netbox: add NetBox 4.6.8 with postgres, valkey and rqworker

Five components under applications/netbox: the web pod, an rqworker,
a daily housekeeping CronJob, postgres 18 and two valkey instances.
The task queue runs appendonly on its own PVC so queued jobs survive a
restart, while the cache instance is disposable.

Worker and cronjob override args rather than command, which replaces
CMD while keeping tini as the entrypoint, so only the web pod runs
migrations. Media, reports and scripts share one RWX PVC via subPaths
because both the web pod and the worker mount them.

Exposed on the internal gateway only.

infra/argocd/applications/netbox-application.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: netbox
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
+    path: applications/netbox
+    targetRevision: HEAD
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: netbox
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
+      - PrunePropagationPolicy=foreground

infra/envoy-gateway/kustomization.yaml

@@ -60,8 +60,7 @@ resources:
   - pelican/pelican-wings-mc-certificate.yaml
   - pelican/pelican-wings-ark-certificate.yaml
   - outline/outline-certificate.yaml
-  # netbox: uncomment together with the patch below once infra/envoy-gateway/netbox/ is committed
-  # - netbox/netbox-certificate.yaml
+  - netbox/netbox-certificate.yaml
 
 patches:
   # Internal gateway patches
@@ -293,12 +292,12 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: outline/outline-gateway-patch.yaml
-  # - target:
-  # group: gateway.networking.k8s.io
-  # version: v1
-  # kind: Gateway
-  # name: gateway-internal
-  # path: netbox/netbox-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: netbox/netbox-gateway-patch.yaml
 
   # Public gateway patches
   - target:

infra/envoy-gateway/netbox/netbox-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: netbox-tls
+  namespace: envoy-gateway
+spec:
+  secretName: netbox-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - netbox.jsme.be

infra/envoy-gateway/netbox/netbox-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: netbox
+    protocol: HTTPS
+    port: 443
+    hostname: "netbox.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: netbox
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: netbox-tls
+          namespace: envoy-gateway