications/reactive-resume.yaml | 23 + argocd/applications/searxng.yaml | 28 + argocd/applications/seerr.yaml | 20 + argocd/applications/technitium.yaml | 24 + argocd/applications/truenas.yaml | 24 + argocd/applications/unifi.yaml | 23 + argocd/applications/uptime-kuma.yaml | 23 + argocd/applications/victoria-metrics.yaml | 34 + argocd/applications/zipline.yaml | 22 + argocd/argocd-install.yaml | 28219 ++++++++++++++++ argocd/httproute.yaml | 46 + .../arrstack-vpn-services-endpointslice.yaml | 38 + arrstack/prowlarr-httproute.yaml | 46 + arrstack/radarr-httproute.yaml | 48 + arrstack/radarr/radarr-pvc.yaml | 12 + arrstack/radarr/radarr-svc.yaml | 14 + arrstack/radarr/radarr.yaml | 61 + arrstack/smb-download.yaml | 34 + arrstack/smb-media.yaml | 33 + arrstack/sonarr-httproute.yaml | 28 + arrstack/sonarr/sonarr-pvc.yaml | 12 + arrstack/sonarr/sonarr.yaml | 67 + arrstack/sonarr/sonarrr-svc.yaml | 14 + arrstack/torrent-httproute.yaml | 46 + authentik/httproute.yaml | 51 + authentik/postgres/pvc.yaml | 12 + authentik/postgres/service.yaml | 11 + authentik/postgres/statefulset.yaml | 52 + authentik/server/deployment.yaml | 106 + authentik/server/pvc.yaml | 12 + authentik/server/service.yaml | 15 + authentik/worker/deployment.yaml | 107 + authentik/worker/pvc.yaml | 12 + azure-ddns-python/azure-ddns-svc.yaml | 14 + azure-ddns-python/azure-ddns.yaml | 54 + bentopdf/bentopdf-svc.yaml | 13 + bentopdf/bentopdf.yaml | 29 + bentopdf/httproute.yaml | 51 + cert-manager/azure-dns-certs.yaml | 33 + cloud-native-postgres/values.yaml | 692 + comfyui/comfyui-pvc.yaml | 12 + comfyui/comfyui-svc.yaml | 13 + comfyui/comfyui.yaml | 44 + databasus/databasus-ns.yaml | 4 + databasus/databasus-pvc.yaml | 12 + databasus/databasus-statefulset.yaml | 38 + databasus/databasus-svc.yaml | 13 + databasus/httproute.yaml | 46 + .../argocd-ingress.yaml | 29 + .../bentopdf-ingress.yaml | 26 + .../gitea-ingress.yaml | 29 + .../infisical-ingress.yaml | 28 + .../it-tools-ingress.yaml | 26 + .../jellyseer-ingress.yaml | 29 + .../jenkins-ingress.yaml | 28 + .../jenkins-svc-ingress.yaml | 13 + .../longhorn-ingress.yaml | 27 + .../minio-ingress-webui.yaml | 26 + .../minio-ingress.yaml | 26 + .../nginx-ingress-controller/n8n-ingress.yaml | 26 + .../netbootxyz-ingress.yaml | 26 + .../passbolt-ingress.yaml | 26 + .../proxmox-ingress.yaml | 26 + .../radarr-ingress.yaml | 30 + .../resume-ingress.yaml | 26 + .../sonarr-ingress.yaml | 30 + .../technitium-ingress.yaml | 28 + .../technitium-ingress.yml | 27 + .../truenas-ingress.yaml | 28 + .../unifi-ingress.yaml | 26 + .../wiki-ingress.yaml | 26 + .../zipline-ingress.yaml | 28 + .../psono/envoy-gateway/certificate.yaml | 14 + .../psono/envoy-gateway/gateway-patch.yaml | 19 + deprecated/psono/httproute.yaml | 46 + deprecated/psono/infisical/psono.yaml | 22 + deprecated/psono/namespace.yaml | 4 + .../psono/postgres/postgres-statefulset.yaml | 46 + deprecated/psono/postgres/postgresql-pvc.yaml | 12 + deprecated/psono/postgres/postgresql-svc.yaml | 14 + deprecated/psono/pvc.yaml | 12 + deprecated/psono/settings-configmap.yaml | 254 + deprecated/psono/statefulset.yaml | 88 + deprecated/vaultwarden/httproute.yaml | 46 + deprecated/vaultwarden/namespace.yaml | 4 + deprecated/vaultwarden/pvc.yaml | 12 + deprecated/vaultwarden/statefulset.yaml | 120 + envoy-gateway/argocd/certificate.yaml | 14 + envoy-gateway/argocd/gateway-patch.yaml | 19 + .../arrstack/radarr-certificate.yaml | 14 + .../arrstack/radarr-gateway-patch.yaml | 19 + .../arrstack/sonarr-certificate.yaml | 14 + .../arrstack/sonarr-gateway-patch.yaml | 19 + envoy-gateway/authentik/certificate.yaml | 14 + envoy-gateway/authentik/gateway-patch.yaml | 19 + .../authentik/gateway-public-patch.yaml | 19 + envoy-gateway/bentopdf/certificate.yaml | 14 + envoy-gateway/bentopdf/gateway-patch.yaml | 19 + .../bentopdf/gateway-public-patch.yaml | 19 + envoy-gateway/clientsettingspolicies.yaml | 21 + envoy-gateway/databasus/certificate.yaml | 14 + envoy-gateway/databasus/gateway-patch.yaml | 19 + envoy-gateway/excalidraw/certificate.yaml | 14 + envoy-gateway/excalidraw/gateway-patch.yaml | 19 + .../excalidraw/gateway-public-patch.yaml | 19 + envoy-gateway/gateway-public.yaml | 11 + envoy-gateway/gateway.yaml | 11 + envoy-gateway/gitea/certificate.yaml | 14 + envoy-gateway/gitea/gateway-patch.yaml | 19 + envoy-gateway/gitea/gateway-public-patch.yaml | 19 + envoy-gateway/gotify/certificate.yaml | 14 + envoy-gateway/gotify/gateway-patch.yaml | 19 + .../gotify/gateway-public-patch.yaml | 19 + envoy-gateway/httproute-template.yaml | 68 + envoy-gateway/immich/certificate.yaml | 14 + envoy-gateway/immich/gateway-patch.yaml | 19 + .../immich/gateway-public-patch.yaml | 19 + envoy-gateway/infisical/certificate.yaml | 14 + envoy-gateway/infisical/gateway-patch.yaml | 19 + envoy-gateway/it-tools/certificate.yaml | 14 + envoy-gateway/it-tools/gateway-patch.yaml | 19 + .../it-tools/gateway-public-patch.yaml | 19 + envoy-gateway/jellyfin/certificate.yaml | 14 + envoy-gateway/jellyfin/gateway-patch.yaml | 19 + .../jellyfin/gateway-public-patch.yaml | 19 + envoy-gateway/jenkins/certificate.yaml | 14 + envoy-gateway/jenkins/gateway-patch.yaml | 19 + envoy-gateway/kustomization.yaml | 372 + envoy-gateway/longhorn/certificate.yaml | 14 + envoy-gateway/longhorn/gateway-patch.yaml | 19 + .../minio-aistor/api-certificate.yaml | 14 + .../minio-aistor/api-gateway-patch.yaml | 19 + .../minio-aistor/console-certificate.yaml | 14 + .../minio-aistor/console-gateway-patch.yaml | 19 + envoy-gateway/monitoring/certificate.yaml | 44 + envoy-gateway/monitoring/gateway-patch.yaml | 57 + .../grafana-gateway-public-patch.yaml | 19 + envoy-gateway/n8n/certificate.yaml | 14 + envoy-gateway/n8n/gateway-patch.yaml | 19 + envoy-gateway/netbootxyz/certificate.yaml | 14 + envoy-gateway/netbootxyz/gateway-patch.yaml | 19 + envoy-gateway/ollama/certificate.yaml | 14 + envoy-gateway/ollama/gateway-patch.yaml | 19 + envoy-gateway/openwebui/certificate.yaml | 14 + envoy-gateway/openwebui/gateway-patch.yaml | 19 + envoy-gateway/passbolt/certificate.yaml | 14 + envoy-gateway/passbolt/gateway-patch.yaml | 19 + .../passbolt/gateway-public-patch.yaml | 19 + envoy-gateway/prowlarr/certificate.yaml | 14 + envoy-gateway/prowlarr/gateway-patch.yaml | 19 + envoy-gateway/proxmox/certificate.yaml | 14 + envoy-gateway/proxmox/gateway-patch.yaml | 19 + envoy-gateway/resume/minio-certificate.yaml | 14 + envoy-gateway/resume/minio-gateway-patch.yaml | 19 + .../resume/minio-webui-certificate.yaml | 14 + .../resume/minio-webui-gateway-patch.yaml | 19 + envoy-gateway/resume/resume-certificate.yaml | 14 + .../resume/resume-gateway-patch.yaml | 19 + .../resume/resume-gateway-public-patch.yaml | 19 + envoy-gateway/searxng/certificate.yaml | 14 + envoy-gateway/searxng/gateway-patch.yaml | 19 + .../searxng/gateway-public-patch.yaml | 19 + envoy-gateway/seerr/certificate.yaml | 14 + envoy-gateway/seerr/gateway-patch.yaml | 19 + .../technitium-backup-certificate.yaml | 14 + .../technitium-backup-gateway-patch.yaml | 19 + .../technitium/technitium-certificate.yaml | 14 + .../technitium/technitium-gateway-patch.yaml | 19 + envoy-gateway/torrent/certificate.yaml | 14 + envoy-gateway/torrent/gateway-patch.yaml | 19 + envoy-gateway/truenas/certificate.yaml | 14 + envoy-gateway/truenas/gateway-patch.yaml | 19 + envoy-gateway/unifi/certificate.yaml | 14 + envoy-gateway/unifi/gateway-patch.yaml | 19 + envoy-gateway/uptime-kuma/certificate.yaml | 14 + envoy-gateway/uptime-kuma/gateway-patch.yaml | 19 + envoy-gateway/vaultwarden/certificate.yaml | 14 + envoy-gateway/vaultwarden/gateway-patch.yaml | 19 + envoy-gateway/wikijs/certificate.yaml | 14 + envoy-gateway/wikijs/gateway-patch.yaml | 19 + .../wikijs/gateway-public-patch.yaml | 19 + envoy-gateway/zipline/certificate.yaml | 14 + envoy-gateway/zipline/gateway-patch.yaml | 19 + .../zipline/gateway-public-patch.yaml | 19 + excalidraw/excalidraw-svc.yaml | 13 + excalidraw/excalidraw.yaml | 29 + excalidraw/httproute.yaml | 51 + gitea/gitea-ns.yaml | 4 + gitea/gitea/gitea-pvc.yaml | 38 + gitea/gitea/gitea-svc.yaml | 14 + gitea/gitea/gitea.yaml | 71 + gitea/httproute.yaml | 51 + gitea/postgres/postgres.yaml | 55 + gitea/postgres/postgresql-pvc.yaml | 13 + gitea/postgres/postgresql-svc.yaml | 14 + gitea/runner/GITEA-ACTIONS.md | 500 + gitea/runner/runner-pvc.yaml | 13 + gitea/runner/values.yaml | 164 + gotify/gotify-pvc.yaml | 13 + gotify/gotify-svc.yaml | 13 + gotify/gotify.yaml | 63 + gotify/httproute.yaml | 51 + gotify/postgres/postgres-statefulset.yaml | 55 + gotify/postgres/postgresql-pvc.yaml | 12 + gotify/postgres/postgresql-svc.yaml | 14 + immich/immich/httproute.yaml | 51 + immich/immich/immich-pvc.yaml | 36 + immich/immich/immich-svc.yaml | 13 + immich/immich/immich.yaml | 61 + immich/postgres/postgres.yaml | 53 + immich/postgres/postgresql-pvc.yaml | 12 + immich/postgres/postgresql-svc.yaml | 14 + immich/valkey/valkey-svc.yaml | 14 + immich/valkey/valkey.yaml | 28 + infisical/Infisical-secrets/arrstack.yaml | 22 + infisical/Infisical-secrets/authentik.yaml | 22 + infisical/Infisical-secrets/azure-ddns.yaml | 22 + infisical/Infisical-secrets/gitea.yaml | 22 + infisical/Infisical-secrets/gotify.yaml | 22 + infisical/Infisical-secrets/immich.yaml | 22 + infisical/Infisical-secrets/jellyfin.yaml | 22 + infisical/Infisical-secrets/longhorn.yaml | 22 + infisical/Infisical-secrets/minecraft.yaml | 22 + infisical/Infisical-secrets/n8n.yaml | 22 + infisical/Infisical-secrets/netbootxyz.yaml | 22 + infisical/Infisical-secrets/openwebui.yaml | 22 + infisical/Infisical-secrets/passbolt.yaml | 22 + infisical/Infisical-secrets/resume.yaml | 22 + infisical/Infisical-secrets/searxng.yaml | 22 + infisical/Infisical-secrets/uptime-kuma.yaml | 22 + infisical/Infisical-secrets/vaultwarden.yaml | 22 + .../Infisical-secrets/victoria-metrics.yaml | 22 + infisical/Infisical-secrets/zipline.yaml | 22 + infisical/httproute.yaml | 46 + infisical/infisical-endpointslice.yaml | 18 + infisical/infisical-svc.yaml | 11 + infisical/template-infisical-secret.yaml | 30 + infisical/universal-auth-secret.yaml | 9 + it-tools/httproute.yaml | 51 + it-tools/it-tools-svc.yaml | 13 + it-tools/it-tools.yaml | 29 + jellyfin/httproute.yaml | 49 + jellyfin/jellyfin-pvc.yaml | 13 + jellyfin/jellyfin-smb.yaml | 33 + jellyfin/jellyfin-svc.yaml | 13 + jellyfin/jellyfin.yaml | 42 + jenkins/httproute.yaml | 46 + jenkins/jenkins-pvc.yaml | 12 + jenkins/jenkins.yaml | 36 + kubevip/kubevip.yaml | 82 + longhorn/backup-target.yaml | 9 + longhorn/httproute.yaml | 46 + longhorn/infisical-secret.yaml | 22 + longhorn/recurring-backup.yaml | 13 + metallb/metallb.yaml | 17 + minecraft/atm10/atm10-ftbchunks-world.yaml | 230 + .../atm10/atm10-ftbessentials-configmap.yaml | 386 + minecraft/atm10/atm10-ops.yaml | 15 + .../atm10/atm10-properties-configmap.yaml | 68 + minecraft/atm10/atm10-pvc.yaml | 45 + minecraft/atm10/atm10-statefulset.yaml | 69 + minecraft/atm10/atm10-svc.yaml | 19 + minecraft/atm10/backup-configmap.yaml | 80 + minecraft/atm10/whitelist-configmap.yaml | 13 + minecraft/homestead/backup-configmap.yaml | 80 + minecraft/homestead/homestead-ops.yaml | 21 + .../homestead-properties-configmap.yaml | 68 + minecraft/homestead/homestead-pvc.yaml | 45 + .../homestead/homestead-statefulset.yaml | 87 + minecraft/homestead/homestead-svc.yaml | 32 + .../homestead-variables-configmap.yaml | 26 + .../homestead-voicechat-configmap.yaml | 59 + .../homestead/homestead-ysns-configmap.yaml | 66 + minecraft/homestead/whitelist-configmap.yaml | 13 + .../stacia-2-expert/stacia-deployment.yaml | 50 + .../stacia-properties-configmap.yaml | 63 + minecraft/stacia-2-expert/stacia-pvc.yaml | 45 + .../stacia-2-expert/stacia-statefulset.yaml | 51 + minecraft/stacia-2-expert/stacia-svc.yaml | 19 + minio-aistor/endpointslice.yaml | 22 + minio-aistor/httproutes.yaml | 67 + minio-aistor/service.yaml | 14 + n8n/httproute.yaml | 46 + n8n/n8n/n8n-pvc.yaml | 12 + n8n/n8n/n8n-statefulset.yaml | 74 + n8n/n8n/n8n-svc.yaml | 13 + n8n/postgres/postgres-statefulset.yaml | 53 + n8n/postgres/postgresql-pvc.yaml | 12 + n8n/postgres/postgresql-svc.yaml | 14 + netbootxyz/httproute.yaml | 46 + netbootxyz/netbootxyz-pvc.yaml | 26 + netbootxyz/netbootxyz-smb.yaml | 22 + netbootxyz/netbootxyz-stateful.yaml | 60 + netbootxyz/netbootxyz-svc.yaml | 35 + ntfy/ntfy-configmap.yaml | 9 + ntfy/ntfy-ns.yaml | 4 + ntfy/ntfy-pvc.yaml | 13 + ntfy/ntfy-svc.yaml | 13 + ntfy/ntfy.yaml | 43 + ollama/httproute.yaml | 40 + ollama/ollama-backend-traffic.yaml | 13 + ollama/ollama-pvc.yaml | 12 + ollama/ollama-svc.yaml | 13 + ollama/ollama.yaml | 38 + openwebui/httproute.yaml | 40 + openwebui/openwebui-backend-traffic.yaml | 13 + openwebui/openwebui-pvc.yaml | 12 + openwebui/openwebui-svc.yaml | 13 + openwebui/openwebui.yaml | 71 + passbolt/httproute.yaml | 51 + passbolt/mariadb/mariadb-pvc.yaml | 12 + passbolt/mariadb/mariadb-svc.yaml | 13 + passbolt/mariadb/mariadb.yaml | 55 + passbolt/passbolt/passbolt-gpg-pvc.yaml | 12 + passbolt/passbolt/passbolt-jwt-pvc.yaml | 12 + .../passbolt/passbolt-nginx-configmap.yaml | 8 + passbolt/passbolt/passbolt-svc.yaml | 14 + passbolt/passbolt/passbolt.yaml | 103 + passbolt/ratelimit.yaml | 17 + proxmox/backendtlspolicy.yaml | 16 + proxmox/httproute.yaml | 46 + proxmox/proxmox-endpointslice.yaml | 18 + proxmox/proxmox-svc.yaml | 11 + react-resume/chrome/chrome-svc.yaml | 13 + react-resume/chrome/chrome.yaml | 43 + react-resume/postgres/postgres.yaml | 52 + react-resume/postgres/postgresql-pvc.yaml | 12 + react-resume/postgres/postgresql-svc.yaml | 14 + react-resume/resume-httproute.yaml | 51 + react-resume/resume/resume-svc.yaml | 13 + react-resume/resume/resume.yaml | 134 + searxng/httproute.yaml | 25 + searxng/searxng-pvc.yaml | 13 + searxng/searxng-svc.yaml | 13 + searxng/searxng.yaml | 45 + seerr/httproute.yaml | 46 + seerr/seerr-pvc.yaml | 12 + seerr/seerr-svc.yaml | 13 + seerr/seerr.yaml | 42 + .../technitium-endpointslice.yaml | 18 + .../backup-dns-ingress/technitium-svc.yaml | 11 + technitium/technitium-backup-httproute.yaml | 46 + technitium/technitium-httproute.yaml | 46 + technitium/technitium-pvc.yaml | 12 + technitium/technitium-svc.yaml | 43 + technitium/technitium.yaml | 44 + truenas/backendtlspolicy.yaml | 16 + truenas/backendtrafficpolicy.yaml | 15 + truenas/httproute.yaml | 33 + truenas/truenas-endpointslice.yaml | 18 + truenas/truenas-svc.yaml | 11 + unifi/backendtlspolicy.yaml | 16 + unifi/backendtrafficpolicy.yaml | 15 + unifi/httproute.yaml | 51 + unifi/unifi-ca-cert.yaml | 27 + unifi/unifi-endpointslice.yaml | 18 + unifi/unifi-svc.yaml | 11 + uptime-kuma/httproute.yaml | 46 + uptime-kuma/mariadb/mariadb-pvc.yaml | 13 + uptime-kuma/mariadb/mariadb-svc.yaml | 11 + uptime-kuma/mariadb/mariadb.yaml | 55 + uptime-kuma/uptime-kuma-pvc.yaml | 12 + uptime-kuma/uptime-kuma-svc.yaml | 13 + uptime-kuma/uptime-kuma.yaml | 66 + victoria-metrics/httproute.yaml | 146 + .../service-scrapers/minecraft.yaml | 15 + victoria-metrics/values.yaml | 215 + wikijs/httproute.yaml | 51 + wikijs/postgresql/postgres.yaml | 49 + wikijs/postgresql/postgresql-pvc.yaml | 12 + wikijs/postgresql/postgresql-svc.yaml | 14 + wikijs/wikijs-ns.yaml | 4 + wikijs/wikijs/wiki-svc.yaml | 14 + wikijs/wikijs/wiki.yaml | 46 + zipline/httproute.yaml | 51 + zipline/postgres/postgres.yaml | 55 + zipline/postgres/postgresql-pvc.yaml | 12 + zipline/postgres/postgresql-svc.yaml | 14 + zipline/zipline/zipline-public-pvc.yaml | 12 + zipline/zipline/zipline-svc.yaml | 14 + zipline/zipline/zipline-themes-pvc.yaml | 12 + zipline/zipline/zipline-uploads-pvc.yaml | 36 + zipline/zipline/zipline.yaml | 61 + 403 files changed, 41983 insertions(+) create mode 100644 README.md create mode 100644 argocd/applications/arrstack.yaml create mode 100644 argocd/applications/authentik.yaml create mode 100644 argocd/applications/bentopdf.yaml create mode 100644 argocd/applications/databasus.yaml create mode 100644 argocd/applications/ddns.yaml create mode 100644 argocd/applications/excalidraw.yaml create mode 100644 argocd/applications/gitea.yaml create mode 100644 argocd/applications/gotify.yaml create mode 100644 argocd/applications/immich.yaml create mode 100644 argocd/applications/infisical.yaml create mode 100644 argocd/applications/intel-gpu.yaml create mode 100644 argocd/applications/intel-nfd-rules.yaml create mode 100644 argocd/applications/intel-nfd.yaml create mode 100644 argocd/applications/it-tools.yaml create mode 100644 argocd/applications/jellyfin.yaml create mode 100644 argocd/applications/minio-aistor.yaml create mode 100644 argocd/applications/netbootxyz.yaml create mode 100644 argocd/applications/passbolt.yaml create mode 100644 argocd/applications/proxmox.yaml create mode 100644 argocd/applications/reactive-resume.yaml create mode 100644 argocd/applications/searxng.yaml create mode 100644 argocd/applications/seerr.yaml create mode 100644 argocd/applications/technitium.yaml create mode 100644 argocd/applications/truenas.yaml create mode 100644 argocd/applications/unifi.yaml create mode 100644 argocd/applications/uptime-kuma.yaml create mode 100644 argocd/applications/victoria-metrics.yaml create mode 100644 argocd/applications/zipline.yaml create mode 100644 argocd/argocd-install.yaml create mode 100644 argocd/httproute.yaml create mode 100644 arrstack/arrstack-vpn-services-endpointslice.yaml create mode 100644 arrstack/prowlarr-httproute.yaml create mode 100644 arrstack/radarr-httproute.yaml create mode 100644 arrstack/radarr/radarr-pvc.yaml create mode 100644 arrstack/radarr/radarr-svc.yaml create mode 100644 arrstack/radarr/radarr.yaml create mode 100644 arrstack/smb-download.yaml create mode 100644 arrstack/smb-media.yaml create mode 100644 arrstack/sonarr-httproute.yaml create mode 100644 arrstack/sonarr/sonarr-pvc.yaml create mode 100644 arrstack/sonarr/sonarr.yaml create mode 100644 arrstack/sonarr/sonarrr-svc.yaml create mode 100644 arrstack/torrent-httproute.yaml create mode 100644 authentik/httproute.yaml create mode 100644 authentik/postgres/pvc.yaml create mode 100644 authentik/postgres/service.yaml create mode 100644 authentik/postgres/statefulset.yaml create mode 100644 authentik/server/deployment.yaml create mode 100644 authentik/server/pvc.yaml create mode 100644 authentik/server/service.yaml create mode 100644 authentik/worker/deployment.yaml create mode 100644 authentik/worker/pvc.yaml create mode 100755 azure-ddns-python/azure-ddns-svc.yaml create mode 100755 azure-ddns-python/azure-ddns.yaml create mode 100644 bentopdf/bentopdf-svc.yaml create mode 100644 bentopdf/bentopdf.yaml create mode 100644 bentopdf/httproute.yaml create mode 100644 cert-manager/azure-dns-certs.yaml create mode 100644 cloud-native-postgres/values.yaml create mode 100644 comfyui/comfyui-pvc.yaml create mode 100644 comfyui/comfyui-svc.yaml create mode 100644 comfyui/comfyui.yaml create mode 100644 databasus/databasus-ns.yaml create mode 100644 databasus/databasus-pvc.yaml create mode 100644 databasus/databasus-statefulset.yaml create mode 100644 databasus/databasus-svc.yaml create mode 100644 databasus/httproute.yaml create mode 100644 deprecated/nginx-ingress-controller/argocd-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/bentopdf-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/gitea-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/infisical-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/it-tools-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/jellyseer-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/jenkins-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/jenkins-svc-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/longhorn-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/minio-ingress-webui.yaml create mode 100644 deprecated/nginx-ingress-controller/minio-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/n8n-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/netbootxyz-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/passbolt-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/proxmox-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/radarr-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/resume-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/sonarr-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/technitium-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/technitium-ingress.yml create mode 100644 deprecated/nginx-ingress-controller/truenas-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/unifi-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/wiki-ingress.yaml create mode 100644 deprecated/nginx-ingress-controller/zipline-ingress.yaml create mode 100644 deprecated/psono/envoy-gateway/certificate.yaml create mode 100644 deprecated/psono/envoy-gateway/gateway-patch.yaml create mode 100644 deprecated/psono/httproute.yaml create mode 100644 deprecated/psono/infisical/psono.yaml create mode 100644 deprecated/psono/namespace.yaml create mode 100644 deprecated/psono/postgres/postgres-statefulset.yaml create mode 100644 deprecated/psono/postgres/postgresql-pvc.yaml create mode 100644 deprecated/psono/postgres/postgresql-svc.yaml create mode 100644 deprecated/psono/pvc.yaml create mode 100644 deprecated/psono/settings-configmap.yaml create mode 100644 deprecated/psono/statefulset.yaml create mode 100644 deprecated/vaultwarden/httproute.yaml create mode 100644 deprecated/vaultwarden/namespace.yaml create mode 100644 deprecated/vaultwarden/pvc.yaml create mode 100644 deprecated/vaultwarden/statefulset.yaml create mode 100644 envoy-gateway/argocd/certificate.yaml create mode 100644 envoy-gateway/argocd/gateway-patch.yaml create mode 100644 envoy-gateway/arrstack/radarr-certificate.yaml create mode 100644 envoy-gateway/arrstack/radarr-gateway-patch.yaml create mode 100644 envoy-gateway/arrstack/sonarr-certificate.yaml create mode 100644 envoy-gateway/arrstack/sonarr-gateway-patch.yaml create mode 100644 envoy-gateway/authentik/certificate.yaml create mode 100644 envoy-gateway/authentik/gateway-patch.yaml create mode 100644 envoy-gateway/authentik/gateway-public-patch.yaml create mode 100644 envoy-gateway/bentopdf/certificate.yaml create mode 100644 envoy-gateway/bentopdf/gateway-patch.yaml create mode 100644 envoy-gateway/bentopdf/gateway-public-patch.yaml create mode 100644 envoy-gateway/clientsettingspolicies.yaml create mode 100644 envoy-gateway/databasus/certificate.yaml create mode 100644 envoy-gateway/databasus/gateway-patch.yaml create mode 100644 envoy-gateway/excalidraw/certificate.yaml create mode 100644 envoy-gateway/excalidraw/gateway-patch.yaml create mode 100644 envoy-gateway/excalidraw/gateway-public-patch.yaml create mode 100644 envoy-gateway/gateway-public.yaml create mode 100644 envoy-gateway/gateway.yaml create mode 100644 envoy-gateway/gitea/certificate.yaml create mode 100644 envoy-gateway/gitea/gateway-patch.yaml create mode 100644 envoy-gateway/gitea/gateway-public-patch.yaml create mode 100644 envoy-gateway/gotify/certificate.yaml create mode 100644 envoy-gateway/gotify/gateway-patch.yaml create mode 100644 envoy-gateway/gotify/gateway-public-patch.yaml create mode 100644 envoy-gateway/httproute-template.yaml create mode 100644 envoy-gateway/immich/certificate.yaml create mode 100644 envoy-gateway/immich/gateway-patch.yaml create mode 100644 envoy-gateway/immich/gateway-public-patch.yaml create mode 100644 envoy-gateway/infisical/certificate.yaml create mode 100644 envoy-gateway/infisical/gateway-patch.yaml create mode 100644 envoy-gateway/it-tools/certificate.yaml create mode 100644 envoy-gateway/it-tools/gateway-patch.yaml create mode 100644 envoy-gateway/it-tools/gateway-public-patch.yaml create mode 100644 envoy-gateway/jellyfin/certificate.yaml create mode 100644 envoy-gateway/jellyfin/gateway-patch.yaml create mode 100644 envoy-gateway/jellyfin/gateway-public-patch.yaml create mode 100644 envoy-gateway/jenkins/certificate.yaml create mode 100644 envoy-gateway/jenkins/gateway-patch.yaml create mode 100644 envoy-gateway/kustomization.yaml create mode 100644 envoy-gateway/longhorn/certificate.yaml create mode 100644 envoy-gateway/longhorn/gateway-patch.yaml create mode 100644 envoy-gateway/minio-aistor/api-certificate.yaml create mode 100644 envoy-gateway/minio-aistor/api-gateway-patch.yaml create mode 100644 envoy-gateway/minio-aistor/console-certificate.yaml create mode 100644 envoy-gateway/minio-aistor/console-gateway-patch.yaml create mode 100644 envoy-gateway/monitoring/certificate.yaml create mode 100644 envoy-gateway/monitoring/gateway-patch.yaml create mode 100644 envoy-gateway/monitoring/grafana-gateway-public-patch.yaml create mode 100644 envoy-gateway/n8n/certificate.yaml create mode 100644 envoy-gateway/n8n/gateway-patch.yaml create mode 100644 envoy-gateway/netbootxyz/certificate.yaml create mode 100644 envoy-gateway/netbootxyz/gateway-patch.yaml create mode 100644 envoy-gateway/ollama/certificate.yaml create mode 100644 envoy-gateway/ollama/gateway-patch.yaml create mode 100644 envoy-gateway/openwebui/certificate.yaml create mode 100644 envoy-gateway/openwebui/gateway-patch.yaml create mode 100644 envoy-gateway/passbolt/certificate.yaml create mode 100644 envoy-gateway/passbolt/gateway-patch.yaml create mode 100644 envoy-gateway/passbolt/gateway-public-patch.yaml create mode 100644 envoy-gateway/prowlarr/certificate.yaml create mode 100644 envoy-gateway/prowlarr/gateway-patch.yaml create mode 100644 envoy-gateway/proxmox/certificate.yaml create mode 100644 envoy-gateway/proxmox/gateway-patch.yaml create mode 100644 envoy-gateway/resume/minio-certificate.yaml create mode 100644 envoy-gateway/resume/minio-gateway-patch.yaml create mode 100644 envoy-gateway/resume/minio-webui-certificate.yaml create mode 100644 envoy-gateway/resume/minio-webui-gateway-patch.yaml create mode 100644 envoy-gateway/resume/resume-certificate.yaml create mode 100644 envoy-gateway/resume/resume-gateway-patch.yaml create mode 100644 envoy-gateway/resume/resume-gateway-public-patch.yaml create mode 100644 envoy-gateway/searxng/certificate.yaml create mode 100644 envoy-gateway/searxng/gateway-patch.yaml create mode 100644 envoy-gateway/searxng/gateway-public-patch.yaml create mode 100644 envoy-gateway/seerr/certificate.yaml create mode 100644 envoy-gateway/seerr/gateway-patch.yaml create mode 100644 envoy-gateway/technitium/technitium-backup-certificate.yaml create mode 100644 envoy-gateway/technitium/technitium-backup-gateway-patch.yaml create mode 100644 envoy-gateway/technitium/technitium-certificate.yaml create mode 100644 envoy-gateway/technitium/technitium-gateway-patch.yaml create mode 100644 envoy-gateway/torrent/certificate.yaml create mode 100644 envoy-gateway/torrent/gateway-patch.yaml create mode 100644 envoy-gateway/truenas/certificate.yaml create mode 100644 envoy-gateway/truenas/gateway-patch.yaml create mode 100644 envoy-gateway/unifi/certificate.yaml create mode 100644 envoy-gateway/unifi/gateway-patch.yaml create mode 100644 envoy-gateway/uptime-kuma/certificate.yaml create mode 100644 envoy-gateway/uptime-kuma/gateway-patch.yaml create mode 100644 envoy-gateway/vaultwarden/certificate.yaml create mode 100644 envoy-gateway/vaultwarden/gateway-patch.yaml create mode 100644 envoy-gateway/wikijs/certificate.yaml create mode 100644 envoy-gateway/wikijs/gateway-patch.yaml create mode 100644 envoy-gateway/wikijs/gateway-public-patch.yaml create mode 100644 envoy-gateway/zipline/certificate.yaml create mode 100644 envoy-gateway/zipline/gateway-patch.yaml create mode 100644 envoy-gateway/zipline/gateway-public-patch.yaml create mode 100644 excalidraw/excalidraw-svc.yaml create mode 100644 excalidraw/excalidraw.yaml create mode 100644 excalidraw/httproute.yaml create mode 100644 gitea/gitea-ns.yaml create mode 100644 gitea/gitea/gitea-pvc.yaml create mode 100644 gitea/gitea/gitea-svc.yaml create mode 100644 gitea/gitea/gitea.yaml create mode 100644 gitea/httproute.yaml create mode 100644 gitea/postgres/postgres.yaml create mode 100644 gitea/postgres/postgresql-pvc.yaml create mode 100644 gitea/postgres/postgresql-svc.yaml create mode 100644 gitea/runner/GITEA-ACTIONS.md create mode 100644 gitea/runner/runner-pvc.yaml create mode 100644 gitea/runner/values.yaml create mode 100644 gotify/gotify-pvc.yaml create mode 100644 gotify/gotify-svc.yaml create mode 100644 gotify/gotify.yaml create mode 100644 gotify/httproute.yaml create mode 100644 gotify/postgres/postgres-statefulset.yaml create mode 100644 gotify/postgres/postgresql-pvc.yaml create mode 100644 gotify/postgres/postgresql-svc.yaml create mode 100644 immich/immich/httproute.yaml create mode 100644 immich/immich/immich-pvc.yaml create mode 100644 immich/immich/immich-svc.yaml create mode 100644 immich/immich/immich.yaml create mode 100644 immich/postgres/postgres.yaml create mode 100644 immich/postgres/postgresql-pvc.yaml create mode 100644 immich/postgres/postgresql-svc.yaml create mode 100644 immich/valkey/valkey-svc.yaml create mode 100644 immich/valkey/valkey.yaml create mode 100644 infisical/Infisical-secrets/arrstack.yaml create mode 100644 infisical/Infisical-secrets/authentik.yaml create mode 100644 infisical/Infisical-secrets/azure-ddns.yaml create mode 100644 infisical/Infisical-secrets/gitea.yaml create mode 100644 infisical/Infisical-secrets/gotify.yaml create mode 100644 infisical/Infisical-secrets/immich.yaml create mode 100644 infisical/Infisical-secrets/jellyfin.yaml create mode 100644 infisical/Infisical-secrets/longhorn.yaml create mode 100644 infisical/Infisical-secrets/minecraft.yaml create mode 100644 infisical/Infisical-secrets/n8n.yaml create mode 100644 infisical/Infisical-secrets/netbootxyz.yaml create mode 100644 infisical/Infisical-secrets/openwebui.yaml create mode 100644 infisical/Infisical-secrets/passbolt.yaml create mode 100644 infisical/Infisical-secrets/resume.yaml create mode 100644 infisical/Infisical-secrets/searxng.yaml create mode 100644 infisical/Infisical-secrets/uptime-kuma.yaml create mode 100644 infisical/Infisical-secrets/vaultwarden.yaml create mode 100644 infisical/Infisical-secrets/victoria-metrics.yaml create mode 100644 infisical/Infisical-secrets/zipline.yaml create mode 100644 infisical/httproute.yaml create mode 100644 infisical/infisical-endpointslice.yaml create mode 100644 infisical/infisical-svc.yaml create mode 100644 infisical/template-infisical-secret.yaml create mode 100644 infisical/universal-auth-secret.yaml create mode 100644 it-tools/httproute.yaml create mode 100644 it-tools/it-tools-svc.yaml create mode 100644 it-tools/it-tools.yaml create mode 100644 jellyfin/httproute.yaml create mode 100644 jellyfin/jellyfin-pvc.yaml create mode 100644 jellyfin/jellyfin-smb.yaml create mode 100644 jellyfin/jellyfin-svc.yaml create mode 100644 jellyfin/jellyfin.yaml create mode 100644 jenkins/httproute.yaml create mode 100644 jenkins/jenkins-pvc.yaml create mode 100644 jenkins/jenkins.yaml create mode 100644 kubevip/kubevip.yaml create mode 100644 longhorn/backup-target.yaml create mode 100644 longhorn/httproute.yaml create mode 100644 longhorn/infisical-secret.yaml create mode 100644 longhorn/recurring-backup.yaml create mode 100644 metallb/metallb.yaml create mode 100644 minecraft/atm10/atm10-ftbchunks-world.yaml create mode 100644 minecraft/atm10/atm10-ftbessentials-configmap.yaml create mode 100644 minecraft/atm10/atm10-ops.yaml create mode 100644 minecraft/atm10/atm10-properties-configmap.yaml create mode 100644 minecraft/atm10/atm10-pvc.yaml create mode 100644 minecraft/atm10/atm10-statefulset.yaml create mode 100644 minecraft/atm10/atm10-svc.yaml create mode 100644 minecraft/atm10/backup-configmap.yaml create mode 100644 minecraft/atm10/whitelist-configmap.yaml create mode 100644 minecraft/homestead/backup-configmap.yaml create mode 100644 minecraft/homestead/homestead-ops.yaml create mode 100644 minecraft/homestead/homestead-properties-configmap.yaml create mode 100644 minecraft/homestead/homestead-pvc.yaml create mode 100644 minecraft/homestead/homestead-statefulset.yaml create mode 100644 minecraft/homestead/homestead-svc.yaml create mode 100644 minecraft/homestead/homestead-variables-configmap.yaml create mode 100644 minecraft/homestead/homestead-voicechat-configmap.yaml create mode 100644 minecraft/homestead/homestead-ysns-configmap.yaml create mode 100644 minecraft/homestead/whitelist-configmap.yaml create mode 100644 minecraft/stacia-2-expert/stacia-deployment.yaml create mode 100644 minecraft/stacia-2-expert/stacia-properties-configmap.yaml create mode 100644 minecraft/stacia-2-expert/stacia-pvc.yaml create mode 100644 minecraft/stacia-2-expert/stacia-statefulset.yaml create mode 100644 minecraft/stacia-2-expert/stacia-svc.yaml create mode 100644 minio-aistor/endpointslice.yaml create mode 100644 minio-aistor/httproutes.yaml create mode 100644 minio-aistor/service.yaml create mode 100644 n8n/httproute.yaml create mode 100644 n8n/n8n/n8n-pvc.yaml create mode 100644 n8n/n8n/n8n-statefulset.yaml create mode 100644 n8n/n8n/n8n-svc.yaml create mode 100644 n8n/postgres/postgres-statefulset.yaml create mode 100644 n8n/postgres/postgresql-pvc.yaml create mode 100644 n8n/postgres/postgresql-svc.yaml create mode 100644 netbootxyz/httproute.yaml create mode 100644 netbootxyz/netbootxyz-pvc.yaml create mode 100644 netbootxyz/netbootxyz-smb.yaml create mode 100644 netbootxyz/netbootxyz-stateful.yaml create mode 100644 netbootxyz/netbootxyz-svc.yaml create mode 100644 ntfy/ntfy-configmap.yaml create mode 100644 ntfy/ntfy-ns.yaml create mode 100644 ntfy/ntfy-pvc.yaml create mode 100644 ntfy/ntfy-svc.yaml create mode 100644 ntfy/ntfy.yaml create mode 100644 ollama/httproute.yaml create mode 100644 ollama/ollama-backend-traffic.yaml create mode 100644 ollama/ollama-pvc.yaml create mode 100644 ollama/ollama-svc.yaml create mode 100644 ollama/ollama.yaml create mode 100644 openwebui/httproute.yaml create mode 100644 openwebui/openwebui-backend-traffic.yaml create mode 100644 openwebui/openwebui-pvc.yaml create mode 100644 openwebui/openwebui-svc.yaml create mode 100644 openwebui/openwebui.yaml create mode 100644 passbolt/httproute.yaml create mode 100644 passbolt/mariadb/mariadb-pvc.yaml create mode 100644 passbolt/mariadb/mariadb-svc.yaml create mode 100644 passbolt/mariadb/mariadb.yaml create mode 100644 passbolt/passbolt/passbolt-gpg-pvc.yaml create mode 100644 passbolt/passbolt/passbolt-jwt-pvc.yaml create mode 100644 passbolt/passbolt/passbolt-nginx-configmap.yaml create mode 100644 passbolt/passbolt/passbolt-svc.yaml create mode 100644 passbolt/passbolt/passbolt.yaml create mode 100644 passbolt/ratelimit.yaml create mode 100644 proxmox/backendtlspolicy.yaml create mode 100644 proxmox/httproute.yaml create mode 100644 proxmox/proxmox-endpointslice.yaml create mode 100644 proxmox/proxmox-svc.yaml create mode 100644 react-resume/chrome/chrome-svc.yaml create mode 100644 react-resume/chrome/chrome.yaml create mode 100644 react-resume/postgres/postgres.yaml create mode 100644 react-resume/postgres/postgresql-pvc.yaml create mode 100644 react-resume/postgres/postgresql-svc.yaml create mode 100644 react-resume/resume-httproute.yaml create mode 100644 react-resume/resume/resume-svc.yaml create mode 100644 react-resume/resume/resume.yaml create mode 100644 searxng/httproute.yaml create mode 100644 searxng/searxng-pvc.yaml create mode 100644 searxng/searxng-svc.yaml create mode 100644 searxng/searxng.yaml create mode 100644 seerr/httproute.yaml create mode 100644 seerr/seerr-pvc.yaml create mode 100644 seerr/seerr-svc.yaml create mode 100644 seerr/seerr.yaml create mode 100644 technitium/backup-dns-ingress/technitium-endpointslice.yaml create mode 100644 technitium/backup-dns-ingress/technitium-svc.yaml create mode 100644 technitium/technitium-backup-httproute.yaml create mode 100644 technitium/technitium-httproute.yaml create mode 100644 technitium/technitium-pvc.yaml create mode 100644 technitium/technitium-svc.yaml create mode 100644 technitium/technitium.yaml create mode 100644 truenas/backendtlspolicy.yaml create mode 100644 truenas/backendtrafficpolicy.yaml create mode 100644 truenas/httproute.yaml create mode 100644 truenas/truenas-endpointslice.yaml create mode 100644 truenas/truenas-svc.yaml create mode 100644 unifi/backendtlspolicy.yaml create mode 100644 unifi/backendtrafficpolicy.yaml create mode 100644 unifi/httproute.yaml create mode 100644 unifi/unifi-ca-cert.yaml create mode 100644 unifi/unifi-endpointslice.yaml create mode 100644 unifi/unifi-svc.yaml create mode 100644 uptime-kuma/httproute.yaml create mode 100644 uptime-kuma/mariadb/mariadb-pvc.yaml create mode 100644 uptime-kuma/mariadb/mariadb-svc.yaml create mode 100644 uptime-kuma/mariadb/mariadb.yaml create mode 100644 uptime-kuma/uptime-kuma-pvc.yaml create mode 100644 uptime-kuma/uptime-kuma-svc.yaml create mode 100644 uptime-kuma/uptime-kuma.yaml create mode 100644 victoria-metrics/httproute.yaml create mode 100644 victoria-metrics/service-scrapers/minecraft.yaml create mode 100644 victoria-metrics/values.yaml create mode 100644 wikijs/httproute.yaml create mode 100644 wikijs/postgresql/postgres.yaml create mode 100644 wikijs/postgresql/postgresql-pvc.yaml create mode 100644 wikijs/postgresql/postgresql-svc.yaml create mode 100644 wikijs/wikijs-ns.yaml create mode 100644 wikijs/wikijs/wiki-svc.yaml create mode 100644 wikijs/wikijs/wiki.yaml create mode 100644 zipline/httproute.yaml create mode 100644 zipline/postgres/postgres.yaml create mode 100644 zipline/postgres/postgresql-pvc.yaml create mode 100644 zipline/postgres/postgresql-svc.yaml create mode 100644 zipline/zipline/zipline-public-pvc.yaml create mode 100644 zipline/zipline/zipline-svc.yaml create mode 100644 zipline/zipline/zipline-themes-pvc.yaml create mode 100644 zipline/zipline/zipline-uploads-pvc.yaml create mode 100644 zipline/zipline/zipline.yaml diff --git a/README.md b/README.md new file mode 100644 index 0000000..b46bc0e --- /dev/null +++ b/README.md @@ -0,0 +1,182 @@ +# Kubernetes Manifests Repository + +This repository contains Kubernetes manifest files for a comprehensive self-hosted platform running 40+ applications across various categories. This infrastructure was created for the migration from Docker to Kubernetes (K3S). + +## Overview + +This infrastructure provides a complete solution for: +- Media management and streaming +- AI/ML workloads +- Development and CI/CD workflows +- Productivity and collaboration tools +- Network and system administration +- Storage and backup solutions + +All applications are managed using GitOps principles with ArgoCD and utilize cert-manager for automated TLS certificate management. + +## Repository Structure + +The repository is organized with one directory per application, containing all necessary Kubernetes resources: + +``` +├── argocd/ # GitOps continuous deployment +├── cert-manager/ # TLS certificate management +├── metallb/ # Load balancer +├── kubevip/ # High availability +├── longhorn/ # Distributed storage +├── cloud-native-postgres/ # PostgreSQL operator +├── envoy-gateway/ # Kubernetes Gateway API configuration +├── infisical/ # Secrets management +├── authentik/ # Identity provider and SSO +├── it-tools/ # IT utilities +├── jellyfin/ # Media server +├── seerr/ # Media request management +├── immich/ # Photo and video management +├── minecraft/ # Game servers +├── gitea/ # Git service +├── harbor/ # Container registry +├── jenkins/ # CI/CD automation +├── n8n/ # Workflow automation +├── react-resume/ # Resume builder application +├── passbolt/ # Password manager +├── wikijs/ # Documentation wiki +├── zipline/ # File sharing +├── gotify/ # Push notification server +├── ntfy/ # Push notifications +├── bentopdf/ # PDF conversion +├── excalidraw/ # Whiteboard / diagramming +├── searxng/ # Privacy-respecting search engine +├── uptime-kuma/ # Uptime monitoring +├── openwebui/ # Web UI for AI models +├── ollama/ # Local LLM runner +├── comfyui/ # Stable Diffusion workflow UI +├── stable-diffusion/ # Image generation +├── minio-aistor/ # S3-compatible object storage +├── databasus/ # Database management +├── netbootxyz/ # Network boot service +├── technitium/ # DNS server +├── azure-ddns-python/ # Dynamic DNS updater +├── victoria-metrics/ # Metrics and monitoring +├── proxmox/ # Virtualization platform +├── unifi/ # Network controller +└── truenas/ # Storage system +``` + +## Categories + +### Core Infrastructure +- **ArgoCD**: GitOps continuous deployment and application management +- **cert-manager**: Automated TLS certificate provisioning using Azure DNS +- **MetalLB**: Bare-metal load balancer (IP pool: 10.8.11.100-10.8.11.150) +- **KubeVIP**: High-availability control plane +- **Longhorn**: Distributed block storage +- **Cloud Native Postgres**: PostgreSQL operator for database management +- **Envoy Gateway**: Kubernetes Gateway API implementation +- **Infisical**: Secrets management platform +- **Authentik**: Identity provider and SSO + +### Media & Entertainment +- **Jellyfin**: Media streaming server +- **Seerr**: Media request and discovery +- **Immich**: Self-hosted photo and video management +- **Minecraft**: Game servers (ATM-10 and Stacia 2 Expert modpacks) + +### AI & Machine Learning +- **Ollama**: Local LLM runner +- **Open WebUI**: Web interface for AI models +- **ComfyUI**: Stable Diffusion workflow UI +- **Stable Diffusion**: AI image generation + +### Development & CI/CD +- **Gitea**: Self-hosted Git service with container registry +- **Harbor**: Enterprise container registry +- **Jenkins**: Automation server for CI/CD pipelines +- **n8n**: Workflow automation platform +- **MinIO AIStor**: S3-compatible object storage + +### Productivity & Collaboration +- **React-Resume**: Resume builder with MinIO and PostgreSQL +- **Passbolt**: Team password manager +- **Wiki.js**: Modern documentation platform +- **Zipline**: File sharing and screenshot service +- **Gotify**: Push notification server with REST API and WebSocket support +- **Ntfy**: Push notification service +- **BentoPDF**: PDF conversion service +- **Excalidraw**: Online whiteboard and diagramming tool +- **SearXNG**: Privacy-respecting metasearch engine +- **Databasus**: Database management UI +- **Uptime Kuma**: Uptime and status monitoring + +### Administration & Monitoring +- **IT-Tools**: Collection of useful IT utilities +- **Technitium**: DNS server with web interface +- **Azure DDNS Python**: Dynamic DNS updater for Azure DNS +- **NetbootXYZ**: Network boot service for OS installation +- **VictoriaMetrics**: Metrics collection and monitoring stack + +### External Service Integration +- **Proxmox**: Virtualization platform integration +- **UniFi**: Network controller integration +- **TrueNAS**: Storage system integration + +## Common Patterns + +### Networking +- **Ingress Controller**: Envoy Gateway (Kubernetes Gateway API) +- **TLS**: Automated certificate management via cert-manager +- **DNS**: Certificate validation through Azure DNS +- **Domain**: *.jsme.be +- **Load Balancer**: MetalLB for external access + +### Storage +- **Persistent Storage**: Longhorn distributed storage +- **StatefulSets**: Used for applications requiring persistent state +- **PersistentVolumeClaims**: Separate PVCs for different data types (config, data, backups) + +### Security +- **Secrets Management**: Kubernetes Secrets for sensitive data +- **Network Policies**: Application isolation where configured +- **RBAC**: Role-based access control for ArgoCD and service accounts +- **TLS**: All web interfaces secured with HTTPS +- **SSO**: Authentik for centralized authentication + +### Application Architecture +- **Multi-tier Applications**: Separate deployments for apps and databases +- **Database Pattern**: PostgreSQL via Cloud Native Postgres operator as backend +- **Configuration Management**: ConfigMaps for application settings +- **Service Discovery**: ClusterIP services with internal DNS + +## Deployment + +This repository is designed for GitOps deployment using ArgoCD: + +1. ArgoCD monitors this repository for changes +2. Changes are automatically synced to the cluster +3. Applications are deployed with declarative configurations +4. Rollbacks are possible through Git history + +## Documentation + +Each application directory contains a detailed README.md with: +- Application description and purpose +- Configuration details +- Resource specifications +- Setup instructions +- Integration notes + +Refer to individual application READMEs for specific information. + +## Infrastructure Requirements + +- **Kubernetes Cluster**: K3S v1.33+ +- **Storage**: Longhorn distributed storage +- **Load Balancer**: MetalLB configured +- **DNS**: Azure DNS for certificate validation +- **Domain**: jsme.be with wildcard DNS records + +## Maintenance + +- **GitOps**: All changes made through Git commits +- **Certificate Renewal**: Automated via cert-manager +- **Backups**: Application-specific backup strategies (see individual READMEs) +- **Updates**: Managed through image tag updates in manifests diff --git a/argocd/applications/arrstack.yaml b/argocd/applications/arrstack.yaml new file mode 100644 index 0000000..0939af9 --- /dev/null +++ b/argocd/applications/arrstack.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: arrstack + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: arrstack + targetRevision: HEAD + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: arrstack + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true diff --git a/argocd/applications/authentik.yaml b/argocd/applications/authentik.yaml new file mode 100644 index 0000000..22f28a6 --- /dev/null +++ b/argocd/applications/authentik.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authentik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: authentik + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: authentik + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/argocd/applications/bentopdf.yaml b/argocd/applications/bentopdf.yaml new file mode 100644 index 0000000..afd220b --- /dev/null +++ b/argocd/applications/bentopdf.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: bentopdf + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: bentopdf + targetRevision: main + destination: + server: https://kubernetes.default.svc + namespace: bentopdf + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - PruneLast=true + - CreateNamespace=true diff --git a/argocd/applications/databasus.yaml b/argocd/applications/databasus.yaml new file mode 100644 index 0000000..9a7a56f --- /dev/null +++ b/argocd/applications/databasus.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: databasus + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: databasus + targetRevision: HEAD + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: databasus + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/argocd/applications/ddns.yaml b/argocd/applications/ddns.yaml new file mode 100644 index 0000000..a353d58 --- /dev/null +++ b/argocd/applications/ddns.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: ddns + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: azure-ddns-python + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: azure-ddns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/applications/excalidraw.yaml b/argocd/applications/excalidraw.yaml new file mode 100644 index 0000000..496d0e7 --- /dev/null +++ b/argocd/applications/excalidraw.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: excalidraw + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: excalidraw + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: excalidraw + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true diff --git a/argocd/applications/gitea.yaml b/argocd/applications/gitea.yaml new file mode 100644 index 0000000..2bc12bb --- /dev/null +++ b/argocd/applications/gitea.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: gitea + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: gitea + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: gitea + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - Replace=true + - CreateNamespace=true + - PruneLast=true + ignoreDifferences: + - group: "" + kind: PersistentVolumeClaim + jsonPointers: + - /spec/volumeName diff --git a/argocd/applications/gotify.yaml b/argocd/applications/gotify.yaml new file mode 100644 index 0000000..a90c0cf --- /dev/null +++ b/argocd/applications/gotify.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: gotify + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: gotify + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: gotify + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true + ignoreDifferences: + - group: "" + kind: PersistentVolumeClaim + jsonPointers: + - /spec/volumeName diff --git a/argocd/applications/immich.yaml b/argocd/applications/immich.yaml new file mode 100644 index 0000000..8962381 --- /dev/null +++ b/argocd/applications/immich.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: immich + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: immich + targetRevision: HEAD + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: immich + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + - PrunePropagationPolicy=foreground diff --git a/argocd/applications/infisical.yaml b/argocd/applications/infisical.yaml new file mode 100644 index 0000000..a3bee49 --- /dev/null +++ b/argocd/applications/infisical.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: infisical + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: infisical + targetRevision: HEAD + directory: + recurse: true + exclude: universal-auth-secret.yaml + destination: + server: https://kubernetes.default.svc + namespace: infisical + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - ServerSideApply=true diff --git a/argocd/applications/intel-gpu.yaml b/argocd/applications/intel-gpu.yaml new file mode 100644 index 0000000..7fbeab0 --- /dev/null +++ b/argocd/applications/intel-gpu.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: intel-gpu + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + project: default + source: + repoURL: https://github.com/intel/intel-device-plugins-for-kubernetes.git + path: deployments/gpu_plugin/overlays/nfd_labeled_nodes + targetRevision: v0.35.0 + destination: + server: https://kubernetes.default.svc + namespace: kube-system + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/argocd/applications/intel-nfd-rules.yaml b/argocd/applications/intel-nfd-rules.yaml new file mode 100644 index 0000000..8da218f --- /dev/null +++ b/argocd/applications/intel-nfd-rules.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: intel-nfd-rules + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + project: default + source: + repoURL: https://github.com/intel/intel-device-plugins-for-kubernetes.git + path: deployments/nfd/overlays/node-feature-rules + targetRevision: v0.35.0 + destination: + server: https://kubernetes.default.svc + namespace: node-feature-discovery + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/argocd/applications/intel-nfd.yaml b/argocd/applications/intel-nfd.yaml new file mode 100644 index 0000000..1f98f1f --- /dev/null +++ b/argocd/applications/intel-nfd.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: intel-nfd + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + project: default + source: + repoURL: https://github.com/intel/intel-device-plugins-for-kubernetes.git + path: deployments/nfd + targetRevision: v0.35.0 + destination: + server: https://kubernetes.default.svc + namespace: node-feature-discovery + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/applications/it-tools.yaml b/argocd/applications/it-tools.yaml new file mode 100644 index 0000000..c7ffdee --- /dev/null +++ b/argocd/applications/it-tools.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: it-tools + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: it-tools + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: it-tools + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - Replace=true + - CreateNamespace=true + - PruneLast=true diff --git a/argocd/applications/jellyfin.yaml b/argocd/applications/jellyfin.yaml new file mode 100644 index 0000000..c8e18cf --- /dev/null +++ b/argocd/applications/jellyfin.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: jellyfin + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: jellyfin + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: jellyfin + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/applications/minio-aistor.yaml b/argocd/applications/minio-aistor.yaml new file mode 100644 index 0000000..d6ee516 --- /dev/null +++ b/argocd/applications/minio-aistor.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: minio-aistor + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + targetRevision: HEAD + path: minio-aistor + destination: + server: https://kubernetes.default.svc + namespace: minio-aistor + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/applications/netbootxyz.yaml b/argocd/applications/netbootxyz.yaml new file mode 100644 index 0000000..d7bad3c --- /dev/null +++ b/argocd/applications/netbootxyz.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: netbootxyz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: netbootxyz + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: netbootxyz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/argocd/applications/passbolt.yaml b/argocd/applications/passbolt.yaml new file mode 100644 index 0000000..4cccf3e --- /dev/null +++ b/argocd/applications/passbolt.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: passbolt + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: passbolt + targetRevision: HEAD + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: passbolt + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/applications/proxmox.yaml b/argocd/applications/proxmox.yaml new file mode 100644 index 0000000..5344a4c --- /dev/null +++ b/argocd/applications/proxmox.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: proxmox + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: proxmox + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: proxmox + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/argocd/applications/reactive-resume.yaml b/argocd/applications/reactive-resume.yaml new file mode 100644 index 0000000..d43bd82 --- /dev/null +++ b/argocd/applications/reactive-resume.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: reactive-resume + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: react-resume + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: resume + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/argocd/applications/searxng.yaml b/argocd/applications/searxng.yaml new file mode 100644 index 0000000..d4a265e --- /dev/null +++ b/argocd/applications/searxng.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: searxng + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: searxng + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: searxng + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true + ignoreDifferences: + - group: "" + kind: PersistentVolumeClaim + jsonPointers: + - /spec/volumeName diff --git a/argocd/applications/seerr.yaml b/argocd/applications/seerr.yaml new file mode 100644 index 0000000..263da34 --- /dev/null +++ b/argocd/applications/seerr.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: seerr + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: seerr + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: seerr + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/applications/technitium.yaml b/argocd/applications/technitium.yaml new file mode 100644 index 0000000..2d1c3b2 --- /dev/null +++ b/argocd/applications/technitium.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: technitium + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: technitium + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: technitium + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - Replace=true + - CreateNamespace=true + - PruneLast=true diff --git a/argocd/applications/truenas.yaml b/argocd/applications/truenas.yaml new file mode 100644 index 0000000..bdd2ce4 --- /dev/null +++ b/argocd/applications/truenas.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: truenas + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: truenas + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: truenas + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - Replace=true + - CreateNamespace=true + - PruneLast=true diff --git a/argocd/applications/unifi.yaml b/argocd/applications/unifi.yaml new file mode 100644 index 0000000..02852d0 --- /dev/null +++ b/argocd/applications/unifi.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: unifi + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: unifi + targetRevision: HEAD + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: unifi + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - ServerSideApply=true + - CreateNamespace=true diff --git a/argocd/applications/uptime-kuma.yaml b/argocd/applications/uptime-kuma.yaml new file mode 100644 index 0000000..9d6ad4d --- /dev/null +++ b/argocd/applications/uptime-kuma.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: uptime-kuma + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: uptime-kuma + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: uptime-kuma + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true diff --git a/argocd/applications/victoria-metrics.yaml b/argocd/applications/victoria-metrics.yaml new file mode 100644 index 0000000..bcaad6c --- /dev/null +++ b/argocd/applications/victoria-metrics.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: victoria-metrics + namespace: argocd +spec: + project: default + sources: + - repoURL: https://victoriametrics.github.io/helm-charts/ + chart: victoria-metrics-k8s-stack + targetRevision: 0.77.0 + helm: + # Release name kept short to avoid label length >63 chars on alertmanager StatefulSet pods + releaseName: vm + valueFiles: + - $values/victoria-metrics/values.yaml + - repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + targetRevision: HEAD + ref: values + - repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + targetRevision: HEAD + path: victoria-metrics + directory: + exclude: "values.yaml" + destination: + server: https://kubernetes.default.svc + namespace: victoria-metrics + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/argocd/applications/zipline.yaml b/argocd/applications/zipline.yaml new file mode 100644 index 0000000..f605d1b --- /dev/null +++ b/argocd/applications/zipline.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: zipline + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: zipline + targetRevision: HEAD + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: zipline + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/argocd/argocd-install.yaml b/argocd/argocd-install.yaml new file mode 100644 index 0000000..d07a03b --- /dev/null +++ b/argocd/argocd-install.yaml @@ -0,0 +1,28219 @@ +# This is an auto-generated file. DO NOT EDIT +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/name: applications.argoproj.io + app.kubernetes.io/part-of: argocd + name: applications.argoproj.io +spec: + group: argoproj.io + names: + kind: Application + listKind: ApplicationList + plural: applications + shortNames: + - app + - apps + singular: application + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.sync.status + name: Sync Status + type: string + - jsonPath: .status.health.status + name: Health Status + type: string + - jsonPath: .status.sync.revision + name: Revision + priority: 10 + type: string + - jsonPath: .spec.project + name: Project + priority: 10 + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: Application is a definition of Application resource. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + operation: + description: Operation contains information about a requested or running + operation + properties: + info: + description: Info is a list of informational items for this operation + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + initiatedBy: + description: InitiatedBy contains information about who initiated + the operations + properties: + automated: + description: Automated is set to true if operation was initiated + automatically by the application controller. + type: boolean + username: + description: Username contains the name of a user who started + operation + type: string + type: object + retry: + description: Retry controls the strategy to apply if a sync fails + properties: + backoff: + description: Backoff controls how to backoff on subsequent retries + of failed syncs + properties: + duration: + description: Duration is the amount to back off. Default unit + is seconds, but could also be a duration (e.g. "2m", "1h") + type: string + factor: + description: Factor is a factor to multiply the base duration + after each failed retry + format: int64 + type: integer + maxDuration: + description: MaxDuration is the maximum amount of time allowed + for the backoff strategy + type: string + type: object + limit: + description: Limit is the maximum number of attempts for retrying + a failed sync. If set to 0, no retries will be performed. + format: int64 + type: integer + refresh: + description: 'Refresh indicates if the latest revision should + be used on retry instead of the initial one (default: false)' + type: boolean + type: object + sync: + description: Sync contains parameters for the operation + properties: + autoHealAttemptsCount: + description: SelfHealAttemptsCount contains the number of auto-heal + attempts + format: int64 + type: integer + dryRun: + description: DryRun specifies to perform a `kubectl apply --dry-run` + without actually performing the sync + type: boolean + manifests: + description: Manifests is an optional field that overrides sync + source with a local directory for development + items: + type: string + type: array + prune: + description: Prune specifies to delete resources from the cluster + that are no longer tracked in git + type: boolean + resources: + description: Resources describes which resources shall be part + of the sync + items: + description: SyncOperationResource contains resources to sync. + properties: + group: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + type: array + revision: + description: |- + Revision is the revision (Git) or chart version (Helm) which to sync the application to + If omitted, will use the revision specified in app spec. + type: string + revisions: + description: |- + Revisions is the list of revision (Git) or chart version (Helm) which to sync each source in sources field for the application to + If omitted, will use the revision specified in app spec. + items: + type: string + type: array + source: + description: |- + Source overrides the source definition set in the application. + This is typically set in a Rollback operation and is nil during a Sync operation + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match + paths against that should be explicitly excluded from + being used during manifest generation + type: string + include: + description: Include contains a glob pattern to match + paths against that should be explicitly included during + manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable to + be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level Arguments + items: + description: JsonnetVar represents a variable to + be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to the + helm template + items: + description: HelmFileParameter is a file parameter that's + passed to helm template during manifest generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm template + from failing when valueFiles do not exist locally by + not appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to template + with. If left empty, defaults to the app's destination + namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters which + are passed to the helm template command upon manifest + generation + items: + description: HelmParameter is a parameter that's passed + to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether to tell + Helm to interpret booleans and numbers as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all domains + (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name to use. + If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema validation + (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files + to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed + to helm template, typically defined as a block. ValuesObject + takes precedence over Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to be + passed to helm template, defined as a map. This takes + precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for templating + ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional labels + to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources for + Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to force + applying common labels to resources for Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally by + not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize image + definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether to + apply common labels to resource templates or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether to + apply common labels to resource selectors or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is displayed + in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable entries + items: + description: EnvEntry represents an entry in the application's + environment + properties: + name: + description: Name is the name of the variable, usually + expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array type + parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type parameter. + type: object + name: + description: Name is the name identifying a parameter. + type: string + string: + description: String_ is the value of a string type + parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within sources + field. This field will not be used if used with a `source` + tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git or + Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + sources: + description: |- + Sources overrides the source definition set in the application. + This is typically set in a Rollback operation and is nil during a Sync operation + items: + description: ApplicationSource contains all required information + about the source of an application + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match + paths against that should be explicitly excluded from + being used during manifest generation + type: string + include: + description: Include contains a glob pattern to match + paths against that should be explicitly included during + manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to the + helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm template + from failing when valueFiles do not exist locally + by not appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to template + with. If left empty, defaults to the app's destination + namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command upon + manifest generation + items: + description: HelmParameter is a parameter that's passed + to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether to + tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all + domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name to + use. If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files + to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed + to helm template, typically defined as a block. ValuesObject + takes precedence over Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to be + passed to helm template, defined as a map. This takes + precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for + templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation + values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional labels + to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to + force applying common labels to resources for Kustomize + apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is displayed + in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable entries + items: + description: EnvEntry represents an entry in the application's + environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array type + parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type parameter. + type: object + name: + description: Name is the name identifying a parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within sources + field. This field will not be used if used with a `source` + tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git or + Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + type: array + syncOptions: + description: SyncOptions provide per-sync sync-options, e.g. Validate=false + items: + type: string + type: array + syncStrategy: + description: SyncStrategy describes how to perform the sync + properties: + apply: + description: Apply will perform a `kubectl apply` to perform + the sync. + properties: + force: + description: |- + Force indicates whether or not to supply the --force flag to `kubectl apply`. + The --force flag deletes and re-create the resource, when PATCH encounters conflict and has + retried for 5 times. + type: boolean + type: object + hook: + description: Hook will submit any referenced resources to + perform the sync. This is the default strategy + properties: + force: + description: |- + Force indicates whether or not to supply the --force flag to `kubectl apply`. + The --force flag deletes and re-create the resource, when PATCH encounters conflict and has + retried for 5 times. + type: boolean + type: object + type: object + type: object + type: object + spec: + description: ApplicationSpec represents desired application state. Contains + link to repository with application definition and additional parameters + link definition revision. + properties: + destination: + description: Destination is a reference to the target Kubernetes server + and namespace + properties: + name: + description: Name is an alternate way of specifying the target + cluster by its symbolic name. This must be set if Server is + not set. + type: string + namespace: + description: |- + Namespace specifies the target namespace for the application's resources. + The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace + type: string + server: + description: Server specifies the URL of the target cluster's + Kubernetes control plane API. This must be set if Name is not + set. + type: string + type: object + ignoreDifferences: + description: IgnoreDifferences is a list of resources and their fields + which should be ignored during comparison + items: + description: ResourceIgnoreDifferences contains resource filter + and list of json paths which should be ignored during comparison + with live state. + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + description: |- + ManagedFieldsManagers is a list of trusted managers. Fields mutated by those managers will take precedence over the + desired state defined in the SCM and won't be displayed in diffs + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + description: Info contains a list of information (URLs, email addresses, + and plain text) that relates to the application + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + description: |- + Project is a reference to the project this application belongs to. + The empty string means that application belongs to the 'default' project. + type: string + revisionHistoryLimit: + description: |- + RevisionHistoryLimit limits the number of items kept in the application's revision history, which is used for informational purposes as well as for rollbacks to previous versions. + This should only be changed in exceptional circumstances. + Setting to zero will store no history. This will reduce storage used. + Increasing will increase the space used to store the history, so we do not recommend increasing it. + Default is 10. + format: int64 + type: integer + source: + description: Source is a reference to the location of the application's + manifests or chart + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match paths + against that should be explicitly excluded from being used + during manifest generation + type: string + include: + description: Include contains a glob pattern to match paths + against that should be explicitly included during manifest + generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External Variables + items: + description: JsonnetVar represents a variable to be + passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level Arguments + items: + description: JsonnetVar represents a variable to be + passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to the helm + template + items: + description: HelmFileParameter is a file parameter that's + passed to helm template during manifest generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm template + from failing when valueFiles do not exist locally by not + appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to template + with. If left empty, defaults to the app's destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters which + are passed to the helm template command upon manifest generation + items: + description: HelmParameter is a parameter that's passed + to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether to tell + Helm to interpret booleans and numbers as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all domains + (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name to use. + If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition installation + step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema validation + (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation step + (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files to + use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed to + helm template, typically defined as a block. ValuesObject + takes precedence over Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to be passed + to helm template, defined as a map. This takes precedence + over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for templating + ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional annotations + to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether to + apply env variables substitution for annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional labels to + add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize components + to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether to force + applying common annotations to resources for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to force + applying common labels to resources for Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize from + failing when components do not exist locally by not appending + them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize image + definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether to apply + common labels to resource templates or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether to apply + common labels to resource selectors or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize adds + to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas override + specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize to + use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is displayed + in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific options + properties: + env: + description: Env is a list of environment variable entries + items: + description: EnvEntry represents an entry in the application's + environment + properties: + name: + description: Name is the name of the variable, usually + expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type parameter. + type: object + name: + description: Name is the name identifying a parameter. + type: string + string: + description: String_ is the value of a string type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within sources + field. This field will not be used if used with a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git or Helm) + that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + sourceHydrator: + description: SourceHydrator provides a way to push hydrated manifests + back to git before syncing them to the cluster. + properties: + drySource: + description: DrySource specifies where the dry "don't repeat yourself" + manifest source lives. + properties: + path: + description: Path is a directory path within the Git repository + where the manifests are located + type: string + repoURL: + description: RepoURL is the URL to the git repository that + contains the application manifests + type: string + targetRevision: + description: TargetRevision defines the revision of the source + to hydrate + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + description: |- + HydrateTo specifies an optional "staging" location to push hydrated manifests to. An external system would then + have to move manifests to the SyncSource, e.g. by pull request. + properties: + targetBranch: + description: TargetBranch is the branch to which hydrated + manifests should be committed + type: string + required: + - targetBranch + type: object + syncSource: + description: SyncSource specifies where to sync hydrated manifests + from. + properties: + path: + description: |- + Path is a directory path within the git repository where hydrated manifests should be committed to and synced + from. The Path should never point to the root of the repo. If hydrateTo is set, this is just the path from which + hydrated manifests will be synced. + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + description: |- + TargetBranch is the branch from which hydrated manifests will be synced. + If HydrateTo is not set, this is also the branch to which hydrated manifests are committed. + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + description: Sources is a reference to the location of the application's + manifests or chart + items: + description: ApplicationSource contains all required information + about the source of an application + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match paths + against that should be explicitly excluded from being + used during manifest generation + type: string + include: + description: Include contains a glob pattern to match paths + against that should be explicitly included during manifest + generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External Variables + items: + description: JsonnetVar represents a variable to be + passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level Arguments + items: + description: JsonnetVar represents a variable to be + passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to the helm + template + items: + description: HelmFileParameter is a file parameter that's + passed to helm template during manifest generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm template + from failing when valueFiles do not exist locally by not + appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to template + with. If left empty, defaults to the app's destination + namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters which + are passed to the helm template command upon manifest + generation + items: + description: HelmParameter is a parameter that's passed + to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether to tell + Helm to interpret booleans and numbers as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all domains + (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name to use. + If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition installation + step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema validation + (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files to + use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed to + helm template, typically defined as a block. ValuesObject + takes precedence over Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to be passed + to helm template, defined as a map. This takes precedence + over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for templating + ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional annotations + to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional labels + to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize components + to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether to + force applying common annotations to resources for Kustomize + apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to force + applying common labels to resources for Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally by not + appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize image + definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether to + apply common labels to resource templates or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether to apply + common labels to resource selectors or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas override + specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is displayed + in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable entries + items: + description: EnvEntry represents an entry in the application's + environment + properties: + name: + description: Name is the name of the variable, usually + expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type parameter. + type: object + name: + description: Name is the name identifying a parameter. + type: string + string: + description: String_ is the value of a string type + parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within sources + field. This field will not be used if used with a `source` + tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git or Helm) + that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + description: SyncPolicy controls when and how a sync will be performed + properties: + automated: + description: Automated will keep an application synced to the + target revision + properties: + allowEmpty: + description: 'AllowEmpty allows apps have zero live resources + (default: false)' + type: boolean + enabled: + description: Enable allows apps to explicitly control automated + sync + type: boolean + prune: + description: 'Prune specifies whether to delete resources + from the cluster that are not found in the sources anymore + as part of automated sync (default: false)' + type: boolean + selfHeal: + description: 'SelfHeal specifies whether to revert resources + back to their desired state upon modification in the cluster + (default: false)' + type: boolean + type: object + managedNamespaceMetadata: + description: ManagedNamespaceMetadata controls metadata in the + given namespace (if CreateNamespace=true) + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + description: Retry controls failed sync retry behavior + properties: + backoff: + description: Backoff controls how to backoff on subsequent + retries of failed syncs + properties: + duration: + description: Duration is the amount to back off. Default + unit is seconds, but could also be a duration (e.g. + "2m", "1h") + type: string + factor: + description: Factor is a factor to multiply the base duration + after each failed retry + format: int64 + type: integer + maxDuration: + description: MaxDuration is the maximum amount of time + allowed for the backoff strategy + type: string + type: object + limit: + description: Limit is the maximum number of attempts for retrying + a failed sync. If set to 0, no retries will be performed. + format: int64 + type: integer + refresh: + description: 'Refresh indicates if the latest revision should + be used on retry instead of the initial one (default: false)' + type: boolean + type: object + syncOptions: + description: Options allow you to specify whole app sync-options + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + status: + description: ApplicationStatus contains status information for the application + properties: + conditions: + description: Conditions is a list of currently observed application + conditions + items: + description: ApplicationCondition contains details about an application + condition, which is usually an error or warning + properties: + lastTransitionTime: + description: LastTransitionTime is the time the condition was + last observed + format: date-time + type: string + message: + description: Message contains human-readable message indicating + details about condition + type: string + type: + description: Type is an application condition type + type: string + required: + - message + - type + type: object + type: array + controllerNamespace: + description: ControllerNamespace indicates the namespace in which + the application controller is located + type: string + health: + description: Health contains information about the application's current + health status + properties: + lastTransitionTime: + description: LastTransitionTime is the time the HealthStatus was + set or updated + format: date-time + type: string + message: + description: |- + Message is a human-readable informational message describing the health status + + Deprecated: this field is not used and will be removed in a future release. + type: string + status: + description: Status holds the status code of the application + type: string + type: object + history: + description: History contains information about the application's + sync history + items: + description: RevisionHistory contains history information about + a previous sync + properties: + deployStartedAt: + description: DeployStartedAt holds the time the sync operation + started + format: date-time + type: string + deployedAt: + description: DeployedAt holds the time the sync operation completed + format: date-time + type: string + id: + description: ID is an auto incrementing identifier of the RevisionHistory + format: int64 + type: integer + initiatedBy: + description: InitiatedBy contains information about who initiated + the operations + properties: + automated: + description: Automated is set to true if operation was initiated + automatically by the application controller. + type: boolean + username: + description: Username contains the name of a user who started + operation + type: string + type: object + revision: + description: Revision holds the revision the sync was performed + against + type: string + revisions: + description: Revisions holds the revision of each source in + sources field the sync was performed against + items: + type: string + type: array + source: + description: Source is a reference to the application source + used for the sync operation + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match + paths against that should be explicitly excluded from + being used during manifest generation + type: string + include: + description: Include contains a glob pattern to match + paths against that should be explicitly included during + manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to the + helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm template + from failing when valueFiles do not exist locally + by not appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to template + with. If left empty, defaults to the app's destination + namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command upon + manifest generation + items: + description: HelmParameter is a parameter that's passed + to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether to + tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all + domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name to + use. If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files + to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed + to helm template, typically defined as a block. ValuesObject + takes precedence over Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to be + passed to helm template, defined as a map. This takes + precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for + templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation + values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional labels + to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to + force applying common labels to resources for Kustomize + apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is displayed + in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable entries + items: + description: EnvEntry represents an entry in the application's + environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array type + parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type parameter. + type: object + name: + description: Name is the name identifying a parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within sources + field. This field will not be used if used with a `source` + tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git or + Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + sources: + description: Sources is a reference to the application sources + used for the sync operation + items: + description: ApplicationSource contains all required information + about the source of an application + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match + paths against that should be explicitly excluded + from being used during manifest generation + type: string + include: + description: Include contains a glob pattern to match + paths against that should be explicitly included + during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to + the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm + template from failing when valueFiles do not exist + locally by not appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to + template with. If left empty, defaults to the app's + destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command upon + manifest generation + items: + description: HelmParameter is a parameter that's + passed to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm + parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all + domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name + to use. If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files + to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed + to helm template, typically defined as a block. + ValuesObject takes precedence over Values, so use + one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to + be passed to helm template, defined as a map. This + takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for + templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation + values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to + force applying common labels to resources for Kustomize + apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or + not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or + not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is + displayed in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry in the + application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array + type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type + parameter. + type: object + name: + description: Name is the name identifying a + parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within + sources field. This field will not be used if used with + a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git + or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + type: array + required: + - deployedAt + - id + type: object + type: array + observedAt: + description: |- + ObservedAt indicates when the application state was updated without querying latest git state + Deprecated: controller no longer updates ObservedAt field + format: date-time + type: string + operationState: + description: OperationState contains information about any ongoing + operations, such as a sync + properties: + finishedAt: + description: FinishedAt contains time of operation completion + format: date-time + type: string + message: + description: Message holds any pertinent messages when attempting + to perform operation (typically errors). + type: string + operation: + description: Operation is the original requested operation + properties: + info: + description: Info is a list of informational items for this + operation + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + initiatedBy: + description: InitiatedBy contains information about who initiated + the operations + properties: + automated: + description: Automated is set to true if operation was + initiated automatically by the application controller. + type: boolean + username: + description: Username contains the name of a user who + started operation + type: string + type: object + retry: + description: Retry controls the strategy to apply if a sync + fails + properties: + backoff: + description: Backoff controls how to backoff on subsequent + retries of failed syncs + properties: + duration: + description: Duration is the amount to back off. Default + unit is seconds, but could also be a duration (e.g. + "2m", "1h") + type: string + factor: + description: Factor is a factor to multiply the base + duration after each failed retry + format: int64 + type: integer + maxDuration: + description: MaxDuration is the maximum amount of + time allowed for the backoff strategy + type: string + type: object + limit: + description: Limit is the maximum number of attempts for + retrying a failed sync. If set to 0, no retries will + be performed. + format: int64 + type: integer + refresh: + description: 'Refresh indicates if the latest revision + should be used on retry instead of the initial one (default: + false)' + type: boolean + type: object + sync: + description: Sync contains parameters for the operation + properties: + autoHealAttemptsCount: + description: SelfHealAttemptsCount contains the number + of auto-heal attempts + format: int64 + type: integer + dryRun: + description: DryRun specifies to perform a `kubectl apply + --dry-run` without actually performing the sync + type: boolean + manifests: + description: Manifests is an optional field that overrides + sync source with a local directory for development + items: + type: string + type: array + prune: + description: Prune specifies to delete resources from + the cluster that are no longer tracked in git + type: boolean + resources: + description: Resources describes which resources shall + be part of the sync + items: + description: SyncOperationResource contains resources + to sync. + properties: + group: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + type: array + revision: + description: |- + Revision is the revision (Git) or chart version (Helm) which to sync the application to + If omitted, will use the revision specified in app spec. + type: string + revisions: + description: |- + Revisions is the list of revision (Git) or chart version (Helm) which to sync each source in sources field for the application to + If omitted, will use the revision specified in app spec. + items: + type: string + type: array + source: + description: |- + Source overrides the source definition set in the application. + This is typically set in a Rollback operation and is nil during a Sync operation + properties: + chart: + description: Chart is a Helm chart name, and must + be specified for applications sourced from a Helm + repo. + type: string + directory: + description: Directory holds path/directory specific + options + properties: + exclude: + description: Exclude contains a glob pattern to + match paths against that should be explicitly + excluded from being used during manifest generation + type: string + include: + description: Include contains a glob pattern to + match paths against that should be explicitly + included during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to + Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet + External Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan + a directory recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters + to the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm + parameter + type: string + path: + description: Path is the path to the file + containing the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents + helm template from failing when valueFiles do + not exist locally by not appending them to helm + template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace + to template with. If left empty, defaults to + the app's destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command + upon manifest generation + items: + description: HelmParameter is a parameter that's + passed to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and + numbers as strings + type: boolean + name: + description: Name is the name of the Helm + parameter + type: string + value: + description: Value is the value for the + Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials + to all domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name + to use. If omitted it will use the application + name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value + files to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be + passed to helm template, typically defined as + a block. ValuesObject takes precedence over + Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values + to be passed to helm template, defined as a + map. This takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use + for templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies + whether to apply env variables substitution + for annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before + building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies + whether to force applying common annotations + to resources for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether + to force applying common labels to resources + for Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents + kustomize from failing when components do not + exist locally by not appending them to kustomization + file + type: boolean + images: + description: Images is a list of Kustomize image + override specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates + or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors + or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to + resources for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to + resources for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that + Kustomize adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of + Kustomize to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and + is displayed in the UI. It is used in multi-source + Applications. + type: string + path: + description: Path is a directory path within the Git + repository, and is only valid for applications sourced + from Git. + type: string + plugin: + description: Plugin holds config management plugin + specific options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry in + the application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array + type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type + parameter. + type: object + name: + description: Name is the name identifying + a parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within + sources field. This field will not be used if used + with a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository + (Git or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + sources: + description: |- + Sources overrides the source definition set in the application. + This is typically set in a Rollback operation and is nil during a Sync operation + items: + description: ApplicationSource contains all required + information about the source of an application + properties: + chart: + description: Chart is a Helm chart name, and must + be specified for applications sourced from a Helm + repo. + type: string + directory: + description: Directory holds path/directory specific + options + properties: + exclude: + description: Exclude contains a glob pattern + to match paths against that should be explicitly + excluded from being used during manifest generation + type: string + include: + description: Include contains a glob pattern + to match paths against that should be explicitly + included during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific + to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet + External Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan + a directory recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters + to the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm + parameter + type: string + path: + description: Path is the path to the file + containing the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents + helm template from failing when valueFiles + do not exist locally by not appending them + to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace + to template with. If left empty, defaults + to the app's destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command + upon manifest generation + items: + description: HelmParameter is a parameter + that's passed to helm template during manifest + generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and + numbers as strings + type: boolean + name: + description: Name is the name of the Helm + parameter + type: string + value: + description: Value is the value for the + Helm parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials + to all domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release + name to use. If omitted it will use the application + name + type: string + skipCrds: + description: SkipCrds skips custom resource + definition installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON + schema validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value + files to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to + be passed to helm template, typically defined + as a block. ValuesObject takes precedence + over Values, so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values + to be passed to helm template, defined as + a map. This takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to + use for templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific + options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of + additional annotations to add to rendered + manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies + whether to apply env variables substitution + for annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of + kustomize components to add to the kustomization + before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies + whether to force applying common annotations + to resources for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether + to force applying common labels to resources + for Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents + kustomize from failing when components do + not exist locally by not appending them to + kustomization file + type: boolean + images: + description: Images is a list of Kustomize image + override specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies + whether to apply common labels to resource + templates or not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies + whether to apply common labels to resource + selectors or not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended + to resources for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended + to resources for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that + Kustomize adds to all resources + type: string + patches: + description: Patches is a list of Kustomize + patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize + Replicas override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version + of Kustomize to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and + is displayed in the UI. It is used in multi-source + Applications. + type: string + path: + description: Path is a directory path within the + Git repository, and is only valid for applications + sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin + specific options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry + in the application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the + variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an + array type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map + type parameter. + type: object + name: + description: Name is the name identifying + a parameter. + type: string + string: + description: String_ is the value of a + string type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source + within sources field. This field will not be used + if used with a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository + (Git or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + type: array + syncOptions: + description: SyncOptions provide per-sync sync-options, + e.g. Validate=false + items: + type: string + type: array + syncStrategy: + description: SyncStrategy describes how to perform the + sync + properties: + apply: + description: Apply will perform a `kubectl apply` + to perform the sync. + properties: + force: + description: |- + Force indicates whether or not to supply the --force flag to `kubectl apply`. + The --force flag deletes and re-create the resource, when PATCH encounters conflict and has + retried for 5 times. + type: boolean + type: object + hook: + description: Hook will submit any referenced resources + to perform the sync. This is the default strategy + properties: + force: + description: |- + Force indicates whether or not to supply the --force flag to `kubectl apply`. + The --force flag deletes and re-create the resource, when PATCH encounters conflict and has + retried for 5 times. + type: boolean + type: object + type: object + type: object + type: object + phase: + description: Phase is the current phase of the operation + type: string + retryCount: + description: RetryCount contains time of operation retries + format: int64 + type: integer + startedAt: + description: StartedAt contains time of operation start + format: date-time + type: string + syncResult: + description: SyncResult is the result of a Sync operation + properties: + managedNamespaceMetadata: + description: ManagedNamespaceMetadata contains the current + sync state of managed namespace metadata + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + resources: + description: Resources contains a list of sync result items + for each individual resource in a sync operation + items: + description: ResourceResult holds the operation result details + of a specific resource + properties: + group: + description: Group specifies the API group of the resource + type: string + hookPhase: + description: |- + HookPhase contains the state of any operation associated with this resource OR hook + This can also contain values for non-hook resources. + type: string + hookType: + description: HookType specifies the type of the hook. + Empty for non-hook resources + type: string + images: + description: Images contains the images related to the + ResourceResult + items: + type: string + type: array + kind: + description: Kind specifies the API kind of the resource + type: string + message: + description: Message contains an informational or error + message for the last sync OR operation + type: string + name: + description: Name specifies the name of the resource + type: string + namespace: + description: Namespace specifies the target namespace + of the resource + type: string + status: + description: Status holds the final result of the sync. + Will be empty if the resources is yet to be applied/pruned + and is always zero-value for hooks + type: string + syncPhase: + description: SyncPhase indicates the particular phase + of the sync that this result was acquired in + type: string + version: + description: Version specifies the API version of the + resource + type: string + required: + - group + - kind + - name + - namespace + - version + type: object + type: array + revision: + description: Revision holds the revision this sync operation + was performed to + type: string + revisions: + description: Revisions holds the revision this sync operation + was performed for respective indexed source in sources field + items: + type: string + type: array + source: + description: Source records the application source information + of the sync, used for comparing auto-sync + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match + paths against that should be explicitly excluded + from being used during manifest generation + type: string + include: + description: Include contains a glob pattern to match + paths against that should be explicitly included + during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to + the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm + template from failing when valueFiles do not exist + locally by not appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to + template with. If left empty, defaults to the app's + destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command upon + manifest generation + items: + description: HelmParameter is a parameter that's + passed to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm + parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all + domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name + to use. If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files + to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed + to helm template, typically defined as a block. + ValuesObject takes precedence over Values, so use + one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to + be passed to helm template, defined as a map. This + takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for + templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation + values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to + force applying common labels to resources for Kustomize + apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or + not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or + not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is + displayed in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry in the + application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array + type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type + parameter. + type: object + name: + description: Name is the name identifying a + parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within + sources field. This field will not be used if used with + a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git + or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + sources: + description: Source records the application source information + of the sync, used for comparing auto-sync + items: + description: ApplicationSource contains all required information + about the source of an application + properties: + chart: + description: Chart is a Helm chart name, and must be + specified for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific + options + properties: + exclude: + description: Exclude contains a glob pattern to + match paths against that should be explicitly + excluded from being used during manifest generation + type: string + include: + description: Include contains a glob pattern to + match paths against that should be explicitly + included during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a + directory recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters + to the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm + parameter + type: string + path: + description: Path is the path to the file + containing the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm + template from failing when valueFiles do not exist + locally by not appending them to helm template + --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace + to template with. If left empty, defaults to the + app's destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command + upon manifest generation + items: + description: HelmParameter is a parameter that's + passed to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm + parameter + type: string + value: + description: Value is the value for the Helm + parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to + all domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name + to use. If omitted it will use the application + name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value + files to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be + passed to helm template, typically defined as + a block. ValuesObject takes precedence over Values, + so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values + to be passed to helm template, defined as a map. + This takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use + for templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies + whether to apply env variables substitution for + annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before + building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether + to force applying common labels to resources for + Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image + override specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or + not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or + not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to + resources for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to + resources for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is + displayed in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git + repository, and is only valid for applications sourced + from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry in the + application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array + type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type + parameter. + type: object + name: + description: Name is the name identifying + a parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within + sources field. This field will not be used if used + with a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git + or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + type: array + required: + - revision + type: object + required: + - operation + - phase + - startedAt + type: object + reconciledAt: + description: ReconciledAt indicates when the application state was + reconciled using the latest git version + format: date-time + type: string + resourceHealthSource: + description: 'ResourceHealthSource indicates where the resource health + status is stored: inline if not set or appTree' + type: string + resources: + description: Resources is a list of Kubernetes resources managed by + this application + items: + description: ResourceStatus holds the current synchronization and + health status of a Kubernetes resource. + properties: + group: + description: Group represents the API group of the resource + (e.g., "apps" for Deployments). + type: string + health: + description: Health indicates the health status of the resource + (e.g., Healthy, Degraded, Progressing). + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the time the HealthStatus was set or updated + + Deprecated: this field is not used and will be removed in a future release. + format: date-time + type: string + message: + description: Message is a human-readable informational message + describing the health status + type: string + status: + description: Status holds the status code of the resource + type: string + type: object + hook: + description: Hook is true if the resource is used as a lifecycle + hook in an Argo CD application. + type: boolean + kind: + description: Kind specifies the type of the resource (e.g., + "Deployment", "Service"). + type: string + name: + description: Name is the unique name of the resource within + the namespace. + type: string + namespace: + description: Namespace defines the Kubernetes namespace where + the resource is located. + type: string + requiresDeletionConfirmation: + description: RequiresDeletionConfirmation is true if the resource + requires explicit user confirmation before deletion. + type: boolean + requiresPruning: + description: RequiresPruning is true if the resource needs to + be pruned (deleted) as part of synchronization. + type: boolean + status: + description: Status represents the synchronization state of + the resource (e.g., Synced, OutOfSync). + type: string + syncWave: + description: |- + SyncWave determines the order in which resources are applied during a sync operation. + Lower values are applied first. + format: int64 + type: integer + version: + description: Version indicates the API version of the resource + (e.g., "v1", "v1beta1"). + type: string + type: object + type: array + sourceHydrator: + description: SourceHydrator stores information about the current state + of source hydration + properties: + currentOperation: + description: CurrentOperation holds the status of the hydrate + operation + properties: + drySHA: + description: DrySHA holds the resolved revision (sha) of the + dry source as of the most recent reconciliation + type: string + finishedAt: + description: FinishedAt indicates when the hydrate operation + finished + format: date-time + type: string + hydratedSHA: + description: HydratedSHA holds the resolved revision (sha) + of the hydrated source as of the most recent reconciliation + type: string + message: + description: Message contains a message describing the current + status of the hydrate operation + type: string + phase: + description: Phase indicates the status of the hydrate operation + enum: + - Hydrating + - Failed + - Hydrated + type: string + sourceHydrator: + description: SourceHydrator holds the hydrator config used + for the hydrate operation + properties: + drySource: + description: DrySource specifies where the dry "don't + repeat yourself" manifest source lives. + properties: + path: + description: Path is a directory path within the Git + repository where the manifests are located + type: string + repoURL: + description: RepoURL is the URL to the git repository + that contains the application manifests + type: string + targetRevision: + description: TargetRevision defines the revision of + the source to hydrate + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + description: |- + HydrateTo specifies an optional "staging" location to push hydrated manifests to. An external system would then + have to move manifests to the SyncSource, e.g. by pull request. + properties: + targetBranch: + description: TargetBranch is the branch to which hydrated + manifests should be committed + type: string + required: + - targetBranch + type: object + syncSource: + description: SyncSource specifies where to sync hydrated + manifests from. + properties: + path: + description: |- + Path is a directory path within the git repository where hydrated manifests should be committed to and synced + from. The Path should never point to the root of the repo. If hydrateTo is set, this is just the path from which + hydrated manifests will be synced. + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + description: |- + TargetBranch is the branch from which hydrated manifests will be synced. + If HydrateTo is not set, this is also the branch to which hydrated manifests are committed. + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + startedAt: + description: StartedAt indicates when the hydrate operation + started + format: date-time + type: string + required: + - message + - phase + type: object + lastSuccessfulOperation: + description: LastSuccessfulOperation holds info about the most + recent successful hydration + properties: + drySHA: + description: DrySHA holds the resolved revision (sha) of the + dry source as of the most recent reconciliation + type: string + hydratedSHA: + description: HydratedSHA holds the resolved revision (sha) + of the hydrated source as of the most recent reconciliation + type: string + sourceHydrator: + description: SourceHydrator holds the hydrator config used + for the hydrate operation + properties: + drySource: + description: DrySource specifies where the dry "don't + repeat yourself" manifest source lives. + properties: + path: + description: Path is a directory path within the Git + repository where the manifests are located + type: string + repoURL: + description: RepoURL is the URL to the git repository + that contains the application manifests + type: string + targetRevision: + description: TargetRevision defines the revision of + the source to hydrate + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + description: |- + HydrateTo specifies an optional "staging" location to push hydrated manifests to. An external system would then + have to move manifests to the SyncSource, e.g. by pull request. + properties: + targetBranch: + description: TargetBranch is the branch to which hydrated + manifests should be committed + type: string + required: + - targetBranch + type: object + syncSource: + description: SyncSource specifies where to sync hydrated + manifests from. + properties: + path: + description: |- + Path is a directory path within the git repository where hydrated manifests should be committed to and synced + from. The Path should never point to the root of the repo. If hydrateTo is set, this is just the path from which + hydrated manifests will be synced. + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + description: |- + TargetBranch is the branch from which hydrated manifests will be synced. + If HydrateTo is not set, this is also the branch to which hydrated manifests are committed. + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + type: object + type: object + sourceType: + description: SourceType specifies the type of this application + type: string + sourceTypes: + description: SourceTypes specifies the type of the sources included + in the application + items: + description: ApplicationSourceType specifies the type of the application's + source + type: string + type: array + summary: + description: Summary contains a list of URLs and container images + used by this application + properties: + externalURLs: + description: ExternalURLs holds all external URLs of application + child resources. + items: + type: string + type: array + images: + description: Images holds all images of application child resources. + items: + type: string + type: array + type: object + sync: + description: Sync contains information about the application's current + sync status + properties: + comparedTo: + description: ComparedTo contains information about what has been + compared + properties: + destination: + description: Destination is a reference to the application's + destination used for comparison + properties: + name: + description: Name is an alternate way of specifying the + target cluster by its symbolic name. This must be set + if Server is not set. + type: string + namespace: + description: |- + Namespace specifies the target namespace for the application's resources. + The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace + type: string + server: + description: Server specifies the URL of the target cluster's + Kubernetes control plane API. This must be set if Name + is not set. + type: string + type: object + ignoreDifferences: + description: IgnoreDifferences is a reference to the application's + ignored differences used for comparison + items: + description: ResourceIgnoreDifferences contains resource + filter and list of json paths which should be ignored + during comparison with live state. + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + description: |- + ManagedFieldsManagers is a list of trusted managers. Fields mutated by those managers will take precedence over the + desired state defined in the SCM and won't be displayed in diffs + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + source: + description: Source is a reference to the application's source + used for comparison + properties: + chart: + description: Chart is a Helm chart name, and must be specified + for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific options + properties: + exclude: + description: Exclude contains a glob pattern to match + paths against that should be explicitly excluded + from being used during manifest generation + type: string + include: + description: Include contains a glob pattern to match + paths against that should be explicitly included + during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a directory + recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters to + the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm parameter + type: string + path: + description: Path is the path to the file containing + the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm + template from failing when valueFiles do not exist + locally by not appending them to helm template --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace to + template with. If left empty, defaults to the app's + destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command upon + manifest generation + items: + description: HelmParameter is a parameter that's + passed to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm parameter + type: string + value: + description: Value is the value for the Helm + parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to all + domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name + to use. If omitted it will use the application name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value files + to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be passed + to helm template, typically defined as a block. + ValuesObject takes precedence over Values, so use + one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values to + be passed to helm template, defined as a map. This + takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use for + templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies whether + to apply env variables substitution for annotation + values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether to + force applying common labels to resources for Kustomize + apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image override + specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or + not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or + not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to resources + for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to resources + for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is + displayed in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git repository, + and is only valid for applications sourced from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry in the + application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array + type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type + parameter. + type: object + name: + description: Name is the name identifying a + parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within + sources field. This field will not be used if used with + a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git + or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + sources: + description: Sources is a reference to the application's multiple + sources used for comparison + items: + description: ApplicationSource contains all required information + about the source of an application + properties: + chart: + description: Chart is a Helm chart name, and must be + specified for applications sourced from a Helm repo. + type: string + directory: + description: Directory holds path/directory specific + options + properties: + exclude: + description: Exclude contains a glob pattern to + match paths against that should be explicitly + excluded from being used during manifest generation + type: string + include: + description: Include contains a glob pattern to + match paths against that should be explicitly + included during manifest generation + type: string + jsonnet: + description: Jsonnet holds options specific to Jsonnet + properties: + extVars: + description: ExtVars is a list of Jsonnet External + Variables + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + description: Additional library search dirs + items: + type: string + type: array + tlas: + description: TLAS is a list of Jsonnet Top-level + Arguments + items: + description: JsonnetVar represents a variable + to be passed to jsonnet during manifest + generation + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + description: Recurse specifies whether to scan a + directory recursively for manifests + type: boolean + type: object + helm: + description: Helm holds helm specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + fileParameters: + description: FileParameters are file parameters + to the helm template + items: + description: HelmFileParameter is a file parameter + that's passed to helm template during manifest + generation + properties: + name: + description: Name is the name of the Helm + parameter + type: string + path: + description: Path is the path to the file + containing the values for the Helm parameter + type: string + type: object + type: array + ignoreMissingValueFiles: + description: IgnoreMissingValueFiles prevents helm + template from failing when valueFiles do not exist + locally by not appending them to helm template + --values + type: boolean + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + namespace: + description: Namespace is an optional namespace + to template with. If left empty, defaults to the + app's destination namespace. + type: string + parameters: + description: Parameters is a list of Helm parameters + which are passed to the helm template command + upon manifest generation + items: + description: HelmParameter is a parameter that's + passed to helm template during manifest generation + properties: + forceString: + description: ForceString determines whether + to tell Helm to interpret booleans and numbers + as strings + type: boolean + name: + description: Name is the name of the Helm + parameter + type: string + value: + description: Value is the value for the Helm + parameter + type: string + type: object + type: array + passCredentials: + description: PassCredentials pass credentials to + all domains (Helm's --pass-credentials) + type: boolean + releaseName: + description: ReleaseName is the Helm release name + to use. If omitted it will use the application + name + type: string + skipCrds: + description: SkipCrds skips custom resource definition + installation step (Helm's --skip-crds) + type: boolean + skipSchemaValidation: + description: SkipSchemaValidation skips JSON schema + validation (Helm's --skip-schema-validation) + type: boolean + skipTests: + description: SkipTests skips test manifest installation + step (Helm's --skip-tests). + type: boolean + valueFiles: + description: ValuesFiles is a list of Helm value + files to use when generating a template + items: + type: string + type: array + values: + description: Values specifies Helm values to be + passed to helm template, typically defined as + a block. ValuesObject takes precedence over Values, + so use one or the other. + type: string + valuesObject: + description: ValuesObject specifies Helm values + to be passed to helm template, defined as a map. + This takes precedence over Values. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: Version is the Helm version to use + for templating ("3") + type: string + type: object + kustomize: + description: Kustomize holds kustomize specific options + properties: + apiVersions: + description: |- + APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, + Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + description: CommonAnnotations is a list of additional + annotations to add to rendered manifests + type: object + commonAnnotationsEnvsubst: + description: CommonAnnotationsEnvsubst specifies + whether to apply env variables substitution for + annotation values + type: boolean + commonLabels: + additionalProperties: + type: string + description: CommonLabels is a list of additional + labels to add to rendered manifests + type: object + components: + description: Components specifies a list of kustomize + components to add to the kustomization before + building + items: + type: string + type: array + forceCommonAnnotations: + description: ForceCommonAnnotations specifies whether + to force applying common annotations to resources + for Kustomize apps + type: boolean + forceCommonLabels: + description: ForceCommonLabels specifies whether + to force applying common labels to resources for + Kustomize apps + type: boolean + ignoreMissingComponents: + description: IgnoreMissingComponents prevents kustomize + from failing when components do not exist locally + by not appending them to kustomization file + type: boolean + images: + description: Images is a list of Kustomize image + override specifications + items: + description: KustomizeImage represents a Kustomize + image definition in the format [old_image_name=]: + type: string + type: array + kubeVersion: + description: |- + KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD + uses the Kubernetes version of the target cluster. + type: string + labelIncludeTemplates: + description: LabelIncludeTemplates specifies whether + to apply common labels to resource templates or + not + type: boolean + labelWithoutSelector: + description: LabelWithoutSelector specifies whether + to apply common labels to resource selectors or + not + type: boolean + namePrefix: + description: NamePrefix is a prefix appended to + resources for Kustomize apps + type: string + nameSuffix: + description: NameSuffix is a suffix appended to + resources for Kustomize apps + type: string + namespace: + description: Namespace sets the namespace that Kustomize + adds to all resources + type: string + patches: + description: Patches is a list of Kustomize patches + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + description: Replicas is a list of Kustomize Replicas + override specifications + items: + properties: + count: + anyOf: + - type: integer + - type: string + description: Number of replicas + x-kubernetes-int-or-string: true + name: + description: Name of Deployment or StatefulSet + type: string + required: + - count + - name + type: object + type: array + version: + description: Version controls which version of Kustomize + to use for rendering manifests + type: string + type: object + name: + description: Name is used to refer to a source and is + displayed in the UI. It is used in multi-source Applications. + type: string + path: + description: Path is a directory path within the Git + repository, and is only valid for applications sourced + from Git. + type: string + plugin: + description: Plugin holds config management plugin specific + options + properties: + env: + description: Env is a list of environment variable + entries + items: + description: EnvEntry represents an entry in the + application's environment + properties: + name: + description: Name is the name of the variable, + usually expressed in uppercase + type: string + value: + description: Value is the value of the variable + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + description: Array is the value of an array + type parameter. + items: + type: string + type: array + map: + additionalProperties: + type: string + description: Map is the value of a map type + parameter. + type: object + name: + description: Name is the name identifying + a parameter. + type: string + string: + description: String_ is the value of a string + type parameter. + type: string + type: object + type: array + type: object + ref: + description: Ref is reference to another source within + sources field. This field will not be used if used + with a `source` tag. + type: string + repoURL: + description: RepoURL is the URL to the repository (Git + or Helm) that contains the application manifests + type: string + targetRevision: + description: |- + TargetRevision defines the revision of the source to sync the application to. + In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. + In case of Helm, this is a semver tag for the Chart's version. + type: string + required: + - repoURL + type: object + type: array + required: + - destination + type: object + revision: + description: Revision contains information about the revision + the comparison has been performed to + type: string + revisions: + description: Revisions contains information about the revisions + of multiple sources the comparison has been performed to + items: + type: string + type: array + status: + description: Status is the sync state of the comparison + type: string + required: + - status + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/name: applicationsets.argoproj.io + app.kubernetes.io/part-of: argocd + name: applicationsets.argoproj.io +spec: + group: argoproj.io + names: + kind: ApplicationSet + listKind: ApplicationSetList + plural: applicationsets + shortNames: + - appset + - appsets + singular: applicationset + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + applyNestedSelectors: + type: boolean + generators: + items: + properties: + clusterDecisionResource: + properties: + configMapRef: + type: string + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + name: + type: string + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - configMapRef + type: object + clusters: + properties: + flatList: + type: boolean + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + git: + properties: + directories: + items: + properties: + exclude: + type: boolean + path: + type: string + required: + - path + type: object + type: array + files: + items: + properties: + exclude: + type: boolean + path: + type: string + required: + - path + type: object + type: array + pathParamPrefix: + type: string + repoURL: + type: string + requeueAfterSeconds: + format: int64 + type: integer + revision: + type: string + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - repoURL + - revision + type: object + list: + properties: + elements: + items: + x-kubernetes-preserve-unknown-fields: true + type: array + elementsYaml: + type: string + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + type: object + matrix: + properties: + generators: + items: + properties: + clusterDecisionResource: + properties: + configMapRef: + type: string + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + name: + type: string + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - configMapRef + type: object + clusters: + properties: + flatList: + type: boolean + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + git: + properties: + directories: + items: + properties: + exclude: + type: boolean + path: + type: string + required: + - path + type: object + type: array + files: + items: + properties: + exclude: + type: boolean + path: + type: string + required: + - path + type: object + type: array + pathParamPrefix: + type: string + repoURL: + type: string + requeueAfterSeconds: + format: int64 + type: integer + revision: + type: string + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - repoURL + - revision + type: object + list: + properties: + elements: + items: + x-kubernetes-preserve-unknown-fields: true + type: array + elementsYaml: + type: string + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + type: object + matrix: + x-kubernetes-preserve-unknown-fields: true + merge: + x-kubernetes-preserve-unknown-fields: true + plugin: + properties: + configMapRef: + properties: + name: + type: string + required: + - name + type: object + input: + properties: + parameters: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - configMapRef + type: object + pullRequest: + properties: + azuredevops: + properties: + api: + type: string + labels: + items: + type: string + type: array + organization: + type: string + project: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - organization + - project + - repo + type: object + bitbucket: + properties: + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + owner: + type: string + repo: + type: string + required: + - owner + - repo + type: object + bitbucketServer: + properties: + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + project: + type: string + repo: + type: string + required: + - api + - project + - repo + type: object + continueOnRepoNotFoundError: + type: boolean + filters: + items: + properties: + branchMatch: + type: string + targetBranchMatch: + type: string + titleMatch: + type: string + type: object + type: array + gitea: + properties: + api: + type: string + insecure: + type: boolean + labels: + items: + type: string + type: array + owner: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - api + - owner + - repo + type: object + github: + properties: + api: + type: string + appSecretName: + type: string + labels: + items: + type: string + type: array + owner: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - owner + - repo + type: object + gitlab: + properties: + api: + type: string + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + labels: + items: + type: string + type: array + project: + type: string + pullRequestState: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - project + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + scmProvider: + properties: + awsCodeCommit: + properties: + allBranches: + type: boolean + region: + type: string + role: + type: string + tagFilters: + items: + properties: + key: + type: string + value: + type: string + required: + - key + type: object + type: array + type: object + azureDevOps: + properties: + accessTokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + allBranches: + type: boolean + api: + type: string + organization: + type: string + teamProject: + type: string + required: + - accessTokenRef + - organization + - teamProject + type: object + bitbucket: + properties: + allBranches: + type: boolean + appPasswordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + owner: + type: string + user: + type: string + required: + - appPasswordRef + - owner + - user + type: object + bitbucketServer: + properties: + allBranches: + type: boolean + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + project: + type: string + required: + - api + - project + type: object + cloneProtocol: + type: string + filters: + items: + properties: + branchMatch: + type: string + labelMatch: + type: string + pathsDoNotExist: + items: + type: string + type: array + pathsExist: + items: + type: string + type: array + repositoryMatch: + type: string + type: object + type: array + gitea: + properties: + allBranches: + type: boolean + api: + type: string + insecure: + type: boolean + owner: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - api + - owner + type: object + github: + properties: + allBranches: + type: boolean + api: + type: string + appSecretName: + type: string + organization: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - organization + type: object + gitlab: + properties: + allBranches: + type: boolean + api: + type: string + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + group: + type: string + includeSharedProjects: + type: boolean + includeSubgroups: + type: boolean + insecure: + type: boolean + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + topic: + type: string + required: + - group + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + required: + - generators + type: object + merge: + properties: + generators: + items: + properties: + clusterDecisionResource: + properties: + configMapRef: + type: string + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + name: + type: string + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - configMapRef + type: object + clusters: + properties: + flatList: + type: boolean + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + git: + properties: + directories: + items: + properties: + exclude: + type: boolean + path: + type: string + required: + - path + type: object + type: array + files: + items: + properties: + exclude: + type: boolean + path: + type: string + required: + - path + type: object + type: array + pathParamPrefix: + type: string + repoURL: + type: string + requeueAfterSeconds: + format: int64 + type: integer + revision: + type: string + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - repoURL + - revision + type: object + list: + properties: + elements: + items: + x-kubernetes-preserve-unknown-fields: true + type: array + elementsYaml: + type: string + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + type: object + matrix: + x-kubernetes-preserve-unknown-fields: true + merge: + x-kubernetes-preserve-unknown-fields: true + plugin: + properties: + configMapRef: + properties: + name: + type: string + required: + - name + type: object + input: + properties: + parameters: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - configMapRef + type: object + pullRequest: + properties: + azuredevops: + properties: + api: + type: string + labels: + items: + type: string + type: array + organization: + type: string + project: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - organization + - project + - repo + type: object + bitbucket: + properties: + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + owner: + type: string + repo: + type: string + required: + - owner + - repo + type: object + bitbucketServer: + properties: + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + project: + type: string + repo: + type: string + required: + - api + - project + - repo + type: object + continueOnRepoNotFoundError: + type: boolean + filters: + items: + properties: + branchMatch: + type: string + targetBranchMatch: + type: string + titleMatch: + type: string + type: object + type: array + gitea: + properties: + api: + type: string + insecure: + type: boolean + labels: + items: + type: string + type: array + owner: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - api + - owner + - repo + type: object + github: + properties: + api: + type: string + appSecretName: + type: string + labels: + items: + type: string + type: array + owner: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - owner + - repo + type: object + gitlab: + properties: + api: + type: string + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + labels: + items: + type: string + type: array + project: + type: string + pullRequestState: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - project + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + scmProvider: + properties: + awsCodeCommit: + properties: + allBranches: + type: boolean + region: + type: string + role: + type: string + tagFilters: + items: + properties: + key: + type: string + value: + type: string + required: + - key + type: object + type: array + type: object + azureDevOps: + properties: + accessTokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + allBranches: + type: boolean + api: + type: string + organization: + type: string + teamProject: + type: string + required: + - accessTokenRef + - organization + - teamProject + type: object + bitbucket: + properties: + allBranches: + type: boolean + appPasswordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + owner: + type: string + user: + type: string + required: + - appPasswordRef + - owner + - user + type: object + bitbucketServer: + properties: + allBranches: + type: boolean + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + project: + type: string + required: + - api + - project + type: object + cloneProtocol: + type: string + filters: + items: + properties: + branchMatch: + type: string + labelMatch: + type: string + pathsDoNotExist: + items: + type: string + type: array + pathsExist: + items: + type: string + type: array + repositoryMatch: + type: string + type: object + type: array + gitea: + properties: + allBranches: + type: boolean + api: + type: string + insecure: + type: boolean + owner: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - api + - owner + type: object + github: + properties: + allBranches: + type: boolean + api: + type: string + appSecretName: + type: string + organization: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - organization + type: object + gitlab: + properties: + allBranches: + type: boolean + api: + type: string + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + group: + type: string + includeSharedProjects: + type: boolean + includeSubgroups: + type: boolean + insecure: + type: boolean + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + topic: + type: string + required: + - group + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + mergeKeys: + items: + type: string + type: array + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + required: + - generators + - mergeKeys + type: object + plugin: + properties: + configMapRef: + properties: + name: + type: string + required: + - name + type: object + input: + properties: + parameters: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + required: + - configMapRef + type: object + pullRequest: + properties: + azuredevops: + properties: + api: + type: string + labels: + items: + type: string + type: array + organization: + type: string + project: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - organization + - project + - repo + type: object + bitbucket: + properties: + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + owner: + type: string + repo: + type: string + required: + - owner + - repo + type: object + bitbucketServer: + properties: + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + project: + type: string + repo: + type: string + required: + - api + - project + - repo + type: object + continueOnRepoNotFoundError: + type: boolean + filters: + items: + properties: + branchMatch: + type: string + targetBranchMatch: + type: string + titleMatch: + type: string + type: object + type: array + gitea: + properties: + api: + type: string + insecure: + type: boolean + labels: + items: + type: string + type: array + owner: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - api + - owner + - repo + type: object + github: + properties: + api: + type: string + appSecretName: + type: string + labels: + items: + type: string + type: array + owner: + type: string + repo: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - owner + - repo + type: object + gitlab: + properties: + api: + type: string + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + labels: + items: + type: string + type: array + project: + type: string + pullRequestState: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - project + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + scmProvider: + properties: + awsCodeCommit: + properties: + allBranches: + type: boolean + region: + type: string + role: + type: string + tagFilters: + items: + properties: + key: + type: string + value: + type: string + required: + - key + type: object + type: array + type: object + azureDevOps: + properties: + accessTokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + allBranches: + type: boolean + api: + type: string + organization: + type: string + teamProject: + type: string + required: + - accessTokenRef + - organization + - teamProject + type: object + bitbucket: + properties: + allBranches: + type: boolean + appPasswordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + owner: + type: string + user: + type: string + required: + - appPasswordRef + - owner + - user + type: object + bitbucketServer: + properties: + allBranches: + type: boolean + api: + type: string + basicAuth: + properties: + passwordRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + username: + type: string + required: + - passwordRef + - username + type: object + bearerToken: + properties: + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - tokenRef + type: object + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + insecure: + type: boolean + project: + type: string + required: + - api + - project + type: object + cloneProtocol: + type: string + filters: + items: + properties: + branchMatch: + type: string + labelMatch: + type: string + pathsDoNotExist: + items: + type: string + type: array + pathsExist: + items: + type: string + type: array + repositoryMatch: + type: string + type: object + type: array + gitea: + properties: + allBranches: + type: boolean + api: + type: string + insecure: + type: boolean + owner: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - api + - owner + type: object + github: + properties: + allBranches: + type: boolean + api: + type: string + appSecretName: + type: string + organization: + type: string + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + required: + - organization + type: object + gitlab: + properties: + allBranches: + type: boolean + api: + type: string + caRef: + properties: + configMapName: + type: string + key: + type: string + required: + - configMapName + - key + type: object + group: + type: string + includeSharedProjects: + type: boolean + includeSubgroups: + type: boolean + insecure: + type: boolean + tokenRef: + properties: + key: + type: string + secretName: + type: string + required: + - key + - secretName + type: object + topic: + type: string + required: + - group + type: object + requeueAfterSeconds: + format: int64 + type: integer + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + values: + additionalProperties: + type: string + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + goTemplate: + type: boolean + goTemplateOptions: + items: + type: string + type: array + ignoreApplicationDifferences: + items: + properties: + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + name: + type: string + type: object + type: array + preservedFields: + properties: + annotations: + items: + type: string + type: array + labels: + items: + type: string + type: array + type: object + strategy: + properties: + deletionOrder: + type: string + rollingSync: + properties: + steps: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + type: object + type: array + maxUpdate: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: array + type: object + type: + type: string + type: object + syncPolicy: + properties: + applicationsSync: + enum: + - create-only + - create-update + - create-delete + - sync + type: string + preserveResourcesOnDeletion: + type: boolean + type: object + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + destination: + properties: + name: + type: string + namespace: + type: string + server: + type: string + type: object + ignoreDifferences: + items: + properties: + group: + type: string + jqPathExpressions: + items: + type: string + type: array + jsonPointers: + items: + type: string + type: array + kind: + type: string + managedFieldsManagers: + items: + type: string + type: array + name: + type: string + namespace: + type: string + required: + - kind + type: object + type: array + info: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + project: + type: string + revisionHistoryLimit: + format: int64 + type: integer + source: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + sourceHydrator: + properties: + drySource: + properties: + path: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - path + - repoURL + - targetRevision + type: object + hydrateTo: + properties: + targetBranch: + type: string + required: + - targetBranch + type: object + syncSource: + properties: + path: + minLength: 1 + pattern: ^.{2,}|[^./]$ + type: string + targetBranch: + type: string + required: + - path + - targetBranch + type: object + required: + - drySource + - syncSource + type: object + sources: + items: + properties: + chart: + type: string + directory: + properties: + exclude: + type: string + include: + type: string + jsonnet: + properties: + extVars: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + libs: + items: + type: string + type: array + tlas: + items: + properties: + code: + type: boolean + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + type: object + recurse: + type: boolean + type: object + helm: + properties: + apiVersions: + items: + type: string + type: array + fileParameters: + items: + properties: + name: + type: string + path: + type: string + type: object + type: array + ignoreMissingValueFiles: + type: boolean + kubeVersion: + type: string + namespace: + type: string + parameters: + items: + properties: + forceString: + type: boolean + name: + type: string + value: + type: string + type: object + type: array + passCredentials: + type: boolean + releaseName: + type: string + skipCrds: + type: boolean + skipSchemaValidation: + type: boolean + skipTests: + type: boolean + valueFiles: + items: + type: string + type: array + values: + type: string + valuesObject: + type: object + x-kubernetes-preserve-unknown-fields: true + version: + type: string + type: object + kustomize: + properties: + apiVersions: + items: + type: string + type: array + commonAnnotations: + additionalProperties: + type: string + type: object + commonAnnotationsEnvsubst: + type: boolean + commonLabels: + additionalProperties: + type: string + type: object + components: + items: + type: string + type: array + forceCommonAnnotations: + type: boolean + forceCommonLabels: + type: boolean + ignoreMissingComponents: + type: boolean + images: + items: + type: string + type: array + kubeVersion: + type: string + labelIncludeTemplates: + type: boolean + labelWithoutSelector: + type: boolean + namePrefix: + type: string + nameSuffix: + type: string + namespace: + type: string + patches: + items: + properties: + options: + additionalProperties: + type: boolean + type: object + patch: + type: string + path: + type: string + target: + properties: + annotationSelector: + type: string + group: + type: string + kind: + type: string + labelSelector: + type: string + name: + type: string + namespace: + type: string + version: + type: string + type: object + type: object + type: array + replicas: + items: + properties: + count: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + type: string + required: + - count + - name + type: object + type: array + version: + type: string + type: object + name: + type: string + path: + type: string + plugin: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + name: + type: string + parameters: + items: + properties: + array: + items: + type: string + type: array + map: + additionalProperties: + type: string + type: object + name: + type: string + string: + type: string + type: object + type: array + type: object + ref: + type: string + repoURL: + type: string + targetRevision: + type: string + required: + - repoURL + type: object + type: array + syncPolicy: + properties: + automated: + properties: + allowEmpty: + type: boolean + enabled: + type: boolean + prune: + type: boolean + selfHeal: + type: boolean + type: object + managedNamespaceMetadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + retry: + properties: + backoff: + properties: + duration: + type: string + factor: + format: int64 + type: integer + maxDuration: + type: string + type: object + limit: + format: int64 + type: integer + refresh: + type: boolean + type: object + syncOptions: + items: + type: string + type: array + type: object + required: + - destination + - project + type: object + required: + - metadata + - spec + type: object + templatePatch: + type: string + required: + - generators + - template + type: object + status: + properties: + applicationStatus: + items: + properties: + application: + type: string + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + step: + type: string + targetRevisions: + items: + type: string + type: array + required: + - application + - message + - status + - step + - targetRevisions + type: object + type: array + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - message + - reason + - status + - type + type: object + type: array + resources: + items: + properties: + group: + type: string + health: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: object + hook: + type: boolean + kind: + type: string + name: + type: string + namespace: + type: string + requiresDeletionConfirmation: + type: boolean + requiresPruning: + type: boolean + status: + type: string + syncWave: + format: int64 + type: integer + version: + type: string + type: object + type: array + resourcesCount: + format: int64 + type: integer + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/name: appprojects.argoproj.io + app.kubernetes.io/part-of: argocd + name: appprojects.argoproj.io +spec: + group: argoproj.io + names: + kind: AppProject + listKind: AppProjectList + plural: appprojects + shortNames: + - appproj + - appprojs + singular: appproject + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + AppProject provides a logical grouping of applications, providing controls for: + * where the apps may deploy to (cluster whitelist) + * what may be deployed (repository whitelist, resource whitelist/blacklist) + * who can access these applications (roles, OIDC group claims bindings) + * and what they can do (RBAC policies) + * automation access to these roles (JWT tokens) + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AppProjectSpec is the specification of an AppProject + properties: + clusterResourceBlacklist: + description: ClusterResourceBlacklist contains list of blacklisted + cluster level resources + items: + description: |- + GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying + concepts during lookup stages without having partially valid types + properties: + group: + type: string + kind: + type: string + required: + - group + - kind + type: object + type: array + clusterResourceWhitelist: + description: ClusterResourceWhitelist contains list of whitelisted + cluster level resources + items: + description: |- + GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying + concepts during lookup stages without having partially valid types + properties: + group: + type: string + kind: + type: string + required: + - group + - kind + type: object + type: array + description: + description: Description contains optional project description + maxLength: 255 + type: string + destinationServiceAccounts: + description: DestinationServiceAccounts holds information about the + service accounts to be impersonated for the application sync operation + for each destination. + items: + description: ApplicationDestinationServiceAccount holds information + about the service account to be impersonated for the application + sync operation. + properties: + defaultServiceAccount: + description: DefaultServiceAccount to be used for impersonation + during the sync operation + type: string + namespace: + description: Namespace specifies the target namespace for the + application's resources. + type: string + server: + description: Server specifies the URL of the target cluster's + Kubernetes control plane API. + type: string + required: + - defaultServiceAccount + - server + type: object + type: array + destinations: + description: Destinations contains list of destinations available + for deployment + items: + description: ApplicationDestination holds information about the + application's destination + properties: + name: + description: Name is an alternate way of specifying the target + cluster by its symbolic name. This must be set if Server is + not set. + type: string + namespace: + description: |- + Namespace specifies the target namespace for the application's resources. + The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace + type: string + server: + description: Server specifies the URL of the target cluster's + Kubernetes control plane API. This must be set if Name is + not set. + type: string + type: object + type: array + namespaceResourceBlacklist: + description: NamespaceResourceBlacklist contains list of blacklisted + namespace level resources + items: + description: |- + GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying + concepts during lookup stages without having partially valid types + properties: + group: + type: string + kind: + type: string + required: + - group + - kind + type: object + type: array + namespaceResourceWhitelist: + description: NamespaceResourceWhitelist contains list of whitelisted + namespace level resources + items: + description: |- + GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying + concepts during lookup stages without having partially valid types + properties: + group: + type: string + kind: + type: string + required: + - group + - kind + type: object + type: array + orphanedResources: + description: OrphanedResources specifies if controller should monitor + orphaned resources of apps in this project + properties: + ignore: + description: Ignore contains a list of resources that are to be + excluded from orphaned resources monitoring + items: + description: OrphanedResourceKey is a reference to a resource + to be ignored from + properties: + group: + type: string + kind: + type: string + name: + type: string + type: object + type: array + warn: + description: Warn indicates if warning condition should be created + for apps which have orphaned resources + type: boolean + type: object + permitOnlyProjectScopedClusters: + description: PermitOnlyProjectScopedClusters determines whether destinations + can only reference clusters which are project-scoped + type: boolean + roles: + description: Roles are user defined RBAC roles associated with this + project + items: + description: ProjectRole represents a role that has access to a + project + properties: + description: + description: Description is a description of the role + type: string + groups: + description: Groups are a list of OIDC group claims bound to + this role + items: + type: string + type: array + jwtTokens: + description: JWTTokens are a list of generated JWT tokens bound + to this role + items: + description: JWTToken holds the issuedAt and expiresAt values + of a token + properties: + exp: + format: int64 + type: integer + iat: + format: int64 + type: integer + id: + type: string + required: + - iat + type: object + type: array + name: + description: Name is a name for this role + type: string + policies: + description: Policies Stores a list of casbin formatted strings + that define access policies for the role in the project + items: + type: string + type: array + required: + - name + type: object + type: array + signatureKeys: + description: SignatureKeys contains a list of PGP key IDs that commits + in Git must be signed with in order to be allowed for sync + items: + description: SignatureKey is the specification of a key required + to verify commit signatures with + properties: + keyID: + description: The ID of the key in hexadecimal notation + type: string + required: + - keyID + type: object + type: array + sourceNamespaces: + description: SourceNamespaces defines the namespaces application resources + are allowed to be created in + items: + type: string + type: array + sourceRepos: + description: SourceRepos contains list of repository URLs which can + be used for deployment + items: + type: string + type: array + syncWindows: + description: SyncWindows controls when syncs can be run for apps in + this project + items: + description: SyncWindow contains the kind, time, duration and attributes + that are used to assign the syncWindows to apps + properties: + andOperator: + description: UseAndOperator use AND operator for matching applications, + namespaces and clusters instead of the default OR operator + type: boolean + applications: + description: Applications contains a list of applications that + the window will apply to + items: + type: string + type: array + clusters: + description: Clusters contains a list of clusters that the window + will apply to + items: + type: string + type: array + description: + description: Description of the sync that will be applied to + the schedule, can be used to add any information such as a + ticket number for example + type: string + duration: + description: Duration is the amount of time the sync window + will be open + type: string + kind: + description: Kind defines if the window allows or blocks syncs + type: string + manualSync: + description: ManualSync enables manual syncs when they would + otherwise be blocked + type: boolean + namespaces: + description: Namespaces contains a list of namespaces that the + window will apply to + items: + type: string + type: array + schedule: + description: Schedule is the time the window will begin, specified + in cron format + type: string + timeZone: + description: TimeZone of the sync that will be applied to the + schedule + type: string + type: object + type: array + type: object + status: + description: AppProjectStatus contains status information for AppProject + CRs + properties: + jwtTokensByRole: + additionalProperties: + description: JWTTokens represents a list of JWT tokens + properties: + items: + items: + description: JWTToken holds the issuedAt and expiresAt values + of a token + properties: + exp: + format: int64 + type: integer + iat: + format: int64 + type: integer + id: + type: string + required: + - iat + type: object + type: array + type: object + description: JWTTokensByRole contains a list of JWT tokens issued + for a given role + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: dex-server + app.kubernetes.io/name: argocd-dex-server + app.kubernetes.io/part-of: argocd + name: argocd-dex-server +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-controller +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha +secrets: +- name: argocd-redis +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha-haproxy + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-haproxy +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: repo-server + app.kubernetes.io/name: argocd-repo-server + app.kubernetes.io/part-of: argocd + name: argocd-repo-server +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller +rules: +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list + - watch +- apiGroups: + - argoproj.io + resources: + - applications + - applicationsets + - appprojects + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - list +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +rules: +- apiGroups: + - argoproj.io + resources: + - applications + - applicationsets + - applicationsets/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - argoproj.io + resources: + - appprojects + verbs: + - get + - list + - watch +- apiGroups: + - argoproj.io + resources: + - applicationsets/status + verbs: + - get + - patch + - update +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - watch +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create +- apiGroups: + - coordination.k8s.io + resourceNames: + - 58ac56fa.applicationsets.argoproj.io + resources: + - leases + verbs: + - get + - update + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: dex-server + app.kubernetes.io/name: argocd-dex-server + app.kubernetes.io/part-of: argocd + name: argocd-dex-server +rules: +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-controller +rules: +- apiGroups: + - argoproj.io + resources: + - applications + - appprojects + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - list + - watch +- apiGroups: + - "" + resourceNames: + - argocd-notifications-cm + resources: + - configmaps + verbs: + - get +- apiGroups: + - "" + resourceNames: + - argocd-notifications-secret + resources: + - secrets + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha +rules: +- apiGroups: + - "" + resources: + - endpoints + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-haproxy +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create +- apiGroups: + - "" + resourceNames: + - argocd-redis + resources: + - secrets + verbs: + - get +- apiGroups: + - "" + resources: + - endpoints + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +rules: +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - argoproj.io + resources: + - applications + - appprojects + - applicationsets + verbs: + - create + - get + - list + - watch + - update + - delete + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +- nonResourceURLs: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +rules: +- apiGroups: + - argoproj.io + resources: + - applications + - applicationsets + - applicationsets/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - argoproj.io + resources: + - appprojects + verbs: + - get + - list + - watch +- apiGroups: + - argoproj.io + resources: + - applicationsets/status + verbs: + - get + - patch + - update +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - watch +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create +- apiGroups: + - coordination.k8s.io + resourceNames: + - 58ac56fa.applicationsets.argoproj.io + resources: + - leases + verbs: + - get + - update + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - delete + - get + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - list +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - get +- apiGroups: + - argoproj.io + resources: + - applications + - applicationsets + verbs: + - get + - list + - watch +- apiGroups: + - batch + resources: + - jobs + verbs: + - create +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-application-controller +subjects: +- kind: ServiceAccount + name: argocd-application-controller +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-applicationset-controller +subjects: +- kind: ServiceAccount + name: argocd-applicationset-controller +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: dex-server + app.kubernetes.io/name: argocd-dex-server + app.kubernetes.io/part-of: argocd + name: argocd-dex-server +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-dex-server +subjects: +- kind: ServiceAccount + name: argocd-dex-server +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-notifications-controller +subjects: +- kind: ServiceAccount + name: argocd-notifications-controller +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-redis-ha +subjects: +- kind: ServiceAccount + name: argocd-redis-ha +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-haproxy +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-redis-ha-haproxy +subjects: +- kind: ServiceAccount + name: argocd-redis-ha-haproxy +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-server +subjects: +- kind: ServiceAccount + name: argocd-server +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argocd-application-controller +subjects: +- kind: ServiceAccount + name: argocd-application-controller + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argocd-applicationset-controller +subjects: +- kind: ServiceAccount + name: argocd-applicationset-controller + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argocd-server +subjects: +- kind: ServiceAccount + name: argocd-server + namespace: argocd +--- +apiVersion: v1 +data: + resource.customizations.ignoreResourceUpdates.ConfigMap: | + jqPathExpressions: + # Ignore the cluster-autoscaler status + - '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"' + # Ignore the annotation of the legacy Leases election + - '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"' + resource.customizations.ignoreResourceUpdates.Endpoints: | + jsonPointers: + - /metadata + - /subsets + resource.customizations.ignoreResourceUpdates.all: | + jsonPointers: + - /status + resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: | + jqPathExpressions: + - '.metadata.annotations."deployment.kubernetes.io/desired-replicas"' + - '.metadata.annotations."deployment.kubernetes.io/max-replicas"' + - '.metadata.annotations."rollout.argoproj.io/desired-replicas"' + resource.customizations.ignoreResourceUpdates.argoproj.io_Application: | + jqPathExpressions: + - '.metadata.annotations."notified.notifications.argoproj.io"' + - '.metadata.annotations."argocd.argoproj.io/refresh"' + - '.metadata.annotations."argocd.argoproj.io/hydrate"' + - '.operation' + resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: | + jqPathExpressions: + - '.metadata.annotations."notified.notifications.argoproj.io"' + resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: | + jqPathExpressions: + - '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"' + - '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"' + - '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"' + - '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"' + resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: | + jsonPointers: + - /metadata + - /endpoints + - /ports + resource.exclusions: | + ### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter + - apiGroups: + - '' + kinds: + - Endpoints + ### Internal Kubernetes resources excluded reduce the number of watched events + - apiGroups: + - coordination.k8s.io + kinds: + - Lease + ### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events + - apiGroups: + - authentication.k8s.io + - authorization.k8s.io + kinds: + - SelfSubjectReview + - TokenReview + - LocalSubjectAccessReview + - SelfSubjectAccessReview + - SelfSubjectRulesReview + - SubjectAccessReview + ### Intermediate Certificate Request excluded reduce the number of watched events + - apiGroups: + - certificates.k8s.io + kinds: + - CertificateSigningRequest + - apiGroups: + - cert-manager.io + kinds: + - CertificateRequest + ### Cilium internal resources excluded reduce the number of watched events and UI Clutter + - apiGroups: + - cilium.io + kinds: + - CiliumIdentity + - CiliumEndpoint + - CiliumEndpointSlice + ### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance + - apiGroups: + - kyverno.io + - reports.kyverno.io + - wgpolicyk8s.io + kinds: + - PolicyReport + - ClusterPolicyReport + - EphemeralReport + - ClusterEphemeralReport + - AdmissionReport + - ClusterAdmissionReport + - BackgroundScanReport + - ClusterBackgroundScanReport + - UpdateRequest +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-cm + app.kubernetes.io/part-of: argocd + name: argocd-cm +--- +apiVersion: v1 +data: + redis.server: argocd-redis-ha-haproxy:6379 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-cmd-params-cm + app.kubernetes.io/part-of: argocd + name: argocd-cmd-params-cm +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-gpg-keys-cm + app.kubernetes.io/part-of: argocd + name: argocd-gpg-keys-cm +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-cm +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-rbac-cm + app.kubernetes.io/part-of: argocd + name: argocd-rbac-cm +--- +apiVersion: v1 +data: + fix-split-brain.sh: | + HOSTNAME="$(hostname)" + INDEX="${HOSTNAME##*-}" + SENTINEL_PORT=26379 + ANNOUNCE_IP='' + MASTER='' + MASTER_GROUP="argocd" + QUORUM="2" + REDIS_CONF=/data/conf/redis.conf + REDIS_PORT=6379 + REDIS_TLS_PORT= + SENTINEL_CONF=/data/conf/sentinel.conf + SENTINEL_TLS_PORT= + SERVICE=argocd-redis-ha + SENTINEL_TLS_REPLICATION_ENABLED=false + REDIS_TLS_REPLICATION_ENABLED=false + + ROLE='' + REDIS_MASTER='' + + set -eu + sentinel_get_master() { + set +e + if [ "$SENTINEL_PORT" -eq 0 ]; then + redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key sentinel get-master-addr-by-name "${MASTER_GROUP}" |\ + grep -E '((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?s*$))' + else + redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}" sentinel get-master-addr-by-name "${MASTER_GROUP}" |\ + grep -E '((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?s*$))' + fi + set -e + } + + sentinel_get_master_retry() { + master='' + retry=${1} + sleep=3 + for i in $(seq 1 "${retry}"); do + master=$(sentinel_get_master) + if [ -n "${master}" ]; then + break + fi + sleep $((sleep + i)) + done + echo "${master}" + } + + identify_master() { + echo "Identifying redis master (get-master-addr-by-name).." + echo " using sentinel (argocd-redis-ha), sentinel group name (argocd)" + MASTER="$(sentinel_get_master_retry 3)" + if [ -n "${MASTER}" ]; then + echo " $(date) Found redis master (${MASTER})" + else + echo " $(date) Did not find redis master (${MASTER})" + fi + } + + sentinel_update() { + echo "Updating sentinel config.." + echo " evaluating sentinel id (\${SENTINEL_ID_${INDEX}})" + eval MY_SENTINEL_ID="\$SENTINEL_ID_${INDEX}" + echo " sentinel id (${MY_SENTINEL_ID}), sentinel grp (${MASTER_GROUP}), quorum (${QUORUM})" + sed -i "1s/^/sentinel myid ${MY_SENTINEL_ID}\\n/" "${SENTINEL_CONF}" + if [ "$SENTINEL_TLS_REPLICATION_ENABLED" = true ]; then + echo " redis master (${1}:${REDIS_TLS_PORT})" + sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_TLS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}" + else + echo " redis master (${1}:${REDIS_PORT})" + sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}" + fi + echo "sentinel announce-ip ${ANNOUNCE_IP}" >> ${SENTINEL_CONF} + if [ "$SENTINEL_PORT" -eq 0 ]; then + echo " announce (${ANNOUNCE_IP}:${SENTINEL_TLS_PORT})" + echo "sentinel announce-port ${SENTINEL_TLS_PORT}" >> ${SENTINEL_CONF} + else + echo " announce (${ANNOUNCE_IP}:${SENTINEL_PORT})" + echo "sentinel announce-port ${SENTINEL_PORT}" >> ${SENTINEL_CONF} + fi + } + + redis_update() { + echo "Updating redis config.." + if [ "$REDIS_TLS_REPLICATION_ENABLED" = true ]; then + echo " we are slave of redis master (${1}:${REDIS_TLS_PORT})" + echo "slaveof ${1} ${REDIS_TLS_PORT}" >> "${REDIS_CONF}" + echo "slave-announce-port ${REDIS_TLS_PORT}" >> ${REDIS_CONF} + else + echo " we are slave of redis master (${1}:${REDIS_PORT})" + echo "slaveof ${1} ${REDIS_PORT}" >> "${REDIS_CONF}" + echo "slave-announce-port ${REDIS_PORT}" >> ${REDIS_CONF} + fi + echo "slave-announce-ip ${ANNOUNCE_IP}" >> ${REDIS_CONF} + } + + copy_config() { + echo "Copying default redis config.." + echo " to '${REDIS_CONF}'" + cp /readonly-config/redis.conf "${REDIS_CONF}" + echo "Copying default sentinel config.." + echo " to '${SENTINEL_CONF}'" + cp /readonly-config/sentinel.conf "${SENTINEL_CONF}" + } + + setup_defaults() { + echo "Setting up defaults.." + echo " using statefulset index (${INDEX})" + if [ "${INDEX}" = "0" ]; then + echo "Setting this pod as master for redis and sentinel.." + echo " using announce (${ANNOUNCE_IP})" + redis_update "${ANNOUNCE_IP}" + sentinel_update "${ANNOUNCE_IP}" + echo " make sure ${ANNOUNCE_IP} is not a slave (slaveof no one)" + sed -i "s/^.*slaveof.*//" "${REDIS_CONF}" + else + echo "Getting redis master ip.." + echo " blindly assuming (${SERVICE}-announce-0) or (${SERVICE}-server-0) are master" + DEFAULT_MASTER="$(getent_hosts 0 | awk '{ print $1 }')" + if [ -z "${DEFAULT_MASTER}" ]; then + echo "Error: Unable to resolve redis master (getent hosts)." + exit 1 + fi + echo " identified redis (may be redis master) ip (${DEFAULT_MASTER})" + echo "Setting default slave config for redis and sentinel.." + echo " using master ip (${DEFAULT_MASTER})" + redis_update "${DEFAULT_MASTER}" + sentinel_update "${DEFAULT_MASTER}" + fi + } + + redis_ping() { + set +e + if [ "$REDIS_PORT" -eq 0 ]; then + redis-cli -h "${MASTER}" -a "${AUTH}" --no-auth-warning -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key ping + else + redis-cli -h "${MASTER}" -a "${AUTH}" --no-auth-warning -p "${REDIS_PORT}" ping + fi + set -e + } + + redis_ping_retry() { + ping='' + retry=${1} + sleep=3 + for i in $(seq 1 "${retry}"); do + if [ "$(redis_ping)" = "PONG" ]; then + ping='PONG' + break + fi + sleep $((sleep + i)) + MASTER=$(sentinel_get_master) + done + echo "${ping}" + } + + find_master() { + echo "Verifying redis master.." + if [ "$REDIS_PORT" -eq 0 ]; then + echo " ping (${MASTER}:${REDIS_TLS_PORT})" + else + echo " ping (${MASTER}:${REDIS_PORT})" + fi + if [ "$(redis_ping_retry 3)" != "PONG" ]; then + echo " $(date) Can't ping redis master (${MASTER})" + echo "Attempting to force failover (sentinel failover).." + + if [ "$SENTINEL_PORT" -eq 0 ]; then + echo " on sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})" + if redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then + echo " $(date) Failover returned with 'NOGOODSLAVE'" + echo "Setting defaults for this pod.." + setup_defaults + return 0 + fi + else + echo " on sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})" + if redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}" sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then + echo " $(date) Failover returned with 'NOGOODSLAVE'" + echo "Setting defaults for this pod.." + setup_defaults + return 0 + fi + fi + + echo "Hold on for 10sec" + sleep 10 + echo "We should get redis master's ip now. Asking (get-master-addr-by-name).." + if [ "$SENTINEL_PORT" -eq 0 ]; then + echo " sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})" + else + echo " sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})" + fi + MASTER="$(sentinel_get_master)" + if [ "${MASTER}" ]; then + echo " $(date) Found redis master (${MASTER})" + echo "Updating redis and sentinel config.." + sentinel_update "${MASTER}" + redis_update "${MASTER}" + else + echo "$(date) Error: Could not failover, exiting..." + exit 1 + fi + else + echo " $(date) Found reachable redis master (${MASTER})" + echo "Updating redis and sentinel config.." + sentinel_update "${MASTER}" + redis_update "${MASTER}" + fi + } + + redis_ro_update() { + echo "Updating read-only redis config.." + echo " redis.conf set 'replica-priority 0'" + echo "replica-priority 0" >> ${REDIS_CONF} + } + + getent_hosts() { + index=${1:-${INDEX}} + service="${SERVICE}-announce-${index}" + host=$(getent hosts "${service}") + echo "${host}" + } + + identify_announce_ip() { + echo "Identify announce ip for this pod.." + echo " using (${SERVICE}-announce-${INDEX}) or (${SERVICE}-server-${INDEX})" + ANNOUNCE_IP=$(getent_hosts | awk '{ print $1 }') + echo " identified announce (${ANNOUNCE_IP})" + } + + redis_role() { + set +e + if [ "$REDIS_PORT" -eq 0 ]; then + ROLE=$(redis-cli -a "${AUTH}" --no-auth-warning -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key info | grep role | sed 's/role://' | sed 's/\r//') + else + ROLE=$(redis-cli -a "${AUTH}" --no-auth-warning -p "${REDIS_PORT}" info | grep role | sed 's/role://' | sed 's/\r//') + fi + set -e + } + + identify_redis_master() { + set +e + if [ "$REDIS_PORT" -eq 0 ]; then + REDIS_MASTER=$(redis-cli -a "${AUTH}" --no-auth-warning -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key info | grep master_host | sed 's/master_host://' | sed 's/\r//') + else + REDIS_MASTER=$(redis-cli -a "${AUTH}" --no-auth-warning -p "${REDIS_PORT}" info | grep master_host | sed 's/master_host://' | sed 's/\r//') + fi + set -e + } + + reinit() { + set +e + sh /readonly-config/init.sh + + if [ "$REDIS_PORT" -eq 0 ]; then + echo "shutdown" | redis-cli -a "${AUTH}" --no-auth-warning -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key + else + echo "shutdown" | redis-cli -a "${AUTH}" --no-auth-warning -p "${REDIS_PORT}" + fi + set -e + } + + identify_announce_ip + + while [ -z "${ANNOUNCE_IP}" ]; do + echo "Error: Could not resolve the announce ip for this pod." + sleep 30 + identify_announce_ip + done + + trap "exit 0" TERM + while true; do + sleep 60 + + # where is redis master + identify_master + + if [ "$MASTER" = "$ANNOUNCE_IP" ]; then + redis_role + if [ "$ROLE" != "master" ]; then + echo "waiting for redis to become master" + sleep 10 + identify_master + redis_role + echo "Redis role is $ROLE, expected role is master. No need to reinitialize." + if [ "$ROLE" != "master" ]; then + echo "Redis role is $ROLE, expected role is master, reinitializing" + reinit + fi + fi + elif [ "${MASTER}" ]; then + identify_redis_master + if [ "$REDIS_MASTER" != "$MASTER" ]; then + echo "Redis master and local master are not the same. waiting." + sleep 10 + identify_master + identify_redis_master + echo "Redis master is ${MASTER}, expected master is ${REDIS_MASTER}. No need to reinitialize." + if [ "${REDIS_MASTER}" != "${MASTER}" ]; then + echo "Redis master is ${MASTER}, expected master is ${REDIS_MASTER}, reinitializing" + reinit + fi + fi + fi + done + haproxy.cfg: "defaults REDIS\n mode tcp\n timeout connect 4s\n timeout server + 6m\n timeout client 6m\n timeout check 2s\n\nlisten health_check_http_url\n + \ bind :8888 \n mode http\n monitor-uri /healthz\n option dontlognull\n# + Check Sentinel and whether they are nominated master\nbackend check_if_redis_is_master_0\n + \ mode tcp\n option tcp-check\n tcp-check connect\n tcp-check send PING\\r\\n\n + \ tcp-check expect string +PONG\n tcp-check send SENTINEL\\ get-master-addr-by-name\\ + argocd\\r\\n\n tcp-check expect string REPLACE_ANNOUNCE0\n tcp-check send QUIT\\r\\n\n + \ server R0 argocd-redis-ha-announce-0:26379 check inter 3s\n server R1 argocd-redis-ha-announce-1:26379 + check inter 3s\n server R2 argocd-redis-ha-announce-2:26379 check inter 3s\n# + Check Sentinel and whether they are nominated master\nbackend check_if_redis_is_master_1\n + \ mode tcp\n option tcp-check\n tcp-check connect\n tcp-check send PING\\r\\n\n + \ tcp-check expect string +PONG\n tcp-check send SENTINEL\\ get-master-addr-by-name\\ + argocd\\r\\n\n tcp-check expect string REPLACE_ANNOUNCE1\n tcp-check send QUIT\\r\\n\n + \ server R0 argocd-redis-ha-announce-0:26379 check inter 3s\n server R1 argocd-redis-ha-announce-1:26379 + check inter 3s\n server R2 argocd-redis-ha-announce-2:26379 check inter 3s\n# + Check Sentinel and whether they are nominated master\nbackend check_if_redis_is_master_2\n + \ mode tcp\n option tcp-check\n tcp-check connect\n tcp-check send PING\\r\\n\n + \ tcp-check expect string +PONG\n tcp-check send SENTINEL\\ get-master-addr-by-name\\ + argocd\\r\\n\n tcp-check expect string REPLACE_ANNOUNCE2\n tcp-check send QUIT\\r\\n\n + \ server R0 argocd-redis-ha-announce-0:26379 check inter 3s\n server R1 argocd-redis-ha-announce-1:26379 + check inter 3s\n server R2 argocd-redis-ha-announce-2:26379 check inter 3s\n\n# + decide redis backend to use\n#master\nfrontend ft_redis_master\n bind :6379 \n + \ use_backend bk_redis_master\n# Check all redis servers to see if they think + they are master\nbackend bk_redis_master\n mode tcp\n option tcp-check\n tcp-check + connect\n tcp-check send \"AUTH ${AUTH}\"\\r\\n\n tcp-check expect string +OK\n + \ tcp-check send PING\\r\\n\n tcp-check expect string +PONG\n tcp-check send + info\\ replication\\r\\n\n tcp-check expect string role:master\n tcp-check send + QUIT\\r\\n\n tcp-check expect string +OK\n use-server R0 if { srv_is_up(R0) + } { nbsrv(check_if_redis_is_master_0) ge 2 }\n server R0 argocd-redis-ha-announce-0:6379 + check inter 3s fall 1 rise 1\n use-server R1 if { srv_is_up(R1) } { nbsrv(check_if_redis_is_master_1) + ge 2 }\n server R1 argocd-redis-ha-announce-1:6379 check inter 3s fall 1 rise + 1\n use-server R2 if { srv_is_up(R2) } { nbsrv(check_if_redis_is_master_2) ge + 2 }\n server R2 argocd-redis-ha-announce-2:6379 check inter 3s fall 1 rise 1\nfrontend + stats\n mode http\n bind :9101 \n http-request use-service prometheus-exporter + if { path /metrics }\n stats enable\n stats uri /stats\n stats refresh 10s\n# + Additional configuration\nglobal\n maxconn 4096\n" + haproxy_init.sh: | + HAPROXY_CONF=/data/haproxy.cfg + cp /readonly/haproxy.cfg "$HAPROXY_CONF" + for loop in $(seq 1 10); do + getent hosts argocd-redis-ha-announce-0 && break + echo "Waiting for service argocd-redis-ha-announce-0 to be ready ($loop) ..." && sleep 1 + done + ANNOUNCE_IP0=$(getent hosts "argocd-redis-ha-announce-0" | awk '{ print $1 }') + if [ -z "$ANNOUNCE_IP0" ]; then + echo "Could not resolve the announce ip for argocd-redis-ha-announce-0" + exit 1 + fi + sed -i "s/REPLACE_ANNOUNCE0/$ANNOUNCE_IP0/" "$HAPROXY_CONF" + for loop in $(seq 1 10); do + getent hosts argocd-redis-ha-announce-1 && break + echo "Waiting for service argocd-redis-ha-announce-1 to be ready ($loop) ..." && sleep 1 + done + ANNOUNCE_IP1=$(getent hosts "argocd-redis-ha-announce-1" | awk '{ print $1 }') + if [ -z "$ANNOUNCE_IP1" ]; then + echo "Could not resolve the announce ip for argocd-redis-ha-announce-1" + exit 1 + fi + sed -i "s/REPLACE_ANNOUNCE1/$ANNOUNCE_IP1/" "$HAPROXY_CONF" + for loop in $(seq 1 10); do + getent hosts argocd-redis-ha-announce-2 && break + echo "Waiting for service argocd-redis-ha-announce-2 to be ready ($loop) ..." && sleep 1 + done + ANNOUNCE_IP2=$(getent hosts "argocd-redis-ha-announce-2" | awk '{ print $1 }') + if [ -z "$ANNOUNCE_IP2" ]; then + echo "Could not resolve the announce ip for argocd-redis-ha-announce-2" + exit 1 + fi + sed -i "s/REPLACE_ANNOUNCE2/$ANNOUNCE_IP2/" "$HAPROXY_CONF" + init.sh: | + echo "$(date) Start..." + HOSTNAME="$(hostname)" + INDEX="${HOSTNAME##*-}" + SENTINEL_PORT=26379 + ANNOUNCE_IP='' + MASTER='' + MASTER_GROUP="argocd" + QUORUM="2" + REDIS_CONF=/data/conf/redis.conf + REDIS_PORT=6379 + REDIS_TLS_PORT= + SENTINEL_CONF=/data/conf/sentinel.conf + SENTINEL_TLS_PORT= + SERVICE=argocd-redis-ha + SENTINEL_TLS_REPLICATION_ENABLED=false + REDIS_TLS_REPLICATION_ENABLED=false + + set -eu + sentinel_get_master() { + set +e + if [ "$SENTINEL_PORT" -eq 0 ]; then + redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key sentinel get-master-addr-by-name "${MASTER_GROUP}" |\ + grep -E '((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?s*$))' + else + redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}" sentinel get-master-addr-by-name "${MASTER_GROUP}" |\ + grep -E '((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?s*$))' + fi + set -e + } + + sentinel_get_master_retry() { + master='' + retry=${1} + sleep=3 + for i in $(seq 1 "${retry}"); do + master=$(sentinel_get_master) + if [ -n "${master}" ]; then + break + fi + sleep $((sleep + i)) + done + echo "${master}" + } + + identify_master() { + echo "Identifying redis master (get-master-addr-by-name).." + echo " using sentinel (argocd-redis-ha), sentinel group name (argocd)" + MASTER="$(sentinel_get_master_retry 3)" + if [ -n "${MASTER}" ]; then + echo " $(date) Found redis master (${MASTER})" + else + echo " $(date) Did not find redis master (${MASTER})" + fi + } + + sentinel_update() { + echo "Updating sentinel config.." + echo " evaluating sentinel id (\${SENTINEL_ID_${INDEX}})" + eval MY_SENTINEL_ID="\$SENTINEL_ID_${INDEX}" + echo " sentinel id (${MY_SENTINEL_ID}), sentinel grp (${MASTER_GROUP}), quorum (${QUORUM})" + sed -i "1s/^/sentinel myid ${MY_SENTINEL_ID}\\n/" "${SENTINEL_CONF}" + if [ "$SENTINEL_TLS_REPLICATION_ENABLED" = true ]; then + echo " redis master (${1}:${REDIS_TLS_PORT})" + sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_TLS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}" + else + echo " redis master (${1}:${REDIS_PORT})" + sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}" + fi + echo "sentinel announce-ip ${ANNOUNCE_IP}" >> ${SENTINEL_CONF} + if [ "$SENTINEL_PORT" -eq 0 ]; then + echo " announce (${ANNOUNCE_IP}:${SENTINEL_TLS_PORT})" + echo "sentinel announce-port ${SENTINEL_TLS_PORT}" >> ${SENTINEL_CONF} + else + echo " announce (${ANNOUNCE_IP}:${SENTINEL_PORT})" + echo "sentinel announce-port ${SENTINEL_PORT}" >> ${SENTINEL_CONF} + fi + } + + redis_update() { + echo "Updating redis config.." + if [ "$REDIS_TLS_REPLICATION_ENABLED" = true ]; then + echo " we are slave of redis master (${1}:${REDIS_TLS_PORT})" + echo "slaveof ${1} ${REDIS_TLS_PORT}" >> "${REDIS_CONF}" + echo "slave-announce-port ${REDIS_TLS_PORT}" >> ${REDIS_CONF} + else + echo " we are slave of redis master (${1}:${REDIS_PORT})" + echo "slaveof ${1} ${REDIS_PORT}" >> "${REDIS_CONF}" + echo "slave-announce-port ${REDIS_PORT}" >> ${REDIS_CONF} + fi + echo "slave-announce-ip ${ANNOUNCE_IP}" >> ${REDIS_CONF} + } + + copy_config() { + echo "Copying default redis config.." + echo " to '${REDIS_CONF}'" + cp /readonly-config/redis.conf "${REDIS_CONF}" + echo "Copying default sentinel config.." + echo " to '${SENTINEL_CONF}'" + cp /readonly-config/sentinel.conf "${SENTINEL_CONF}" + } + + setup_defaults() { + echo "Setting up defaults.." + echo " using statefulset index (${INDEX})" + if [ "${INDEX}" = "0" ]; then + echo "Setting this pod as master for redis and sentinel.." + echo " using announce (${ANNOUNCE_IP})" + redis_update "${ANNOUNCE_IP}" + sentinel_update "${ANNOUNCE_IP}" + echo " make sure ${ANNOUNCE_IP} is not a slave (slaveof no one)" + sed -i "s/^.*slaveof.*//" "${REDIS_CONF}" + else + echo "Getting redis master ip.." + echo " blindly assuming (${SERVICE}-announce-0) or (${SERVICE}-server-0) are master" + DEFAULT_MASTER="$(getent_hosts 0 | awk '{ print $1 }')" + if [ -z "${DEFAULT_MASTER}" ]; then + echo "Error: Unable to resolve redis master (getent hosts)." + exit 1 + fi + echo " identified redis (may be redis master) ip (${DEFAULT_MASTER})" + echo "Setting default slave config for redis and sentinel.." + echo " using master ip (${DEFAULT_MASTER})" + redis_update "${DEFAULT_MASTER}" + sentinel_update "${DEFAULT_MASTER}" + fi + } + + redis_ping() { + set +e + if [ "$REDIS_PORT" -eq 0 ]; then + redis-cli -h "${MASTER}" -a "${AUTH}" --no-auth-warning -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key ping + else + redis-cli -h "${MASTER}" -a "${AUTH}" --no-auth-warning -p "${REDIS_PORT}" ping + fi + set -e + } + + redis_ping_retry() { + ping='' + retry=${1} + sleep=3 + for i in $(seq 1 "${retry}"); do + if [ "$(redis_ping)" = "PONG" ]; then + ping='PONG' + break + fi + sleep $((sleep + i)) + MASTER=$(sentinel_get_master) + done + echo "${ping}" + } + + find_master() { + echo "Verifying redis master.." + if [ "$REDIS_PORT" -eq 0 ]; then + echo " ping (${MASTER}:${REDIS_TLS_PORT})" + else + echo " ping (${MASTER}:${REDIS_PORT})" + fi + if [ "$(redis_ping_retry 3)" != "PONG" ]; then + echo " $(date) Can't ping redis master (${MASTER})" + echo "Attempting to force failover (sentinel failover).." + + if [ "$SENTINEL_PORT" -eq 0 ]; then + echo " on sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})" + if redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}" --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then + echo " $(date) Failover returned with 'NOGOODSLAVE'" + echo "Setting defaults for this pod.." + setup_defaults + return 0 + fi + else + echo " on sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})" + if redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}" sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then + echo " $(date) Failover returned with 'NOGOODSLAVE'" + echo "Setting defaults for this pod.." + setup_defaults + return 0 + fi + fi + + echo "Hold on for 10sec" + sleep 10 + echo "We should get redis master's ip now. Asking (get-master-addr-by-name).." + if [ "$SENTINEL_PORT" -eq 0 ]; then + echo " sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})" + else + echo " sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})" + fi + MASTER="$(sentinel_get_master)" + if [ "${MASTER}" ]; then + echo " $(date) Found redis master (${MASTER})" + echo "Updating redis and sentinel config.." + sentinel_update "${MASTER}" + redis_update "${MASTER}" + else + echo "$(date) Error: Could not failover, exiting..." + exit 1 + fi + else + echo " $(date) Found reachable redis master (${MASTER})" + echo "Updating redis and sentinel config.." + sentinel_update "${MASTER}" + redis_update "${MASTER}" + fi + } + + redis_ro_update() { + echo "Updating read-only redis config.." + echo " redis.conf set 'replica-priority 0'" + echo "replica-priority 0" >> ${REDIS_CONF} + } + + getent_hosts() { + index=${1:-${INDEX}} + service="${SERVICE}-announce-${index}" + host=$(getent hosts "${service}") + echo "${host}" + } + + identify_announce_ip() { + echo "Identify announce ip for this pod.." + echo " using (${SERVICE}-announce-${INDEX}) or (${SERVICE}-server-${INDEX})" + ANNOUNCE_IP=$(getent_hosts | awk '{ print $1 }') + echo " identified announce (${ANNOUNCE_IP})" + } + + mkdir -p /data/conf/ + + echo "Initializing config.." + copy_config + + # where is redis master + identify_master + + identify_announce_ip + + if [ -z "${ANNOUNCE_IP}" ]; then + "Error: Could not resolve the announce ip for this pod" + exit 1 + elif [ "${MASTER}" ]; then + find_master + else + setup_defaults + fi + + if [ "${AUTH:-}" ]; then + echo "Setting redis auth values.." + ESCAPED_AUTH=$(echo "${AUTH}" | sed -e 's/[\/&]/\\&/g'); + sed -i "s/replace-default-auth/${ESCAPED_AUTH}/" "${REDIS_CONF}" "${SENTINEL_CONF}" + fi + + if [ "${SENTINELAUTH:-}" ]; then + echo "Setting sentinel auth values" + ESCAPED_AUTH_SENTINEL=$(echo "$SENTINELAUTH" | sed -e 's/[\/&]/\\&/g'); + sed -i "s/replace-default-sentinel-auth/${ESCAPED_AUTH_SENTINEL}/" "$SENTINEL_CONF" + fi + + echo "$(date) Ready..." + redis.conf: | + dir "/data" + port 6379 + rename-command FLUSHDB "" + rename-command FLUSHALL "" + bind 0.0.0.0 + maxmemory 0 + maxmemory-policy volatile-lru + min-replicas-max-lag 5 + min-replicas-to-write 1 + rdbchecksum yes + rdbcompression yes + repl-diskless-sync yes + save "" + requirepass replace-default-auth + masterauth replace-default-auth + sentinel.conf: | + dir "/data" + port 26379 + bind 0.0.0.0 + sentinel down-after-milliseconds argocd 10000 + sentinel failover-timeout argocd 180000 + maxclients 10000 + sentinel parallel-syncs argocd 5 + sentinel auth-pass argocd replace-default-auth + trigger-failover-if-master.sh: | + get_redis_role() { + is_master=$( + redis-cli \ + -a "${AUTH}" --no-auth-warning \ + -h localhost \ + -p 6379 \ + info | grep -c 'role:master' || true + ) + } + get_redis_role + if [[ "$is_master" -eq 1 ]]; then + echo "This node is currently master, we trigger a failover." + response=$( + redis-cli \ + -h localhost \ + -p 26379 \ + SENTINEL failover argocd + ) + if [[ "$response" != "OK" ]] ; then + echo "$response" + exit 1 + fi + timeout=30 + while [[ "$is_master" -eq 1 && $timeout -gt 0 ]]; do + sleep 1 + get_redis_role + timeout=$((timeout - 1)) + done + echo "Failover successful" + fi +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-configmap +--- +apiVersion: v1 +data: + redis_liveness.sh: | + response=$( + redis-cli \ + -a "${AUTH}" --no-auth-warning \ + -h localhost \ + -p 6379 \ + ping + ) + echo "response=$response" + case $response in + PONG|LOADING*) ;; + *) exit 1 ;; + esac + exit 0 + redis_readiness.sh: | + response=$( + redis-cli \ + -a "${AUTH}" --no-auth-warning \ + -h localhost \ + -p 6379 \ + ping + ) + if [ "$response" != "PONG" ] ; then + echo "ping=$response" + exit 1 + fi + + response=$( + redis-cli \ + -a "${AUTH}" --no-auth-warning \ + -h localhost \ + -p 6379 \ + role + ) + role=$( echo "$response" | sed "1!d" ) + if [ "$role" = "master" ]; then + echo "role=$role" + exit 0 + elif [ "$role" = "slave" ]; then + repl=$( echo "$response" | sed "4!d" ) + echo "role=$role; repl=$repl" + if [ "$repl" = "connected" ]; then + exit 0 + else + exit 1 + fi + else + echo "role=$role" + exit 1 + fi + sentinel_liveness.sh: | + response=$( + redis-cli \ + -h localhost \ + -p 26379 \ + ping + ) + if [ "$response" != "PONG" ]; then + echo "$response" + exit 1 + fi + echo "response=$response" +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-health-configmap +--- +apiVersion: v1 +data: + ssh_known_hosts: | + # This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT + [ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= + [ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl + [ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= + bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE= + bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO + bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M= + github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= + github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl + github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= + gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY= + gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf + gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9 + ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H + vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-ssh-known-hosts-cm + app.kubernetes.io/part-of: argocd + name: argocd-ssh-known-hosts-cm +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-tls-certs-cm + app.kubernetes.io/part-of: argocd + name: argocd-tls-certs-cm +--- +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-secret +type: Opaque +--- +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/name: argocd-secret + app.kubernetes.io/part-of: argocd + name: argocd-secret +type: Opaque +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +spec: + ports: + - name: webhook + port: 7000 + protocol: TCP + targetPort: webhook + - name: metrics + port: 8080 + protocol: TCP + targetPort: metrics + selector: + app.kubernetes.io/name: argocd-applicationset-controller +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: dex-server + app.kubernetes.io/name: argocd-dex-server + app.kubernetes.io/part-of: argocd + name: argocd-dex-server +spec: + ports: + - appProtocol: TCP + name: http + port: 5556 + protocol: TCP + targetPort: 5556 + - name: grpc + port: 5557 + protocol: TCP + targetPort: 5557 + - name: metrics + port: 5558 + protocol: TCP + targetPort: 5558 + selector: + app.kubernetes.io/name: argocd-dex-server +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: metrics + app.kubernetes.io/name: argocd-metrics + app.kubernetes.io/part-of: argocd + name: argocd-metrics +spec: + ports: + - name: metrics + port: 8082 + protocol: TCP + targetPort: 8082 + selector: + app.kubernetes.io/name: argocd-application-controller +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller-metrics + app.kubernetes.io/part-of: argocd + name: argocd-notifications-controller-metrics +spec: + ports: + - name: metrics + port: 9001 + protocol: TCP + targetPort: 9001 + selector: + app.kubernetes.io/name: argocd-notifications-controller +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha +spec: + clusterIP: None + ports: + - name: tcp-server + port: 6379 + protocol: TCP + targetPort: redis + - name: tcp-sentinel + port: 26379 + protocol: TCP + targetPort: sentinel + selector: + app.kubernetes.io/name: argocd-redis-ha + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-announce-0 +spec: + ports: + - name: tcp-server + port: 6379 + protocol: TCP + targetPort: redis + - name: tcp-sentinel + port: 26379 + protocol: TCP + targetPort: sentinel + publishNotReadyAddresses: true + selector: + app.kubernetes.io/name: argocd-redis-ha + statefulset.kubernetes.io/pod-name: argocd-redis-ha-server-0 + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-announce-1 +spec: + ports: + - name: tcp-server + port: 6379 + protocol: TCP + targetPort: redis + - name: tcp-sentinel + port: 26379 + protocol: TCP + targetPort: sentinel + publishNotReadyAddresses: true + selector: + app.kubernetes.io/name: argocd-redis-ha + statefulset.kubernetes.io/pod-name: argocd-redis-ha-server-1 + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-announce-2 +spec: + ports: + - name: tcp-server + port: 6379 + protocol: TCP + targetPort: redis + - name: tcp-sentinel + port: 26379 + protocol: TCP + targetPort: sentinel + publishNotReadyAddresses: true + selector: + app.kubernetes.io/name: argocd-redis-ha + statefulset.kubernetes.io/pod-name: argocd-redis-ha-server-2 + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha-haproxy + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-haproxy +spec: + ports: + - name: tcp-haproxy + port: 6379 + protocol: TCP + targetPort: redis + - name: http-exporter-port + port: 9101 + protocol: TCP + targetPort: metrics-port + selector: + app.kubernetes.io/name: argocd-redis-ha-haproxy + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: repo-server + app.kubernetes.io/name: argocd-repo-server + app.kubernetes.io/part-of: argocd + name: argocd-repo-server +spec: + ports: + - name: server + port: 8081 + protocol: TCP + targetPort: 8081 + - name: metrics + port: 8084 + protocol: TCP + targetPort: 8084 + selector: + app.kubernetes.io/name: argocd-repo-server +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 8080 + - name: https + port: 443 + protocol: TCP + targetPort: 8080 + selector: + app.kubernetes.io/name: argocd-server +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server-metrics + app.kubernetes.io/part-of: argocd + name: argocd-server-metrics +spec: + ports: + - name: metrics + port: 8083 + protocol: TCP + targetPort: 8083 + selector: + app.kubernetes.io/name: argocd-server +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller +spec: + selector: + matchLabels: + app.kubernetes.io/name: argocd-applicationset-controller + template: + metadata: + labels: + app.kubernetes.io/name: argocd-applicationset-controller + spec: + containers: + - args: + - /usr/local/bin/argocd-applicationset-controller + env: + - name: ARGOCD_APPLICATIONSET_CONTROLLER_GLOBAL_PRESERVED_ANNOTATIONS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.global.preserved.annotations + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_GLOBAL_PRESERVED_LABELS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.global.preserved.labels + name: argocd-cmd-params-cm + optional: true + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_LEADER_ELECTION + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.leader.election + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER + valueFrom: + configMapKeyRef: + key: repo.server + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_POLICY + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.policy + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_POLICY_OVERRIDE + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.policy.override + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_DEBUG + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.debug + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_LOGFORMAT + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.log.format + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_LOGLEVEL + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.log.level + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_LOG_FORMAT_TIMESTAMP + valueFrom: + configMapKeyRef: + key: log.format.timestamp + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_DRY_RUN + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.dryrun + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_GIT_MODULES_ENABLED + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.git.submodule + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_PROGRESSIVE_SYNCS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.progressive.syncs + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_TOKENREF_STRICT_MODE + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.tokenref.strict.mode + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_NEW_GIT_FILE_GLOBBING + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.new.git.file.globbing + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_PLAINTEXT + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.repo.server.plaintext + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_STRICT_TLS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.repo.server.strict.tls + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.repo.server.timeout.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_CONCURRENT_RECONCILIATIONS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.concurrent.reconciliations.max + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_NAMESPACES + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.namespaces + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ALLOWED_SCM_PROVIDERS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.allowed.scm.providers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_SCM_PROVIDERS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.scm.providers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_GITHUB_API_METRICS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.github.api.metrics + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_WEBHOOK_PARALLELISM_LIMIT + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.webhook.parallelism.limit + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_REQUEUE_AFTER + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.requeue.after + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_MAX_RESOURCES_STATUS_COUNT + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.status.max.resources.count + name: argocd-cmd-params-cm + optional: true + image: quay.io/argoproj/argocd:latest + imagePullPolicy: Always + name: argocd-applicationset-controller + ports: + - containerPort: 7000 + name: webhook + - containerPort: 8080 + name: metrics + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /app/config/ssh + name: ssh-known-hosts + - mountPath: /app/config/tls + name: tls-certs + - mountPath: /app/config/gpg/source + name: gpg-keys + - mountPath: /app/config/gpg/keys + name: gpg-keyring + - mountPath: /tmp + name: tmp + - mountPath: /app/config/reposerver/tls + name: argocd-repo-server-tls + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: argocd-applicationset-controller + volumes: + - configMap: + name: argocd-ssh-known-hosts-cm + name: ssh-known-hosts + - configMap: + name: argocd-tls-certs-cm + name: tls-certs + - configMap: + name: argocd-gpg-keys-cm + name: gpg-keys + - emptyDir: {} + name: gpg-keyring + - emptyDir: {} + name: tmp + - name: argocd-repo-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-repo-server-tls +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: dex-server + app.kubernetes.io/name: argocd-dex-server + app.kubernetes.io/part-of: argocd + name: argocd-dex-server +spec: + selector: + matchLabels: + app.kubernetes.io/name: argocd-dex-server + template: + metadata: + labels: + app.kubernetes.io/name: argocd-dex-server + spec: + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/part-of: argocd + topologyKey: kubernetes.io/hostname + weight: 5 + containers: + - command: + - /shared/argocd-dex + - rundex + env: + - name: ARGOCD_DEX_SERVER_LOGFORMAT + valueFrom: + configMapKeyRef: + key: dexserver.log.format + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_DEX_SERVER_LOGLEVEL + valueFrom: + configMapKeyRef: + key: dexserver.log.level + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_LOG_FORMAT_TIMESTAMP + valueFrom: + configMapKeyRef: + key: log.format.timestamp + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_DEX_SERVER_DISABLE_TLS + valueFrom: + configMapKeyRef: + key: dexserver.disable.tls + name: argocd-cmd-params-cm + optional: true + image: ghcr.io/dexidp/dex:v2.43.0 + imagePullPolicy: Always + name: dex + ports: + - containerPort: 5556 + - containerPort: 5557 + - containerPort: 5558 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /shared + name: static-files + - mountPath: /tmp + name: dexconfig + - mountPath: /tls + name: argocd-dex-server-tls + initContainers: + - command: + - /bin/cp + - -n + - /usr/local/bin/argocd + - /shared/argocd-dex + image: quay.io/argoproj/argocd:latest + imagePullPolicy: Always + name: copyutil + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /shared + name: static-files + - mountPath: /tmp + name: dexconfig + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: argocd-dex-server + volumes: + - emptyDir: {} + name: static-files + - emptyDir: {} + name: dexconfig + - name: argocd-dex-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-dex-server-tls +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-controller +spec: + selector: + matchLabels: + app.kubernetes.io/name: argocd-notifications-controller + strategy: + type: Recreate + template: + metadata: + labels: + app.kubernetes.io/name: argocd-notifications-controller + spec: + containers: + - args: + - /usr/local/bin/argocd-notifications + env: + - name: ARGOCD_NOTIFICATIONS_CONTROLLER_LOGFORMAT + valueFrom: + configMapKeyRef: + key: notificationscontroller.log.format + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_NOTIFICATIONS_CONTROLLER_LOGLEVEL + valueFrom: + configMapKeyRef: + key: notificationscontroller.log.level + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_LOG_FORMAT_TIMESTAMP + valueFrom: + configMapKeyRef: + key: log.format.timestamp + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_NAMESPACES + valueFrom: + configMapKeyRef: + key: application.namespaces + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_NOTIFICATION_CONTROLLER_SELF_SERVICE_NOTIFICATION_ENABLED + valueFrom: + configMapKeyRef: + key: notificationscontroller.selfservice.enabled + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_PLAINTEXT + valueFrom: + configMapKeyRef: + key: notificationscontroller.repo.server.plaintext + name: argocd-cmd-params-cm + optional: true + image: quay.io/argoproj/argocd:latest + imagePullPolicy: Always + livenessProbe: + tcpSocket: + port: 9001 + name: argocd-notifications-controller + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /app/config/tls + name: tls-certs + - mountPath: /app/config/reposerver/tls + name: argocd-repo-server-tls + workingDir: /app + nodeSelector: + kubernetes.io/os: linux + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: argocd-notifications-controller + volumes: + - configMap: + name: argocd-tls-certs-cm + name: tls-certs + - name: argocd-repo-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-repo-server-tls +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha-haproxy + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-haproxy +spec: + replicas: 3 + revisionHistoryLimit: 1 + selector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha-haproxy + strategy: + type: RollingUpdate + template: + metadata: + annotations: + checksum/config: cd6508bdf9819601c454d0cc491fb77a209e3a88761d92514d105b6681829953 + prometheus.io/path: /metrics + prometheus.io/port: "9101" + prometheus.io/scrape: "true" + labels: + app.kubernetes.io/name: argocd-redis-ha-haproxy + name: argocd-redis-ha-haproxy + spec: + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha-haproxy + topologyKey: kubernetes.io/hostname + automountServiceAccountToken: true + containers: + - env: + - name: AUTH + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + image: public.ecr.aws/docker/library/haproxy:3.0.8-alpine + imagePullPolicy: IfNotPresent + lifecycle: {} + livenessProbe: + httpGet: + path: /healthz + port: probe + initialDelaySeconds: 5 + periodSeconds: 3 + name: haproxy + ports: + - containerPort: 8888 + name: probe + - containerPort: 6379 + name: redis + - containerPort: 9101 + name: metrics-port + readinessProbe: + httpGet: + path: /healthz + port: probe + initialDelaySeconds: 5 + periodSeconds: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /usr/local/etc/haproxy + name: data + - mountPath: /run/haproxy + name: shared-socket + initContainers: + - command: + - argocd + - admin + - redis-initial-password + image: quay.io/argoproj/argocd:latest + imagePullPolicy: IfNotPresent + name: secret-init + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + - args: + - /readonly/haproxy_init.sh + command: + - sh + image: public.ecr.aws/docker/library/haproxy:3.0.8-alpine + imagePullPolicy: IfNotPresent + name: config-init + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /readonly + name: config-volume + readOnly: true + - mountPath: /data + name: data + securityContext: + fsGroup: 99 + runAsNonRoot: true + runAsUser: 99 + serviceAccountName: argocd-redis-ha-haproxy + volumes: + - configMap: + name: argocd-redis-ha-configmap + name: config-volume + - emptyDir: {} + name: shared-socket + - emptyDir: {} + name: data +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: repo-server + app.kubernetes.io/name: argocd-repo-server + app.kubernetes.io/part-of: argocd + name: argocd-repo-server +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: argocd-repo-server + template: + metadata: + labels: + app.kubernetes.io/name: argocd-repo-server + spec: + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-repo-server + topologyKey: topology.kubernetes.io/zone + weight: 100 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-repo-server + topologyKey: kubernetes.io/hostname + automountServiceAccountToken: false + containers: + - args: + - /usr/local/bin/argocd-repo-server + env: + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + - name: ARGOCD_RECONCILIATION_TIMEOUT + valueFrom: + configMapKeyRef: + key: timeout.reconciliation + name: argocd-cm + optional: true + - name: ARGOCD_REPO_SERVER_LOGFORMAT + valueFrom: + configMapKeyRef: + key: reposerver.log.format + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_LOGLEVEL + valueFrom: + configMapKeyRef: + key: reposerver.log.level + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_LOG_FORMAT_TIMESTAMP + valueFrom: + configMapKeyRef: + key: log.format.timestamp + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT + valueFrom: + configMapKeyRef: + key: reposerver.parallelism.limit + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_LISTEN_ADDRESS + valueFrom: + configMapKeyRef: + key: reposerver.listen.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_LISTEN_METRICS_ADDRESS + valueFrom: + configMapKeyRef: + key: reposerver.metrics.listen.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_DISABLE_TLS + valueFrom: + configMapKeyRef: + key: reposerver.disable.tls + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_TLS_MIN_VERSION + valueFrom: + configMapKeyRef: + key: reposerver.tls.minversion + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_TLS_MAX_VERSION + valueFrom: + configMapKeyRef: + key: reposerver.tls.maxversion + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_TLS_CIPHERS + valueFrom: + configMapKeyRef: + key: reposerver.tls.ciphers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: reposerver.repo.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: REDIS_SERVER + valueFrom: + configMapKeyRef: + key: redis.server + name: argocd-cmd-params-cm + optional: true + - name: REDIS_COMPRESSION + valueFrom: + configMapKeyRef: + key: redis.compression + name: argocd-cmd-params-cm + optional: true + - name: REDISDB + valueFrom: + configMapKeyRef: + key: redis.db + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_DEFAULT_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: reposerver.default.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS + valueFrom: + configMapKeyRef: + key: otlp.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_OTLP_INSECURE + valueFrom: + configMapKeyRef: + key: otlp.insecure + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_OTLP_HEADERS + valueFrom: + configMapKeyRef: + key: otlp.headers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_OTLP_ATTRS + valueFrom: + configMapKeyRef: + key: otlp.attrs + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.max.combined.directory.manifests.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS + valueFrom: + configMapKeyRef: + key: reposerver.plugin.tar.exclusions + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_PLUGIN_USE_MANIFEST_GENERATE_PATHS + valueFrom: + configMapKeyRef: + key: reposerver.plugin.use.manifest.generate.paths + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS + valueFrom: + configMapKeyRef: + key: reposerver.allow.oob.symlinks + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.streamed.manifest.max.tar.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.streamed.manifest.max.extracted.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.helm.manifest.max.extracted.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.disable.helm.manifest.max.extracted.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_OCI_MANIFEST_MAX_EXTRACTED_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.oci.manifest.max.extracted.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_DISABLE_OCI_MANIFEST_MAX_EXTRACTED_SIZE + valueFrom: + configMapKeyRef: + key: reposerver.disable.oci.manifest.max.extracted.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_OCI_LAYER_MEDIA_TYPES + valueFrom: + configMapKeyRef: + key: reposerver.oci.layer.media.types + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REVISION_CACHE_LOCK_TIMEOUT + valueFrom: + configMapKeyRef: + key: reposerver.revision.cache.lock.timeout + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_GIT_MODULES_ENABLED + valueFrom: + configMapKeyRef: + key: reposerver.enable.git.submodule + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_GIT_LS_REMOTE_PARALLELISM_LIMIT + valueFrom: + configMapKeyRef: + key: reposerver.git.lsremote.parallelism.limit + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_GIT_REQUEST_TIMEOUT + valueFrom: + configMapKeyRef: + key: reposerver.git.request.timeout + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_GRPC_MAX_SIZE_MB + valueFrom: + configMapKeyRef: + key: reposerver.grpc.max.size + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_REPO_SERVER_INCLUDE_HIDDEN_DIRECTORIES + valueFrom: + configMapKeyRef: + key: reposerver.include.hidden.directories + name: argocd-cmd-params-cm + optional: true + - name: HELM_CACHE_HOME + value: /helm-working-dir + - name: HELM_CONFIG_HOME + value: /helm-working-dir + - name: HELM_DATA_HOME + value: /helm-working-dir + image: quay.io/argoproj/argocd:latest + imagePullPolicy: Always + livenessProbe: + failureThreshold: 3 + httpGet: + path: /healthz?full=true + port: 8084 + initialDelaySeconds: 30 + periodSeconds: 30 + timeoutSeconds: 5 + name: argocd-repo-server + ports: + - containerPort: 8081 + - containerPort: 8084 + readinessProbe: + httpGet: + path: /healthz + port: 8084 + initialDelaySeconds: 5 + periodSeconds: 10 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /app/config/ssh + name: ssh-known-hosts + - mountPath: /app/config/tls + name: tls-certs + - mountPath: /app/config/gpg/source + name: gpg-keys + - mountPath: /app/config/gpg/keys + name: gpg-keyring + - mountPath: /app/config/reposerver/tls + name: argocd-repo-server-tls + - mountPath: /tmp + name: tmp + - mountPath: /helm-working-dir + name: helm-working-dir + - mountPath: /home/argocd/cmp-server/plugins + name: plugins + initContainers: + - args: + - /bin/cp --update=none /usr/local/bin/argocd /var/run/argocd/argocd && /bin/ln + -s /var/run/argocd/argocd /var/run/argocd/argocd-cmp-server + command: + - sh + - -c + image: quay.io/argoproj/argocd:latest + name: copyutil + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /var/run/argocd + name: var-files + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: argocd-repo-server + volumes: + - configMap: + name: argocd-ssh-known-hosts-cm + name: ssh-known-hosts + - configMap: + name: argocd-tls-certs-cm + name: tls-certs + - configMap: + name: argocd-gpg-keys-cm + name: gpg-keys + - emptyDir: {} + name: gpg-keyring + - emptyDir: {} + name: tmp + - emptyDir: {} + name: helm-working-dir + - name: argocd-repo-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-repo-server-tls + - emptyDir: {} + name: var-files + - emptyDir: {} + name: plugins +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: argocd-server + template: + metadata: + labels: + app.kubernetes.io/name: argocd-server + spec: + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + topologyKey: topology.kubernetes.io/zone + weight: 100 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + topologyKey: kubernetes.io/hostname + containers: + - args: + - /usr/local/bin/argocd-server + - --insecure + env: + - name: ARGOCD_API_SERVER_REPLICAS + value: "2" + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + - name: ARGOCD_SERVER_INSECURE + valueFrom: + configMapKeyRef: + key: server.insecure + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_BASEHREF + valueFrom: + configMapKeyRef: + key: server.basehref + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_ROOTPATH + valueFrom: + configMapKeyRef: + key: server.rootpath + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_LOGFORMAT + valueFrom: + configMapKeyRef: + key: server.log.format + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_LOG_LEVEL + valueFrom: + configMapKeyRef: + key: server.log.level + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_REPO_SERVER + valueFrom: + configMapKeyRef: + key: repo.server + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_DEX_SERVER + valueFrom: + configMapKeyRef: + key: server.dex.server + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_DISABLE_AUTH + valueFrom: + configMapKeyRef: + key: server.disable.auth + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_ENABLE_GZIP + valueFrom: + configMapKeyRef: + key: server.enable.gzip + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_REPO_SERVER_TIMEOUT_SECONDS + valueFrom: + configMapKeyRef: + key: server.repo.server.timeout.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_X_FRAME_OPTIONS + valueFrom: + configMapKeyRef: + key: server.x.frame.options + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_CONTENT_SECURITY_POLICY + valueFrom: + configMapKeyRef: + key: server.content.security.policy + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_REPO_SERVER_PLAINTEXT + valueFrom: + configMapKeyRef: + key: server.repo.server.plaintext + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_REPO_SERVER_STRICT_TLS + valueFrom: + configMapKeyRef: + key: server.repo.server.strict.tls + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT + valueFrom: + configMapKeyRef: + key: server.dex.server.plaintext + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_DEX_SERVER_STRICT_TLS + valueFrom: + configMapKeyRef: + key: server.dex.server.strict.tls + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_TLS_MIN_VERSION + valueFrom: + configMapKeyRef: + key: server.tls.minversion + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_TLS_MAX_VERSION + valueFrom: + configMapKeyRef: + key: server.tls.maxversion + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_TLS_CIPHERS + valueFrom: + configMapKeyRef: + key: server.tls.ciphers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_CONNECTION_STATUS_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: server.connection.status.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_OIDC_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: server.oidc.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_STATIC_ASSETS + valueFrom: + configMapKeyRef: + key: server.staticassets + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APP_STATE_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: server.app.state.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: REDIS_SERVER + valueFrom: + configMapKeyRef: + key: redis.server + name: argocd-cmd-params-cm + optional: true + - name: REDIS_COMPRESSION + valueFrom: + configMapKeyRef: + key: redis.compression + name: argocd-cmd-params-cm + optional: true + - name: REDISDB + valueFrom: + configMapKeyRef: + key: redis.db + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_DEFAULT_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: server.default.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_MAX_COOKIE_NUMBER + valueFrom: + configMapKeyRef: + key: server.http.cookie.maxnumber + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_LISTEN_ADDRESS + valueFrom: + configMapKeyRef: + key: server.listen.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_METRICS_LISTEN_ADDRESS + valueFrom: + configMapKeyRef: + key: server.metrics.listen.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_OTLP_ADDRESS + valueFrom: + configMapKeyRef: + key: otlp.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_OTLP_INSECURE + valueFrom: + configMapKeyRef: + key: otlp.insecure + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_OTLP_HEADERS + valueFrom: + configMapKeyRef: + key: otlp.headers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_OTLP_ATTRS + valueFrom: + configMapKeyRef: + key: otlp.attrs + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_NAMESPACES + valueFrom: + configMapKeyRef: + key: application.namespaces + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_ENABLE_PROXY_EXTENSION + valueFrom: + configMapKeyRef: + key: server.enable.proxy.extension + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_K8SCLIENT_RETRY_MAX + valueFrom: + configMapKeyRef: + key: server.k8sclient.retry.max + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_K8SCLIENT_RETRY_BASE_BACKOFF + valueFrom: + configMapKeyRef: + key: server.k8sclient.retry.base.backoff + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_API_CONTENT_TYPES + valueFrom: + configMapKeyRef: + key: server.api.content.types + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SERVER_WEBHOOK_PARALLELISM_LIMIT + valueFrom: + configMapKeyRef: + key: server.webhook.parallelism.limit + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_NEW_GIT_FILE_GLOBBING + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.new.git.file.globbing + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.scm.root.ca.path + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ALLOWED_SCM_PROVIDERS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.allowed.scm.providers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_SCM_PROVIDERS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.scm.providers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_GITHUB_API_METRICS + valueFrom: + configMapKeyRef: + key: applicationsetcontroller.enable.github.api.metrics + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_HYDRATOR_ENABLED + valueFrom: + configMapKeyRef: + key: hydrator.enabled + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SYNC_WITH_REPLACE_ALLOWED + valueFrom: + configMapKeyRef: + key: server.sync.replace.allowed + name: argocd-cmd-params-cm + optional: true + image: quay.io/argoproj/argocd:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz?full=true + port: 8080 + initialDelaySeconds: 3 + periodSeconds: 30 + timeoutSeconds: 5 + name: argocd-server + ports: + - containerPort: 8080 + - containerPort: 8083 + readinessProbe: + httpGet: + path: /healthz + port: 8080 + initialDelaySeconds: 3 + periodSeconds: 30 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /app/config/ssh + name: ssh-known-hosts + - mountPath: /app/config/tls + name: tls-certs + - mountPath: /app/config/server/tls + name: argocd-repo-server-tls + - mountPath: /app/config/dex/tls + name: argocd-dex-server-tls + - mountPath: /home/argocd + name: plugins-home + - mountPath: /tmp + name: tmp + - mountPath: /home/argocd/params + name: argocd-cmd-params-cm + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: argocd-server + volumes: + - emptyDir: {} + name: plugins-home + - emptyDir: {} + name: tmp + - configMap: + name: argocd-ssh-known-hosts-cm + name: ssh-known-hosts + - configMap: + name: argocd-tls-certs-cm + name: tls-certs + - name: argocd-repo-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-repo-server-tls + - name: argocd-dex-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-dex-server-tls + - configMap: + items: + - key: server.profile.enabled + path: profiler.enabled + name: argocd-cmd-params-cm + optional: true + name: argocd-cmd-params-cm +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: argocd-application-controller + serviceName: argocd-application-controller + template: + metadata: + labels: + app.kubernetes.io/name: argocd-application-controller + spec: + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-application-controller + topologyKey: kubernetes.io/hostname + weight: 100 + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/part-of: argocd + topologyKey: kubernetes.io/hostname + weight: 5 + containers: + - args: + - /usr/local/bin/argocd-application-controller + env: + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + - name: ARGOCD_CONTROLLER_REPLICAS + value: "1" + - name: ARGOCD_RECONCILIATION_TIMEOUT + valueFrom: + configMapKeyRef: + key: timeout.reconciliation + name: argocd-cm + optional: true + - name: ARGOCD_HARD_RECONCILIATION_TIMEOUT + valueFrom: + configMapKeyRef: + key: timeout.hard.reconciliation + name: argocd-cm + optional: true + - name: ARGOCD_RECONCILIATION_JITTER + valueFrom: + configMapKeyRef: + key: timeout.reconciliation.jitter + name: argocd-cm + optional: true + - name: ARGOCD_REPO_ERROR_GRACE_PERIOD_SECONDS + valueFrom: + configMapKeyRef: + key: controller.repo.error.grace.period.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER + valueFrom: + configMapKeyRef: + key: repo.server + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS + valueFrom: + configMapKeyRef: + key: controller.repo.server.timeout.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_STATUS_PROCESSORS + valueFrom: + configMapKeyRef: + key: controller.status.processors + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_OPERATION_PROCESSORS + valueFrom: + configMapKeyRef: + key: controller.operation.processors + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_LOGFORMAT + valueFrom: + configMapKeyRef: + key: controller.log.format + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_LOGLEVEL + valueFrom: + configMapKeyRef: + key: controller.log.level + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_LOG_FORMAT_TIMESTAMP + valueFrom: + configMapKeyRef: + key: log.format.timestamp + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_METRICS_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: controller.metrics.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_TIMEOUT_SECONDS + valueFrom: + configMapKeyRef: + key: controller.self.heal.timeout.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_TIMEOUT_SECONDS + valueFrom: + configMapKeyRef: + key: controller.self.heal.backoff.timeout.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_FACTOR + valueFrom: + configMapKeyRef: + key: controller.self.heal.backoff.factor + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_CAP_SECONDS + valueFrom: + configMapKeyRef: + key: controller.self.heal.backoff.cap.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_COOLDOWN_SECONDS + valueFrom: + configMapKeyRef: + key: controller.self.heal.backoff.cooldown.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_SYNC_WAVE_DELAY + valueFrom: + configMapKeyRef: + key: controller.sync.wave.delay.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.sync.timeout.seconds + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT + valueFrom: + configMapKeyRef: + key: controller.repo.server.plaintext + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_STRICT_TLS + valueFrom: + configMapKeyRef: + key: controller.repo.server.strict.tls + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH + valueFrom: + configMapKeyRef: + key: controller.resource.health.persist + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APP_STATE_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: controller.app.state.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: REDIS_SERVER + valueFrom: + configMapKeyRef: + key: redis.server + name: argocd-cmd-params-cm + optional: true + - name: REDIS_COMPRESSION + valueFrom: + configMapKeyRef: + key: redis.compression + name: argocd-cmd-params-cm + optional: true + - name: REDISDB + valueFrom: + configMapKeyRef: + key: redis.db + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_DEFAULT_CACHE_EXPIRATION + valueFrom: + configMapKeyRef: + key: controller.default.cache.expiration + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_ADDRESS + valueFrom: + configMapKeyRef: + key: otlp.address + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_INSECURE + valueFrom: + configMapKeyRef: + key: otlp.insecure + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_HEADERS + valueFrom: + configMapKeyRef: + key: otlp.headers + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_ATTRS + valueFrom: + configMapKeyRef: + key: otlp.attrs + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_NAMESPACES + valueFrom: + configMapKeyRef: + key: application.namespaces + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_CONTROLLER_SHARDING_ALGORITHM + valueFrom: + configMapKeyRef: + key: controller.sharding.algorithm + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_KUBECTL_PARALLELISM_LIMIT + valueFrom: + configMapKeyRef: + key: controller.kubectl.parallelism.limit + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_K8SCLIENT_RETRY_MAX + valueFrom: + configMapKeyRef: + key: controller.k8sclient.retry.max + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_K8SCLIENT_RETRY_BASE_BACKOFF + valueFrom: + configMapKeyRef: + key: controller.k8sclient.retry.base.backoff + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SERVER_SIDE_DIFF + valueFrom: + configMapKeyRef: + key: controller.diff.server.side + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_IGNORE_NORMALIZER_JQ_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.ignore.normalizer.jq.timeout + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_HYDRATOR_ENABLED + valueFrom: + configMapKeyRef: + key: hydrator.enabled + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_CLUSTER_CACHE_BATCH_EVENTS_PROCESSING + valueFrom: + configMapKeyRef: + key: controller.cluster.cache.batch.events.processing + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_CLUSTER_CACHE_EVENTS_PROCESSING_INTERVAL + valueFrom: + configMapKeyRef: + key: controller.cluster.cache.events.processing.interval + name: argocd-cmd-params-cm + optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_COMMIT_SERVER + valueFrom: + configMapKeyRef: + key: commit.server + name: argocd-cmd-params-cm + optional: true + - name: KUBECACHEDIR + value: /tmp/kubecache + image: quay.io/argoproj/argocd:latest + imagePullPolicy: Always + name: argocd-application-controller + ports: + - containerPort: 8082 + readinessProbe: + httpGet: + path: /healthz + port: 8082 + initialDelaySeconds: 5 + periodSeconds: 10 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /app/config/controller/tls + name: argocd-repo-server-tls + - mountPath: /home/argocd + name: argocd-home + - mountPath: /home/argocd/params + name: argocd-cmd-params-cm + - mountPath: /tmp + name: argocd-application-controller-tmp + workingDir: /home/argocd + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: argocd-application-controller + volumes: + - emptyDir: {} + name: argocd-home + - emptyDir: {} + name: argocd-application-controller-tmp + - name: argocd-repo-server-tls + secret: + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + - key: ca.crt + path: ca.crt + optional: true + secretName: argocd-repo-server-tls + - configMap: + items: + - key: controller.profile.enabled + path: profiler.enabled + name: argocd-cmd-params-cm + optional: true + name: argocd-cmd-params-cm +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-server +spec: + podManagementPolicy: OrderedReady + replicas: 3 + selector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha + serviceName: argocd-redis-ha + template: + metadata: + annotations: + checksum/init-config: fd74f7d84e39b3f6eac1d7ce5deb0083e58f218376faf363343d91a0fb4f2563 + labels: + app.kubernetes.io/name: argocd-redis-ha + spec: + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha + topologyKey: kubernetes.io/hostname + automountServiceAccountToken: false + containers: + - args: + - /data/conf/redis.conf + command: + - redis-server + env: + - name: AUTH + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + image: public.ecr.aws/docker/library/redis:8.2.1-alpine + imagePullPolicy: IfNotPresent + lifecycle: + preStop: + exec: + command: + - /bin/sh + - /readonly-config/trigger-failover-if-master.sh + livenessProbe: + exec: + command: + - sh + - -c + - /health/redis_liveness.sh + failureThreshold: 5 + initialDelaySeconds: 30 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 15 + name: redis + ports: + - containerPort: 6379 + name: redis + readinessProbe: + exec: + command: + - sh + - -c + - /health/redis_readiness.sh + failureThreshold: 5 + initialDelaySeconds: 30 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 15 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + startupProbe: + exec: + command: + - sh + - -c + - /health/redis_readiness.sh + failureThreshold: 5 + initialDelaySeconds: 30 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 15 + volumeMounts: + - mountPath: /readonly-config + name: config + readOnly: true + - mountPath: /data + name: data + - mountPath: /health + name: health + - args: + - /data/conf/sentinel.conf + command: + - redis-sentinel + env: + - name: AUTH + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + image: public.ecr.aws/docker/library/redis:8.2.1-alpine + imagePullPolicy: IfNotPresent + lifecycle: + postStart: + exec: + command: + - /bin/sh + - -c + - sleep 30; redis-cli -p 26379 sentinel reset argocd + livenessProbe: + exec: + command: + - sh + - -c + - /health/sentinel_liveness.sh + failureThreshold: 5 + initialDelaySeconds: 30 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 15 + name: sentinel + ports: + - containerPort: 26379 + name: sentinel + readinessProbe: + exec: + command: + - sh + - -c + - /health/sentinel_liveness.sh + failureThreshold: 5 + initialDelaySeconds: 30 + periodSeconds: 15 + successThreshold: 3 + timeoutSeconds: 15 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + startupProbe: + exec: + command: + - sh + - -c + - /health/sentinel_liveness.sh + failureThreshold: 3 + initialDelaySeconds: 5 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 15 + volumeMounts: + - mountPath: /data + name: data + - mountPath: /health + name: health + - args: + - /readonly-config/fix-split-brain.sh + command: + - sh + env: + - name: SENTINEL_ID_0 + value: 3c0d9c0320bb34888c2df5757c718ce6ca992ce6 + - name: SENTINEL_ID_1 + value: 40000915ab58c3fa8fd888fb8b24711944e6cbb4 + - name: SENTINEL_ID_2 + value: 2bbec7894d954a8af3bb54d13eaec53cb024e2ca + - name: AUTH + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + image: public.ecr.aws/docker/library/redis:8.2.1-alpine + imagePullPolicy: IfNotPresent + name: split-brain-fix + resources: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /readonly-config + name: config + readOnly: true + - mountPath: /data + name: data + initContainers: + - args: + - /readonly-config/init.sh + command: + - sh + env: + - name: SENTINEL_ID_0 + value: 3c0d9c0320bb34888c2df5757c718ce6ca992ce6 + - name: SENTINEL_ID_1 + value: 40000915ab58c3fa8fd888fb8b24711944e6cbb4 + - name: SENTINEL_ID_2 + value: 2bbec7894d954a8af3bb54d13eaec53cb024e2ca + - name: AUTH + valueFrom: + secretKeyRef: + key: auth + name: argocd-redis + image: public.ecr.aws/docker/library/redis:8.2.1-alpine + imagePullPolicy: IfNotPresent + name: config-init + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /readonly-config + name: config + readOnly: true + - mountPath: /data + name: data + securityContext: + fsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + serviceAccountName: argocd-redis-ha + terminationGracePeriodSeconds: 60 + volumes: + - configMap: + name: argocd-redis-ha-configmap + name: config + - configMap: + defaultMode: 493 + name: argocd-redis-ha-health-configmap + name: health + - emptyDir: {} + name: data + updateStrategy: + type: RollingUpdate +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: application-controller + app.kubernetes.io/name: argocd-application-controller + app.kubernetes.io/part-of: argocd + name: argocd-application-controller-network-policy +spec: + ingress: + - from: + - namespaceSelector: {} + ports: + - port: 8082 + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-application-controller + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: applicationset-controller + app.kubernetes.io/name: argocd-applicationset-controller + app.kubernetes.io/part-of: argocd + name: argocd-applicationset-controller-network-policy +spec: + ingress: + - from: + - namespaceSelector: {} + ports: + - port: 7000 + protocol: TCP + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-applicationset-controller + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: dex-server + app.kubernetes.io/name: argocd-dex-server + app.kubernetes.io/part-of: argocd + name: argocd-dex-server-network-policy +spec: + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + ports: + - port: 5556 + protocol: TCP + - port: 5557 + protocol: TCP + - from: + - namespaceSelector: {} + ports: + - port: 5558 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-dex-server + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: notifications-controller + app.kubernetes.io/name: argocd-notifications-controller + app.kubernetes.io/part-of: argocd + name: argocd-notifications-controller-network-policy +spec: + ingress: + - from: + - namespaceSelector: {} + ports: + - port: 9001 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-notifications-controller + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha-haproxy + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-proxy-network-policy +spec: + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-repo-server + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-application-controller + ports: + - port: 6379 + protocol: TCP + - port: 26379 + protocol: TCP + - from: + - namespaceSelector: {} + ports: + - port: 9101 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha-haproxy + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: redis + app.kubernetes.io/name: argocd-redis-ha + app.kubernetes.io/part-of: argocd + name: argocd-redis-ha-server-network-policy +spec: + egress: + - ports: + - port: 6379 + protocol: TCP + - port: 26379 + protocol: TCP + to: + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha-haproxy + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha + ports: + - port: 6379 + protocol: TCP + - port: 26379 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-redis-ha + policyTypes: + - Ingress + - Egress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: repo-server + app.kubernetes.io/name: argocd-repo-server + app.kubernetes.io/part-of: argocd + name: argocd-repo-server-network-policy +spec: + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-application-controller + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-notifications-controller + - podSelector: + matchLabels: + app.kubernetes.io/name: argocd-applicationset-controller + ports: + - port: 8081 + protocol: TCP + - from: + - namespaceSelector: {} + ports: + - port: 8084 + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-repo-server + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: server + app.kubernetes.io/name: argocd-server + app.kubernetes.io/part-of: argocd + name: argocd-server-network-policy +spec: + ingress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + policyTypes: + - Ingress diff --git a/argocd/httproute.yaml b/argocd/httproute.yaml new file mode 100644 index 0000000..701ff50 --- /dev/null +++ b/argocd/httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: argocd-route + namespace: argocd +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: argocd + hostnames: + - "argocd.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "argocd.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: argocd-server + port: 80 + kind: Service + group: "" + weight: 1 diff --git a/arrstack/arrstack-vpn-services-endpointslice.yaml b/arrstack/arrstack-vpn-services-endpointslice.yaml new file mode 100644 index 0000000..1981f84 --- /dev/null +++ b/arrstack/arrstack-vpn-services-endpointslice.yaml @@ -0,0 +1,38 @@ +# external-services-and-endpoints.yaml +apiVersion: discovery.k8s.io/v1 +kind: EndpointSlice +metadata: + name: arr-stack-endpoints + namespace: arrstack + labels: + kubernetes.io/service-name: arr-stack # This label now links to the Service +addressType: IPv4 +ports: + - name: qbittorrent-port + protocol: TCP + port: 8080 + - name: prowlarr-port + protocol: TCP + port: 9696 +endpoints: + - addresses: + - "10.8.13.2" + conditions: + ready: true +--- +apiVersion: v1 +kind: Service +metadata: + name: arr-stack # Service name now matches the label + namespace: arrstack +spec: + ports: + - name: qbittorrent-port + protocol: TCP + port: 8080 + targetPort: 8080 + - name: prowlarr-port + protocol: TCP + port: 9696 + targetPort: 9696 + type: ClusterIP diff --git a/arrstack/prowlarr-httproute.yaml b/arrstack/prowlarr-httproute.yaml new file mode 100644 index 0000000..9503c8f --- /dev/null +++ b/arrstack/prowlarr-httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: prowlarr-route + namespace: arrstack +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: prowlarr + hostnames: + - "prowlarr.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "prowlarr.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: arr-stack + port: 9696 + kind: Service + group: "" + weight: 1 diff --git a/arrstack/radarr-httproute.yaml b/arrstack/radarr-httproute.yaml new file mode 100644 index 0000000..29a0389 --- /dev/null +++ b/arrstack/radarr-httproute.yaml @@ -0,0 +1,48 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: radarr-route + namespace: arrstack + # NOTE: original ingress had VPN IP whitelist (whitelist-source-range) + # Gateway API has no direct equivalent — handle with NetworkPolicy if needed +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: radarr + hostnames: + - "radarr.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "radarr.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: radarr + port: 7878 + kind: Service + group: "" + weight: 1 diff --git a/arrstack/radarr/radarr-pvc.yaml b/arrstack/radarr/radarr-pvc.yaml new file mode 100644 index 0000000..1a24581 --- /dev/null +++ b/arrstack/radarr/radarr-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: arrstack + name: radarr-config +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn-static + resources: + requests: + storage: 5Gi diff --git a/arrstack/radarr/radarr-svc.yaml b/arrstack/radarr/radarr-svc.yaml new file mode 100644 index 0000000..fca3bc1 --- /dev/null +++ b/arrstack/radarr/radarr-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: radarr + namespace: arrstack +spec: + selector: + app: radarr + type: ClusterIP + ports: + - name: radarr + protocol: TCP + port: 7878 + targetPort: 7878 \ No newline at end of file diff --git a/arrstack/radarr/radarr.yaml b/arrstack/radarr/radarr.yaml new file mode 100644 index 0000000..955b515 --- /dev/null +++ b/arrstack/radarr/radarr.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: radarr + namespace: arrstack +spec: + replicas: 1 + selector: + matchLabels: + app: radarr + serviceName: radarr + template: + metadata: + labels: + app: radarr + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 60 + securityContext: + fsGroup: 0 + containers: + - name: radarr + image: lscr.io/linuxserver/radarr:6.1.1 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + env: + - name: PUID + value: "0" + - name: PGID + value: "0" + ports: + - containerPort: 7878 + volumeMounts: + - name: config + mountPath: /config + - name: media + subPath: "Anime Movies" + mountPath: /anime + - name: media + subPath: Movies + mountPath: /movies + - name: media + subPath: Nostalgia + mountPath: /nostalgia + - name: downloads + mountPath: /downloads + volumes: + - name: config + persistentVolumeClaim: + claimName: radarr-config + - name: media + persistentVolumeClaim: + claimName: smb-media + - name: downloads + persistentVolumeClaim: + claimName: smb-downloads diff --git a/arrstack/smb-download.yaml b/arrstack/smb-download.yaml new file mode 100644 index 0000000..56f62ff --- /dev/null +++ b/arrstack/smb-download.yaml @@ -0,0 +1,34 @@ +--- +apiVersion: v1 +kind: PersistentVolume +metadata: + name: smb-downloads +spec: + capacity: + storage: 5Gi + accessModes: + - ReadWriteMany + persistentVolumeReclaimPolicy: Retain + csi: + driver: smb.csi.k8s.io + volumeHandle: smb-downloads + volumeAttributes: + source: "//10.8.14.2/downloads" + nodeStageSecretRef: + name: arrstack-secrets + namespace: arrstack +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: arrstack + name: smb-downloads +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + volumeName: smb-downloads + storageClassName: "" + diff --git a/arrstack/smb-media.yaml b/arrstack/smb-media.yaml new file mode 100644 index 0000000..0be450d --- /dev/null +++ b/arrstack/smb-media.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: smb-media +# namespace: arrstack +spec: + capacity: + storage: 20Gi + accessModes: + - ReadWriteMany + persistentVolumeReclaimPolicy: Retain + csi: + driver: smb.csi.k8s.io + volumeHandle: smb-media + volumeAttributes: + source: "//10.8.14.2/Media" + nodeStageSecretRef: + name: arrstack-secrets + namespace: arrstack +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: arrstack + name: smb-media +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + volumeName: smb-media + storageClassName: "" diff --git a/arrstack/sonarr-httproute.yaml b/arrstack/sonarr-httproute.yaml new file mode 100644 index 0000000..b911e4e --- /dev/null +++ b/arrstack/sonarr-httproute.yaml @@ -0,0 +1,28 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: sonarr-route + namespace: arrstack + # NOTE: original ingress had VPN IP whitelist (whitelist-source-range) + # Gateway API has no direct equivalent — handle with NetworkPolicy if needed +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: sonarr + hostnames: + - "sonarr.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: sonarr + namespace: arrstack + port: 8989 + kind: Service + group: "" + weight: 1 diff --git a/arrstack/sonarr/sonarr-pvc.yaml b/arrstack/sonarr/sonarr-pvc.yaml new file mode 100644 index 0000000..f008f14 --- /dev/null +++ b/arrstack/sonarr/sonarr-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: arrstack + name: sonarr-config +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn-static + resources: + requests: + storage: 10Gi diff --git a/arrstack/sonarr/sonarr.yaml b/arrstack/sonarr/sonarr.yaml new file mode 100644 index 0000000..4b5392d --- /dev/null +++ b/arrstack/sonarr/sonarr.yaml @@ -0,0 +1,67 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: sonarr + namespace: arrstack +spec: + replicas: 1 + selector: + matchLabels: + app: sonarr + serviceName: sonarr + template: + metadata: + labels: + app: sonarr + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 60 + securityContext: + fsGroup: 0 + containers: + - name: sonarr + image: lscr.io/linuxserver/sonarr:4.0.17 + resources: + requests: + cpu: 100m + memory: 512Mi + limits: + cpu: 500m + memory: 1.5Gi + env: + - name: PUID + value: "0" + - name: PGID + value: "0" + ports: + - containerPort: 8989 + volumeMounts: + - name: config + mountPath: /config + - name: media + subPath: "Anime Series" + mountPath: /anime + - name: media + subPath: "Series" + mountPath: /series + - name: media + subPath: Cartoon + mountPath: /cartoon + - name: media + subPath: Nostalgia + mountPath: /nostalgia + - name: media + subPath: Kdrama + mountPath: /kdrama + - name: downloads + mountPath: /downloads + volumes: + - name: config + persistentVolumeClaim: + claimName: sonarr-config + - name: media + persistentVolumeClaim: + claimName: smb-media + - name: downloads + persistentVolumeClaim: + claimName: smb-downloads diff --git a/arrstack/sonarr/sonarrr-svc.yaml b/arrstack/sonarr/sonarrr-svc.yaml new file mode 100644 index 0000000..fac14bb --- /dev/null +++ b/arrstack/sonarr/sonarrr-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: sonarr + namespace: arrstack +spec: + selector: + app: sonarr + type: ClusterIP + ports: + - name: sonarr + protocol: TCP + port: 8989 + targetPort: 8989 \ No newline at end of file diff --git a/arrstack/torrent-httproute.yaml b/arrstack/torrent-httproute.yaml new file mode 100644 index 0000000..039a1c1 --- /dev/null +++ b/arrstack/torrent-httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: torrent-route + namespace: arrstack +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: torrent + hostnames: + - "torrent.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "torrent.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: arr-stack + port: 8080 + kind: Service + group: "" + weight: 1 diff --git a/authentik/httproute.yaml b/authentik/httproute.yaml new file mode 100644 index 0000000..628cecc --- /dev/null +++ b/authentik/httproute.yaml @@ -0,0 +1,51 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: authentik-route + namespace: authentik +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: authentik + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + namespace: envoy-gateway + sectionName: authentik + hostnames: + - "auth.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "auth.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: authentik-server + port: 80 + kind: Service + group: "" + weight: 1 diff --git a/authentik/postgres/pvc.yaml b/authentik/postgres/pvc.yaml new file mode 100644 index 0000000..159bd31 --- /dev/null +++ b/authentik/postgres/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: authentik-postgres-data + namespace: authentik +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 10Gi diff --git a/authentik/postgres/service.yaml b/authentik/postgres/service.yaml new file mode 100644 index 0000000..ff7f065 --- /dev/null +++ b/authentik/postgres/service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: authentik-postgresql + namespace: authentik +spec: + selector: + app: authentik-postgresql + ports: + - port: 5432 + targetPort: 5432 diff --git a/authentik/postgres/statefulset.yaml b/authentik/postgres/statefulset.yaml new file mode 100644 index 0000000..2ebf68e --- /dev/null +++ b/authentik/postgres/statefulset.yaml @@ -0,0 +1,52 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: authentik-postgresql + namespace: authentik +spec: + serviceName: authentik-postgresql + replicas: 1 + selector: + matchLabels: + app: authentik-postgresql + template: + metadata: + labels: + app: authentik-postgresql + spec: + containers: + - name: authentik-postgresql + image: postgres:16-alpine + ports: + - containerPort: 5432 + env: + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_name + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_user + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_password + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi + volumes: + - name: data + persistentVolumeClaim: + claimName: authentik-postgres-data diff --git a/authentik/server/deployment.yaml b/authentik/server/deployment.yaml new file mode 100644 index 0000000..db52c8c --- /dev/null +++ b/authentik/server/deployment.yaml @@ -0,0 +1,106 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: authentik-server + namespace: authentik +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: authentik-server + template: + metadata: + labels: + app: authentik-server + spec: + containers: + - name: authentik + image: ghcr.io/goauthentik/server:2026.2.1 + command: ["ak"] + args: ["server"] + ports: + - containerPort: 9000 + name: http + - containerPort: 9443 + name: https + env: + - name: AUTHENTIK_POSTGRESQL__HOST + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_host + - name: AUTHENTIK_POSTGRESQL__NAME + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_name + - name: AUTHENTIK_POSTGRESQL__USER + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_user + - name: AUTHENTIK_POSTGRESQL__PASSWORD + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_password + - name: AUTHENTIK_SECRET_KEY + valueFrom: + secretKeyRef: + name: authentik-secrets + key: AUTHENTIK_SECRET_KEY + - name: AUTHENTIK_EMAIL__HOST + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_host + - name: AUTHENTIK_EMAIL__PORT + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_port + - name: AUTHENTIK_EMAIL__USERNAME + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_username + - name: AUTHENTIK_EMAIL__PASSWORD + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_password + - name: AUTHENTIK_EMAIL__FROM + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_from + - name: AUTHENTIK_EMAIL__USE_TLS + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_use_tls + volumeMounts: + - name: data + mountPath: /data + - name: templates + mountPath: /templates + - name: dshm + mountPath: /dev/shm + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 1Gi + volumes: + - name: data + persistentVolumeClaim: + claimName: authentik-server-data + - name: templates + emptyDir: {} + - name: dshm + emptyDir: + medium: Memory + sizeLimit: 512Mi diff --git a/authentik/server/pvc.yaml b/authentik/server/pvc.yaml new file mode 100644 index 0000000..44fbc4e --- /dev/null +++ b/authentik/server/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: authentik-server-data + namespace: authentik +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 1Gi diff --git a/authentik/server/service.yaml b/authentik/server/service.yaml new file mode 100644 index 0000000..e31360a --- /dev/null +++ b/authentik/server/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: authentik-server + namespace: authentik +spec: + selector: + app: authentik-server + ports: + - name: http + port: 80 + targetPort: 9000 + - name: https + port: 443 + targetPort: 9443 diff --git a/authentik/worker/deployment.yaml b/authentik/worker/deployment.yaml new file mode 100644 index 0000000..fa5e5d3 --- /dev/null +++ b/authentik/worker/deployment.yaml @@ -0,0 +1,107 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: authentik-worker + namespace: authentik +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: authentik-worker + template: + metadata: + labels: + app: authentik-worker + spec: + securityContext: + runAsUser: 0 + containers: + - name: authentik + image: ghcr.io/goauthentik/server:2026.2.1 + command: ["ak"] + args: ["worker"] + env: + - name: AUTHENTIK_POSTGRESQL__HOST + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_host + - name: AUTHENTIK_POSTGRESQL__NAME + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_name + - name: AUTHENTIK_POSTGRESQL__USER + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_user + - name: AUTHENTIK_POSTGRESQL__PASSWORD + valueFrom: + secretKeyRef: + name: authentik-secrets + key: db_password + - name: AUTHENTIK_SECRET_KEY + valueFrom: + secretKeyRef: + name: authentik-secrets + key: AUTHENTIK_SECRET_KEY + - name: AUTHENTIK_EMAIL__HOST + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_host + - name: AUTHENTIK_EMAIL__PORT + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_port + - name: AUTHENTIK_EMAIL__USERNAME + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_username + - name: AUTHENTIK_EMAIL__PASSWORD + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_password + - name: AUTHENTIK_EMAIL__FROM + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_from + - name: AUTHENTIK_EMAIL__USE_TLS + valueFrom: + secretKeyRef: + name: authentik-secrets + key: email_use_tls + volumeMounts: + - name: data + mountPath: /data + - name: certs + mountPath: /certs + - name: templates + mountPath: /templates + - name: dshm + mountPath: /dev/shm + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 1Gi + volumes: + - name: data + persistentVolumeClaim: + claimName: authentik-worker-data + - name: templates + emptyDir: {} + - name: certs + emptyDir: {} + - name: dshm + emptyDir: + medium: Memory + sizeLimit: 512Mi diff --git a/authentik/worker/pvc.yaml b/authentik/worker/pvc.yaml new file mode 100644 index 0000000..7088343 --- /dev/null +++ b/authentik/worker/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: authentik-worker-data + namespace: authentik +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 1Gi diff --git a/azure-ddns-python/azure-ddns-svc.yaml b/azure-ddns-python/azure-ddns-svc.yaml new file mode 100755 index 0000000..c87dcf1 --- /dev/null +++ b/azure-ddns-python/azure-ddns-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: azure-ddns + namespace: azure-ddns +spec: + selector: + app: azure-ddns + ports: + - name: azure-ddns + port: 443 + targetPort: 443 + protocol: TCP + type: ClusterIP \ No newline at end of file diff --git a/azure-ddns-python/azure-ddns.yaml b/azure-ddns-python/azure-ddns.yaml new file mode 100755 index 0000000..d8e71ee --- /dev/null +++ b/azure-ddns-python/azure-ddns.yaml @@ -0,0 +1,54 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: azure-ddns + namespace: azure-ddns +spec: + replicas: 1 + selector: + matchLabels: + app: azure-ddns + serviceName: azure-ddns + template: + metadata: + labels: + app: azure-ddns + spec: + terminationGracePeriodSeconds: 60 + containers: + - name: azure-ddns + image: gitea.jsme.be/jeffrey/azure-ddns-python:1.0.2 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 200m + memory: 128Mi + env: + - name: AZURE_TENANT_ID + valueFrom: + secretKeyRef: + name: azure-ddns-secrets + key: TENANT_ID + - name: AZURE_CLIENT_ID + valueFrom: + secretKeyRef: + name: azure-ddns-secrets + key: CLIENT_ID + - name: AZURE_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: azure-ddns-secrets + key: CLIENT_SECRET + - name: AZURE_SUBSCRIPTION_ID + valueFrom: + secretKeyRef: + name: azure-ddns-secrets + key: SUBSCRIPTION_ID + - name: AZURE_RESOURCE_GROUP + valueFrom: + secretKeyRef: + name: azure-ddns-secrets + key: RESOURCE_GROUP + restartPolicy: Always \ No newline at end of file diff --git a/bentopdf/bentopdf-svc.yaml b/bentopdf/bentopdf-svc.yaml new file mode 100644 index 0000000..7932dd0 --- /dev/null +++ b/bentopdf/bentopdf-svc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: bentopdf + namespace: bentopdf +spec: + selector: + app: bentopdf + ports: + - protocol: TCP + port: 8080 + targetPort: 8080 + type: ClusterIP diff --git a/bentopdf/bentopdf.yaml b/bentopdf/bentopdf.yaml new file mode 100644 index 0000000..d4a8046 --- /dev/null +++ b/bentopdf/bentopdf.yaml @@ -0,0 +1,29 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: bentopdf + name: bentopdf +spec: + replicas: 1 + selector: + matchLabels: + app: bentopdf + template: + metadata: + labels: + app: bentopdf + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 10 + containers: + - name: bentopdf + image: ghcr.io/alam00000/bentopdf:v2.8.2-amd64 + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 200m + memory: 256Mi + ports: + - containerPort: 8080 \ No newline at end of file diff --git a/bentopdf/httproute.yaml b/bentopdf/httproute.yaml new file mode 100644 index 0000000..a14dc3b --- /dev/null +++ b/bentopdf/httproute.yaml @@ -0,0 +1,51 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: bentopdf-route + namespace: bentopdf +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: bentopdf + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + namespace: envoy-gateway + sectionName: bentopdf + hostnames: + - "pdf.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "pdf.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: bentopdf + port: 8080 + kind: Service + group: "" + weight: 1 diff --git a/cert-manager/azure-dns-certs.yaml b/cert-manager/azure-dns-certs.yaml new file mode 100644 index 0000000..d767f76 --- /dev/null +++ b/cert-manager/azure-dns-certs.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: Secret +metadata: + name: azuredns-config + namespace: cert-manager +type: Opaque +data: + client-secret: +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: azure-dns + namespace: cert-manager +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: jeffreysmeets@jsme.be + privateKeySecretRef: + name: azuredns + solvers: + - dns01: + azureDNS: + clientID: 1144257c-6893-4f34-be9b-fa2ac3f3780e + clientSecretSecretRef: + name: azuredns-config + key: client-secret + subscriptionID: 5b701352-f929-464d-9b1c-7b8ed6d23b53 + tenantID: cf2466c7-c9b9-4820-b416-3bb4c380e52d + resourceGroupName: jsme.be + hostedZoneName: jsme.be + # Azure Cloud Environment, default to AzurePublicCloud + environment: AzurePublicCloud diff --git a/cloud-native-postgres/values.yaml b/cloud-native-postgres/values.yaml new file mode 100644 index 0000000..95180ee --- /dev/null +++ b/cloud-native-postgres/values.yaml @@ -0,0 +1,692 @@ +# +# Copyright © contributors to CloudNativePG, established as +# CloudNativePG a Series of LF Projects, LLC. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# +# Default values for CloudNativePG. +# This is a YAML-formatted file. +# Please declare variables to be passed to your templates. + +replicaCount: 1 + +image: + repository: ghcr.io/cloudnative-pg/cloudnative-pg + pullPolicy: IfNotPresent + # -- Overrides the image tag whose default is the chart appVersion. + tag: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" +namespaceOverride: "" + +hostNetwork: false +dnsPolicy: "" + +# -- Update strategy for the operator. +# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy +# For example: +# type: RollingUpdate +# rollingUpdate: +# maxSurge: 25% +# maxUnavailable: 25% +updateStrategy: {} + +crds: + # -- Specifies whether the CRDs should be created when installing the chart. + create: true + +# -- The webhook configuration. +webhook: + port: 9443 + mutating: + create: true + failurePolicy: Fail + validating: + create: true + failurePolicy: Fail + livenessProbe: + initialDelaySeconds: 3 + readinessProbe: + initialDelaySeconds: 3 + startupProbe: + failureThreshold: 6 + periodSeconds: 5 + +# Operator configuration. +config: + # -- Specifies whether the secret should be created. + create: true + # -- The name of the configmap/secret to use. + name: cnpg-controller-manager-config + # -- Specifies whether it should be stored in a secret, instead of a configmap. + secret: false + # -- This option determines if the operator is responsible for observing + # events across the entire Kubernetes cluster or if its focus should be + # narrowed down to the specific namespace within which it has been deployed. + clusterWide: true + # -- The content of the configmap/secret, see + # https://cloudnative-pg.io/documentation/current/operator_conf/#available-options + # for all the available options. + data: {} + # INHERITED_ANNOTATIONS: categories + # INHERITED_LABELS: environment, workload, app + # WATCH_NAMESPACE: namespace-a,namespace-b + # -- The maximum number of concurrent reconciles. Defaults to 10. + maxConcurrentReconciles: 10 + +# -- Additional arguments to be added to the operator's args list. +additionalArgs: [] + +# -- Array containing extra environment variables which can be templated. +# For example: +# - name: RELEASE_NAME +# value: "{{ .Release.Name }}" +# - name: MY_VAR +# value: "mySpecialKey" +additionalEnv: [] + +serviceAccount: + # -- Specifies whether the service account should be created. + create: true + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + +rbac: + # -- Specifies whether ClusterRole and ClusterRoleBinding should be created. + create: true + # -- Aggregate ClusterRoles to Kubernetes default user-facing roles. + # Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles + aggregateClusterRoles: false + +# -- Annotations to be added to all other resources. +commonAnnotations: {} +# -- Annotations to be added to the pod. +podAnnotations: {} +# -- Labels to be added to the pod. +podLabels: {} + +# -- Container Security Context. +containerSecurityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsUser: 10001 + runAsGroup: 10001 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - "ALL" + +# -- Security Context for the whole pod. +podSecurityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + # fsGroup: 2000 + +# -- Priority indicates the importance of a Pod relative to other Pods. +priorityClassName: "" + +service: + type: ClusterIP + # -- DO NOT CHANGE THE SERVICE NAME as it is currently used to generate the certificate + # and can not be configured + name: cnpg-webhook-service + port: 443 + # -- Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) + ipFamilyPolicy: "" + # -- Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6. + ipFamilies: [] + +resources: + limits: + memory: 256Mi + requests: + cpu: 100m + memory: 128Mi + +# -- Nodeselector for the operator to be installed. +nodeSelector: {} + +# -- Topology Spread Constraints for the operator to be installed. +topologySpreadConstraints: [] + +# -- Tolerations for the operator to be installed. +tolerations: [] + +# -- Affinity for the operator to be installed. +affinity: {} + +monitoring: + + # -- Specifies whether the monitoring should be enabled. Requires Prometheus Operator CRDs. + # Disabled because Victoria Metrics doesn't have PodMonitor CRD - use VMPodScrape instead + podMonitorEnabled: false + # -- Metrics relabel configurations to apply to samples before ingestion. + podMonitorMetricRelabelings: [] + # -- Relabel configurations to apply to samples before scraping. + podMonitorRelabelings: [] + # -- Additional labels for the podMonitor + podMonitorAdditionalLabels: {} + + grafanaDashboard: + create: true + # -- Allows overriding the namespace where the ConfigMap will be created, defaulting to the same one as the Release. + namespace: "monitoring" + # -- The name of the ConfigMap containing the dashboard. + configMapName: "cnpg-grafana-dashboard" + # -- Label that ConfigMaps should have to be loaded as dashboards. DEPRECATED: Use labels instead. + sidecarLabel: "" + # -- Label value that ConfigMaps should have to be loaded as dashboards. DEPRECATED: Use labels instead. + sidecarLabelValue: "" + # -- Labels that ConfigMaps should have to get configured in Grafana. + labels: + grafana_dashboard: "1" + # -- Annotations that ConfigMaps can have to get configured in Grafana. + annotations: {} + +# Default monitoring queries +monitoringQueriesConfigMap: + # -- The name of the default monitoring configmap. + name: cnpg-default-monitoring + # -- A string representation of a YAML defining monitoring queries. + queries: | + backends: + query: | + SELECT sa.datname + , sa.usename + , sa.application_name + , states.state + , COALESCE(sa.count, 0) AS total + , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds + FROM ( VALUES ('active') + , ('idle') + , ('idle in transaction') + , ('idle in transaction (aborted)') + , ('fastpath function call') + , ('disabled') + ) AS states(state) + LEFT JOIN ( + SELECT datname + , state + , usename + , COALESCE(application_name, '') AS application_name + , COUNT(*) + , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs + FROM pg_catalog.pg_stat_activity + GROUP BY datname, state, usename, application_name + ) sa ON states.state = sa.state + WHERE sa.usename IS NOT NULL + metrics: + - datname: + usage: "LABEL" + description: "Name of the database" + - usename: + usage: "LABEL" + description: "Name of the user" + - application_name: + usage: "LABEL" + description: "Name of the application" + - state: + usage: "LABEL" + description: "State of the backend" + - total: + usage: "GAUGE" + description: "Number of backends" + - max_tx_duration_seconds: + usage: "GAUGE" + description: "Maximum duration of a transaction in seconds" + + backends_waiting: + query: | + SELECT count(*) AS total + FROM pg_catalog.pg_locks blocked_locks + JOIN pg_catalog.pg_locks blocking_locks + ON blocking_locks.locktype = blocked_locks.locktype + AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database + AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation + AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page + AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple + AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid + AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid + AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid + AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid + AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid + AND blocking_locks.pid != blocked_locks.pid + JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid + WHERE NOT blocked_locks.granted + metrics: + - total: + usage: "GAUGE" + description: "Total number of backends that are currently waiting on other queries" + + pg_database: + query: | + SELECT datname + , pg_catalog.pg_database_size(datname) AS size_bytes + , pg_catalog.age(datfrozenxid) AS xid_age + , pg_catalog.mxid_age(datminmxid) AS mxid_age + FROM pg_catalog.pg_database + WHERE datallowconn + metrics: + - datname: + usage: "LABEL" + description: "Name of the database" + - size_bytes: + usage: "GAUGE" + description: "Disk space used by the database" + - xid_age: + usage: "GAUGE" + description: "Number of transactions from the frozen XID to the current one" + - mxid_age: + usage: "GAUGE" + description: "Number of multiple transactions (Multixact) from the frozen XID to the current one" + + pg_postmaster: + query: | + SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time + FROM pg_catalog.pg_postmaster_start_time() + metrics: + - start_time: + usage: "GAUGE" + description: "Time at which postgres started (based on epoch)" + + pg_replication: + query: | + SELECT CASE WHEN ( + NOT pg_catalog.pg_is_in_recovery() + OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn()) + THEN 0 + ELSE GREATEST (0, + EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp()))) + END AS lag, + pg_catalog.pg_is_in_recovery() AS in_recovery, + EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up, + (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas + metrics: + - lag: + usage: "GAUGE" + description: "Replication lag behind primary in seconds" + - in_recovery: + usage: "GAUGE" + description: "Whether the instance is in recovery" + - is_wal_receiver_up: + usage: "GAUGE" + description: "Whether the instance wal_receiver is up" + - streaming_replicas: + usage: "GAUGE" + description: "Number of streaming replicas connected to the instance" + + pg_replication_slots: + query: | + SELECT slot_name, + slot_type, + database, + active, + (CASE pg_catalog.pg_is_in_recovery() + WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn) + ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn) + END) as pg_wal_lsn_diff + FROM pg_catalog.pg_replication_slots + WHERE NOT temporary + metrics: + - slot_name: + usage: "LABEL" + description: "Name of the replication slot" + - slot_type: + usage: "LABEL" + description: "Type of the replication slot" + - database: + usage: "LABEL" + description: "Name of the database" + - active: + usage: "GAUGE" + description: "Flag indicating whether the slot is active" + - pg_wal_lsn_diff: + usage: "GAUGE" + description: "Replication lag in bytes" + + pg_stat_archiver: + query: | + SELECT archived_count + , failed_count + , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival + , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure + , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time + , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time + , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn + , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn + , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time + FROM pg_catalog.pg_stat_archiver + predicate_query: | + SELECT NOT pg_catalog.pg_is_in_recovery() + OR pg_catalog.current_setting('archive_mode') = 'always' + metrics: + - archived_count: + usage: "COUNTER" + description: "Number of WAL files that have been successfully archived" + - failed_count: + usage: "COUNTER" + description: "Number of failed attempts for archiving WAL files" + - seconds_since_last_archival: + usage: "GAUGE" + description: "Seconds since the last successful archival operation" + - seconds_since_last_failure: + usage: "GAUGE" + description: "Seconds since the last failed archival operation" + - last_archived_time: + usage: "GAUGE" + description: "Epoch of the last time WAL archiving succeeded" + - last_failed_time: + usage: "GAUGE" + description: "Epoch of the last time WAL archiving failed" + - last_archived_wal_start_lsn: + usage: "GAUGE" + description: "Archived WAL start LSN" + - last_failed_wal_start_lsn: + usage: "GAUGE" + description: "Last failed WAL LSN" + - stats_reset_time: + usage: "GAUGE" + description: "Time at which these statistics were last reset" + + pg_stat_bgwriter: + runonserver: "<17.0.0" + query: | + SELECT checkpoints_timed + , checkpoints_req + , checkpoint_write_time + , checkpoint_sync_time + , buffers_checkpoint + , buffers_clean + , maxwritten_clean + , buffers_backend + , buffers_backend_fsync + , buffers_alloc + FROM pg_catalog.pg_stat_bgwriter + metrics: + - checkpoints_timed: + usage: "COUNTER" + description: "Number of scheduled checkpoints that have been performed" + - checkpoints_req: + usage: "COUNTER" + description: "Number of requested checkpoints that have been performed" + - checkpoint_write_time: + usage: "COUNTER" + description: "Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds" + - checkpoint_sync_time: + usage: "COUNTER" + description: "Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds" + - buffers_checkpoint: + usage: "COUNTER" + description: "Number of buffers written during checkpoints" + - buffers_clean: + usage: "COUNTER" + description: "Number of buffers written by the background writer" + - maxwritten_clean: + usage: "COUNTER" + description: "Number of times the background writer stopped a cleaning scan because it had written too many buffers" + - buffers_backend: + usage: "COUNTER" + description: "Number of buffers written directly by a backend" + - buffers_backend_fsync: + usage: "COUNTER" + description: "Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)" + - buffers_alloc: + usage: "COUNTER" + description: "Number of buffers allocated" + + pg_stat_bgwriter_17: + runonserver: ">=17.0.0" + name: pg_stat_bgwriter + query: | + SELECT buffers_clean + , maxwritten_clean + , buffers_alloc + , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time + FROM pg_catalog.pg_stat_bgwriter + metrics: + - buffers_clean: + usage: "COUNTER" + description: "Number of buffers written by the background writer" + - maxwritten_clean: + usage: "COUNTER" + description: "Number of times the background writer stopped a cleaning scan because it had written too many buffers" + - buffers_alloc: + usage: "COUNTER" + description: "Number of buffers allocated" + - stats_reset_time: + usage: "GAUGE" + description: "Time at which these statistics were last reset" + + pg_stat_checkpointer: + runonserver: ">=17.0.0" + query: | + SELECT num_timed AS checkpoints_timed + , num_requested AS checkpoints_req + , restartpoints_timed + , restartpoints_req + , restartpoints_done + , write_time + , sync_time + , buffers_written + , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time + FROM pg_catalog.pg_stat_checkpointer + metrics: + - checkpoints_timed: + usage: "COUNTER" + description: "Number of scheduled checkpoints that have been performed" + - checkpoints_req: + usage: "COUNTER" + description: "Number of requested checkpoints that have been performed" + - restartpoints_timed: + usage: "COUNTER" + description: "Number of scheduled restartpoints due to timeout or after a failed attempt to perform it" + - restartpoints_req: + usage: "COUNTER" + description: "Number of requested restartpoints that have been performed" + - restartpoints_done: + usage: "COUNTER" + description: "Number of restartpoints that have been performed" + - write_time: + usage: "COUNTER" + description: "Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds" + - sync_time: + usage: "COUNTER" + description: "Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds" + - buffers_written: + usage: "COUNTER" + description: "Number of buffers written during checkpoints and restartpoints" + - stats_reset_time: + usage: "GAUGE" + description: "Time at which these statistics were last reset" + + pg_stat_database: + query: | + SELECT datname + , xact_commit + , xact_rollback + , blks_read + , blks_hit + , tup_returned + , tup_fetched + , tup_inserted + , tup_updated + , tup_deleted + , conflicts + , temp_files + , temp_bytes + , deadlocks + , blk_read_time + , blk_write_time + FROM pg_catalog.pg_stat_database + metrics: + - datname: + usage: "LABEL" + description: "Name of this database" + - xact_commit: + usage: "COUNTER" + description: "Number of transactions in this database that have been committed" + - xact_rollback: + usage: "COUNTER" + description: "Number of transactions in this database that have been rolled back" + - blks_read: + usage: "COUNTER" + description: "Number of disk blocks read in this database" + - blks_hit: + usage: "COUNTER" + description: "Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)" + - tup_returned: + usage: "COUNTER" + description: "Number of rows returned by queries in this database" + - tup_fetched: + usage: "COUNTER" + description: "Number of rows fetched by queries in this database" + - tup_inserted: + usage: "COUNTER" + description: "Number of rows inserted by queries in this database" + - tup_updated: + usage: "COUNTER" + description: "Number of rows updated by queries in this database" + - tup_deleted: + usage: "COUNTER" + description: "Number of rows deleted by queries in this database" + - conflicts: + usage: "COUNTER" + description: "Number of queries canceled due to conflicts with recovery in this database" + - temp_files: + usage: "COUNTER" + description: "Number of temporary files created by queries in this database" + - temp_bytes: + usage: "COUNTER" + description: "Total amount of data written to temporary files by queries in this database" + - deadlocks: + usage: "COUNTER" + description: "Number of deadlocks detected in this database" + - blk_read_time: + usage: "COUNTER" + description: "Time spent reading data file blocks by backends in this database, in milliseconds" + - blk_write_time: + usage: "COUNTER" + description: "Time spent writing data file blocks by backends in this database, in milliseconds" + + pg_stat_replication: + primary: true + query: | + SELECT usename + , COALESCE(application_name, '') AS application_name + , COALESCE(client_addr::text, '') AS client_addr + , COALESCE(client_port::text, '') AS client_port + , EXTRACT(EPOCH FROM backend_start) AS backend_start + , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age + , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes + , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes + , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes + , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes + , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds + , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds + , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds + FROM pg_catalog.pg_stat_replication + metrics: + - usename: + usage: "LABEL" + description: "Name of the replication user" + - application_name: + usage: "LABEL" + description: "Name of the application" + - client_addr: + usage: "LABEL" + description: "Client IP address" + - client_port: + usage: "LABEL" + description: "Client TCP port" + - backend_start: + usage: "COUNTER" + description: "Time when this process was started" + - backend_xmin_age: + usage: "COUNTER" + description: "The age of this standby's xmin horizon" + - sent_diff_bytes: + usage: "GAUGE" + description: "Difference in bytes from the last write-ahead log location sent on this connection" + - write_diff_bytes: + usage: "GAUGE" + description: "Difference in bytes from the last write-ahead log location written to disk by this standby server" + - flush_diff_bytes: + usage: "GAUGE" + description: "Difference in bytes from the last write-ahead log location flushed to disk by this standby server" + - replay_diff_bytes: + usage: "GAUGE" + description: "Difference in bytes from the last write-ahead log location replayed into the database on this standby server" + - write_lag_seconds: + usage: "GAUGE" + description: "Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it" + - flush_lag_seconds: + usage: "GAUGE" + description: "Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it" + - replay_lag_seconds: + usage: "GAUGE" + description: "Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it" + + pg_settings: + query: | + SELECT name, + CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting + FROM pg_catalog.pg_settings + WHERE vartype IN ('integer', 'real', 'bool') + ORDER BY 1 + metrics: + - name: + usage: "LABEL" + description: "Name of the setting" + - setting: + usage: "GAUGE" + description: "Setting value" + + pg_extensions: + query: | + SELECT + current_database() as datname, + name as extname, + default_version, + installed_version, + CASE + WHEN default_version = installed_version THEN 0 + ELSE 1 + END AS update_available + FROM pg_catalog.pg_available_extensions + WHERE installed_version IS NOT NULL + metrics: + - datname: + usage: "LABEL" + description: "Name of the database" + - extname: + usage: "LABEL" + description: "Extension name" + - default_version: + usage: "LABEL" + description: "Default version" + - installed_version: + usage: "LABEL" + description: "Installed version" + - update_available: + usage: "GAUGE" + description: "An update is available" + target_databases: + - '*' + diff --git a/comfyui/comfyui-pvc.yaml b/comfyui/comfyui-pvc.yaml new file mode 100644 index 0000000..75a7039 --- /dev/null +++ b/comfyui/comfyui-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: comfyui-pvc + namespace: comfyui +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 50Gi diff --git a/comfyui/comfyui-svc.yaml b/comfyui/comfyui-svc.yaml new file mode 100644 index 0000000..86c5f46 --- /dev/null +++ b/comfyui/comfyui-svc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: comfyui + namespace: comfyui +spec: + selector: + app: comfyui + ports: + - protocol: TCP + port: 8188 + targetPort: 8188 + type: ClusterIP diff --git a/comfyui/comfyui.yaml b/comfyui/comfyui.yaml new file mode 100644 index 0000000..fc85ae1 --- /dev/null +++ b/comfyui/comfyui.yaml @@ -0,0 +1,44 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: comfyui + namespace: comfyui +spec: + replicas: 1 + selector: + matchLabels: + app: comfyui + serviceName: comfyui + template: + metadata: + labels: + app: comfyui + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 30 + nodeSelector: + kubernetes.io/hostname: kubernetes-worker-1.jsme.be + containers: + - name: comfyui + image: ghcr.io/ai-dock/comfyui:latest + ports: + - containerPort: 8188 + env: + - name: COMFYUI_FLAGS + value: "--listen 0.0.0.0 --port 8188 --use-xpu" + - name: AUTO_UPDATE + value: "false" + securityContext: + privileged: true + volumeMounts: + - name: data + mountPath: /config + - name: dri + mountPath: /dev/dri + volumes: + - name: data + persistentVolumeClaim: + claimName: comfyui-pvc + - name: dri + hostPath: + path: /dev/dri diff --git a/databasus/databasus-ns.yaml b/databasus/databasus-ns.yaml new file mode 100644 index 0000000..84ac48b --- /dev/null +++ b/databasus/databasus-ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: databasus diff --git a/databasus/databasus-pvc.yaml b/databasus/databasus-pvc.yaml new file mode 100644 index 0000000..2166b3a --- /dev/null +++ b/databasus/databasus-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: databasus-pvc + namespace: databasus +spec: + accessModes: + - ReadWriteMany + storageClassName: longhorn-static + resources: + requests: + storage: 10Gi diff --git a/databasus/databasus-statefulset.yaml b/databasus/databasus-statefulset.yaml new file mode 100644 index 0000000..e56ee81 --- /dev/null +++ b/databasus/databasus-statefulset.yaml @@ -0,0 +1,38 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: databasus + namespace: databasus +spec: + replicas: 1 + selector: + matchLabels: + app: databasus + serviceName: databasus-svc + template: + metadata: + labels: + app: databasus + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 10 + containers: + - name: databasus + image: databasus/databasus:latest + imagePullPolicy: Always + resources: + requests: + cpu: 200m + memory: 512Mi + limits: + cpu: 1000m + memory: 2Gi + ports: + - containerPort: 4005 + volumeMounts: + - name: data + mountPath: /databasus-data + volumes: + - name: data + persistentVolumeClaim: + claimName: databasus-pvc diff --git a/databasus/databasus-svc.yaml b/databasus/databasus-svc.yaml new file mode 100644 index 0000000..10ae6a6 --- /dev/null +++ b/databasus/databasus-svc.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: databasus-svc + namespace: databasus +spec: + ports: + - name: databasus + port: 4005 + targetPort: 4005 + selector: + app: databasus + type: ClusterIP diff --git a/databasus/httproute.yaml b/databasus/httproute.yaml new file mode 100644 index 0000000..a925644 --- /dev/null +++ b/databasus/httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: databasus-route + namespace: databasus +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: databasus + hostnames: + - "databasus.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "databasus.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: databasus-svc + port: 4005 + kind: Service + group: "" + weight: 1 diff --git a/deprecated/nginx-ingress-controller/argocd-ingress.yaml b/deprecated/nginx-ingress-controller/argocd-ingress.yaml new file mode 100644 index 0000000..f27799d --- /dev/null +++ b/deprecated/nginx-ingress-controller/argocd-ingress.yaml @@ -0,0 +1,29 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-ingress + namespace: argocd + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" + nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0" +spec: + ingressClassName: nginx + tls: + - hosts: + - argocd.jsme.be + secretName: argocd-tls + rules: + - host: argocd.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + number: 443 + diff --git a/deprecated/nginx-ingress-controller/bentopdf-ingress.yaml b/deprecated/nginx-ingress-controller/bentopdf-ingress.yaml new file mode 100644 index 0000000..e0887c6 --- /dev/null +++ b/deprecated/nginx-ingress-controller/bentopdf-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: bentopdf-ingress + namespace: bentopdf + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - pdf.jsme.be + secretName: bentopdf-tls + rules: + - host: pdf.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: bentopdf + port: + number: 8080 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/gitea-ingress.yaml b/deprecated/nginx-ingress-controller/gitea-ingress.yaml new file mode 100644 index 0000000..3507f34 --- /dev/null +++ b/deprecated/nginx-ingress-controller/gitea-ingress.yaml @@ -0,0 +1,29 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: gitea-ingress + namespace: gitea + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/proxy-body-size: "8192m" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" +spec: + ingressClassName: nginx + tls: + - hosts: + - gitea.jsme.be + secretName: gitea-tls + rules: + - host: gitea.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: gitea + port: + number: 3000 + diff --git a/deprecated/nginx-ingress-controller/infisical-ingress.yaml b/deprecated/nginx-ingress-controller/infisical-ingress.yaml new file mode 100644 index 0000000..67c0afa --- /dev/null +++ b/deprecated/nginx-ingress-controller/infisical-ingress.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: infisical-ingress + namespace: infisical + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/proxy-body-size: "100g" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" +spec: + ingressClassName: nginx + tls: + - hosts: + - infisical.jsme.be + secretName: infisical-tls + rules: + - host: infisical.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: infisical + port: + number: 8080 diff --git a/deprecated/nginx-ingress-controller/it-tools-ingress.yaml b/deprecated/nginx-ingress-controller/it-tools-ingress.yaml new file mode 100644 index 0000000..d2baea9 --- /dev/null +++ b/deprecated/nginx-ingress-controller/it-tools-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ittools-ingress + namespace: ittools + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - tools.jsme.be + secretName: tools-tls + rules: + - host: tools.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: ittools + port: + number: 8080 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/jellyseer-ingress.yaml b/deprecated/nginx-ingress-controller/jellyseer-ingress.yaml new file mode 100644 index 0000000..ba398a6 --- /dev/null +++ b/deprecated/nginx-ingress-controller/jellyseer-ingress.yaml @@ -0,0 +1,29 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: jellyseer-ingress + namespace: jellyseer + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" + nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0" +spec: + ingressClassName: nginx + tls: + - hosts: + - jellyseer.jsme.be + secretName: jellyseer-tls + rules: + - host: jellyseer.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: jellyseer + port: + number: 5055 + diff --git a/deprecated/nginx-ingress-controller/jenkins-ingress.yaml b/deprecated/nginx-ingress-controller/jenkins-ingress.yaml new file mode 100644 index 0000000..4393cc4 --- /dev/null +++ b/deprecated/nginx-ingress-controller/jenkins-ingress.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: jenkins-ingress + namespace: jenkins + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" + nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0" +spec: + ingressClassName: nginx + tls: + - hosts: + - jenkins.jsme.be + secretName: jenkins-tls + rules: + - host: jenkins.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: jenkins-svc-ingress + port: + number: 8080 diff --git a/deprecated/nginx-ingress-controller/jenkins-svc-ingress.yaml b/deprecated/nginx-ingress-controller/jenkins-svc-ingress.yaml new file mode 100644 index 0000000..0059c9b --- /dev/null +++ b/deprecated/nginx-ingress-controller/jenkins-svc-ingress.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: jenkins-svc-ingress + namespace: jenkins +spec: + selector: + app: jenkins + ports: + - protocol: TCP + port: 8080 + targetPort: 8080 + type: ClusterIP diff --git a/deprecated/nginx-ingress-controller/longhorn-ingress.yaml b/deprecated/nginx-ingress-controller/longhorn-ingress.yaml new file mode 100644 index 0000000..60a29ef --- /dev/null +++ b/deprecated/nginx-ingress-controller/longhorn-ingress.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: longhorn-ingress + namespace: longhorn-system + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - longhorn.jsme.be + secretName: longhorn-tls + rules: + - host: longhorn.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: longhorn-frontend + port: + number: 80 + diff --git a/deprecated/nginx-ingress-controller/minio-ingress-webui.yaml b/deprecated/nginx-ingress-controller/minio-ingress-webui.yaml new file mode 100644 index 0000000..821dfce --- /dev/null +++ b/deprecated/nginx-ingress-controller/minio-ingress-webui.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: resume-minioweb-ingress + namespace: resume + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - resume-minioweb.jsme.be + secretName: resume-minioweb-tls + rules: + - host: resume-minioweb.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: minio + port: + number: 9001 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/minio-ingress.yaml b/deprecated/nginx-ingress-controller/minio-ingress.yaml new file mode 100644 index 0000000..4011b8e --- /dev/null +++ b/deprecated/nginx-ingress-controller/minio-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: resume-minio-ingress + namespace: resume + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - resume-minio.jsme.be + secretName: resume-minio-tls + rules: + - host: resume-minio.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: minio + port: + number: 9000 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/n8n-ingress.yaml b/deprecated/nginx-ingress-controller/n8n-ingress.yaml new file mode 100644 index 0000000..5c374db --- /dev/null +++ b/deprecated/nginx-ingress-controller/n8n-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: n8n-ingress + namespace: n8n + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - n8n.jsme.be + secretName: n8n-tls + rules: + - host: n8n.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: n8n-svc + port: + number: 5678 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/netbootxyz-ingress.yaml b/deprecated/nginx-ingress-controller/netbootxyz-ingress.yaml new file mode 100644 index 0000000..259cf78 --- /dev/null +++ b/deprecated/nginx-ingress-controller/netbootxyz-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: netbootxyz + namespace: netbootxyz + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - netboot.jsme.be + secretName: netbootxyz-tls + rules: + - host: netboot.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: netbootxyz + port: + number: 3000 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/passbolt-ingress.yaml b/deprecated/nginx-ingress-controller/passbolt-ingress.yaml new file mode 100644 index 0000000..9ed0653 --- /dev/null +++ b/deprecated/nginx-ingress-controller/passbolt-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: passbolt-ingress + namespace: passbolt + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" +spec: + ingressClassName: nginx + tls: + - hosts: + - passbolt.jsme.be + secretName: passbolt-tls + rules: + - host: passbolt.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: passbolt + port: + number: 443 diff --git a/deprecated/nginx-ingress-controller/proxmox-ingress.yaml b/deprecated/nginx-ingress-controller/proxmox-ingress.yaml new file mode 100644 index 0000000..8f7bfea --- /dev/null +++ b/deprecated/nginx-ingress-controller/proxmox-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: proxmox-ingress + namespace: proxmox + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" +spec: + ingressClassName: nginx + tls: + - hosts: + - proxmox.jsme.be + secretName: proxmox-tls + rules: + - host: proxmox.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: proxmox + port: + number: 8006 diff --git a/deprecated/nginx-ingress-controller/radarr-ingress.yaml b/deprecated/nginx-ingress-controller/radarr-ingress.yaml new file mode 100644 index 0000000..808b0a4 --- /dev/null +++ b/deprecated/nginx-ingress-controller/radarr-ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: radarr-ingress + namespace: arrstack + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" + nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0" + nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32" +spec: + ingressClassName: nginx + tls: + - hosts: + - radarr.jsme.be + secretName: radarr-tls + rules: + - host: radarr.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: radarr + port: + number: 7878 + diff --git a/deprecated/nginx-ingress-controller/resume-ingress.yaml b/deprecated/nginx-ingress-controller/resume-ingress.yaml new file mode 100644 index 0000000..842ffcd --- /dev/null +++ b/deprecated/nginx-ingress-controller/resume-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: resume-ingress + namespace: resume + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - resume.jsme.be + secretName: resume-tls + rules: + - host: resume.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: resume + port: + number: 3000 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/sonarr-ingress.yaml b/deprecated/nginx-ingress-controller/sonarr-ingress.yaml new file mode 100644 index 0000000..038bc62 --- /dev/null +++ b/deprecated/nginx-ingress-controller/sonarr-ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: sonarr-ingress + namespace: arrstack + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" + nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0" + nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32" +spec: + ingressClassName: nginx + tls: + - hosts: + - sonarr.jsme.be + secretName: sonarr-tls + rules: + - host: sonarr.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: sonarr + port: + number: 8989 + diff --git a/deprecated/nginx-ingress-controller/technitium-ingress.yaml b/deprecated/nginx-ingress-controller/technitium-ingress.yaml new file mode 100644 index 0000000..0059b29 --- /dev/null +++ b/deprecated/nginx-ingress-controller/technitium-ingress.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: technitium-backup-ingress + namespace: technitium + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/proxy-body-size: "100g" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" +spec: + ingressClassName: nginx + tls: + - hosts: + - dns2.jsme.be + secretName: technitium-backup-tls + rules: + - host: dns2.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: technitium-backup + port: + number: 5380 diff --git a/deprecated/nginx-ingress-controller/technitium-ingress.yml b/deprecated/nginx-ingress-controller/technitium-ingress.yml new file mode 100644 index 0000000..9bc5512 --- /dev/null +++ b/deprecated/nginx-ingress-controller/technitium-ingress.yml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: technitium-ingress + namespace: technitium + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - dns1.jsme.be + secretName: technitium-tls + rules: + - host: dns1.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: technitium + port: + number: 5380 + diff --git a/deprecated/nginx-ingress-controller/truenas-ingress.yaml b/deprecated/nginx-ingress-controller/truenas-ingress.yaml new file mode 100644 index 0000000..2b178dd --- /dev/null +++ b/deprecated/nginx-ingress-controller/truenas-ingress.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: truenas-ingress + namespace: truenas + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + nginx.ingress.kubernetes.io/proxy-body-size: "100g" + nginx.ingress.kubernetes.io/use-forwarded-headers: "true" +spec: + ingressClassName: nginx + tls: + - hosts: + - truenas.jsme.be + secretName: truenas-tls + rules: + - host: truenas.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: truenas + port: + number: 443 diff --git a/deprecated/nginx-ingress-controller/unifi-ingress.yaml b/deprecated/nginx-ingress-controller/unifi-ingress.yaml new file mode 100644 index 0000000..532f8e5 --- /dev/null +++ b/deprecated/nginx-ingress-controller/unifi-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: unifi-ingress + namespace: unifi + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" +spec: + ingressClassName: nginx + tls: + - hosts: + - unifi.jsme.be + secretName: unifi-tls + rules: + - host: unifi.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: unifi + port: + number: 443 diff --git a/deprecated/nginx-ingress-controller/wiki-ingress.yaml b/deprecated/nginx-ingress-controller/wiki-ingress.yaml new file mode 100644 index 0000000..a41deb7 --- /dev/null +++ b/deprecated/nginx-ingress-controller/wiki-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: wiki-ingress + namespace: wiki + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + # nginx.ingress.kubernetes.io/backend-protocol: "HTTP" +spec: + ingressClassName: nginx + tls: + - hosts: + - wiki.jsme.be + secretName: wiki-tls + rules: + - host: wiki.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: wiki + port: + number: 3000 \ No newline at end of file diff --git a/deprecated/nginx-ingress-controller/zipline-ingress.yaml b/deprecated/nginx-ingress-controller/zipline-ingress.yaml new file mode 100644 index 0000000..08e578d --- /dev/null +++ b/deprecated/nginx-ingress-controller/zipline-ingress.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: zipline-ingress + namespace: zipline + annotations: + cert-manager.io/cluster-issuer: azure-dns + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/proxy-body-size: "0" +spec: + ingressClassName: nginx + tls: + - hosts: + - share.jsme.be + secretName: zipline-tls + rules: + - host: share.jsme.be + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: zipline + port: + number: 3000 + diff --git a/deprecated/psono/envoy-gateway/certificate.yaml b/deprecated/psono/envoy-gateway/certificate.yaml new file mode 100644 index 0000000..69b1fca --- /dev/null +++ b/deprecated/psono/envoy-gateway/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: psono-tls + namespace: envoy-gateway +spec: + secretName: psono-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - psono.jsme.be diff --git a/deprecated/psono/envoy-gateway/gateway-patch.yaml b/deprecated/psono/envoy-gateway/gateway-patch.yaml new file mode 100644 index 0000000..a0d6e84 --- /dev/null +++ b/deprecated/psono/envoy-gateway/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: psono + protocol: HTTPS + port: 443 + hostname: "psono.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: psono + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: psono-tls + namespace: envoy-gateway diff --git a/deprecated/psono/httproute.yaml b/deprecated/psono/httproute.yaml new file mode 100644 index 0000000..a8f200b --- /dev/null +++ b/deprecated/psono/httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: psono-route + namespace: psono +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: psono + hostnames: + - "psono.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "psono.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: psono + port: 80 + kind: Service + group: "" + weight: 1 diff --git a/deprecated/psono/infisical/psono.yaml b/deprecated/psono/infisical/psono.yaml new file mode 100644 index 0000000..efaa046 --- /dev/null +++ b/deprecated/psono/infisical/psono.yaml @@ -0,0 +1,22 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: psono-secrets + namespace: infisical +spec: + hostAPI: https://infisical.jsme.be + resyncInterval: 30 + authentication: + universalAuth: + secretsScope: + projectSlug: "kubernetes" + envSlug: "prod" + secretsPath: "/psono" + recursive: true + credentialsRef: + secretName: infisical-universal-auth + secretNamespace: infisical + managedSecretReference: + secretName: psono-secrets + secretNamespace: psono + secretType: Opaque diff --git a/deprecated/psono/namespace.yaml b/deprecated/psono/namespace.yaml new file mode 100644 index 0000000..fc84290 --- /dev/null +++ b/deprecated/psono/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: psono diff --git a/deprecated/psono/postgres/postgres-statefulset.yaml b/deprecated/psono/postgres/postgres-statefulset.yaml new file mode 100644 index 0000000..00eeab5 --- /dev/null +++ b/deprecated/psono/postgres/postgres-statefulset.yaml @@ -0,0 +1,46 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: postgresql + namespace: psono +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: postgresql + template: + metadata: + labels: + app: postgresql + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 60 + containers: + - name: postgresql + image: postgres:18 + ports: + - containerPort: 5432 + volumeMounts: + - name: postgresql-database + mountPath: /var/lib/postgresql/pgdata + env: + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: psono-secrets + key: db_password + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: psono-secrets + key: db_user + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: psono-secrets + key: db_name + volumes: + - name: postgresql-database + persistentVolumeClaim: + claimName: postgresql-pvc diff --git a/deprecated/psono/postgres/postgresql-pvc.yaml b/deprecated/psono/postgres/postgresql-pvc.yaml new file mode 100644 index 0000000..93c6c42 --- /dev/null +++ b/deprecated/psono/postgres/postgresql-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: postgresql-pvc + namespace: psono +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 10Gi diff --git a/deprecated/psono/postgres/postgresql-svc.yaml b/deprecated/psono/postgres/postgresql-svc.yaml new file mode 100644 index 0000000..0733a8b --- /dev/null +++ b/deprecated/psono/postgres/postgresql-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: postgresql + namespace: psono +spec: + selector: + app: postgresql + type: ClusterIP + ports: + - name: postgresql-port + protocol: TCP + port: 5432 + targetPort: 5432 diff --git a/deprecated/psono/pvc.yaml b/deprecated/psono/pvc.yaml new file mode 100644 index 0000000..857ea66 --- /dev/null +++ b/deprecated/psono/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: psono-data + namespace: psono +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 5Gi diff --git a/deprecated/psono/settings-configmap.yaml b/deprecated/psono/settings-configmap.yaml new file mode 100644 index 0000000..20354fe --- /dev/null +++ b/deprecated/psono/settings-configmap.yaml @@ -0,0 +1,254 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: psono-settings + namespace: psono +data: + settings.yaml: | + SECRET_KEY: 'KPjkg8HXdizAGt5DHV43DIAc9O3yeDy2UnbNMN35a3A2BthUhdh1sHX4V2yEGn6a' + ACTIVATION_LINK_SECRET: 'tTJnSKGtEzsh3cRj0WYCC3ZoGNwtSIgvsodbt72Jr037O0avVTUqbHTCKCzuiXH2' + DB_SECRET: 'oLSX12kWYDEaKPXWOU8uPk0sP9vmKmdAE84SqCj2z2XkSdJnMR3hVUsW1CwFQ7cP' + EMAIL_SECRET_SALT: '$2b$12$7iZIEIbGsilSxtPlJ4Tuce' + PRIVATE_KEY: 'f1eb687fb69ab3be9372b9acfce649518c1602e47e07f8fe909fe82059961e5d' + PUBLIC_KEY: '2154e086c8b469bce14d47382ca953b3ca37be485af16757e2cbab5543645974' + + WEB_CLIENT_URL: 'https://psono.jsme.be' + + # The number of proxies in your environment to parse the X-Forwarded-For header. The basic setup of Psono uses 2 + # reverse proxies, the regular one and one in the combo container. If you have additional Loadbalancers you may have + # adjust this parameter. + NUM_PROXIES: 2 + + FAVICON_SERVICE_URL: 'https://favicon.psono.com/v1/icon/' + + # Switch DEBUG to false if you go into production + DEBUG: False + + # Adjust this according to Django Documentation https://docs.djangoproject.com/en/5.2/ref/settings/ + ALLOWED_HOSTS: ['*'] + + # Should be your domain without "www.". Will be the last part of the username + ALLOWED_DOMAINS: ['jsme.be', 'gmail.com', 'telenet.be'] + + # If you want to disable registration, you can comment in the following line + # ALLOW_REGISTRATION: False + + # If you want to disable the lost password functionality, you can comment in the following line + # ALLOW_LOST_PASSWORD: False + + # If you want to enforce that the email address and username needs to match upon registration + ENFORCE_MATCHING_USERNAME_AND_EMAIL: False + + # If you want to restrict registration to some email addresses you can specify here a list of domains to filter + # REGISTRATION_EMAIL_FILTER: ['company1.com', 'company2.com'] + + # Should be the URL of the host under which the host is reachable + # If you open the url and append /info/ to it you should have a text similar to {"info":"{\"version\": \"....} + HOST_URL: 'https://psono.jsme.be/server' + + # The email used to send emails, e.g. for activation + # ATTENTION: If executed in a docker container, then "localhost" will resolve to the docker container, so + # "localhost" will not work as host. Use the public IP or DNS record of the server. + EMAIL_FROM: $email_from + EMAIL_HOST: $email_host + EMAIL_HOST_USER: $email_user + EMAIL_HOST_PASSWORD: $email_password + EMAIL_PORT: $email_port + EMAIL_SUBJECT_PREFIX: '' + EMAIL_USE_TLS: True + EMAIL_TIMEOUT: 10 + + + # Cache with Redis + # By default you should use something different than database 0 or 1, e.g. 13 (default max is 16, can be configured in + # redis.conf) possible URLS are: + # redis://[:password]@localhost:6379/0 + # rediss://[:password]@localhost:6379/0 + # unix://[:password]@/path/to/socket.sock?db=0 + # CACHE_ENABLE: False + # CACHE_REDIS: False + # CACHE_REDIS_LOCATION: 'redis://127.0.0.1:6379/13' + + # The server will automatically connect to the license server to get a license for 10 users. + # For paying customers we offer the opportunity to get an offline license code. + # + # LICENSE_CODE: | + # 0abcdefg... + # 1abcdefg... + # 2abcdefg... + # 3abcdefg... + # 4abcdefg... + # 5abcdefg... + # 6abcdefg... + # 7abcdefg... + # 8abcdefg... + + # Optional: Send an email notification when remaining licenses reach a threshold. + # The threshold is checked whenever users are created or activated. + ADMIN_EMAIL: [$email_user] + # ADMIN_EMAIL_LICENSE_THRESHOLD: 1 + + # Enables the management API, required for the psono-admin-client / admin portal (Default is set to False) + MANAGEMENT_ENABLED: True + + # Enables the fileserver API, required for the psono-fileserver + # FILESERVER_HANDLER_ENABLED: False + + # Enables files for the client + # FILES_ENABLED: False + + # Allows that users can search for partial usernames + ALLOW_USER_SEARCH_BY_USERNAME_PARTIAL: True + + # Allows that users can search for email addresses too + ALLOW_USER_SEARCH_BY_EMAIL: True + + # Disables central security reports + # DISABLE_CENTRAL_SECURITY_REPORTS: True + + # If you want to use SAML, then you can configure it like this as a dictionary. + # + # About the parameters: + # idp->entityId: Thats the url to the metadata of your IDP + # idp->singleLogoutService->url: Thats the url to the logout service of your IDP + # idp->singleSignOnService->url: Thats the url to the single sign-on service of your IDP + # idp->x509cert: Thats the certificate of your IDP + # idp->groups_attribute: The attribute in the SAML response that holds your groups + # idp->username_attribute: The attribute in the SAML response that holds the username. If you put here null, then it will use the NameID + # idp->email_attribute: The attribute in the SAML response that holds the email address. + # idp->username_domain: The domain that is appended to the provided username, if the provided username is not already in email format. + # idp->required_group: A list of group names (casesensitive) in order to restrict who can use SAML login with this installation. Leave empty for no restriction. + # idp->is_adfs: If you are using ADFS. + # idp->honor_multifactors: Multifactor authentication can be bypassed with this flag for all SAML users (e.g. when you already enforce multifactor on the SAML provider). + # idp->max_session_lifetime: The time in seconds that a session created throught SAML will live + # + # sp->NameIDFormat: The normal nameformat parameter. (should only be set to transient if you have set a username attribute with username_attribute) + # sp->attributeConsumingService: Only necessary if the IDP needs to be told to send some specific attributes + # sp->x509cert: The X.509 cert + # sp->privateKey: The corresponding private key of the X.509 cert + # + # There are a couple of more options next to those required ones below. + # More information can be found here https://github.com/onelogin/python3-saml + # + # A self-signed certificate can be generated with: + # openssl req -new -newkey rsa:2048 -x509 -days 3650 -nodes -sha256 -out sp_x509cert.crt -keyout sp_private_key.key + # + # To help you setup SAML, we have created a small "testsaml" command that should make things easier. You can execute it like: + # docker run --rm \ + # -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \ + # -ti psono/psono-combo-enterprise:latest python3 psono/manage.py testsaml + # + # The number 1 in line 2 is the provider id. Users are matched by the constructed username. + # + # SAML_CONFIGURATIONS: + # 1: + # idp: + # entityId: "https://idp.exampple.com/metadata.php" + # singleLogoutService: + # binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" + # url: "https://idp.exampple.com/SingleLogoutService.php" + # singleSignOnService: + # binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" + # url: "https://idp.exampple.com/SingleSignOnService.php" + # x509cert: "ABC...==" + # groups_attribute: "groups" + # username_attribute: 'username' + # email_attribute: 'email' + # username_domain: 'example.com' + # required_group: [] + # is_adfs: false + # honor_multifactors: true + # max_session_lifetime: 86400 + # sp: + # NameIDFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" + # assertionConsumerService: + # binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" + # attributeConsumingService: + # serviceName: "Psono" + # serviceDescription: "Psono password manager" + # requestedAttributes: + # - + # attributeValue: [] + # friendlyName: "" + # isRequired: false + # name: "attribute-that-has-to-be-requested-explicitely" + # nameFormat: "" + # privateKey: "ABC...==" + # singleLogoutService: + # binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" + # x509cert: "ABC...==" + # autoprovision_psono_folder: false + # autoprovision_psono_group: false + # strict: true + # + # You need a couple of urls to configure the IDP correctly. If the server is accessible under https://example.com/server + # (e.g. https://example.com/server/healthcheck/ shows some json output) and the provider id is 1 as in the example + # above the following urls are valid: + # + # for metadata : https://example.com/server/saml/1/metadata/ + # for assertion consumer service : https://example.com/server/saml/1/acs/ + # for single logout service : https://example.com/server/saml/1/sls/ + # + # + # ATTENTION: API kays currently bypass SAML authentication, that means API keys can still access secrets even if the + # user was disabled in SAML. API keys can be disabled with COMPLIANCE_DISABLE_API_KEYS + + # If you want to use OIDC, then you can configure it like this as a dictionary. + # OIDC_CONFIGURATIONS: + # 1: + # OIDC_RP_SIGN_ALGO: 'RS256' + # OIDC_RP_CLIENT_ID: 'whatever client id was provided' + # OIDC_RP_CLIENT_SECRET: 'whatever secret was provided' + # OIDC_OP_JWKS_ENDPOINT: 'https://example.com/jwks' + # OIDC_OP_AUTHORIZATION_ENDPOINT: 'https://example.com/authorize' + # OIDC_OP_TOKEN_ENDPOINT: 'https://example.com/token' + # OIDC_OP_USER_ENDPOINT: 'https://example.com/userinfo' + # + # Standard parameters explained: + # OIDC_RP_SIGN_ALGO defaults to HS256 and needs to match the algo of your IDP + # OIDC_RP_CLIENT_ID the client id that is provided by your IDP + # OIDC_RP_CLIENT_SECRET the secret that is provided by your IDP + # OIDC_OP_JWKS_ENDPOINT The JWKS endpoint of your IDP + # OIDC_OP_AUTHORIZATION_ENDPOINT The authorization endpoint of your IDP + # OIDC_OP_TOKEN_ENDPOINT The token endpoint of your IDP + # + # other parameters are: + # OIDC_VERIFY_JWT defaults to true, Controls whether Psono verifies the signature of the JWT tokens + # OIDC_USE_NONCE defaults to true, Controls whether Psono uses nonce verification + # OIDC_VERIFY_SSL defaults to true, Controls whether Psono verifies the SSL certificate of the IDP responses + # OIDC_TIMEOUT defaults to 10, Defines a timeout for all requests in seconds to the IDP (fetch JWS, retrieve JWT tokens, userinfo endpoint)) + # OIDC_PROXY defaults to None, Defines a proxy for all requests to the IDP (fetch JWS, retrieve JWT tokens, Userinfo Endpoint). More infos can be found here https://requests.readthedocs.io/en/master/user/advanced/#proxies + # OIDC_RP_SCOPES defaults to 'openid email', The OpenID Connect scopes to request during login. + # OIDC_AUTH_REQUEST_EXTRA_PARAMS defaults to {}, Additional parameters to include in the initial authorization request. + # OIDC_RP_IDP_SIGN_KEY defaults to None, Sets the key the IDP uses to sign ID tokens in the case of an RSA sign algorithm. Should be the signing key in PEM or DER format. + # OIDC_ALLOW_UNSECURED_JWT defaults to False, Controls whether the Psono is going to allow unsecured JWT tokens (tokens with header {"alg":"none"}). This needs to be set to True if the IDP is returning unsecured JWT tokens and you want to accept them. See also https://tools.ietf.org/html/rfc7519#section-6 + # OIDC_TOKEN_USE_BASIC_AUTH defaults to False, Use HTTP Basic Authentication instead of sending the client secret in token request POST body. + + # Your Postgres Database credentials + # ATTENTION: If executed in a docker container, then "localhost" will resolve to the docker container, so + # "localhost" will not work as host. Use the public IP or DNS record of the server. + DATABASES: + default: + 'ENGINE': 'django.db.backends.postgresql_psycopg2' + 'NAME': $db_name + 'USER': $db_user + 'PASSWORD': $db_password + 'HOST': $db_host + 'PORT': $db_port + + # The path to the template folder can be "shadowed" if required later + TEMPLATES: [ + { + 'BACKEND': 'django.template.backends.django.DjangoTemplates', + 'DIRS': ['/root/psono/templates'], + 'APP_DIRS': True, + 'OPTIONS': { + 'context_processors': [ + 'django.template.context_processors.debug', + 'django.template.context_processors.request', + 'django.contrib.auth.context_processors.auth', + 'django.contrib.messages.context_processors.messages', + ], + }, + }, + ] diff --git a/deprecated/psono/statefulset.yaml b/deprecated/psono/statefulset.yaml new file mode 100644 index 0000000..4fb8303 --- /dev/null +++ b/deprecated/psono/statefulset.yaml @@ -0,0 +1,88 @@ +apiVersion: v1 +kind: Service +metadata: + name: psono + namespace: psono +spec: + clusterIP: None + selector: + app: psono + ports: + - name: http + port: 80 + targetPort: 80 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: psono + namespace: psono +spec: + serviceName: psono + replicas: 1 + selector: + matchLabels: + app: psono + template: + metadata: + labels: + app: psono + spec: + initContainers: + - name: envsubst + image: bhgedigital/envsubst:latest + command: ["sh", "-c", "envsubst < /tmp/settings-template/settings.yaml > /root/.psono_server/settings.yaml"] + envFrom: + - secretRef: + name: psono-secrets + volumeMounts: + - name: psono-settings-template + mountPath: /tmp/settings-template + - name: psono-settings-processed + mountPath: /root/.psono_server + - name: migrate + image: psono/psono-combo-enterprise:7.1.5-4.5.3-1.8.0 + command: ["python3", "./psono/manage.py", "migrate"] + envFrom: + - secretRef: + name: psono-secrets + volumeMounts: + - name: psono-settings-processed + mountPath: /root/.psono_server + containers: + - name: psono + image: psono/psono-combo-enterprise:7.1.5-4.5.3-1.8.0 + ports: + - name: http + containerPort: 80 + envFrom: + - secretRef: + name: psono-secrets + volumeMounts: + - name: psono-settings-processed + mountPath: /root/.psono_server + - name: psono-data + mountPath: /var/log/psono + livenessProbe: + httpGet: + path: /server/healthcheck/ + port: 80 + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /server/healthcheck/ + port: 80 + initialDelaySeconds: 15 + periodSeconds: 10 + failureThreshold: 3 + volumes: + - name: psono-settings-template + configMap: + name: psono-settings + - name: psono-settings-processed + emptyDir: {} + - name: psono-data + persistentVolumeClaim: + claimName: psono-data diff --git a/deprecated/vaultwarden/httproute.yaml b/deprecated/vaultwarden/httproute.yaml new file mode 100644 index 0000000..18187c2 --- /dev/null +++ b/deprecated/vaultwarden/httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: vaultwarden-route + namespace: vaultwarden +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: vaultwarden + hostnames: + - "vault.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "vault.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: vaultwarden + port: 80 + kind: Service + group: "" + weight: 1 diff --git a/deprecated/vaultwarden/namespace.yaml b/deprecated/vaultwarden/namespace.yaml new file mode 100644 index 0000000..6fc17a5 --- /dev/null +++ b/deprecated/vaultwarden/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: vaultwarden diff --git a/deprecated/vaultwarden/pvc.yaml b/deprecated/vaultwarden/pvc.yaml new file mode 100644 index 0000000..100a7f7 --- /dev/null +++ b/deprecated/vaultwarden/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: vaultwarden-data + namespace: vaultwarden +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 5Gi diff --git a/deprecated/vaultwarden/statefulset.yaml b/deprecated/vaultwarden/statefulset.yaml new file mode 100644 index 0000000..fb3a2ed --- /dev/null +++ b/deprecated/vaultwarden/statefulset.yaml @@ -0,0 +1,120 @@ +apiVersion: v1 +kind: Service +metadata: + name: vaultwarden + namespace: vaultwarden +spec: + selector: + app: vaultwarden + ports: + - name: http + port: 80 + targetPort: 80 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: vaultwarden + namespace: vaultwarden +spec: + serviceName: vaultwarden + replicas: 1 + selector: + matchLabels: + app: vaultwarden + template: + metadata: + labels: + app: vaultwarden + spec: + containers: + - name: vaultwarden + image: vaultwarden/server:1.35.6-alpine + ports: + - name: http + containerPort: 80 + env: + - name: DOMAIN + value: "https://vault.jsme.be" + - name: SIGNUPS_ALLOWED + value: "false" + - name: ADMIN_TOKEN + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: admin_token + - name: SMTP_HOST + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: smtp_host + - name: SMTP_FROM + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: smtp_from + - name: SMTP_PORT + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: smtp_port + - name: SSO_ENABLED + value: "true" + - name: SSO_AUTHORITY + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: sso_authority + - name: SSO_CLIENT_ID + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: sso_client_id + - name: SSO_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: sso_client_secret + - name: SSO_SCOPES + value: "email profile offline_access" + - name: SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION + value: "false" + - name: SSO_CLIENT_CACHE_EXPIRATION + value: "0" + - name: SSO_ONLY + value: "true" + - name: SSO_SIGNUPS_MATCH_EMAIL + value: "true" + - name: SMTP_SECURITY + value: "starttls" + - name: SMTP_USERNAME + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: smtp_username + - name: SMTP_PASSWORD + valueFrom: + secretKeyRef: + name: vaultwarden-secrets + key: smtp_password + volumeMounts: + - name: vaultwarden-data + mountPath: /data + livenessProbe: + httpGet: + path: /alive + port: 80 + initialDelaySeconds: 15 + periodSeconds: 30 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /alive + port: 80 + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 3 + volumes: + - name: vaultwarden-data + persistentVolumeClaim: + claimName: vaultwarden-data diff --git a/envoy-gateway/argocd/certificate.yaml b/envoy-gateway/argocd/certificate.yaml new file mode 100644 index 0000000..6530560 --- /dev/null +++ b/envoy-gateway/argocd/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-tls + namespace: envoy-gateway +spec: + secretName: argocd-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - argocd.jsme.be diff --git a/envoy-gateway/argocd/gateway-patch.yaml b/envoy-gateway/argocd/gateway-patch.yaml new file mode 100644 index 0000000..cada94d --- /dev/null +++ b/envoy-gateway/argocd/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: argocd + protocol: HTTPS + port: 443 + hostname: "argocd.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: argocd + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: argocd-tls + namespace: envoy-gateway diff --git a/envoy-gateway/arrstack/radarr-certificate.yaml b/envoy-gateway/arrstack/radarr-certificate.yaml new file mode 100644 index 0000000..1403cf5 --- /dev/null +++ b/envoy-gateway/arrstack/radarr-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: radarr-tls + namespace: envoy-gateway +spec: + secretName: radarr-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - radarr.jsme.be diff --git a/envoy-gateway/arrstack/radarr-gateway-patch.yaml b/envoy-gateway/arrstack/radarr-gateway-patch.yaml new file mode 100644 index 0000000..fec0a15 --- /dev/null +++ b/envoy-gateway/arrstack/radarr-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: radarr + protocol: HTTPS + port: 443 + hostname: "radarr.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: arrstack + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: radarr-tls + namespace: envoy-gateway diff --git a/envoy-gateway/arrstack/sonarr-certificate.yaml b/envoy-gateway/arrstack/sonarr-certificate.yaml new file mode 100644 index 0000000..3446635 --- /dev/null +++ b/envoy-gateway/arrstack/sonarr-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: sonarr-tls + namespace: envoy-gateway +spec: + secretName: sonarr-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - sonarr.jsme.be diff --git a/envoy-gateway/arrstack/sonarr-gateway-patch.yaml b/envoy-gateway/arrstack/sonarr-gateway-patch.yaml new file mode 100644 index 0000000..734bcf3 --- /dev/null +++ b/envoy-gateway/arrstack/sonarr-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: sonarr + protocol: HTTPS + port: 443 + hostname: "sonarr.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: arrstack + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: sonarr-tls + namespace: envoy-gateway diff --git a/envoy-gateway/authentik/certificate.yaml b/envoy-gateway/authentik/certificate.yaml new file mode 100644 index 0000000..4d170c5 --- /dev/null +++ b/envoy-gateway/authentik/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls + namespace: envoy-gateway +spec: + secretName: authentik-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - auth.jsme.be diff --git a/envoy-gateway/authentik/gateway-patch.yaml b/envoy-gateway/authentik/gateway-patch.yaml new file mode 100644 index 0000000..fb064d6 --- /dev/null +++ b/envoy-gateway/authentik/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: authentik + protocol: HTTPS + port: 443 + hostname: "auth.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: authentik + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: authentik-tls + namespace: envoy-gateway diff --git a/envoy-gateway/authentik/gateway-public-patch.yaml b/envoy-gateway/authentik/gateway-public-patch.yaml new file mode 100644 index 0000000..fb064d6 --- /dev/null +++ b/envoy-gateway/authentik/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: authentik + protocol: HTTPS + port: 443 + hostname: "auth.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: authentik + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: authentik-tls + namespace: envoy-gateway diff --git a/envoy-gateway/bentopdf/certificate.yaml b/envoy-gateway/bentopdf/certificate.yaml new file mode 100644 index 0000000..92e1c0a --- /dev/null +++ b/envoy-gateway/bentopdf/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bentopdf-tls + namespace: envoy-gateway +spec: + secretName: bentopdf-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - pdf.jsme.be diff --git a/envoy-gateway/bentopdf/gateway-patch.yaml b/envoy-gateway/bentopdf/gateway-patch.yaml new file mode 100644 index 0000000..8d77815 --- /dev/null +++ b/envoy-gateway/bentopdf/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: bentopdf + protocol: HTTPS + port: 443 + hostname: "pdf.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: bentopdf + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: bentopdf-tls + namespace: envoy-gateway diff --git a/envoy-gateway/bentopdf/gateway-public-patch.yaml b/envoy-gateway/bentopdf/gateway-public-patch.yaml new file mode 100644 index 0000000..8d77815 --- /dev/null +++ b/envoy-gateway/bentopdf/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: bentopdf + protocol: HTTPS + port: 443 + hostname: "pdf.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: bentopdf + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: bentopdf-tls + namespace: envoy-gateway diff --git a/envoy-gateway/clientsettingspolicies.yaml b/envoy-gateway/clientsettingspolicies.yaml new file mode 100644 index 0000000..4259ba5 --- /dev/null +++ b/envoy-gateway/clientsettingspolicies.yaml @@ -0,0 +1,21 @@ +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: ClientTrafficPolicy +metadata: + name: gateway-internal-client-settings + namespace: envoy-gateway +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: ClientTrafficPolicy +metadata: + name: gateway-public-client-settings + namespace: envoy-gateway +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public diff --git a/envoy-gateway/databasus/certificate.yaml b/envoy-gateway/databasus/certificate.yaml new file mode 100644 index 0000000..da369f0 --- /dev/null +++ b/envoy-gateway/databasus/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: databasus-tls + namespace: envoy-gateway +spec: + secretName: databasus-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - databasus.jsme.be diff --git a/envoy-gateway/databasus/gateway-patch.yaml b/envoy-gateway/databasus/gateway-patch.yaml new file mode 100644 index 0000000..325a9a8 --- /dev/null +++ b/envoy-gateway/databasus/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: databasus + protocol: HTTPS + port: 443 + hostname: "databasus.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: databasus + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: databasus-tls + namespace: envoy-gateway diff --git a/envoy-gateway/excalidraw/certificate.yaml b/envoy-gateway/excalidraw/certificate.yaml new file mode 100644 index 0000000..9691b61 --- /dev/null +++ b/envoy-gateway/excalidraw/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: excalidraw-tls + namespace: envoy-gateway +spec: + secretName: excalidraw-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - draw.jsme.be diff --git a/envoy-gateway/excalidraw/gateway-patch.yaml b/envoy-gateway/excalidraw/gateway-patch.yaml new file mode 100644 index 0000000..890e701 --- /dev/null +++ b/envoy-gateway/excalidraw/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: excalidraw + protocol: HTTPS + port: 443 + hostname: "draw.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: excalidraw + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: excalidraw-tls + namespace: envoy-gateway diff --git a/envoy-gateway/excalidraw/gateway-public-patch.yaml b/envoy-gateway/excalidraw/gateway-public-patch.yaml new file mode 100644 index 0000000..890e701 --- /dev/null +++ b/envoy-gateway/excalidraw/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: excalidraw + protocol: HTTPS + port: 443 + hostname: "draw.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: excalidraw + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: excalidraw-tls + namespace: envoy-gateway diff --git a/envoy-gateway/gateway-public.yaml b/envoy-gateway/gateway-public.yaml new file mode 100644 index 0000000..19f58e0 --- /dev/null +++ b/envoy-gateway/gateway-public.yaml @@ -0,0 +1,11 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: gateway-public + namespace: envoy-gateway +spec: + gatewayClassName: eg + infrastructure: + annotations: + metallb.universe.tf/loadBalancerIPs: "10.8.11.105" + listeners: [] diff --git a/envoy-gateway/gateway.yaml b/envoy-gateway/gateway.yaml new file mode 100644 index 0000000..da74eb2 --- /dev/null +++ b/envoy-gateway/gateway.yaml @@ -0,0 +1,11 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: gateway-internal + namespace: envoy-gateway +spec: + gatewayClassName: eg + infrastructure: + annotations: + metallb.universe.tf/loadBalancerIPs: "10.8.11.104" + listeners: [] diff --git a/envoy-gateway/gitea/certificate.yaml b/envoy-gateway/gitea/certificate.yaml new file mode 100644 index 0000000..7c714c1 --- /dev/null +++ b/envoy-gateway/gitea/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitea-tls + namespace: envoy-gateway +spec: + secretName: gitea-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - gitea.jsme.be diff --git a/envoy-gateway/gitea/gateway-patch.yaml b/envoy-gateway/gitea/gateway-patch.yaml new file mode 100644 index 0000000..18983ee --- /dev/null +++ b/envoy-gateway/gitea/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: gitea + protocol: HTTPS + port: 443 + hostname: "gitea.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gitea + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: gitea-tls + namespace: envoy-gateway diff --git a/envoy-gateway/gitea/gateway-public-patch.yaml b/envoy-gateway/gitea/gateway-public-patch.yaml new file mode 100644 index 0000000..18983ee --- /dev/null +++ b/envoy-gateway/gitea/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: gitea + protocol: HTTPS + port: 443 + hostname: "gitea.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gitea + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: gitea-tls + namespace: envoy-gateway diff --git a/envoy-gateway/gotify/certificate.yaml b/envoy-gateway/gotify/certificate.yaml new file mode 100644 index 0000000..3a3b36a --- /dev/null +++ b/envoy-gateway/gotify/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gotify-tls + namespace: envoy-gateway +spec: + secretName: gotify-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - gotify.jsme.be diff --git a/envoy-gateway/gotify/gateway-patch.yaml b/envoy-gateway/gotify/gateway-patch.yaml new file mode 100644 index 0000000..f3c3606 --- /dev/null +++ b/envoy-gateway/gotify/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: gotify + protocol: HTTPS + port: 443 + hostname: "gotify.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gotify + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: gotify-tls + namespace: envoy-gateway diff --git a/envoy-gateway/gotify/gateway-public-patch.yaml b/envoy-gateway/gotify/gateway-public-patch.yaml new file mode 100644 index 0000000..f3c3606 --- /dev/null +++ b/envoy-gateway/gotify/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: gotify + protocol: HTTPS + port: 443 + hostname: "gotify.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gotify + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: gotify-tls + namespace: envoy-gateway diff --git a/envoy-gateway/httproute-template.yaml b/envoy-gateway/httproute-template.yaml new file mode 100644 index 0000000..9f45c9e --- /dev/null +++ b/envoy-gateway/httproute-template.yaml @@ -0,0 +1,68 @@ +# ============================================================================= +# PLACEHOLDERS: +# - listener/route name (e.g. jellyfin) +# - namespace the service runs in (e.g. jellyfin) +# - full hostname (e.g. jellyfin.jsme.be) +# - Kubernetes Service name (e.g. jellyfin) +# - port the Service exposes (e.g. 8096) +# ============================================================================= +# apiVersion: gateway.networking.k8s.io/v1 +# kind: HTTPRoute +# metadata: +# name: -route +# namespace: +# spec: +# parentRefs: +# - group: gateway.networking.k8s.io +# kind: Gateway +# name: gateway-internal +# namespace: envoy-gateway +# sectionName: +# # - group: gateway.networking.k8s.io # uncomment if publicly accessible +# # kind: Gateway +# # name: gateway-public +# # namespace: envoy-gateway +# # sectionName: +# hostnames: +# - "" +# rules: +# - filters: +# - type: RequestHeaderModifier +# requestHeaderModifier: +# set: +# - name: X-Forwarded-Host +# value: "" +# - name: X-Forwarded-Proto +# value: https +# - type: ResponseHeaderModifier +# responseHeaderModifier: +# set: +# - name: Strict-Transport-Security +# value: "max-age=31536000; includeSubDomains" +# - name: X-Content-Type-Options +# value: nosniff +# - name: X-Frame-Options +# value: SAMEORIGIN +# - name: Referrer-Policy +# value: strict-origin-when-cross-origin +# - name: Permissions-Policy +# value: "camera=(), microphone=(), geolocation=(), payment=()" +# backendRefs: +# - name: +# port: +# kind: Service +# --- +# # Optional: only needed if you need to override body size limits +# # Remove this section if not needed +# apiVersion: gateway.nginx.org/v1alpha1 +# kind: ClientSettingsPolicy +# metadata: +# name: -client-settings +# namespace: +# spec: +# targetRef: +# group: gateway.networking.k8s.io +# kind: HTTPRoute +# name: -route +# body: +# maxSize: 100m # adjust as needed, use "0" for unlimited diff --git a/envoy-gateway/immich/certificate.yaml b/envoy-gateway/immich/certificate.yaml new file mode 100644 index 0000000..f388253 --- /dev/null +++ b/envoy-gateway/immich/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: immich-tls + namespace: envoy-gateway +spec: + secretName: immich-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - photos.jsme.be diff --git a/envoy-gateway/immich/gateway-patch.yaml b/envoy-gateway/immich/gateway-patch.yaml new file mode 100644 index 0000000..910ab9f --- /dev/null +++ b/envoy-gateway/immich/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: immich + protocol: HTTPS + port: 443 + hostname: "photos.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: immich + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: immich-tls + namespace: envoy-gateway diff --git a/envoy-gateway/immich/gateway-public-patch.yaml b/envoy-gateway/immich/gateway-public-patch.yaml new file mode 100644 index 0000000..910ab9f --- /dev/null +++ b/envoy-gateway/immich/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: immich + protocol: HTTPS + port: 443 + hostname: "photos.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: immich + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: immich-tls + namespace: envoy-gateway diff --git a/envoy-gateway/infisical/certificate.yaml b/envoy-gateway/infisical/certificate.yaml new file mode 100644 index 0000000..c7d2ef5 --- /dev/null +++ b/envoy-gateway/infisical/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: infisical-tls + namespace: envoy-gateway +spec: + secretName: infisical-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - infisical.jsme.be diff --git a/envoy-gateway/infisical/gateway-patch.yaml b/envoy-gateway/infisical/gateway-patch.yaml new file mode 100644 index 0000000..296df9f --- /dev/null +++ b/envoy-gateway/infisical/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: infisical + protocol: HTTPS + port: 443 + hostname: "infisical.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: infisical + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: infisical-tls + namespace: envoy-gateway diff --git a/envoy-gateway/it-tools/certificate.yaml b/envoy-gateway/it-tools/certificate.yaml new file mode 100644 index 0000000..6349527 --- /dev/null +++ b/envoy-gateway/it-tools/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: it-tools-tls + namespace: envoy-gateway +spec: + secretName: it-tools-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - tools.jsme.be diff --git a/envoy-gateway/it-tools/gateway-patch.yaml b/envoy-gateway/it-tools/gateway-patch.yaml new file mode 100644 index 0000000..61134a2 --- /dev/null +++ b/envoy-gateway/it-tools/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: it-tools + protocol: HTTPS + port: 443 + hostname: "tools.