feat: replace ansible templating with makejinja (#1156)

2024-01-14 23:03:02 -05:00
1 parent a4731906d9
commit f9481d6202
@@ -0,0 +1,65 @@
+{% if discord_template_notifier.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: discord-template-notifier
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 2.4.0
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controllers:
+      main:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          main:
+            image:
+              repository: ghcr.io/morphy2k/rss-forwarder
+              tag: 0.6.1
+            env:
+              TZ: "${TIMEZONE}"
+            probes:
+              liveness: &disabled
+                enabled: false
+              readiness: *disabled
+              startup: *disabled
+            resources:
+              requests:
+                cpu: 5m
+                memory: 10M
+              limits:
+                memory: 64M
+    service:
+      main: *disabled
+    ingress:
+      main: *disabled
+    persistence:
+      config:
+        enabled: true
+        type: secret
+        name: discord-template-notifier-secret
+        globalMounts:
+          - path: /data/config.toml
+            subPath: config.toml
+            readOnly: true
+{% endif %}
@@ -0,0 +1,8 @@
+{% if discord_template_notifier.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,16 @@
+{% if discord_template_notifier.enabled | default(false) %}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: discord-template-notifier-secret
+type: Opaque
+stringData:
+  config.toml: |-
+    [feeds.github-template]
+    url = "https://github.com/onedr0p/flux-cluster-template/commits/main/.atom"
+    interval = "10m"
+    retry_limit = 5
+    sink.type = "discord"
+    sink.url = "{{ discord_template_notifier.webhook_url }}"
+{% endif %}
@@ -0,0 +1,22 @@
+{% if discord_template_notifier.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app discord-template-notifier
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/default/discord-template-notifier/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,79 @@
+{% if homepage.enabled | default(false) %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homepage-config
+  labels:
+    app.kubernetes.io/name: homepage
+data:
+  bookmarks.yaml: |
+    - Communitcate:
+        - Discord:
+            - icon: discord.png
+              href: https://discord.com/app
+    - Media:
+        - YouTube:
+            - icon: youtube.png
+              href: https://youtube.com/feed/subscriptions
+    - Reading:
+        - Reddit:
+            - icon: reddit.png
+              href: https://reddit.com
+    - Git:
+        - kubesearch:
+            - icon: kubernetes-dashboard.png
+              href: https://kubesearch.dev
+        - flux-cluster-template:
+            - icon: github.png
+              href: https://github.com/onedr0p/flux-cluster-template
+  docker.yaml: ""
+  kubernetes.yaml: |
+    mode: cluster
+  services.yaml: |
+    - Network:
+        - Cloudflared:
+            href: https://dash.cloudflare.com
+            icon: cloudflare-zero-trust.png
+            description: Cloudflared Tunnel
+            widget:
+              type: cloudflared
+              accountid: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}{% endraw %}"
+              tunnelid: "{% raw %}{{ HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}{% endraw %}"
+              key: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}{% endraw %}"
+  settings.yaml: |
+    title: Dashboard
+    theme: dark
+    color: slate
+    headerStyle: clean
+    layout:
+      Home:
+        style: column
+        icon: mdi-home-analytics
+      Network:
+        style: row
+        columns: 3
+        icon: mdi-server
+      Observability:
+        style: column
+        icon: mdi-chart-line
+  widgets.yaml: |
+    - resources:
+        backend: kubernetes
+        cpu: true
+        expanded: true
+        memory: true
+    - search:
+        provider: ["duckduckgo"]
+        focus: false
+        target: _blank
+    - greeting:
+        text_size: xl
+        text: "Welcome!"
