Compare commits
17
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 claude-bot
|
dd954ce23a | ||
 k.renner
|
38c186d424 | ||
 security-bot
|
d659097b8f | ||
|
security-bot
|
4baf5aa8be | ||
 claude-botandClaude Opus 5.5
|
fafc73cb3f | ||
|
k.renner
|
ab876a1231 | ||
|
claude-botandClaude Opus 5.5
|
790e258894 | ||
|
security-bot
|
d8d676b711 | ||
|
security-bot
|
3f43d5fa17 | ||
|
security-bot
|
142a21883d | ||
|
k.renner
|
dc3a299cf6 | ||
|
k.renner
|
b73e1b5636 | ||
|
k.renner
|
c8d2d073a5 | ||
|
k.renner
|
7b1041c188 | ||
 renovate-bot
|
94090c68c3 | ||
|
renovate-bot
|
b555277634 | ||
|
renovate-bot
|
d7d99365e8 |
@@ -974,6 +974,71 @@ data:
|
||||
negate: false
|
||||
failure_result: false
|
||||
|
||||
# Hermes Agent dashboard (apps/hermes): its self-hosted OIDC login,
|
||||
# also brokered for Hermes Desktop's native sign-in. Public client +
|
||||
# PKCE (Hermes does not support confidential clients); RS256 so the
|
||||
# dashboard can verify the ID token against the JWKS.
|
||||
- id: hermes-users-group
|
||||
model: authentik_core.group
|
||||
identifiers:
|
||||
name: Hermes Users
|
||||
state: present
|
||||
attrs:
|
||||
is_superuser: false
|
||||
# Members get the agent, which holds a read-only kubeconfig and
|
||||
# the model login. Add/remove members HERE.
|
||||
users:
|
||||
- !Find [authentik_core.user, [username, k.renner]]
|
||||
|
||||
- id: hermes-provider
|
||||
model: authentik_providers_oauth2.oauth2provider
|
||||
identifiers:
|
||||
name: Hermes Dashboard
|
||||
state: present
|
||||
attrs:
|
||||
authentication_flow: null
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_type: public
|
||||
client_id: hermes-dashboard
|
||||
# See the Matrix (MAS) provider: a blueprint-made provider starts
|
||||
# with no grant types.
|
||||
grant_types:
|
||||
- authorization_code
|
||||
- refresh_token
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
||||
redirect_uris:
|
||||
- url: https://hermes.renner.uno/auth/callback
|
||||
matching_mode: strict
|
||||
|
||||
# The slug is the issuer path: https://auth.renner.uno/application/o/hermes/
|
||||
- model: authentik_core.application
|
||||
identifiers:
|
||||
slug: hermes
|
||||
state: present
|
||||
attrs:
|
||||
name: Hermes
|
||||
slug: hermes
|
||||
provider: !KeyOf hermes-provider
|
||||
meta_launch_url: https://hermes.renner.uno
|
||||
meta_description: "Hermes Agent dashboard"
|
||||
|
||||
# Only the Hermes Users group passes.
|
||||
- model: authentik_policies.policybinding
|
||||
identifiers:
|
||||
target: !Find [authentik_core.application, [slug, hermes]]
|
||||
group: !KeyOf hermes-users-group
|
||||
order: 0
|
||||
state: present
|
||||
attrs:
|
||||
enabled: true
|
||||
negate: false
|
||||
failure_result: false
|
||||
|
||||
# OpenProject, decommissioned. Application first: Application.provider
|
||||
# is on_delete=PROTECT. Its policy binding cascades with it.
|
||||
- model: authentik_core.application
|
||||
|
||||
@@ -114,7 +114,7 @@ spec:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: controller
|
||||
image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-15-0857 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
|
||||
image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-19-0544 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# Bearer key for the OpenAI-compatible API server (hermes-api.renner.uno).
