refactor: consolidate kubernetes categories

2026-09-21 16:36:05 +00:00 · 2026-08-09 19:58:18 +02:00
parent 434c1aa51e
commit 88146579c0
83 changed files with 37 additions and 34 deletions
@@ -0,0 +1,47 @@
+# Cloudflare API Token for DNS-01 Challenges
+#
+# A Cloudflare API token with the following permissions:
+#   - Zone > DNS > Edit
+#   - Zone > Zone > Read
+#
+# Base64-encoded:
+#   echo -n "api-token" | base64
+#
+# This file will be SOPS-encrypted on pre-commit
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-api-token
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager
+        app.kubernetes.io/component: cloudflare-api-token
+type: Opaque
+data:
+    api-token: ENC[AES256_GCM,data:QZEgQdatWsC/vpboMlPDPyY5nVK/bKkBZ9Mjtt4VOfao8uN5zi0Bdu/OPtLKQarKGTR2srMmiRuuH1BGQunBwXAb4beDIT41,iv:sHoJ86a9qNsyIJ83YgPGWerxcvp3okbXE3pX+OYTbwk=,tag:lV8OWepMdI4foSlwXnb5Ng==,type:str]
+sops:
+    lastmodified: "2026-06-16T10:24:36Z"
+    mac: ENC[AES256_GCM,data:vDjNGtGfQgNBJKxIYloBd/eAkx6U+Xh/4laJ31qyAyy8/2R+0NTL/2g6yc6vqf7m47qflfSOYmU4kC7IpNlUbl/WHznaWJky8d/MU2zCmcsqmt44XOf1ppD7wkoiIyTjVh+QDNFLmmg9SDquVDvmMYYGAUypCY/Rh9QAVp/Cwtk=,iv:EMS6tgMml6bMGO3qoPkf71ROjeu/WXR1fLTki/672xw=,tag:jP89nlDi8wNV9f0DJQZljA==,type:str]
+    pgp:
+        - created_at: "2026-06-16T10:24:36Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAgJ19fZrQeD25vjz9wWx+3MYjWj2vq4HWGJ9nG06zc/Rl
+            PeR/LbdMSowAyjvTAdnsqaFnofpz9P7fGbzbIPFiulcsoqC2UQtBO833XWc8RoyY
+            7nP/+fc0UyriIudoblgHV+aEoHuSuJGn7y3lAZWx4fj98Rat1Ip7/gyfN8SgmYM0
+            dS68s2WdXMtV3w6vFcSr/HpQFdwFAvzB4+cEjwJo35axIWKAp4wzLlckv+MG7lLS
+            dqZzYeGjaUyJuIc3GxBNw8ixTcEvIKdxGcRPVCCH2KLphCd+sL2b3qRUHfJXPmNb
+            8Eq3iiLTbh3DZ+MB4UCkVHCNf9wwVERdpjvv1hBBGxckfmgqqB9Jo1MpuQNHJdXY
+            gLATxuR6FSwuNNw4FslBSW0TkjMHhsP1Skfl/R4usTCsIPkN+ogC0QPCwAyH6Jir
+            RoQQLRGnCKgFhSgRyAO+fEOcxHeJIcphcF4RtUDU1rtYIaCRRxjTJrSx9Niz02Sc
+            hC2BsG0gvCMYxC7hV6EE+4Ck/93AD+4ah5nsZBQ0R9OY75RnnHs9qbZDTjnI71OO
+            G6bTLE1rE5KZfvN9tUKfZ8edeUDQEgY4u5IeXZgXtTEE/DqkkKnIg5nNzCs9saWU
+            8/+irtiX3GiXbZsXrsRR37jXzpQu+QoEDydDIZdgEg3P/97R40db6yjh/tmh0pjS
+            XgEZOOAjGdL742K8kMfG4JhFfRw506JH6LLE080VX8yqU3IHQTovILwXtgzcNTyj
+            EF+FIAvT8RR+g0VtbSMPLwCiBFeknxxvKBNmhyzvov7dFnp0zE27/VHN0ZGY6to=
+            =YUJS
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    version: 3.10.2
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  - cloudflare-api-token-secret.yaml
+secretGenerator:
+  - name: cert-manager-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,11 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+        namespace: cert-manager
+      chart: cert-manager
+      version: "v1.20.2"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 1h
+  url: https://charts.jetstack.io
@@ -0,0 +1,91 @@
+# Cert-Manager Values
+# Install CRDs as part of the Helm release
+crds:
+    enabled: true
+    keep: true
+# Enable DNS01 challenge providers
+extraArgs:
+    - ENC[AES256_GCM,data:RcKzGzDSFXAw32vBKyvMTzMx5u0AmXKpXEY9/YRxUI0SNVy68/uUSpFhdmcB0RvmzG7y,iv:AraIcgoVYO1IVAmN3dd6pXr3v2BXaizbK8HefwsDRqE=,tag:QlOBuyxbddyk++nYLhMl6Q==,type:str]
+# Resource settings
+resources:
+    requests:
+        cpu: 10m
+        memory: 32Mi
+    limits:
+        cpu: 100m
+        memory: 128Mi
+# Tolerate failover nodes
+tolerations:
+    - key: ENC[AES256_GCM,data:WXIPFO1nBe+6,iv:t8RP3KL6niOVe84Qqu9+JKp2qNR87qnMzJOh7pUsudg=,tag:uT7gWSdOz86PPi2NZIxZeA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:N1IHrGvrobA=,iv:QiKeIiSBFThw05b5gkU41koci4CDZ0ZxdLX1r1DD7Dc=,tag:QGWcNIYqUdEy0f0bEYC91Q==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:QMtUDj9EDXWbsUBLlQJ5yFEsQ3fksIRUqIk7tKyts1aHqNQ56A==,iv:GVEl1AcWNLAqdXqyJTMoYBPRqqvhSHGBN7fuMLWtjoY=,tag:bmCK8yCiVCXci2JJFvw/GA==,type:str]
+      operator: Exists
+      effect: NoSchedule
+webhook:
+    resources:
+        requests:
+            cpu: 10m
+            memory: 32Mi
+        limits:
+            cpu: 100m
+            memory: 128Mi
+    tolerations:
+        - key: ENC[AES256_GCM,data:QZjbo0u9rqht,iv:H3mZnC4a2abmOiW0RhoFAiAvVfaRFpGU2+XKYy8uBUQ=,tag:xwp+rkiYrSo1q+CsLdup7Q==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:UsVMCFtyl0c=,iv:ImpKIQtC1jX2NLNTSDhq4a9nq3I2HlpSr7QLUOw5gd0=,tag:xM/vf2MhasBNWbLqxkUrQg==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:31pC3NOA0AH2d0V/N10xX1U8E1OD4YL/27+xFLxElfYb1xWSDA==,iv:aaaci0Eu3Mb9og3Za0beB9js3wSjcNE7BOS5iAko3aU=,tag:h40mrm+gPTf9jCP7ax1ihQ==,type:str]
+          operator: Exists
+          effect: NoSchedule
+cainjector:
+    resources:
+        requests:
+            cpu: 10m
+            memory: 32Mi
+        limits:
+            cpu: 100m
+            memory: 128Mi
+    tolerations:
+        - key: ENC[AES256_GCM,data:rqZTE8j9xDAy,iv:EvztWg01VbvJhdhkrVz7M0mA0EUhVW2Ty/de0D3pgmw=,tag:rGUZky1bUhewhKDp3Vo8Eg==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:fPt+n+ftbGI=,iv:xHy9IUIBgkHDQcVZ4MyA3tXPvMAy14gHhkxe2AYthR0=,tag:szam+dyODZSjfX6oxsFdSg==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:As98cp+6SvVwxRtdxx7TT+HGzejgWiacf0TYm2JU9kPqEA7ljA==,iv:dd+TS9T57NrpgyZjYgPi/aCiInfnVxh3VbO7gddkw8k=,tag:KQMA0Kn0YgE/HpAJk83pTw==,type:str]
+          operator: Exists
+          effect: NoSchedule
+startupapicheck:
+    resources:
+        requests:
+            cpu: 10m
+            memory: 32Mi
+        limits:
+            cpu: 100m
+            memory: 128Mi
+sops:
+    lastmodified: "2026-07-25T08:12:52Z"
+    mac: ENC[AES256_GCM,data:yFXZxbhJi5PPVXl4j73FfOO5hurvD7ZXgWr5eZS8poE7IEg6IgZKBjwq1ITMUP5DyS6K2onR/mgZVzgj5X5I7hEwj13DAPW7wWthZql+De7oGxe5Nv74fDFEwCoqh2sTbdrQS2KyPY+rrb0ZMZD5qpdZzyw1AVGzVKeJJj9DdBY=,iv:SW7sb6mmJulekZn1Eh2pfYml1PwJ5v6z/PBdV3TL29A=,tag:5HzpRnH2G8J//J2fZhrxrQ==,type:str]
+    pgp:
+        - created_at: "2026-07-25T08:12:52Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAArV5QxST5xu2jG+X9Fo6F4o3uxMS/Kw56ey1MMTfgkTlM
+            HdV1n6lityMGXB278GiYhmZYRdZl0kAT+Dj9Y0RdaiI8BszocD7IbBKmE1tVseCr
+            Xa4y7nWE58xz2Ca26KVf/I64QPHsKKus4wECGOgZrh7Hzb+KdeTJBpuMMIgnJe3l
+            1C6VdfTgNlYPW+zAmX3i39ZwYO7wcz5UZ1aXozAtoOjWyjdcArEdoCH9iD2GXTOe
+            0EsvgdUD1U2n4ffy+Z8mga6V8URkJQ86XTuFD6PhFF1bhBwa36MCUXAdlD9ONB6d
+            jaKSAPAeia4C+0vCXTv9OYEHizSe11iwsUyPq+bmMrYCUslaiOCC+QfGtJEcCJj/
+            ZeAjXMoyi5Fnmwj+y5ED+O1DKp/sDyUdvix83L1UWVfTrgNVfXFCGzHJUkcZhfUk
+            Ye9KcbH+7+mj3p/lAgbQjBjVemnW6GFzGJYcL/rWwRBxw2ElLxKPnR9NQK9VY5w/
+            wCmWzG4Cjr2gfLlR05A72/i68fRM9eAy4CFL5y4xTN1eYe+MCz2ZedZDd3uYTKUC
+            TMPGXfjhy64W/cV8MWa/aYCyNguVlKbmUl7kZwb+8DAxrSyPqQal11DJtcsv3zFO
+            BUf8GQFn4jXXYqd1LojLM7bUjAkXWZUIUbg1+jWfPGsgsTGn4R0tshtY9JOfQpfS
+            XAGL6+0+DQf8wY7yzbds4DSDMNTlOH7iWoX77okayY3L5Jqc3jB0glMJbRwdmgnj
+            d5JzAoqDhi1F+MQdTYGu7RQpawKr6ndWqwkT5ef5BQ86TQq3/+jZ5uuC3qnE
+            =uS2O
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2