+    - datetime:
+        text_size: l
+        format:
+          dateStyle: long
+          timeStyle: short
+          hourCycle: h23
+{% endif %}
@@ -0,0 +1,90 @@
+{% if homepage.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: homepage
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 2.4.0
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controllers:
+      main:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          main:
+            image:
+              repository: ghcr.io/gethomepage/homepage
+              tag: v0.8.4
+            env:
+              TZ: "${TIMEZONE}"
+            envFrom:
+              - secretRef:
+                  name: homepage-secret
+            resources:
+              requests:
+                cpu: 15m
+                memory: 250M
+              limits:
+                memory: 1G
+    service:
+      main:
+        ports:
+          http:
+            port: 3000
+    ingress:
+      main:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host home.${SECRET_DOMAIN}
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  name: main
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        enabled: true
+        type: configMap
+        name: homepage-config
+        globalMounts:
+          - subPath: bookmarks.yaml
+            path: /app/config/bookmarks.yaml
+          - subPath: docker.yaml
+            path: /app/config/docker.yaml
+          - subPath: kubernetes.yaml
+            path: /app/config/kubernetes.yaml
+          - subPath: services.yaml
+            path: /app/config/services.yaml
+          - subPath: settings.yaml
+            path: /app/config/settings.yaml
+          - subPath: widgets.yaml
+            path: /app/config/widgets.yaml
+    serviceAccount:
+      create: true
+{% endif %}
@@ -0,0 +1,9 @@
+{% if homepage.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./configmap.yaml
+  - ./helmrelease.yaml
+  - ./secret.sops.yaml
+{% endif %}
@@ -0,0 +1,13 @@
+{% if homepage.enabled | default(false) %}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: homepage-secret
+stringData:
+  HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "{{ bootstrap_cloudflare_account_tag }}"
+  HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "{{ bootstrap_cloudflare_tunnel_id }}"
+  HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}"
+  HOMEPAGE_VAR_GRAFANA_USERNAME: admin
+  HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}"
+{% endif %}
@@ -0,0 +1,22 @@
+{% if homepage.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app homepage
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/default/homepage/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,59 @@
+{% if weave_gitops.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: weave-gitops
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: weave-gitops
+      version: 4.0.36
+      sourceRef:
+        kind: HelmRepository
+        name: weave-gitops
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    adminUser:
+      create: true
+      createSecret: false
+      username: admin
+    ingress:
+      enabled: true
+      className: internal
+      {% if homepage.enabled | default(false) %}
+      annotations:
+        gethomepage.dev/enabled: "true"
+        gethomepage.dev/group: Home
+        gethomepage.dev/name: Weave-gitops
+        gethomepage.dev/icon: flux-cd.png
+      {% endif %}
+      hosts:
+        - host: &host "gitops.${SECRET_DOMAIN}"
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - *host
+    networkPolicy:
+      create: false
+    metrics:
+      enabled: true
+    rbac:
+      create: true
+      impersonationResourceNames: ["admin"]
+    podAnnotations:
+      secret.reloader.stakater.com/reload: cluster-user-auth
+{% endif %}
@@ -0,0 +1,8 @@
+{% if weave_gitops.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,11 @@
+{% if weave_gitops.enabled | default(false) %}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cluster-user-auth
+type: Opaque
+stringData:
+  username: admin
+  password: "{{ weave_gitops.password | encrypt }}"
+{% endif %}
@@ -0,0 +1,22 @@
+{% if weave_gitops.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app weave-gitops
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/flux-system/weave-gitops/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -23,7 +23,112 @@ spec:
      retries: 3
  uninstall:
    keepHistory: false
-  valuesFrom:
-    - name: cilium-values
-      kind: ConfigMap
-      valuesKey: values.yaml
+  values:
+    autoDirectNodeRoutes: true
+    bpf:
+      masquerade: true
+    bgp:
+      enabled: false
+    cluster:
+      name: home-cluster
+      id: 1
+    containerRuntime:
+      integration: containerd
+      {% if bootstrap_distribution == "k3s" %}
+      socketPath: /var/run/k3s/containerd/containerd.sock
+      {% else %}
+      socketPath: /var/run/k0s/containerd.sock
+      {% endif %}
+    endpointRoutes:
+      enabled: true
+    hubble:
+      enabled: true
+      metrics:
+        enabled:
+          - dns:query
+          - drop
+          - tcp
+          - flow
+          - port-distribution
+          - icmp
+          - http
+        serviceMonitor:
+          enabled: true
+        dashboards:
+          enabled: true
+          annotations:
+            grafana_folder: Cilium
+      relay:
+        enabled: true
+        rollOutPods: true
+        prometheus:
+          serviceMonitor:
+            enabled: true
+      ui:
+        enabled: true
+        rollOutPods: true
+        ingress:
+          enabled: true
+          className: internal
+          {% if homepage.enabled | default(false) %}
+          annotations:
+            gethomepage.dev/enabled: "true"
+            gethomepage.dev/group: Network
+            gethomepage.dev/name: Cilium
+            gethomepage.dev/icon: cilium.png
+          {% endif %}
+          hosts:
+            - "hubble.${SECRET_DOMAIN}"
+          tls:
+            - hosts:
+                - "hubble.${SECRET_DOMAIN}"
+    ipam:
+      mode: kubernetes
+    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
+    {% if bootstrap_ipv6_enabled | default(false) %}
+    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
+    ipv6:
+      enabled: true
+    {% endif %}
+    k8sServiceHost: "${KUBE_API_ADDR}"
+    k8sServicePort: 6443
+    kubeProxyReplacement: true
+    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
+    l2announcements:
+      {% if bootstrap_ipv6_enabled | default(false) %}
+      enabled: false
+      {% else %}
+      enabled: true
+      # https://github.com/cilium/cilium/issues/26586
+      leaseDuration: 120s
+      leaseRenewDeadline: 60s
+      leaseRetryPeriod: 1s
+      {% endif %}
+    loadBalancer:
+      algorithm: maglev
+      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
+    localRedirectPolicy: true
+    operator:
+      replicas: 1
+      rollOutPods: true
+      prometheus:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+      dashboards:
+        enabled: true
+        annotations:
+          grafana_folder: Cilium
+    prometheus:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        trustCRDsExist: true
+    dashboards:
+      enabled: true
+      annotations:
+        grafana_folder: Cilium
+    rollOutCiliumPods: true
+    routingMode: native
+    securityContext:
+      privileged: true
@@ -1,115 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cilium-values
-data:
-  values.yaml: |
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-    bgp:
-      enabled: false
-    cluster:
-      name: home-cluster
-      id: 1
-    containerRuntime:
-      integration: containerd
-      {% if bootstrap_distribution == "k3s" %}
-      socketPath: /var/run/k3s/containerd/containerd.sock
-      {% else %}
-      socketPath: /var/run/k0s/containerd.sock
-      {% endif %}
-    endpointRoutes:
-      enabled: true
-    hubble:
-      enabled: true
-      metrics:
-        enabled:
-          - dns:query
-          - drop
-          - tcp
-          - flow
-          - port-distribution
-          - icmp
-          - http
-        serviceMonitor:
-          enabled: true
-        dashboards:
-          enabled: true
-          annotations:
-            grafana_folder: Cilium
-      relay:
-        enabled: true
-        rollOutPods: true
-        prometheus:
-          serviceMonitor:
-            enabled: true
-      ui:
-        enabled: true
-        rollOutPods: true
-        ingress:
-          enabled: true
-          className: internal
-          {% if homepage.enabled | default(false) %}
-          annotations:
-            gethomepage.dev/enabled: "true"
-            gethomepage.dev/group: Network
-            gethomepage.dev/name: Cilium
-            gethomepage.dev/icon: cilium.png
-          {% endif %}
-          hosts:
-            - "hubble.${SECRET_DOMAIN}"
-          tls:
-            - hosts:
-                - "hubble.${SECRET_DOMAIN}"
-    ipam:
-      mode: kubernetes
-    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-    {% if bootstrap_ipv6_enabled | default(false) %}
-    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
-    ipv6:
-      enabled: true
-    {% endif %}
-    k8sServiceHost: "${KUBEAPI_ADDR}"
-    k8sServicePort: 6443
-    kubeProxyReplacement: true
-    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
-    l2announcements:
-      {% if bootstrap_ipv6_enabled | default(false) %}
-      enabled: false
-      {% else %}
-      enabled: true
-      # https://github.com/cilium/cilium/issues/26586
-      leaseDuration: 120s
-      leaseRenewDeadline: 60s
-      leaseRetryPeriod: 1s
-      {% endif %}
-    loadBalancer:
-      algorithm: maglev
-      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
-    localRedirectPolicy: true
-    operator:
-      replicas: 1
-      rollOutPods: true
-      prometheus:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-      dashboards:
-        enabled: true
-        annotations:
-          grafana_folder: Cilium
-    prometheus:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        trustCRDsExist: true
-    dashboards:
-      enabled: true
-      annotations:
-        grafana_folder: Cilium
-    rollOutCiliumPods: true
-    routingMode: native
-    securityContext:
-      privileged: true
@@ -5,5 +5,4 @@ resources:
  {% if not bootstrap_ipv6_enabled | default(false) %}
  - ./cilium-l2.yaml
  {% endif %}
-  - ./helmvalues.yaml
  - ./helmrelease.yaml
@@ -0,0 +1,90 @@
+{% if bootstrap_distribution == "k3s" %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: coredns
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: coredns
+      version: 1.29.0
+      sourceRef:
+        kind: HelmRepository
+        name: coredns
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    fullnameOverride: coredns
+    replicaCount: 1
+    k8sAppLabelOverride: kube-dns
+    service:
+      name: kube-dns
+      clusterIP: "${COREDNS_ADDR}"
+    serviceAccount:
+      create: true
+    deployment:
+      annotations:
+        reloader.stakater.com/auto: "true"
+    servers:
+      - zones:
+          - zone: .
+            scheme: dns://
+            use_tcp: true
+        port: 53
+        plugins:
+          - name: log
+          - name: errors
+          - name: health
+            configBlock: |-
+              lameduck 5s
+          - name: ready
+          - name: kubernetes
+            parameters: cluster.local in-addr.arpa ip6.arpa
+            configBlock: |-
+              pods insecure
+              fallthrough in-addr.arpa ip6.arpa
+              ttl 30
+          - name: prometheus
+            parameters: 0.0.0.0:9153
+          - name: forward
+            parameters: . /etc/resolv.conf
+          - name: cache
+            parameters: 30
+          - name: loop
+          - name: reload
+          - name: loadbalance
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/control-plane
+                  operator: Exists
+    tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: coredns
+{% endif %}
@@ -0,0 +1,7 @@
+{% if bootstrap_distribution == "k3s" %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,22 @@
+{% if bootstrap_distribution == "k3s" %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app coredns
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/kube-system/coredns/app
+  prune: false # never should be deleted
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,184 @@
+{% if grafana.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: grafana
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: grafana
+      version: 7.0.19
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: openebs
+      namespace: storage
+  values:
+    deploymentStrategy:
+      type: Recreate
+    admin:
+      existingSecret: grafana-admin-secret
+    env:
+      GF_EXPLORE_ENABLED: true
+      GF_SERVER_ROOT_URL: "https://grafana.${SECRET_DOMAIN}"
+    grafana.ini:
+      analytics:
+        check_for_updates: false
+        check_for_plugin_updates: false
+        reporting_enabled: false
+    dashboardProviders:
+      dashboardproviders.yaml:
+        apiVersion: 1
+        providers:
+          - name: default
+            orgId: 1
+            folder: ""
+            type: file
+            disableDeletion: false
+            editable: true
+            options:
+              path: /var/lib/grafana/dashboards/default
+          - name: flux
+            orgId: 1
+            folder: Flux
+            type: file
+            disableDeletion: false
+            editable: true
+            options:
+              path: /var/lib/grafana/dashboards/flux
+          - name: kubernetes
+            orgId: 1
+            folder: Kubernetes
+            type: file
+            disableDeletion: false
+            editable: true
+            options:
+              path: /var/lib/grafana/dashboards/kubernetes
+          - name: nginx
+            orgId: 1
+            folder: Nginx
+            type: file
+            disableDeletion: false
+            editable: true
+            options:
+              path: /var/lib/grafana/dashboards/nginx
+    datasources:
+      datasources.yaml:
+        apiVersion: 1
+        deleteDatasources:
+          - { name: Prometheus, orgId: 1 }
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            uid: prometheus
+            access: proxy
+            url: http://kube-prometheus-stack-prometheus.observability.svc.cluster.local:9090
+            jsonData:
+              prometheusType: Prometheus
+            isDefault: true
+    dashboards:
+      default:
+        cloudflared:
+          gnetId: 17457 # https://grafana.com/grafana/dashboards/17457?tab=revisions
+          revision: 6
+          datasource:
+            - { name: DS_PROMETHEUS, value: Prometheus }
+        external-dns:
+          gnetId: 15038 # https://grafana.com/grafana/dashboards/15038?tab=revisions
+          revision: 1
+          datasource: Prometheus
+        cert-manager:
+          url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
+          datasource: Prometheus
+        node-exporter-full:
+          gnetId: 1860 # https://grafana.com/grafana/dashboards/1860?tab=revisions
+          revision: 31
+          datasource: Prometheus
+      flux:
+        flux-cluster:
+          url: https://raw.githubusercontent.com/fluxcd/flux2-monitoring-example/main/monitoring/configs/dashboards/cluster.json
+          datasource: Prometheus
+        flux-control-plane:
+          url: https://raw.githubusercontent.com/fluxcd/flux2-monitoring-example/main/monitoring/configs/dashboards/control-plane.json
+          datasource: Prometheus
+      kubernetes:
+        kubernetes-api-server:
+          url: https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-system-api-server.json
+          datasource: Prometheus
+        kubernetes-coredns:
+          url: https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-system-coredns.json
+          datasource: Prometheus
+        kubernetes-global:
+          url: https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-views-global.json
+          datasource: Prometheus
+        kubernetes-namespaces:
+          url: https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-views-namespaces.json
+          datasource: Prometheus
+        kubernetes-nodes:
+          url: https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-views-nodes.json
+          datasource: Prometheus
+        kubernetes-pods:
+          url: https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-views-pods.json
+          datasource: Prometheus
+      nginx:
+        nginx:
+          url: https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/grafana/dashboards/nginx.json
+          datasource: Prometheus
+        nginx-request-handling-performance:
+          url: https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/grafana/dashboards/request-handling-performance.json
+          datasource: Prometheus
+    sidecar:
+      dashboards:
+        enabled: true
+        searchNamespace: ALL
+        labelValue: ""
+        label: grafana_dashboard
+        folderAnnotation: grafana_folder
+        provider:
+          disableDelete: true
+          foldersFromFilesStructure: true
+      datasources:
+        enabled: true
+        searchNamespace: ALL
+        labelValue: ""
+    serviceMonitor:
+      enabled: true
+    ingress:
+      enabled: true
+      ingressClassName: internal
+      {% if homepage.enabled | default(false) %}
+      annotations:
+        gethomepage.dev/enabled: "true"
+        gethomepage.dev/icon: grafana.png
+        gethomepage.dev/name: Grafana
+        gethomepage.dev/group: Observability
+        gethomepage.dev/widget.type: grafana
+        gethomepage.dev/widget.url: http://grafana.observability
+        gethomepage.dev/widget.username: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}{% endraw %}"
+        gethomepage.dev/widget.password: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}{% endraw %}"
+      {% endif %}
+      hosts:
+        - &host "grafana.${SECRET_DOMAIN}"
+      tls:
+        - hosts:
+            - *host
+    persistence:
+      enabled: true
+      storageClassName: openebs-hostpath
+    testFramework:
+      enabled: false
+{% endif %}
@@ -0,0 +1,8 @@
+{% if grafana.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,10 @@
+{% if grafana.enabled | default(false) %}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin-secret
+stringData:
+  admin-user: admin
+  admin-password: "{{ grafana.password }}"
+{% endif %}
@@ -0,0 +1,22 @@
+{% if grafana.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app grafana
+  namespace: flux-system
+spec:
+  targetNamespace: observability
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/observability/grafana/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,167 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+spec:
+  interval: 30m
+  timeout: 15m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: 55.8.1
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: openebs
+      namespace: storage
+  values:
+    crds:
+      enabled: true
+    cleanPrometheusOperatorObjectNames: true
+    alertmanager:
+      enabled: false
+    kube-state-metrics:
+      metricLabelsAllowlist:
+        - "deployments=[*]"
+        - "persistentvolumeclaims=[*]"
+        - "pods=[*]"
+      prometheus:
+        monitor:
+          enabled: true
+          relabelings:
+            - action: replace
+              sourceLabels: ["__meta_kubernetes_pod_node_name"]
+              regex: ^(.*)$
+              replacement: $1
+              targetLabel: kubernetes_node
+    kubelet:
+      enabled: true
+      serviceMonitor:
+        metricRelabelings:
+          {% if bootstrap_distribution == 'k3s' %}
+          # Remove duplicate labels provided by k3s
+          - action: keep
+            sourceLabels: ["__name__"]
+            regex: (apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)
+          - action: replace
+            sourceLabels: ["node"]
+            targetLabel: instance
+          {% endif %}
+          # Drop high cardinality labels
+          - action: labeldrop
+            regex: (uid)
+          - action: labeldrop
+            regex: (id|name)
+          - action: drop
+            sourceLabels: ["__name__"]
+            regex: (rest_client_request_duration_seconds_bucket|rest_client_request_duration_seconds_sum|rest_client_request_duration_seconds_count)
+    kubeApiServer:
+      enabled: true
+      serviceMonitor:
+        metricRelabelings:
+          {% if bootstrap_distribution == 'k3s' %}
+          # Remove duplicate labels provided by k3s
+          - action: keep
+            sourceLabels: ["__name__"]
+            regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
+          {% endif %}
+          # Drop high cardinality labels
+          - action: drop
+            sourceLabels: ["__name__"]
+            regex: (apiserver|etcd|rest_client)_request(|_sli|_slo)_duration_seconds_bucket
+          - action: drop
+            sourceLabels: ["__name__"]
+            regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
+    kubeControllerManager:
+      enabled: true
+      endpoints: &endpoints
+      {% for item in bootstrap_nodes.master %}
+        - {{ item.address }}
+      {% endfor %}
+      {% if bootstrap_distribution == 'k3s' %}
+      serviceMonitor:
+        metricRelabelings:
+          # Remove duplicate labels provided by k3s
+          - action: keep
+            sourceLabels: ["__name__"]
+            regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)"
+      {% endif %}
+    kubeEtcd:
+      {% if bootstrap_nodes.master | length > 1 %}
+      enabled: true
+      {% else %}
+      enabled: false
+      {% endif %}
+      endpoints: *endpoints
+    kubeScheduler:
+      enabled: true
+      endpoints: *endpoints
+      {% if bootstrap_distribution == 'k3s' %}
+      serviceMonitor:
+        metricRelabelings:
+          # Remove duplicate labels provided by k3s
+          - action: keep
+            sourceLabels: ["__name__"]
+            regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)"
+      {% endif %}
+    kubeProxy:
+      enabled: false # Disabled due to eBPF
+    prometheus:
+      ingress:
+        enabled: true
+        ingressClassName: internal
+        {% if homepage.enabled | default(false) %}
+        annotations:
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/icon: prometheus.png
+          gethomepage.dev/name: Prometheus
+          gethomepage.dev/group: Observability
+          gethomepage.dev/widget.type: prometheus
+        {% endif %}
+        pathType: Prefix
+        hosts:
+          - "prometheus.${SECRET_DOMAIN}"
+        tls:
+          - hosts:
+              - "prometheus.${SECRET_DOMAIN}"
+      prometheusSpec:
+        ruleSelectorNilUsesHelmValues: false
+        serviceMonitorSelectorNilUsesHelmValues: false
+        podMonitorSelectorNilUsesHelmValues: false
+        probeSelectorNilUsesHelmValues: false
+        scrapeConfigSelectorNilUsesHelmValues: false
+        enableAdminAPI: true
+        walCompression: true
+        retentionSize: 8GB
+        storageSpec:
+          volumeClaimTemplate:
+            spec:
+              storageClassName: openebs-hostpath
+              resources:
+                requests:
+                  storage: 10Gi
+    grafana:
+      enabled: false
+      forceDeployDashboards: true
+      sidecar:
+        dashboards:
+          multicluster:
+            etcd:
+              enabled: true
+{% endif %}
@@ -0,0 +1,7 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,22 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app kube-prometheus-stack
+  namespace: flux-system
+spec:
+  targetNamespace: observability
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/observability/kube-prometheus-stack/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,49 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: kubernetes-dashboard
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: kubernetes-dashboard
+      version: 6.0.8
+      sourceRef:
+        kind: HelmRepository
+        name: kubernetes-dashboard
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    extraArgs:
+      - --enable-insecure-login
+      - --enable-skip-login
+      - --disable-settings-authorizer
+    ingress:
+      enabled: true
+      className: internal
+      {% if homepage.enabled | default(false) %}
+      annotations:
+        gethomepage.dev/enabled: "true"
+        gethomepage.dev/icon: kubernetes-dashboard.png
+        gethomepage.dev/name: Kubernetes Dashboard
+        gethomepage.dev/group: Observability
+      {% endif %}
+      hosts:
+        - &host "kubernetes.${SECRET_DOMAIN}"
+      tls:
+        - hosts:
+            - *host
+    metricsScraper:
+      enabled: true
+{% endif %}
@@ -0,0 +1,8 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./rbac.yaml
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,41 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
+# For dashboard sign in token:
+# kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubernetes-dashboard
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    meta.helm.sh/release-name: kubernetes-dashboard
+    meta.helm.sh/release-namespace: observability
+secrets:
+  - name: kubernetes-dashboard
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: kubernetes-dashboard
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    meta.helm.sh/release-name: kubernetes-dashboard
+    meta.helm.sh/release-namespace: observability
+    kubernetes.io/service-account.name: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: observability
+{% endif %}
@@ -0,0 +1,25 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app kubernetes-dashboard
+  namespace: flux-system
+spec:
+  targetNamespace: observability
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+    - name: metrics-server
+  path: ./kubernetes/apps/observability/kubernetes-dashboard/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,30 @@
+{% if csi_driver_nfs.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: csi-driver-nfs
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: csi-driver-nfs
+      version: v4.5.0
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-nfs
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    externalSnapshotter:
+      enabled: false
+{% endif %}
@@ -0,0 +1,8 @@
+{% if csi_driver_nfs.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./storageclass.yaml
+{% endif %}
@@ -0,0 +1,16 @@
+{% if csi_driver_nfs.enabled | default(false) %}
+{% for item in csi_driver_nfs.storage_class %}
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: {{ item.name }}
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: {{ item.server }}
+  share: {{ item.share }}
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+mountOptions: ["hard", "noatime"]
+{% endfor %}
+{% endif %}
@@ -0,0 +1,22 @@
+{% if csi_driver_nfs.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app csi-driver-nfs
+  namespace: flux-system
+spec:
+  targetNamespace: storage
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/storage/csi-driver-nfs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -4,7 +4,7 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./openebs/ks.yaml
-    {% if volsync.enabled | default(false) %}
+  {% if volsync.enabled | default(false) %}
  - ./volsync/ks.yaml
  {% endif %}
  {% if csi_driver_nfs.enabled | default(false) %}
@@ -0,0 +1,44 @@
+{% if volsync.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: volsync
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: volsync
+      version: 0.8.0
+      sourceRef:
+        kind: HelmRepository
+        name: backube
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: snapshot-controller
+      namespace: storage
+  values:
+    manageCRDs: true
+    image:
+      # https://github.com/backube/volsync/issues/828
+      repository: &image ghcr.io/onedr0p/volsync
+      tag: &tag 0.8.0
+    rclone:
+      repository: *image
+      tag: *tag
+    restic:
+      repository: *image
+      tag: *tag
+    metrics:
+      disableAuth: true
+{% endif %}
@@ -0,0 +1,8 @@
+{% if volsync.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./prometheusrule.yaml
+{% endif %}
@@ -0,0 +1,25 @@
+{% if volsync.enabled | default(false) %}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: volsync
+spec:
+  groups:
+    - name: volsync.rules
+      rules:
+        - alert: VolSyncComponentAbsent
+          annotations:
+            summary: VolSync component has disappeared from Prometheus target discovery.
