chore(deps): update terraform docker to v3.9.0

infra/kube/manifests/cilium/values.yaml

@@ -31,11 +31,6 @@ l2announcements:
     enabled: true
 externalIPs:
     enabled: true
-# Single-node cluster: the operator defaults to 2 replicas, but both
-# bind the same host ports, so the second replica can never schedule ("node(s)
-# didn't have free ports for the requested pod ports") and sits Pending forever.
-operator:
-    replicas: 1
 ingressController:
     enabled: false
     loadbalancerMode: shared

infra/r740/docker/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     docker = {
       source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
     }
   }
 }

kubernetes/dev/gitea/values-actions.yaml

@@ -44,15 +44,17 @@ statefulset:
                 docker_timeout: 300s
                 # Hard per-job caps (docker create args). Slightly below the
                 # dind limits so the daemon and image cache keep headroom.
-                options: --memory=7g --cpus=1
+                options: --memory=7g --cpus=3
     dind:
         resources:
             requests:
                 cpu: 250m
                 memory: 512Mi
             limits:
-                cpu: 1500m
+                cpu: 4
                 memory: 8Gi
+    # Same failover tolerations/affinity as the gitea release, so runners can
+    # be scheduled wherever Gitea itself runs (p330 during r740 outage).
     tolerations:
         - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
           operator: Equal

kubernetes/dev/gitea/values.yaml

@@ -21,29 +21,65 @@ valkey:
         resources:
             requests:
                 cpu: 100m
-                memory: 256Mi
+                memory: 128Mi
             limits:
                 cpu: 500m
-                memory: 1Gi
+                memory: 256Mi
+        tolerations:
+            - key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
 postgresql:
     enabled: true
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str]
-                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
+                password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
+                username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str]
     volumePermissions:
         enabled: true
     primary:
         resources:
             requests:
-                cpu: 100m
+                cpu: 250m
                 memory: 256Mi
             limits:
-                cpu: 500m
+                cpu: 1000m
                 memory: 1Gi
+        tolerations:
+            - key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
         livenessProbe:
             enabled: true
             initialDelaySeconds: 30
@@ -76,8 +112,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
+          key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str]
-          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
+          secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -106,34 +142,55 @@ gitea:
 # Resource limits for Gitea container
 resources:
     requests:
-        cpu: 100m
+        cpu: 250m
         memory: 512Mi
     limits:
-        cpu: 500m
+        cpu: 1000m
         memory: 1Gi
+# Increase replica count is not useful for 1-node cluster
 replicaCount: 1
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
+tolerations:
+    - key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str]
+      operator: Exists
+      effect: NoSchedule
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+# (postgresql and valkey tolerations are set in their respective blocks above)
 sops:
-    lastmodified: "2026-09-09T21:39:30Z"
+    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
+    mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str]
     pgp:
-        - created_at: "2026-09-09T21:39:30Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
+            hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger
-            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
+            6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA
-            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
+            56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU
-            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
+            T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4
-            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
+            FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc
-            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
+            fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj
-            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
+            D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ
-            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
+            C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3
-            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
+            T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B
-            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
+            6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO
-            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
+            voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS
-            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
+            XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd
-            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
+            H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw=
-            =Q6Pu
+            =U5nI
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/infrastructure/caddy/values.yaml

@@ -10,7 +10,7 @@ image:
     repository: caddy
     pullPolicy: IfNotPresent
     tagSuffix: ""
-    tag: 2.11.4
+    tag: 2.11.2
 service:
     type: LoadBalancer
     # Cluster (not Local) so any node can forward to pods on any other node.

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cert-manager-webhook-ovh
         namespace: cert-manager
       chart: cert-manager-webhook-ovh
-      version: "0.9.16"
+      version: "v0.9.13"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -14,7 +14,7 @@ spec:
         name: stalwart-helm
         namespace: stalwart
       chart: stalwart
-      version: "0.7.16"
+      version: "0.7.5"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -7,7 +7,7 @@
 # Container image
 image:
     repository: stalwartlabs/stalwart
-    tag: v0.16.20
+    tag: v0.16.11
     pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1