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: it-tools + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: it-tools-tls + namespace: envoy-gateway diff --git a/envoy-gateway/it-tools/gateway-public-patch.yaml b/envoy-gateway/it-tools/gateway-public-patch.yaml new file mode 100644 index 0000000..61134a2 --- /dev/null +++ b/envoy-gateway/it-tools/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: it-tools + protocol: HTTPS + port: 443 + hostname: "tools.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: it-tools + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: it-tools-tls + namespace: envoy-gateway diff --git a/envoy-gateway/jellyfin/certificate.yaml b/envoy-gateway/jellyfin/certificate.yaml new file mode 100644 index 0000000..dc8d34f --- /dev/null +++ b/envoy-gateway/jellyfin/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: jellyfin-tls + namespace: envoy-gateway +spec: + secretName: jellyfin-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - jellyfin.jsme.be diff --git a/envoy-gateway/jellyfin/gateway-patch.yaml b/envoy-gateway/jellyfin/gateway-patch.yaml new file mode 100644 index 0000000..55a673b --- /dev/null +++ b/envoy-gateway/jellyfin/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: jellyfin + protocol: HTTPS + port: 443 + hostname: "jellyfin.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: jellyfin + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: jellyfin-tls + namespace: envoy-gateway diff --git a/envoy-gateway/jellyfin/gateway-public-patch.yaml b/envoy-gateway/jellyfin/gateway-public-patch.yaml new file mode 100644 index 0000000..55a673b --- /dev/null +++ b/envoy-gateway/jellyfin/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: jellyfin + protocol: HTTPS + port: 443 + hostname: "jellyfin.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: jellyfin + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: jellyfin-tls + namespace: envoy-gateway diff --git a/envoy-gateway/jenkins/certificate.yaml b/envoy-gateway/jenkins/certificate.yaml new file mode 100644 index 0000000..8a608ea --- /dev/null +++ b/envoy-gateway/jenkins/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: jenkins-tls + namespace: envoy-gateway +spec: + secretName: jenkins-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - jenkins.jsme.be diff --git a/envoy-gateway/jenkins/gateway-patch.yaml b/envoy-gateway/jenkins/gateway-patch.yaml new file mode 100644 index 0000000..31646fc --- /dev/null +++ b/envoy-gateway/jenkins/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: jenkins + protocol: HTTPS + port: 443 + hostname: "jenkins.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: jenkins + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: jenkins-tls + namespace: envoy-gateway diff --git a/envoy-gateway/kustomization.yaml b/envoy-gateway/kustomization.yaml new file mode 100644 index 0000000..ec8b197 --- /dev/null +++ b/envoy-gateway/kustomization.yaml @@ -0,0 +1,372 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - gateway.yaml + - gateway-public.yaml + + # Certificates + - authentik/certificate.yaml + - argocd/certificate.yaml + - arrstack/radarr-certificate.yaml + - arrstack/sonarr-certificate.yaml + - bentopdf/certificate.yaml + - gitea/certificate.yaml + - immich/certificate.yaml + - infisical/certificate.yaml + - it-tools/certificate.yaml + - jellyfin/certificate.yaml + - seerr/certificate.yaml + - jenkins/certificate.yaml + - longhorn/certificate.yaml + - monitoring/certificate.yaml + - n8n/certificate.yaml + - netbootxyz/certificate.yaml + - passbolt/certificate.yaml + - proxmox/certificate.yaml + - prowlarr/certificate.yaml + - resume/resume-certificate.yaml + - resume/minio-certificate.yaml + - resume/minio-webui-certificate.yaml + - minio-aistor/api-certificate.yaml + - minio-aistor/console-certificate.yaml + - technitium/technitium-certificate.yaml + - technitium/technitium-backup-certificate.yaml + - torrent/certificate.yaml + - truenas/certificate.yaml + - unifi/certificate.yaml + - shelfmark/certificate.yaml + - wikijs/certificate.yaml + - zipline/certificate.yaml + - vaultwarden/certificate.yaml + - databasus/certificate.yaml + - excalidraw/certificate.yaml + - gotify/certificate.yaml + - uptime-kuma/certificate.yaml + - ollama/certificate.yaml + - openwebui/certificate.yaml + - searxng/certificate.yaml + +patches: + # Internal gateway patches + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: authentik/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: argocd/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: gitea/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: immich/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: infisical/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: seerr/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: jenkins/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: longhorn/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: n8n/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: netbootxyz/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: arrstack/radarr-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: arrstack/sonarr-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: prowlarr/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: torrent/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: resume/minio-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: resume/minio-webui-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: technitium/technitium-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: technitium/technitium-backup-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: unifi/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: proxmox/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: truenas/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: monitoring/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: bentopdf/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: it-tools/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: jellyfin/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: passbolt/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: resume/resume-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: shelfmark/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: wikijs/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: zipline/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: minio-aistor/api-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: minio-aistor/console-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: vaultwarden/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: databasus/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: excalidraw/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: gotify/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: uptime-kuma/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: ollama/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: openwebui/gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: searxng/gateway-patch.yaml + + # Public gateway patches + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: gitea/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: authentik/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: bentopdf/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: it-tools/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: jellyfin/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: immich/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: passbolt/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: resume/resume-gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: wikijs/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: zipline/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: excalidraw/gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: gotify/gateway-public-patch.yaml + # Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-public + # path: monitoring/grafana-gateway-public-patch.yaml diff --git a/envoy-gateway/longhorn/certificate.yaml b/envoy-gateway/longhorn/certificate.yaml new file mode 100644 index 0000000..7ed58f1 --- /dev/null +++ b/envoy-gateway/longhorn/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls + namespace: envoy-gateway +spec: + secretName: longhorn-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - longhorn.jsme.be diff --git a/envoy-gateway/longhorn/gateway-patch.yaml b/envoy-gateway/longhorn/gateway-patch.yaml new file mode 100644 index 0000000..b46e1a2 --- /dev/null +++ b/envoy-gateway/longhorn/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: longhorn + protocol: HTTPS + port: 443 + hostname: "longhorn.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: longhorn-system + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: longhorn-tls + namespace: envoy-gateway diff --git a/envoy-gateway/minio-aistor/api-certificate.yaml b/envoy-gateway/minio-aistor/api-certificate.yaml new file mode 100644 index 0000000..bc3142e --- /dev/null +++ b/envoy-gateway/minio-aistor/api-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-aistor-api-tls + namespace: envoy-gateway +spec: + secretName: minio-aistor-api-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - s3.jsme.be diff --git a/envoy-gateway/minio-aistor/api-gateway-patch.yaml b/envoy-gateway/minio-aistor/api-gateway-patch.yaml new file mode 100644 index 0000000..9edc9c9 --- /dev/null +++ b/envoy-gateway/minio-aistor/api-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: minio-aistor-api + protocol: HTTPS + port: 443 + hostname: "s3.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: minio-aistor + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: minio-aistor-api-tls + namespace: envoy-gateway diff --git a/envoy-gateway/minio-aistor/console-certificate.yaml b/envoy-gateway/minio-aistor/console-certificate.yaml new file mode 100644 index 0000000..b0f19e3 --- /dev/null +++ b/envoy-gateway/minio-aistor/console-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-aistor-console-tls + namespace: envoy-gateway +spec: + secretName: minio-aistor-console-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - s3-console.jsme.be diff --git a/envoy-gateway/minio-aistor/console-gateway-patch.yaml b/envoy-gateway/minio-aistor/console-gateway-patch.yaml new file mode 100644 index 0000000..aa6ee41 --- /dev/null +++ b/envoy-gateway/minio-aistor/console-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: minio-aistor-console + protocol: HTTPS + port: 443 + hostname: "s3-console.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: minio-aistor + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: minio-aistor-console-tls + namespace: envoy-gateway diff --git a/envoy-gateway/monitoring/certificate.yaml b/envoy-gateway/monitoring/certificate.yaml new file mode 100644 index 0000000..0372d4b --- /dev/null +++ b/envoy-gateway/monitoring/certificate.yaml @@ -0,0 +1,44 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: grafana-tls + namespace: envoy-gateway +spec: + secretName: grafana-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - grafana.jsme.be +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vmagent-tls + namespace: envoy-gateway +spec: + secretName: vmagent-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - vmagent.jsme.be +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vmetrics-tls + namespace: envoy-gateway +spec: + secretName: vmetrics-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - vmetrics.jsme.be diff --git a/envoy-gateway/monitoring/gateway-patch.yaml b/envoy-gateway/monitoring/gateway-patch.yaml new file mode 100644 index 0000000..5b540b0 --- /dev/null +++ b/envoy-gateway/monitoring/gateway-patch.yaml @@ -0,0 +1,57 @@ +- op: add + path: /spec/listeners/- + value: + name: grafana + protocol: HTTPS + port: 443 + hostname: "grafana.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: victoria-metrics + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: grafana-tls + namespace: envoy-gateway +- op: add + path: /spec/listeners/- + value: + name: vmagent + protocol: HTTPS + port: 443 + hostname: "vmagent.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: victoria-metrics + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: vmagent-tls + namespace: envoy-gateway +- op: add + path: /spec/listeners/- + value: + name: vmetrics + protocol: HTTPS + port: 443 + hostname: "vmetrics.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: victoria-metrics + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: vmetrics-tls + namespace: envoy-gateway diff --git a/envoy-gateway/monitoring/grafana-gateway-public-patch.yaml b/envoy-gateway/monitoring/grafana-gateway-public-patch.yaml new file mode 100644 index 0000000..5f7a5fe --- /dev/null +++ b/envoy-gateway/monitoring/grafana-gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: grafana + protocol: HTTPS + port: 443 + hostname: "grafana.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: victoria-metrics + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: grafana-tls + namespace: envoy-gateway diff --git a/envoy-gateway/n8n/certificate.yaml b/envoy-gateway/n8n/certificate.yaml new file mode 100644 index 0000000..ccc9dc3 --- /dev/null +++ b/envoy-gateway/n8n/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: n8n-tls + namespace: envoy-gateway +spec: + secretName: n8n-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - n8n.jsme.be diff --git a/envoy-gateway/n8n/gateway-patch.yaml b/envoy-gateway/n8n/gateway-patch.yaml new file mode 100644 index 0000000..331bc4c --- /dev/null +++ b/envoy-gateway/n8n/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: n8n + protocol: HTTPS + port: 443 + hostname: "n8n.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: n8n + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: n8n-tls + namespace: envoy-gateway diff --git a/envoy-gateway/netbootxyz/certificate.yaml b/envoy-gateway/netbootxyz/certificate.yaml new file mode 100644 index 0000000..6bf4e7a --- /dev/null +++ b/envoy-gateway/netbootxyz/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: netbootxyz-tls + namespace: envoy-gateway +spec: + secretName: netbootxyz-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - netboot.jsme.be diff --git a/envoy-gateway/netbootxyz/gateway-patch.yaml b/envoy-gateway/netbootxyz/gateway-patch.yaml new file mode 100644 index 0000000..afefb0b --- /dev/null +++ b/envoy-gateway/netbootxyz/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: netbootxyz + protocol: HTTPS + port: 443 + hostname: "netboot.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: netbootxyz + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: netbootxyz-tls + namespace: envoy-gateway diff --git a/envoy-gateway/ollama/certificate.yaml b/envoy-gateway/ollama/certificate.yaml new file mode 100644 index 0000000..20eeec6 --- /dev/null +++ b/envoy-gateway/ollama/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls + namespace: envoy-gateway +spec: + secretName: ollama-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - ollama.jsme.be diff --git a/envoy-gateway/ollama/gateway-patch.yaml b/envoy-gateway/ollama/gateway-patch.yaml new file mode 100644 index 0000000..ad9b074 --- /dev/null +++ b/envoy-gateway/ollama/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: ollama + protocol: HTTPS + port: 443 + hostname: "ollama.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: ollama + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: ollama-tls + namespace: envoy-gateway diff --git a/envoy-gateway/openwebui/certificate.yaml b/envoy-gateway/openwebui/certificate.yaml new file mode 100644 index 0000000..5ff0e0a --- /dev/null +++ b/envoy-gateway/openwebui/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: forge-tls + namespace: envoy-gateway +spec: + secretName: forge-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - forge.jsme.be diff --git a/envoy-gateway/openwebui/gateway-patch.yaml b/envoy-gateway/openwebui/gateway-patch.yaml new file mode 100644 index 0000000..6f0f796 --- /dev/null +++ b/envoy-gateway/openwebui/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: forge + protocol: HTTPS + port: 443 + hostname: "forge.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: openwebui + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: forge-tls + namespace: envoy-gateway diff --git a/envoy-gateway/passbolt/certificate.yaml b/envoy-gateway/passbolt/certificate.yaml new file mode 100644 index 0000000..ccd7786 --- /dev/null +++ b/envoy-gateway/passbolt/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: passbolt-tls + namespace: envoy-gateway +spec: + secretName: passbolt-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - passbolt.jsme.be diff --git a/envoy-gateway/passbolt/gateway-patch.yaml b/envoy-gateway/passbolt/gateway-patch.yaml new file mode 100644 index 0000000..e1f700a --- /dev/null +++ b/envoy-gateway/passbolt/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: passbolt + protocol: HTTPS + port: 443 + hostname: "passbolt.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: passbolt + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: passbolt-tls + namespace: envoy-gateway diff --git a/envoy-gateway/passbolt/gateway-public-patch.yaml b/envoy-gateway/passbolt/gateway-public-patch.yaml new file mode 100644 index 0000000..e1f700a --- /dev/null +++ b/envoy-gateway/passbolt/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: passbolt + protocol: HTTPS + port: 443 + hostname: "passbolt.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: passbolt + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: passbolt-tls + namespace: envoy-gateway diff --git a/envoy-gateway/prowlarr/certificate.yaml b/envoy-gateway/prowlarr/certificate.yaml new file mode 100644 index 0000000..cae0600 --- /dev/null +++ b/envoy-gateway/prowlarr/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: prowlarr-tls + namespace: envoy-gateway +spec: + secretName: prowlarr-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - prowlarr.jsme.be diff --git a/envoy-gateway/prowlarr/gateway-patch.yaml b/envoy-gateway/prowlarr/gateway-patch.yaml new file mode 100644 index 0000000..6237c36 --- /dev/null +++ b/envoy-gateway/prowlarr/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: prowlarr + protocol: HTTPS + port: 443 + hostname: "prowlarr.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: arrstack + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: prowlarr-tls + namespace: envoy-gateway diff --git a/envoy-gateway/proxmox/certificate.yaml b/envoy-gateway/proxmox/certificate.yaml new file mode 100644 index 0000000..d331519 --- /dev/null +++ b/envoy-gateway/proxmox/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: proxmox-tls + namespace: envoy-gateway +spec: + secretName: proxmox-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - proxmox.jsme.be diff --git a/envoy-gateway/proxmox/gateway-patch.yaml b/envoy-gateway/proxmox/gateway-patch.yaml new file mode 100644 index 0000000..7dccdc6 --- /dev/null +++ b/envoy-gateway/proxmox/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: proxmox + protocol: HTTPS + port: 443 + hostname: "proxmox.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: proxmox + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: proxmox-tls + namespace: envoy-gateway diff --git a/envoy-gateway/resume/minio-certificate.yaml b/envoy-gateway/resume/minio-certificate.yaml new file mode 100644 index 0000000..51a492a --- /dev/null +++ b/envoy-gateway/resume/minio-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-tls + namespace: envoy-gateway +spec: + secretName: minio-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - resume-minio.jsme.be diff --git a/envoy-gateway/resume/minio-gateway-patch.yaml b/envoy-gateway/resume/minio-gateway-patch.yaml new file mode 100644 index 0000000..d62cce3 --- /dev/null +++ b/envoy-gateway/resume/minio-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: minio + protocol: HTTPS + port: 443 + hostname: "resume-minio.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: resume + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: minio-tls + namespace: envoy-gateway diff --git a/envoy-gateway/resume/minio-webui-certificate.yaml b/envoy-gateway/resume/minio-webui-certificate.yaml new file mode 100644 index 0000000..d6a0775 --- /dev/null +++ b/envoy-gateway/resume/minio-webui-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-webui-tls + namespace: envoy-gateway +spec: + secretName: minio-webui-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - resume-minioweb.jsme.be diff --git a/envoy-gateway/resume/minio-webui-gateway-patch.yaml b/envoy-gateway/resume/minio-webui-gateway-patch.yaml new file mode 100644 index 0000000..654baa7 --- /dev/null +++ b/envoy-gateway/resume/minio-webui-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: minio-webui + protocol: HTTPS + port: 443 + hostname: "resume-minioweb.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: resume + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: minio-webui-tls + namespace: envoy-gateway diff --git a/envoy-gateway/resume/resume-certificate.yaml b/envoy-gateway/resume/resume-certificate.yaml new file mode 100644 index 0000000..7981a49 --- /dev/null +++ b/envoy-gateway/resume/resume-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: resume-tls + namespace: envoy-gateway +spec: + secretName: resume-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - resume.jsme.be diff --git a/envoy-gateway/resume/resume-gateway-patch.yaml b/envoy-gateway/resume/resume-gateway-patch.yaml new file mode 100644 index 0000000..2a56d7a --- /dev/null +++ b/envoy-gateway/resume/resume-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: resume + protocol: HTTPS + port: 443 + hostname: "resume.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: resume + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: resume-tls + namespace: envoy-gateway diff --git a/envoy-gateway/resume/resume-gateway-public-patch.yaml b/envoy-gateway/resume/resume-gateway-public-patch.yaml new file mode 100644 index 0000000..2a56d7a --- /dev/null +++ b/envoy-gateway/resume/resume-gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: resume + protocol: HTTPS + port: 443 + hostname: "resume.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: resume + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: resume-tls + namespace: envoy-gateway diff --git a/envoy-gateway/searxng/certificate.yaml b/envoy-gateway/searxng/certificate.yaml new file mode 100644 index 0000000..f08ecd3 --- /dev/null +++ b/envoy-gateway/searxng/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: searxng-tls + namespace: envoy-gateway +spec: + secretName: searxng-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - search.jsme.be diff --git a/envoy-gateway/searxng/gateway-patch.yaml b/envoy-gateway/searxng/gateway-patch.yaml new file mode 100644 index 0000000..e561d3d --- /dev/null +++ b/envoy-gateway/searxng/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: searxng + protocol: HTTPS + port: 443 + hostname: "search.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: searxng + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: searxng-tls + namespace: envoy-gateway diff --git a/envoy-gateway/searxng/gateway-public-patch.yaml b/envoy-gateway/searxng/gateway-public-patch.yaml new file mode 100644 index 0000000..e561d3d --- /dev/null +++ b/envoy-gateway/searxng/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: searxng + protocol: HTTPS + port: 443 + hostname: "search.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: searxng + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: searxng-tls + namespace: envoy-gateway diff --git a/envoy-gateway/seerr/certificate.yaml b/envoy-gateway/seerr/certificate.yaml new file mode 100644 index 0000000..0cf2a37 --- /dev/null +++ b/envoy-gateway/seerr/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: seerr-tls + namespace: envoy-gateway +spec: + secretName: seerr-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - seerr.jsme.be diff --git a/envoy-gateway/seerr/gateway-patch.yaml b/envoy-gateway/seerr/gateway-patch.yaml new file mode 100644 index 0000000..4c2c080 --- /dev/null +++ b/envoy-gateway/seerr/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: seerr + protocol: HTTPS + port: 443 + hostname: "seerr.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: seerr + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: seerr-tls + namespace: envoy-gateway diff --git a/envoy-gateway/technitium/technitium-backup-certificate.yaml b/envoy-gateway/technitium/technitium-backup-certificate.yaml new file mode 100644 index 0000000..fe898cb --- /dev/null +++ b/envoy-gateway/technitium/technitium-backup-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: technitium-backup-tls + namespace: envoy-gateway +spec: + secretName: technitium-backup-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - dns2.jsme.be diff --git a/envoy-gateway/technitium/technitium-backup-gateway-patch.yaml b/envoy-gateway/technitium/technitium-backup-gateway-patch.yaml new file mode 100644 index 0000000..1017c4a --- /dev/null +++ b/envoy-gateway/technitium/technitium-backup-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: technitium-backup + protocol: HTTPS + port: 443 + hostname: "dns2.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: technitium + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: technitium-backup-tls + namespace: envoy-gateway diff --git a/envoy-gateway/technitium/technitium-certificate.yaml b/envoy-gateway/technitium/technitium-certificate.yaml new file mode 100644 index 0000000..e158de2 --- /dev/null +++ b/envoy-gateway/technitium/technitium-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: technitium-tls + namespace: envoy-gateway +spec: + secretName: technitium-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - dns1.jsme.be diff --git a/envoy-gateway/technitium/technitium-gateway-patch.yaml b/envoy-gateway/technitium/technitium-gateway-patch.yaml new file mode 100644 index 0000000..8fd5f72 --- /dev/null +++ b/envoy-gateway/technitium/technitium-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: technitium + protocol: HTTPS + port: 443 + hostname: "dns1.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: technitium + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: technitium-tls + namespace: envoy-gateway diff --git a/envoy-gateway/torrent/certificate.yaml b/envoy-gateway/torrent/certificate.yaml new file mode 100644 index 0000000..2b23b2f --- /dev/null +++ b/envoy-gateway/torrent/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: torrent-tls + namespace: envoy-gateway +spec: + secretName: torrent-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - torrent.jsme.be diff --git a/envoy-gateway/torrent/gateway-patch.yaml b/envoy-gateway/torrent/gateway-patch.yaml new file mode 100644 index 0000000..669e9a1 --- /dev/null +++ b/envoy-gateway/torrent/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: torrent + protocol: HTTPS + port: 443 + hostname: "torrent.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: arrstack + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: torrent-tls + namespace: envoy-gateway diff --git a/envoy-gateway/truenas/certificate.yaml b/envoy-gateway/truenas/certificate.yaml new file mode 100644 index 0000000..70d10fb --- /dev/null +++ b/envoy-gateway/truenas/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: truenas-tls + namespace: envoy-gateway +spec: + secretName: truenas-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - truenas.jsme.be diff --git a/envoy-gateway/truenas/gateway-patch.yaml b/envoy-gateway/truenas/gateway-patch.yaml new file mode 100644 index 0000000..97876c4 --- /dev/null +++ b/envoy-gateway/truenas/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: truenas + protocol: HTTPS + port: 443 + hostname: "truenas.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: truenas + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: truenas-tls + namespace: envoy-gateway diff --git a/envoy-gateway/unifi/certificate.yaml b/envoy-gateway/unifi/certificate.yaml new file mode 100644 index 0000000..63898bf --- /dev/null +++ b/envoy-gateway/unifi/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unifi-tls + namespace: envoy-gateway +spec: + secretName: unifi-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - unifi.jsme.be diff --git a/envoy-gateway/unifi/gateway-patch.yaml b/envoy-gateway/unifi/gateway-patch.yaml new file mode 100644 index 0000000..f2361ef --- /dev/null +++ b/envoy-gateway/unifi/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: unifi + protocol: HTTPS + port: 443 + hostname: "unifi.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: unifi + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: unifi-tls + namespace: envoy-gateway diff --git a/envoy-gateway/uptime-kuma/certificate.yaml b/envoy-gateway/uptime-kuma/certificate.yaml new file mode 100644 index 0000000..c04db8c --- /dev/null +++ b/envoy-gateway/uptime-kuma/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: uptime-kuma-tls + namespace: envoy-gateway +spec: + secretName: uptime-kuma-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - status.jsme.be diff --git a/envoy-gateway/uptime-kuma/gateway-patch.yaml b/envoy-gateway/uptime-kuma/gateway-patch.yaml new file mode 100644 index 0000000..d5ce541 --- /dev/null +++ b/envoy-gateway/uptime-kuma/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: uptime-kuma + protocol: HTTPS + port: 443 + hostname: "status.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: uptime-kuma + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: uptime-kuma-tls + namespace: envoy-gateway diff --git a/envoy-gateway/vaultwarden/certificate.yaml b/envoy-gateway/vaultwarden/certificate.yaml new file mode 100644 index 0000000..0917984 --- /dev/null +++ b/envoy-gateway/vaultwarden/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vaultwarden-tls + namespace: envoy-gateway +spec: + secretName: vaultwarden-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - vault.jsme.be diff --git a/envoy-gateway/vaultwarden/gateway-patch.yaml b/envoy-gateway/vaultwarden/gateway-patch.yaml new file mode 100644 index 0000000..982971d --- /dev/null +++ b/envoy-gateway/vaultwarden/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: vaultwarden + protocol: HTTPS + port: 443 + hostname: "vault.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: vaultwarden + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: vaultwarden-tls + namespace: envoy-gateway diff --git a/envoy-gateway/wikijs/certificate.yaml b/envoy-gateway/wikijs/certificate.yaml new file mode 100644 index 0000000..d1a0ac7 --- /dev/null +++ b/envoy-gateway/wikijs/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wikijs-tls + namespace: envoy-gateway +spec: + secretName: wikijs-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - wiki.jsme.be diff --git a/envoy-gateway/wikijs/gateway-patch.yaml b/envoy-gateway/wikijs/gateway-patch.yaml new file mode 100644 index 0000000..06930fa --- /dev/null +++ b/envoy-gateway/wikijs/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: wikijs + protocol: HTTPS + port: 443 + hostname: "wiki.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: wiki + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: wikijs-tls + namespace: envoy-gateway diff --git a/envoy-gateway/wikijs/gateway-public-patch.yaml b/envoy-gateway/wikijs/gateway-public-patch.yaml new file mode 100644 index 0000000..06930fa --- /dev/null +++ b/envoy-gateway/wikijs/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: wikijs + protocol: HTTPS + port: 443 + hostname: "wiki.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: wiki + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: wikijs-tls + namespace: envoy-gateway diff --git a/envoy-gateway/zipline/certificate.yaml b/envoy-gateway/zipline/certificate.yaml new file mode 100644 index 0000000..f8decc3 --- /dev/null +++ b/envoy-gateway/zipline/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: zipline-tls + namespace: envoy-gateway +spec: + secretName: zipline-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - share.jsme.be diff --git a/envoy-gateway/zipline/gateway-patch.yaml b/envoy-gateway/zipline/gateway-patch.yaml new file mode 100644 index 0000000..a9060b2 --- /dev/null +++ b/envoy-gateway/zipline/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: zipline + protocol: HTTPS + port: 443 + hostname: "share.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: zipline + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: zipline-tls + namespace: envoy-gateway diff --git a/envoy-gateway/zipline/gateway-public-patch.yaml b/envoy-gateway/zipline/gateway-public-patch.yaml new file mode 100644 index 0000000..a9060b2 --- /dev/null +++ b/envoy-gateway/zipline/gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: zipline + protocol: HTTPS + port: 443 + hostname: "share.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: zipline + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: zipline-tls + namespace: envoy-gateway diff --git a/excalidraw/excalidraw-svc.yaml b/excalidraw/excalidraw-svc.yaml new file mode 100644 index 0000000..634a9cf --- /dev/null +++ b/excalidraw/excalidraw-svc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: excalidraw + namespace: excalidraw +spec: + selector: + app: excalidraw + ports: + - name: http + port: 80 + targetPort: 80 + type: ClusterIP diff --git a/excalidraw/excalidraw.yaml b/excalidraw/excalidraw.yaml new file mode 100644 index 0000000..ea9099c --- /dev/null +++ b/excalidraw/excalidraw.yaml @@ -0,0 +1,29 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: excalidraw + namespace: excalidraw +spec: + replicas: 1 + selector: + matchLabels: + app: excalidraw + template: + metadata: + labels: + app: excalidraw + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 10 + containers: + - name: excalidraw + image: excalidraw/excalidraw:latest + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 200m + memory: 256Mi + ports: + - containerPort: 80 diff --git a/excalidraw/httproute.yaml b/excalidraw/httproute.yaml new file mode 100644 index 0000000..69318d7 --- /dev/null +++ b/excalidraw/httproute.yaml @@ -0,0 +1,51 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: excalidraw-route + namespace: excalidraw +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: excalidraw + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + namespace: envoy-gateway + sectionName: excalidraw + hostnames: + - "draw.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "draw.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: excalidraw + port: 80 + kind: Service + group: "" + weight: 1 diff --git a/gitea/gitea-ns.yaml b/gitea/gitea-ns.yaml new file mode 100644 index 0000000..d884423 --- /dev/null +++ b/gitea/gitea-ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: gitea \ No newline at end of file diff --git a/gitea/gitea/gitea-pvc.yaml b/gitea/gitea/gitea-pvc.yaml new file mode 100644 index 0000000..45eacd5 --- /dev/null +++ b/gitea/gitea/gitea-pvc.yaml @@ -0,0 +1,38 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: containers-data-smb +spec: + capacity: + storage: 5Gi + accessModes: + - ReadWriteMany + persistentVolumeReclaimPolicy: Retain + mountOptions: + - dir_mode=0700 + - file_mode=0700 + - noperm + - uid=1000 + - gid=1000 + csi: + driver: smb.csi.k8s.io + volumeHandle: containers + volumeAttributes: + source: "//10.8.14.2/containers" + nodeStageSecretRef: + name: gitea-secrets + namespace: gitea +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: gitea + name: gitea-pvc +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + volumeName: containers-data-smb + storageClassName: "" \ No newline at end of file diff --git a/gitea/gitea/gitea-svc.yaml b/gitea/gitea/gitea-svc.yaml new file mode 100644 index 0000000..ddd2dc4 --- /dev/null +++ b/gitea/gitea/gitea-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitea + namespace: gitea +spec: + selector: + app: gitea + type: ClusterIP + ports: + - name: gitea-svc + protocol: TCP + port: 3000 + targetPort: 3000 \ No newline at end of file diff --git a/gitea/gitea/gitea.yaml b/gitea/gitea/gitea.yaml new file mode 100644 index 0000000..db4a0ce --- /dev/null +++ b/gitea/gitea/gitea.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: gitea + namespace: gitea +spec: + replicas: 1 + selector: + matchLabels: + app: gitea + serviceName: gitea + template: + metadata: + labels: + app: gitea + spec: + terminationGracePeriodSeconds: 60 + containers: + - name: gitea + image: docker.gitea.com/gitea:1.25 + resources: + requests: + cpu: 200m + memory: 512Mi + limits: + cpu: 1000m + memory: 1Gi + ports: + - containerPort: 3000 + volumeMounts: + - name: data + mountPath: /data + subPath: Gitea + env: + - name: GITEA__database__HOST + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_host + - name: GITEA__database__DB_TYPE + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_type + - name: GITEA__database__NAME + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_name + - name: GITEA__database__USER + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_user + - name: GITEA__database__PASSWD + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_password + - name: USER + valueFrom: + secretKeyRef: + name: gitea-secrets + key: gitea_user + restartPolicy: Always + volumes: + - name: data + persistentVolumeClaim: + claimName: gitea-pvc + + diff --git a/gitea/httproute.yaml b/gitea/httproute.yaml new file mode 100644 index 0000000..70d1333 --- /dev/null +++ b/gitea/httproute.yaml @@ -0,0 +1,51 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: gitea-route + namespace: gitea +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: gitea + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + namespace: envoy-gateway + sectionName: gitea + hostnames: + - "gitea.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "gitea.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: gitea + port: 3000 + kind: Service + group: "" + weight: 1 diff --git a/gitea/postgres/postgres.yaml b/gitea/postgres/postgres.yaml new file mode 100644 index 0000000..86f45be --- /dev/null +++ b/gitea/postgres/postgres.yaml @@ -0,0 +1,55 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + namespace: gitea + name: gitea-postgresql +spec: + replicas: 1 + selector: + matchLabels: + app: gitea-postgresql + serviceName: gitea-postgresql + template: + metadata: + labels: + app: gitea-postgresql + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 60 + containers: + - name: gitea-postgresql + image: postgres:18 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + ports: + - containerPort: 5432 + volumeMounts: + - name: gitea-postgresql-database + mountPath: /var/lib/postgresql/volumes/pgdata + env: + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_password + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_user + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: gitea-secrets + key: db_name + - name: PGDATA + value: /var/lib/postgresql/volumes/pgdata/data + volumes: + - name: gitea-postgresql-database + persistentVolumeClaim: + claimName: gitea-postgresql-pvc \ No newline at end of file diff --git a/gitea/postgres/postgresql-pvc.yaml b/gitea/postgres/postgresql-pvc.yaml new file mode 100644 index 0000000..22796c0 --- /dev/null +++ b/gitea/postgres/postgresql-pvc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: gitea + name: gitea-postgresql-pvc +spec: + accessModes: + - ReadWriteMany + storageClassName: longhorn-static + volumeName: gitea-postgresql-data + resources: + requests: + storage: 10Gi diff --git a/gitea/postgres/postgresql-svc.yaml b/gitea/postgres/postgresql-svc.yaml new file mode 100644 index 0000000..2d2f6f2 --- /dev/null +++ b/gitea/postgres/postgresql-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitea-postgresql + namespace: gitea +spec: + selector: + app: gitea-postgresql + type: ClusterIP + ports: + - name: postgresql-port + protocol: TCP + port: 5432 + targetPort: 5432 \ No newline at end of file diff --git a/gitea/runner/GITEA-ACTIONS.md b/gitea/runner/GITEA-ACTIONS.md new file mode 100644 index 0000000..69e5dc5 --- /dev/null +++ b/gitea/runner/GITEA-ACTIONS.md @@ -0,0 +1,500 @@ +# Gitea Actions Reference + +> Based on Gitea 1.21+ and act_runner v0.2.x +> Gitea Actions is compatible with GitHub Actions syntax. Both `github.*` and `gitea.*` context namespaces work; prefer `gitea.*` for Gitea-specific deployments. + +--- + +## Table of Contents + +1. [Workflow File Location](#workflow-file-location) +2. [Trigger Events (`on:`)](#trigger-events-on) +3. [Context Variables](#context-variables) +4. [Secrets](#secrets) +5. [Variables (`vars`)](#variables-vars) +6. [Built-in Environment Variables](#built-in-environment-variables) +7. [Expression Syntax & Functions](#expression-syntax--functions) +8. [Runner Labels](#runner-labels) +9. [Differences from GitHub Actions](#differences-from-github-actions) +10. [Unsupported Features](#unsupported-features) +11. [Badge URLs](#badge-urls) + +--- + +## Workflow File Location + +``` +.gitea/workflows/.yaml +``` + +Basic structure: + +```yaml +name: My Workflow +run-name: ${{ gitea.actor }} triggered ${{ gitea.event_name }} + +on: + push: + branches: + - main + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Run something + run: echo "Hello from ${{ gitea.actor }}" +``` + +--- + +## Trigger Events (`on:`) + +### Supported Events + +| Event | Activity Types | +|---|---| +| `push` | — | +| `pull_request` | `opened`, `edited`, `closed`, `reopened`, `assigned`, `unassigned`, `synchronize`, `labeled`, `unlabeled` | +| `pull_request_review` | `submitted`, `edited` | +| `pull_request_review_comment` | `created`, `edited` | +| `issues` | `opened`, `edited`, `closed`, `reopened`, `assigned`, `unassigned`, `milestoned`, `demilestoned`, `labeled`, `unlabeled` | +| `issue_comment` | `created`, `edited`, `deleted` | +| `release` | `published`, `edited` | +| `registry_package` | `published` | +| `create` | — | +| `delete` | — | +| `fork` | — | +| `gollum` | — | +| `workflow_dispatch` | — | +| `workflow_run` | `requested`, `completed` | +| `schedule` | — | + +### Filter Options + +```yaml +on: + push: + branches: + - main + - 'feature/**' + tags: + - 'v*' + paths: + - 'src/**' + pull_request: + types: [opened, synchronize] + branches: + - main + schedule: + - cron: '0 1 * * *' + - cron: '@daily' # Gitea extension (not available in GitHub Actions) + - cron: '@hourly' # Gitea extension + - cron: '@weekly' # Gitea extension + - cron: '@monthly' # Gitea extension + - cron: '@yearly' # Gitea extension +``` + +### `workflow_dispatch` with Inputs + +Adds a "Run workflow" button in the Gitea UI. The workflow must be on the **default branch** to appear. + +```yaml +on: + workflow_dispatch: + inputs: + environment: + description: 'Target environment' + required: true + type: choice + options: + - staging + - production + dry_run: + description: 'Dry run' + required: false + type: boolean + default: false + version: + description: 'Version number' + type: string +``` + +Supported input types: `string`, `boolean`, `choice`, `number`, `environment` + +Access inputs via: `${{ inputs.environment }}` or `${{ gitea.event.inputs.environment }}` + +--- + +## Context Variables + +### `gitea.*` / `github.*` + +Both namespaces are identical. Prefer `gitea.*`. + +| Variable | Description | +|---|---| +| `gitea.actor` | Username that triggered the workflow | +| `gitea.event_name` | Triggering event name (`push`, `pull_request`, etc.) | +| `gitea.event` | Full event payload object | +| `gitea.ref` | Full ref (`refs/heads/main`, `refs/pull/1/head`) | +| `gitea.ref_name` | Short ref name (`main`, `v1.0`) | +| `gitea.ref_type` | `branch` or `tag` | +| `gitea.sha` | Full commit SHA | +| `gitea.repository` | `owner/repo` | +| `gitea.repository_owner` | Repository owner (user or org name) | +| `gitea.workspace` | Workspace path on the runner | +| `gitea.run_id` | Unique ID for this workflow run | +| `gitea.run_number` | Sequential run number for this workflow | +| `gitea.server_url` | Gitea instance base URL | +| `gitea.api_url` | Gitea API URL | +| `gitea.head_ref` | PR source branch name | +| `gitea.base_ref` | PR target branch name | +| `gitea.token` | Auto-generated short-lived job token | +| `gitea.workflow` | Workflow name | +| `gitea.job` | Current job ID | + +> **Note**: `gitea.repository_owner` preserves original casing. Use `tr '[:upper:]' '[:lower:]'` when used in Docker image tags. + +### `runner.*` + +| Variable | Description | +|---|---| +| `runner.os` | `Linux`, `Windows`, or `macOS` | +| `runner.arch` | `X64`, `ARM64`, etc. | +| `runner.name` | Runner name | +| `runner.tool_cache` | Tool cache directory | +| `runner.temp` | Temp directory | + +### `steps.*` + +```yaml +steps..outputs. +steps..conclusion # success, failure, cancelled, skipped +steps..outcome # success, failure, cancelled, skipped +``` + +### `needs.*` + +```yaml +needs..outputs. +needs..result # success, failure, cancelled, skipped +``` + +### `secrets.*` + +```yaml +secrets.GITEA_TOKEN # auto-generated job token (cannot push to package registry) +secrets.GITHUB_TOKEN # alias for the same token +secrets. # user-defined secrets +``` + +### `vars.*` + +```yaml +vars. # non-sensitive config variables (stored in UPPERCASE) +``` + +### `inputs.*` + +```yaml +inputs. # for workflow_dispatch and workflow_call +``` + +### `matrix.*` / `strategy.*` + +```yaml +matrix. # current matrix combination value +strategy.fail-fast +strategy.max-parallel +``` + +--- + +## Secrets + +### Scope (highest to lowest priority) + +1. Repository secrets +2. Organization secrets +3. User secrets + +### Rules + +- Allowed characters: `[a-zA-Z0-9_]` +- Cannot start with `GITHUB_`, `GITEA_`, or a number +- Case-insensitive + +### Usage + +```yaml +steps: + - name: Use secret + env: + API_KEY: ${{ secrets.API_KEY }} + run: ./deploy.sh $API_KEY +``` + +### Auto Token (`GITEA_TOKEN`) + +Automatically injected into every job. Short-lived — invalidated when the job completes. + +**Known limitation**: `GITEA_TOKEN` / `GITHUB_TOKEN` **cannot push to the Gitea package/container registry**. Use a Personal Access Token (PAT) with `package` scope stored as a manual secret instead. + +--- + +## Variables (`vars`) + +Non-sensitive configuration values, visible in logs. + +### Scope (highest to lowest priority) + +1. Repository variables +2. Organization variables +3. User variables + +### Rules + +- Allowed characters: `[a-zA-Z0-9_]` +- Cannot start with `GITHUB_`, `GITEA_`, `CI`, or a number +- Keys are stored and accessed in **UPPERCASE** + +### Usage + +```yaml +steps: + - run: echo "Deploying to ${{ vars.ENVIRONMENT }}" +``` + +### Inline `env` (workflow/job/step level) + +```yaml +env: + GLOBAL_VAR: "value" # available to all jobs + +jobs: + build: + env: + JOB_VAR: "value" # available to all steps in this job + steps: + - env: + STEP_VAR: "value" # only this step + run: echo $STEP_VAR +``` + +--- + +## Built-in Environment Variables + +Automatically injected into every step: + +| Variable | Description | +|---|---| +| `CI` | Always `true` | +| `GITHUB_WORKFLOW` / `GITEA_WORKFLOW` | Workflow name | +| `GITHUB_RUN_ID` / `GITEA_RUN_ID` | Unique run ID | +| `GITHUB_RUN_NUMBER` / `GITEA_RUN_NUMBER` | Sequential run number | +| `GITHUB_ACTOR` / `GITEA_ACTOR` | Triggering username | +| `GITHUB_REPOSITORY` | `owner/repo` | +| `GITHUB_EVENT_NAME` | Event name | +| `GITHUB_SHA` | Commit SHA | +| `GITHUB_REF` | Full ref | +| `GITHUB_REF_NAME` | Short ref name | +| `GITHUB_REF_TYPE` | `branch` or `tag` | +| `GITHUB_HEAD_REF` | PR source branch | +| `GITHUB_BASE_REF` | PR target branch | +| `GITHUB_WORKSPACE` | Workspace directory | +| `GITHUB_SERVER_URL` | Gitea instance URL | +| `GITHUB_API_URL` | Gitea API URL | +| `GITHUB_TOKEN` / `GITEA_TOKEN` | Auto job token | +| `RUNNER_OS` | Runner OS | +| `RUNNER_ARCH` | Runner architecture | +| `RUNNER_NAME` | Runner name | +| `RUNNER_TEMP` | Temp directory | +| `RUNNER_TOOL_CACHE` | Tool cache directory | + +--- + +## Expression Syntax & Functions + +### Syntax + +```yaml +${{ }} + +# In `if:` blocks, the ${{ }} wrapper is optional: +if: github.ref == 'refs/heads/main' +if: ${{ github.ref == 'refs/heads/main' }} +``` + +### Operators + +| Operator | Description | +|---|---| +| `( )` | Grouping | +| `[ ]` | Index | +| `.` | Property access | +| `!` | Not | +| `<` `>` `<=` `>=` | Comparison | +| `==` `!=` | Equality | +| `&&` `\|\|` | Logical AND / OR | + +### Functions + +| Function | Description | +|---|---| +| `contains(search, item)` | True if string/array contains item | +| `startsWith(str, prefix)` | Case-insensitive prefix check | +| `endsWith(str, suffix)` | Case-insensitive suffix check | +| `format(str, val0, val1, ...)` | String formatting with `{0}`, `{1}` placeholders | +| `join(array, separator)` | Join array with delimiter | +| `toJSON(value)` | Serialize to JSON string | +| `fromJSON(value)` | Parse JSON string to object | +| `hashFiles(path)` | SHA-256 hash of file(s) matching glob | +| `success()` | True if all previous steps succeeded | +| `failure()` | True if any previous step failed | +| `cancelled()` | True if workflow was cancelled | +| `always()` | Always true; forces step execution | + +### Examples + +```yaml +if: contains(gitea.ref, 'main') +if: startsWith(gitea.ref, 'refs/tags/') +if: always() +if: failure() +if: success() && gitea.ref == 'refs/heads/main' +run: echo ${{ format('Hello {0}', gitea.actor) }} +``` + +--- + +## Runner Labels + +Labels map `runs-on:` values in workflows to runner execution environments. + +### Label Format + +``` +