+          expr: absent(up{job="volsync-metrics"})
+          for: 15m
+          labels:
+            severity: critical
+        - alert: VolSyncVolumeOutOfSync
+          annotations:
+            summary: "{% raw %}{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync.{% endraw %}"
+          expr: volsync_volume_out_of_sync == 1
+          for: 15m
+          labels:
+            severity: critical
+{% endif %}
@@ -0,0 +1,42 @@
+{% if volsync.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app snapshot-controller
+  namespace: flux-system
+spec:
+  targetNamespace: storage
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/storage/volsync/snapshot-controller
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app volsync
+  namespace: flux-system
+spec:
+  targetNamespace: storage
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/storage/volsync/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,35 @@
+{% if volsync.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: snapshot-controller
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: snapshot-controller
+      version: 2.0.4
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controller:
+      serviceMonitor:
+        create: true
+    webhook:
+      enabled: false
+{% endif %}
@@ -0,0 +1,7 @@
+{% if volsync.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+{% endif %}
@@ -0,0 +1,106 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: &app system-upgrade-controller
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 2.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controllers:
+      main:
+        strategy: RollingUpdate
+        containers:
+          main:
+            image:
+              repository: docker.io/rancher/system-upgrade-controller
+              tag: v0.13.2
+            env:
+              SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
+              SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
+              SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
+              SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
+              SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
+              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: docker.io/rancher/kubectl:v1.29.0
+              SYSTEM_UPGRADE_JOB_PRIVILEGED: true
+              SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
+              SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
+              SYSTEM_UPGRADE_CONTROLLER_NAME: *app
+              SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
+                valueFrom:
+                  fieldRef:
+                    fieldPath: metadata.namespace
+        pod:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop: ["ALL"]
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: node-role.kubernetes.io/control-plane
+                        operator: Exists
+          tolerations:
+            - {key: CriticalAddonsOnly, operator: Exists}
+            - {key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute}
+    serviceAccount:
+      create: true
+      name: system-upgrade
+    service:
+      main:
+        enabled: false
+    persistence:
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      etc-ssl:
+        type: hostPath
+        hostPath: /etc/ssl
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - path: /etc/ssl
+            readOnly: true
+      etc-pki:
+        type: hostPath
+        hostPath: /etc/pki
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - path: /etc/pki
+            readOnly: true
+      etc-ca-certificates:
+        type: hostPath
+        hostPath: /etc/ca-certificates
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - path: /etc/ca-certificates
+            readOnly: true
+{% endif %}
@@ -0,0 +1,10 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # renovate: datasource=github-releases depName=rancher/system-upgrade-controller
+  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml
+  - helmrelease.yaml
+  - rbac.yaml
+{% endif %}
@@ -0,0 +1,15 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system-upgrade
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: system-upgrade
+    namespace: tools
+{% endif %}
@@ -0,0 +1,44 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app system-upgrade-controller
+  namespace: flux-system
+spec:
+  targetNamespace: tools
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/tools/system-upgrade-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app system-upgrade-controller-plans
+  namespace: flux-system
+spec:
+  targetNamespace: tools
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: system-upgrade-controller
+  path: ./kubernetes/apps/tools/system-upgrade-controller/plans
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+{% endif %}
@@ -0,0 +1,20 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: agent
+spec:
+  # renovate: datasource=github-releases depName=k3s-io/k3s
+  version: "v1.29.0+k3s1"
+  serviceAccountName: system-upgrade
+  concurrency: 1
+  nodeSelector:
+    matchExpressions:
+      - {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist}
+  prepare:
+    image: rancher/k3s-upgrade
+    args: ["prepare", "server"]
+  upgrade:
+    image: rancher/k3s-upgrade
+{% endif %}
@@ -0,0 +1,8 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./server.yaml
+  - ./agent.yaml
+{% endif %}
@@ -0,0 +1,25 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+---
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: server
+spec:
+  # renovate: datasource=github-releases depName=k3s-io/k3s
+  version: "v1.29.0+k3s1"
+  serviceAccountName: system-upgrade
+  concurrency: 1
+  cordon: true
+  nodeSelector:
+    matchExpressions:
+      - {key: node-role.kubernetes.io/control-plane, operator: Exists}
+  tolerations:
+    - {effect: NoSchedule, operator: Exists}
+    - {effect: NoExecute, operator: Exists}
+    - {key: node-role.kubernetes.io/control-plane, effect: NoSchedule, operator: Exists}
+    - {key: node-role.kubernetes.io/master, effect: NoSchedule, operator: Exists}
+    - {key: node-role.kubernetes.io/etcd, effect: NoExecute, operator: Exists}
+    - {key: CriticalAddonsOnly, operator: Exists}
+  upgrade:
+    image: rancher/k3s-upgrade
+{% endif %}