kubernetes/personal/openclaw/openclaw-instance.yaml

@@ -3,35 +3,6 @@ kind: OpenClawInstance
 metadata:
   name: openclaw
 spec:
-  # Pin the gateway image to an immutable version tag. Running `latest` with
-  # pullPolicy=IfNotPresent let a stale node-cached image (old build, state
-  # schema v1) fight the PVC's DB migrated by a newer build (schema v15),
-  # crash-looping the container. Bump this tag alongside upstream releases.
-  image:
-    repository: ghcr.io/openclaw/openclaw
-    tag: "2026.9.3"
-  # Workaround for paperclipinc/openclaw-operator#607: the operator mounts the
-  # PVC root directly at /home/openclaw/.openclaw and only fsGroup is applied,
-  # so the mount root stays owned by root. OpenClaw >= 2026.9 fchmods its config
-  # dir when writing openclaw.json, which fails with EPERM for a non-owner.
-  # This one-shot init container chowns the mount root to the pod UID.
-  initContainers:
-    - name: fix-data-owner
-      image: docker.io/library/busybox:1.37
-      command: ["sh", "-c", "chown 1000:1000 /data && ls -ld /data"]
-      securityContext:
-        runAsUser: 0
-        runAsNonRoot: false
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
-        capabilities:
-          drop: ["ALL"]
-          add: ["CHOWN"]
-        seccompProfile:
-          type: RuntimeDefault
-      volumeMounts:
-        - name: data
-          mountPath: /data
   # Provider API keys come from the SOPS-encrypted Secret below.
   # The gateway token is auto-generated by the operator (no mDNS pairing in k8s).
   envFrom:

kubernetes/personal/paperless/postgres-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: postgres
-      version: "0.20.4"
+      version: "0.20.0"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/redis-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: redis
-      version: "0.34.26"
+      version: "0.34.16"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/system/coredns/values.yaml

@@ -1,7 +1,7 @@
 replicaCount: 2
 image:
     repository: coredns/coredns
-    tag: 1.14.7
+    tag: 1.14.3
     pullPolicy: IfNotPresent
 deployment:
     dnsPolicy: ClusterFirst

kubernetes/system/flux/kustomization.yaml

@@ -13,5 +13,3 @@ resources:
   - longhorn-jobs.yaml
   - openclaw-operator.yaml
   - openclaw.yaml
-  - kyverno.yaml
-  - kyverno-policies.yaml

kubernetes/system/flux/kyverno-policies.yaml

@@ -1,19 +0,0 @@
----
-# Flux Kustomization for Kyverno ClusterPolicies.
-# dependsOn "kyverno" (the controller + CRDs) so the kyverno.io/v2 CRD exists
-# before Flux dry-runs the ClusterPolicy. Without this split, Flux fails the
-# whole Kustomization at dry-run ("no matches for kind ClusterPolicy").
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: kyverno-policies
-  namespace: flux-system
-spec:
-  interval: 5m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/system/kyverno-policies
-  dependsOn:
-    - name: kyverno

kubernetes/system/flux/kyverno.yaml

@@ -1,24 +0,0 @@
----
-# Flux Kustomization for Kyverno
-# Separate from main homeprod because Kyverno CRDs (installed by the HelmRelease)
-# must be present before the ClusterPolicy can be applied.
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: kyverno
-  namespace: flux-system
-spec:
-  interval: 5m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/system/kyverno
-  # Wait for the admission controller Deployment to be Ready before Flux
-  # considers this Kustomization healthy — this ensures the ClusterPolicy
-  # is applied after the CRDs and controller are live.
-  healthChecks:
-    - apiVersion: apps/v1
-      kind: Deployment
-      name: kyverno-admission-controller
-      namespace: kyverno

kubernetes/system/kyverno-policies/kustomization.yaml

@@ -1,12 +0,0 @@
----
-# Kyverno ClusterPolicies.
-# Applied by the Flux Kustomization "kyverno-policies" which dependsOn "kyverno"
-# (the controller + CRDs). This split is required because Flux dry-runs every
-# resource in a Kustomization before applying any — the ClusterPolicy references
-# the kyverno.io/v2 CRD that only exists once the kyverno HelmRelease installs.
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  # Toggleable emergency relief: strips resources.requests.cpu cluster-wide.
-  # See the file header for the toggle (failurePolicy Ignore/Never) commands.
-  - policy-strip-cpu-requests.yaml

kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml

@@ -1,121 +0,0 @@
----
-# ============================================================================
-# CPU-REQUEST RELIEF — TOGGLEABLE CLUSTER POLICY
-# ============================================================================
-# Emergency relief for CPU-saturated scenarios
-#
-# When ENABLED, this Kyverno ClusterPolicy removes the `resources.requests.cpu`
-# field from every Pod created/updated in the cluster (except Kyverno's own pods,
-# critical kube-system control-plane pods, and the Longhorn instance-manager /
-# engine-image / longhorn-manager, which must keep guarantees so admission and
-# the storage layer keep working). With no CPU request, pods schedule onto
-# whatever capacity is free and burst freely.
-#
-# === TOGGLE ===
-#   The policy is ACTIVE by default (failurePolicy: Ignore = mutate, never block).
-#
-#   DISABLE relief (restore the per-app CPU requests on next Flux reconcile):
-#     kubectl patch clusterpolicy.kyverno.io strip-cpu-requests --type=merge \
-#       -p '{"spec":{"failurePolicy":"Never"}}'
-#   # failurePolicy: Never tells Kyverno to skip the rule without mutating, so the
-#   # original CPU requests from each HelmRelease are restored on next reconcile.
-#
-#   RE-ENABLE relief (strip requests again):
-#     kubectl patch clusterpolicy.kyverno.io strip-cpu-requests --type=merge \
-#       -p '{"spec":{"failurePolicy":"Ignore"}}'
-# ============================================================================
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: strip-cpu-requests
-  annotations:
-    policies.kyverno.io/title: Strip CPU Requests (Emergency Relief)
-    policies.kyverno.io/category: Other
-    policies.kyverno.io/severity: low
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/description: >-
-      Removes resources.requests.cpu AND resources.limits.cpu from pods so they
-      can be scheduled on an overloaded single-node cluster. Limits must be
-      stripped too: the LimitRanger admission plugin defaults requests.cpu =
-      limits.cpu whenever a limit exists without a request, so stripping only
-      the request is a no-op. Toggle via spec.failurePolicy:
-      Ignore = active (strip), Never = inactive (restore).
-spec:
-  # Never block a pod if Kyverno admission is itself under pressure.
-  failurePolicy: Ignore
-  # background: true so the backgroundController also mutates ALREADY-EXISTING
-  # pods (not just new/updated ones at admission). This makes the relief take
-  # effect immediately on flip-on, without waiting for a pod restart.
-  background: true
-  rules:
-    - name: remove-cpu-request-from-containers
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      # Keep guarantees for things that must keep running so admission and the
-      # storage layer keep working even while everything else is bursting.
-      exclude:
-        any:
-          - resources:
-              namespaces:
-                - kyverno
-          - resources:
-              namespaces:
-                - kube-system
-              names:
-                # Control-plane static pods (apiserver, scheduler, controller-manager)
-                - kube-apiserver-*
-                - kube-scheduler-*
-                - kube-controller-manager-*
-          - resources:
-              namespaces:
-                - longhorn-system
-              selector:
-                matchLabels:
-                  app: longhorn-manager
-          - resources:
-              namespaces:
-                - longhorn-system
-              selector:
-                matchLabels:
-                  app: instance-manager
-          - resources:
-              namespaces:
-                - longhorn-system
-              selector:
-                matchLabels:
-                  app: engine-image
-      mutate:
-        # `request.object` is available in BOTH admission and background modes:
-        # the backgroundController synthesizes an admission-like request for
-        # existing resources, so the same foreach works for both.
-        # NOTE 1: inside `foreach`, patchStrategicMerge must be an INLINE YAML
-        # mapping — a `|` block scalar is parsed as a string and fails with
-        # "wrong node kind: expected MappingNode but got ScalarNode".
-        # NOTE 2: limits.cpu MUST be stripped together with requests.cpu.
-        # The LimitRanger admission plugin defaults requests.cpu = limits.cpu
-        # whenever a container has a limit but no request, so stripping only
-        # the request is a no-op for any container that declares a limit.
-        foreach:
-          - list: "request.object.spec.containers"
-            patchStrategicMerge:
-              spec:
-                containers:
-                  - name: "{{ element.name }}"
-                    resources:
-                      requests:
-                        cpu: null
-                      limits:
-                        cpu: null
-          - list: "request.object.spec.initContainers || `[]`"
-            patchStrategicMerge:
-              spec:
-                initContainers:
-                  - name: "{{ element.name }}"
-                    resources:
-                      requests:
-                        cpu: null
-                      limits:
-                        cpu: null

kubernetes/system/kyverno/kustomization.yaml

@@ -1,17 +0,0 @@
----
-# Kyverno controller + CRDs only.
-# The ClusterPolicy lives in a SEPARATE directory (kubernetes/system/kyverno-policies)
-# applied by a SEPARATE Flux Kustomization (kyverno-policies) with dependsOn:
-# kyverno. This split is required because Flux dry-runs every resource in a
-# Kustomization before applying any of them — the ClusterPolicy references the
-# kyverno.io/v2 CRD, which does not exist until this HelmRelease installs it, so
-# bundling them together makes the whole Kustomization fail at dry-run.
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: kyverno
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/system/kyverno/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease

kubernetes/system/kyverno/namespace.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kyverno
-  labels:
-    # Pod Security Admission: Kyverno's own pods run privileged-sidecars/agent.
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged

kubernetes/system/kyverno/release.yaml

@@ -1,70 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kyverno
-  namespace: kyverno
-spec:
-  interval: 5m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: kyverno
-        namespace: kyverno
-      chart: kyverno
-      version: '3.9.1'
-      interval: 5m
-  # Minimal footprint for a single-node cluster:
-  #  - admissionReports disabled (no extra Redis/Postgres)
-  #  - admissionController + backgroundController only (no reports, no
-  #    cleanupController) — the backgroundController lets the ClusterPolicy also
-  #    mutate ALREADY-RUNNING pods (not just new/updated ones), so flipping the
-  #    relief on immediately strips CPU requests from existing workloads.
-  #  - tolerates the control-plane node (allowSchedulingOnMasters=true on p330)
-  #  - low CPU request so Kyverno's own admission doesn't itself deadlock the node
-  values:
-    admissionController:
-      rbac:
-        create: true
-      # Scale to 1 replica on this single-node cluster
-      replicas: 1
-      resources:
-        requests:
-          cpu: 50m
-          memory: 128Mi
-        limits:
-          cpu: 500m
-          memory: 512Mi
-      tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: NoSchedule
-    # The background controller re-applies policies to already-existing resources,
-    # so the CPU-request strip also affects pods that were created BEFORE the policy
-    # (and pods Flux re-applies with their original requests between toggles).
-    backgroundController:
-      enabled: true
-      replicas: 1
-      resources:
-        requests:
-          cpu: 50m
-          memory: 128Mi
-        limits:
-          cpu: 500m
-          memory: 512Mi
-      tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: NoSchedule
-    # Reports/reportsController are for policy-report auditing — not needed for a
-    # one-off relief toggle.
-    reportsController:
-      enabled: false
-    cleanupController:
-      enabled: false
-    # No autoscaling on a single node.
-    autoscaling:
-      admissionController:
-        enabled: false
-      backgroundController:
-        enabled: false

kubernetes/system/kyverno/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: kyverno
-  namespace: kyverno
-spec:
-  interval: 5m
-  url: https://kyverno.github.io/kyverno/

kubernetes/system/longhorn/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: longhorn
         namespace: longhorn-system
       chart: longhorn
-      version: '1.12.1'
+      version: '1.12.0'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/system/longhorn/values.yaml

@@ -1,8 +1,7 @@
 # Longhorn Helm Values
 defaultSettings:
-    # ReplicaCount below is to be updated when cluster node count change.
+    # 2 replicas so volumes survive single-node loss
-    # Single-node clusters can only have 1 replica, multi-node should have 2 or ideally 3 when possible.
+    defaultReplicaCount: 2
-    defaultReplicaCount: 1
     # Allow full disk usage on single-node
     storageOverProvisioningPercentage: 100
     storageMinimalAvailablePercentage: 10
@@ -16,28 +15,35 @@ defaultSettings:
     # set here via the `taintToleration` setting (semicolon-separated `kubectl
     # taint` syntax), not via per-component `tolerations` blocks.
     #
-    taintToleration: node-role.kubernetes.io/control-plane:NoSchedule
+    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
+    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
+    # engine/replica pods there so a volume can be failed over to the P330.
+    # The control-plane taint is also tolerated defensively, although with
+    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
+    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
 persistence:
     defaultClass: true
-    defaultClassReplicaCount: 1
+    defaultClassReplicaCount: 2
     # Retain volumes on PVC delete — safer during migration
     reclaimPolicy: Retain
     # Mount options for ext4
     fstype: ext4
-# longhorn-manager is a DaemonSet — it must run on every storage node.
+# longhorn-manager is a DaemonSet — it must run on every storage node,
+# including the P330 failover node. The control-plane toleration is defensive
+# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
+# R740, but keeps things correct if that ever changes).
 longhornManager:
     tolerations:
         - key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str]
           operator: Exists
           effect: NoSchedule
-        # Was the failover taint toleration (now a no-op; see note above)
+        # Tolerate the failover taint so longhorn-manager runs on the P330
         - key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str]
           value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str]
           operator: Equal
           effect: NoSchedule
 # longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
-# taints so CSI operations work. The second toleration was for the removed
+# taints so CSI operations work from the failover node.
-# failover taint and is now a harmless encrypted no-op.
 longhornDriver:
     tolerations:
         - key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str]
@@ -47,7 +53,8 @@ longhornDriver:
           value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str]
           operator: Equal
           effect: NoSchedule
-# longhorn-ui — tolerate the same taints so the UI is reachable.
+# longhorn-ui — tolerate the same taints so the UI is reachable even if it
+# lands on the failover node.
 longhornUI:
     replicas: 1
     tolerations: