Move affine to deprecated

RollingUpdate deadlocks on the ReadWriteOnce longhorn PVC: old and new
pods cannot both attach the volume. Recreate terminates the old pod first.

argocd/applications/arrstack.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: arrstack
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
-    path: arrstack
-    targetRevision: HEAD
-    directory:
-      recurse: true
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: arrstack
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - PruneLast=true

arrstack/arrstack-vpn-services-endpointslice.yaml

@@ -1,38 +0,0 @@
-# external-services-and-endpoints.yaml
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: arr-stack-endpoints
-  namespace: arrstack
-  labels:
-    kubernetes.io/service-name: arr-stack # This label now links to the Service
-addressType: IPv4
-ports:
-  - name: qbittorrent-port
-    protocol: TCP
-    port: 8080
-  - name: prowlarr-port
-    protocol: TCP
-    port: 9696
-endpoints:
-  - addresses:
-      - "10.8.13.2"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: arr-stack # Service name now matches the label
-  namespace: arrstack
-spec:
-  ports:
-    - name: qbittorrent-port
-      protocol: TCP
-      port: 8080 
-      targetPort: 8080 
-    - name: prowlarr-port
-      protocol: TCP
-      port: 9696
-      targetPort: 9696
-  type: ClusterIP

arrstack/prowlarr-httproute.yaml

@@ -1,46 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: prowlarr-route
-  namespace: arrstack
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: prowlarr
-  hostnames:
-    - "prowlarr.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "prowlarr.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: arr-stack
-          port: 9696
-          kind: Service
-          group: ""
-          weight: 1

arrstack/radarr-httproute.yaml

@@ -1,48 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: radarr-route
-  namespace: arrstack
-  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
-  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: radarr
-  hostnames:
-    - "radarr.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "radarr.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: radarr
-          port: 7878
-          kind: Service
-          group: ""
-          weight: 1

arrstack/radarr/radarr-pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: arrstack
-  name: radarr-config
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 5Gi

arrstack/radarr/radarr-svc.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr
-  namespace: arrstack
-spec:
-  selector:
-    app: radarr
-  type: ClusterIP
-  ports:
-  - name: radarr
-    protocol: TCP
-    port: 7878
-    targetPort: 7878 

arrstack/radarr/radarr.yaml

@@ -1,61 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata: 
-  name: radarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: radarr
-  serviceName: radarr
-  template:
-    metadata:
-      labels:
-        app: radarr
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      securityContext:
-        fsGroup: 0 
-      containers:
-      - name: radarr
-        image: lscr.io/linuxserver/radarr:6.1.1
-        resources:
-          requests:
-            cpu: 100m
-            memory: 256Mi
-          limits:
-            cpu: 500m
-            memory: 512Mi
-        env: 
-          - name: PUID
-            value: "0"
-          - name: PGID
-            value: "0"
-        ports:
-          - containerPort: 7878 
-        volumeMounts:
-          - name: config
-            mountPath: /config
-          - name: media
-            subPath: "Anime Movies"
-            mountPath: /anime
-          - name: media
-            subPath: Movies
-            mountPath: /movies
-          - name: media
-            subPath: Nostalgia
-            mountPath: /nostalgia
-          - name: downloads
-            mountPath: /downloads
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: radarr-config
-        - name: media
-          persistentVolumeClaim:
-            claimName: smb-media
-        - name: downloads
-          persistentVolumeClaim:
-            claimName: smb-downloads

arrstack/smb-download.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: smb-downloads
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  csi:
-    driver: smb.csi.k8s.io
-    volumeHandle: smb-downloads 
-    volumeAttributes:
-      source: "//10.8.14.2/downloads" 
-    nodeStageSecretRef:
-      name: arrstack-secrets
-      namespace: arrstack
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: arrstack 
-  name: smb-downloads
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  volumeName: smb-downloads
-  storageClassName: ""
-

arrstack/smb-media.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: smb-media
-#  namespace: arrstack
-spec:
-  capacity:
-    storage: 20Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  csi:
-    driver: smb.csi.k8s.io
-    volumeHandle: smb-media
-    volumeAttributes:
-      source: "//10.8.14.2/Media" 
-    nodeStageSecretRef:
-      name: arrstack-secrets
-      namespace: arrstack
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: arrstack 
-  name: smb-media
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  volumeName: smb-media
-  storageClassName: ""

arrstack/sonarr-httproute.yaml

@@ -1,28 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: sonarr-route
-  namespace: arrstack
-  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
-  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: sonarr
-  hostnames:
-    - "sonarr.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - name: sonarr
-          namespace: arrstack
-          port: 8989
-          kind: Service
-          group: ""
-          weight: 1

arrstack/sonarr/sonarr-pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: arrstack
-  name: sonarr-config
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 10Gi

arrstack/sonarr/sonarr.yaml

@@ -1,67 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata: 
-  name: sonarr
-  namespace: arrstack
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: sonarr
-  serviceName: sonarr
-  template:
-    metadata:
-      labels:
-        app: sonarr
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      securityContext: 
-        fsGroup: 0 
-      containers:
-      - name: sonarr
-        image: lscr.io/linuxserver/sonarr:4.0.17
-        resources:
-          requests:
-            cpu: 100m
-            memory: 512Mi
-          limits:
-            cpu: 500m
-            memory: 1.5Gi
-        env: 
-          - name: PUID
-            value: "0"
-          - name: PGID
-            value: "0"
-        ports:
-          - containerPort: 8989
-        volumeMounts:
-          - name: config
-            mountPath: /config
-          - name: media
-            subPath: "Anime Series"
-            mountPath: /anime
-          - name: media
-            subPath: "Series"
-            mountPath: /series
-          - name: media
-            subPath: Cartoon
-            mountPath: /cartoon
-          - name: media
-            subPath: Nostalgia
-            mountPath: /nostalgia
-          - name: media
-            subPath: Kdrama
-            mountPath: /kdrama
-          - name: downloads
-            mountPath: /downloads
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: sonarr-config
-        - name: media
-          persistentVolumeClaim:
-            claimName: smb-media
-        - name: downloads
-          persistentVolumeClaim:
-            claimName: smb-downloads

arrstack/sonarr/sonarrr-svc.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr
-  namespace: arrstack
-spec:
-  selector:
-    app: sonarr
-  type: ClusterIP
-  ports:
-  - name: sonarr
-    protocol: TCP
-    port: 8989
-    targetPort: 8989

arrstack/torrent-httproute.yaml

@@ -1,46 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: torrent-route
-  namespace: arrstack
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: torrent
-  hostnames:
-    - "torrent.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "torrent.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: arr-stack
-          port: 8080
-          kind: Service
-          group: ""
-          weight: 1

deprecated/nginx-ingress-controller/radarr-ingress.yaml

@@ -1,30 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: radarr-ingress
-  namespace: arrstack         
-  annotations:
-    cert-manager.io/cluster-issuer: azure-dns
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
-    nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
-    nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32"
-spec:
-  ingressClassName: nginx         
-  tls:
-  - hosts:
-    - radarr.jsme.be
-    secretName: radarr-tls     
-  rules:
-  - host: radarr.jsme.be
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: radarr  
-            port:
-              number: 7878
-

deprecated/nginx-ingress-controller/sonarr-ingress.yaml

@@ -1,30 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: sonarr-ingress
-  namespace: arrstack         
-  annotations:
-    cert-manager.io/cluster-issuer: azure-dns
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
-    nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
-    nginx.ingress.kubernetes.io/whitelist-source-range: "10.8.69.0/24,10.8.3.2/32,10.8.4.0/24,10.8.13.2/32"
-spec:
-  ingressClassName: nginx         
-  tls:
-  - hosts:
-    - sonarr.jsme.be
-    secretName: sonarr-tls     
-  rules:
-  - host: sonarr.jsme.be
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: sonarr  
-            port:
-              number: 8989 
-

infisical/Infisical-secrets/arrstack.yaml

@@ -1,22 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: arrstack-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    universalAuth:
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/arrstack"
-        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
-  managedSecretReference:
-    secretName: arrstack-secrets
-    secretNamespace: arrstack
-    secretType: Opaque