|
||||
# Generated once in-cluster, nothing in OpenBao. Read it with
|
||||
# kubectl -n hermes get secret hermes-api-key -o jsonpath='{.data.API_SERVER_KEY}' | base64 -d
|
||||
apiVersion: generators.external-secrets.io/v1alpha1
|
||||
kind: Password
|
||||
metadata:
|
||||
name: hermes-api-key
|
||||
namespace: hermes
|
||||
spec:
|
||||
length: 64
|
||||
digits: 16
|
||||
symbols: 0
|
||||
allowRepeat: true
|
||||
noUpper: false
|
||||
secretKeys:
|
||||
- API_SERVER_KEY
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: hermes-api-key
|
||||
namespace: hermes
|
||||
spec:
|
||||
refreshPolicy: CreatedOnce
|
||||
target:
|
||||
name: hermes-api-key
|
||||
dataFrom:
|
||||
- sourceRef:
|
||||
generatorRef:
|
||||
apiVersion: generators.external-secrets.io/v1alpha1
|
||||
kind: Password
|
||||
name: hermes-api-key
|
||||
@@ -0,0 +1,170 @@
|
||||
# All Hermes state: config.yaml, .env (keys entered in the dashboard), auth.json
|
||||
# (the Anthropic OAuth login), sessions, memories, skills, cron. Mounted at
|
||||
# /opt/data, the image's HERMES_HOME.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: hermes-data
|
||||
namespace: hermes
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: ceph-block
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
# Hermes Agent: the gateway (messaging platforms, cron, API server on 8642) and
|
||||
# the dashboard (9119, also the Hermes Desktop remote-gateway backend), both
|
||||
# supervised by the image's s6-overlay. s6 must be PID 1 and starts as root,
|
||||
# remapping and dropping to the `hermes` user (10000).
|
||||
#
|
||||
# One replica, Recreate: two gateways must never share one data directory.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: hermes
|
||||
labels:
|
||||
app.kubernetes.io/name: hermes
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hermes
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hermes
|
||||
spec:
|
||||
serviceAccountName: hermes
|
||||
securityContext:
|
||||
fsGroup: 10000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
# The dashboard trusts X-Forwarded-* only from listed peers; Traefik
|
||||
# connects from the pod network. No env equivalent exists, so it is
|
||||
# set in config.yaml on every start (idempotent).
|
||||
- name: config
|
||||
image: nousresearch/hermes-agent:v0.22.2 # {"$imagepolicy": "flux-system:hermes"}
|
||||
command:
|
||||
- /opt/hermes/.venv/bin/hermes
|
||||
- config
|
||||
- set
|
||||
- dashboard.trusted_proxies
|
||||
- '["10.244.0.0/16","fd10:244::/48"]'
|
||||
env:
|
||||
- name: HERMES_HOME
|
||||
value: /opt/data
|
||||
- name: HOME
|
||||
value: /opt/data
|
||||
securityContext:
|
||||
runAsUser: 10000
|
||||
runAsGroup: 10000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /opt/data
|
||||
# kubectl for the agent. /opt/data/.local/bin is on the image's PATH;
|
||||
# an emptyDir there keeps the binary out of the PVC and current with
|
||||
# this pin.
|
||||
- name: kubectl
|
||||
image: docker.io/alpine/kubectl:1.37.1@sha256:b568e8beb6a79aee269c142343078a278b85e7710f1c0e7d8d6b21d1eb566a48
|
||||
command: ["cp", "/usr/local/bin/kubectl", "/tools/kubectl"]
|
||||
securityContext:
|
||||
runAsUser: 10000
|
||||
runAsGroup: 10000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
volumeMounts:
|
||||
- name: tools
|
||||
mountPath: /tools
|
||||
containers:
|
||||
- name: hermes
|
||||
image: nousresearch/hermes-agent:v0.22.2 # {"$imagepolicy": "flux-system:hermes"}
|
||||
args: ["gateway", "run"]
|
||||
env:
|
||||
- name: HERMES_DASHBOARD
|
||||
value: "1"
|
||||
- name: HERMES_DASHBOARD_PUBLIC_URL
|
||||
value: https://hermes.renner.uno
|
||||
# Dashboard login: Authentik OIDC, public PKCE client (blueprint
|
||||
# in apps/authentik/blueprints-configmap.yaml, group Hermes Users).
|
||||
- name: HERMES_DASHBOARD_OIDC_ISSUER
|
||||
value: https://auth.renner.uno/application/o/hermes/
|
||||
- name: HERMES_DASHBOARD_OIDC_CLIENT_ID
|
||||
value: hermes-dashboard
|
||||
- name: API_SERVER_ENABLED
|
||||
value: "true"
|
||||
- name: API_SERVER_HOST
|
||||
value: 0.0.0.0
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: hermes-api-key
|
||||
ports:
|
||||
- name: dashboard
|
||||
containerPort: 9119
|
||||
- name: api
|
||||
containerPort: 8642
|
||||
# The dashboard is the user-facing surface; /api/status is public.
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: dashboard
|
||||
periodSeconds: 10
|
||||
failureThreshold: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: dashboard
|
||||
periodSeconds: 15
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: dashboard
|
||||
periodSeconds: 60
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /opt/data
|
||||
- name: tools
|
||||
mountPath: /opt/data/.local/bin
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: hermes-data
|
||||
- name: tools
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: hermes
|
||||
labels:
|
||||
app.kubernetes.io/name: hermes
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: hermes
|
||||
ports:
|
||||
- name: dashboard
|
||||
port: 9119
|
||||
targetPort: dashboard
|
||||
- name: api
|
||||
port: 8642
|
||||
targetPort: api
|
||||
@@ -0,0 +1,59 @@
|
||||
# Both hosts are LAN-only (no dns.renner.uno/public or netbird.renner.uno/public
|
||||
# label).
|
||||
#
|
||||
# hermes.renner.uno — dashboard and Hermes Desktop remote gateway. Plain
|
||||
# Traefik, not the authentik-gate class: Hermes Desktop calls the API with a
|
||||
# Bearer token from its native (PKCE) sign-in, which a forward-auth gate would
|
||||
# redirect. Authentik still guards it: the dashboard's own OIDC login against
|
||||
# the `hermes` application, restricted to the Hermes Users group.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: hermes
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- hermes.renner.uno
|
||||
secretName: hermes-tls
|
||||
rules:
|
||||
- host: hermes.renner.uno
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: hermes
|
||||
port:
|
||||
number: 9119
|
||||
---
|
||||
# hermes-api.renner.uno — the OpenAI-compatible API server. Hermes checks
|
||||
# `Authorization: Bearer <API_SERVER_KEY>` itself (secret hermes-api-key).
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: hermes-api
|
||||
namespace: hermes
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- hermes-api.renner.uno
|
||||
secretName: hermes-api-tls
|
||||
rules:
|
||||
- host: hermes-api.renner.uno
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: hermes
|
||||
port:
|
||||
number: 8642
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- rbac.yaml
|
||||
- api-key.yaml
|
||||
- hermes.yaml
|
||||
- ingress.yaml
|
||||
@@ -0,0 +1,22 @@
|
||||
# Read-only cluster access for the agent's kubectl, as for claude-workstation:
|
||||
# the built-in `view` ClusterRole, which excludes Secrets. The token is the
|
||||
# pod's projected ServiceAccount token; kubectl picks it up as in-cluster
|
||||
# config.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: hermes
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: hermes-view
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: view
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: hermes
|
||||
namespace: hermes
|
||||
@@ -61,7 +61,7 @@ spec:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: shelly-manager
|
||||
image: gitea.renner.uno/k.renner/shelly-manager:build.1791777553 # {"$imagepolicy": "flux-system:shelly-manager"}
|
||||
image: gitea.renner.uno/k.renner/shelly-manager:build.1792387459 # {"$imagepolicy": "flux-system:shelly-manager"}
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
|
||||
@@ -159,7 +159,7 @@ spec:
|
||||
# substitution to POD_IP so nginx-runtime variables like $host
|
||||
# / $http_x_forwarded_for in the template stay intact.
|
||||
- name: proxy
|
||||
image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b9241c6e7b8e9a862f129d8d4199ab64b10390949a78bdd5603379b32c844083
|
||||
image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00
|
||||
env:
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
@@ -203,7 +203,7 @@ spec:
|
||||
# readiness probe on purpose: a broker outage must not take HA out of
|
||||
# its Service endpoints.
|
||||
- name: mqtt-tls
|
||||
image: ghostunnel/ghostunnel:v1.11.3@sha256:2599b8a04bae16d70a4209495618dea61b46a00a9a05fcf74da282688ad3517f
|
||||
image: ghostunnel/ghostunnel:v1.11.4@sha256:e5248233863aadd36383a11c92360f2981141881ef05e38360a6ada8630d36b1
|
||||
args:
|
||||
- client
|
||||
- --listen=127.0.0.1:11883
|
||||
@@ -304,7 +304,7 @@ spec:
|
||||
# dedicated long-lived token.
|
||||
# Runs as root to match HA's root-owned /config files. See config-sync.sh.
|
||||
- name: config-sync
|
||||
image: alpine/git:2.54.0@sha256:ce84fd6a057b4dc5cf5009da2dd832f1c6d096c1984bf50496cf3c256402264d
|
||||
image: alpine/git:2.54.0@sha256:03228d7ded483b0b3e55e1de7fa660d70d3e1bb432fa7021d29e192640de11aa
|
||||
command: ["/bin/sh", "/scripts/sync.sh"]
|
||||
env:
|
||||
- name: SYNC_BRANCH
|
||||
|
||||
@@ -0,0 +1,296 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.23.0
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
name: kumamonitors.uptime.renner.uno
|
||||
spec:
|
||||
group: uptime.renner.uno
|
||||
names:
|
||||
kind: KumaMonitor
|
||||
listKind: KumaMonitorList
|
||||
plural: kumamonitors
|
||||
singular: kumamonitor
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.type
|
||||
name: Type
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
||||
name: Ready
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
description:
|
||||
type: string
|
||||
displayName:
|
||||
minLength: 1
|
||||
type: string
|
||||
dns:
|
||||
properties:
|
||||
hostname:
|
||||
minLength: 1
|
||||
type: string
|
||||
port:
|
||||
default: 53
|
||||
format: int32
|
||||
maximum: 65535
|
||||
minimum: 1
|
||||
type: integer
|
||||
resolveServer:
|
||||
default: 1.1.1.1
|
||||
type: string
|
||||
resolveType:
|
||||
enum:
|
||||
- A
|
||||
- AAAA
|
||||
- CNAME
|
||||
- MX
|
||||
- NS
|
||||
- PTR
|
||||
- SOA
|
||||
- SRV
|
||||
- TXT
|
||||
- CAA
|
||||
type: string
|
||||
required:
|
||||
- hostname
|
||||
- resolveType
|
||||
type: object
|
||||
http:
|
||||
description: HTTPSpec configures http, keyword and json-query monitors.
|
||||
properties:
|
||||
acceptedStatusCodes:
|
||||
default:
|
||||
- 200-299
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
body:
|
||||
type: string
|
||||
expiryNotification:
|
||||
type: boolean
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
ignoreTLS:
|
||||
type: boolean
|
||||
maxRedirects:
|
||||
format: int32
|
||||
type: integer
|
||||
method:
|
||||
default: GET
|
||||
type: string
|
||||
url:
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
interval:
|
||||
default: 60
|
||||
description: Seconds.
|
||||
format: int32
|
||||
minimum: 20
|
||||
type: integer
|
||||
jsonQuery:
|
||||
properties:
|
||||
expected:
|
||||
type: string
|
||||
expression:
|
||||
description: JSONata expression.
|
||||
minLength: 1
|
||||
type: string
|
||||
operator:
|
||||
enum:
|
||||
- ==
|
||||
- '!='
|
||||
- <
|
||||
- <=
|
||||
- '>'
|
||||
- '>='
|
||||
- contains
|
||||
type: string
|
||||
required:
|
||||
- expected
|
||||
- expression
|
||||
- operator
|
||||
type: object
|
||||
keyword:
|
||||
properties:
|
||||
invert:
|
||||
type: boolean
|
||||
keyword:
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- keyword
|
||||
type: object
|
||||
maxRetries:
|
||||
default: 0
|
||||
format: int32
|
||||
minimum: 0
|
||||
type: integer
|
||||
parentRef:
|
||||
description: LocalRef references a KumaMonitor in the same namespace.
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
paused:
|
||||
type: boolean
|
||||
port:
|
||||
properties:
|
||||
hostname:
|
||||
minLength: 1
|
||||
type: string
|
||||
port:
|
||||
format: int32
|
||||
maximum: 65535
|
||||
minimum: 1
|
||||
type: integer
|
||||
required:
|
||||
- hostname
|
||||
- port
|
||||
type: object
|
||||
retryInterval:
|
||||
default: 60
|
||||
description: Seconds.
|
||||
format: int32
|
||||
minimum: 20
|
||||
type: integer
|
||||
timeout:
|
||||
description: Seconds.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
type:
|
||||
enum:
|
||||
- group
|
||||
- http
|
||||
- keyword
|
||||
- json-query
|
||||
- dns
|
||||
- port
|
||||
type: string
|
||||
required:
|
||||
- displayName
|
||||
- type
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: http is required for types http, keyword and json-query, and
|
||||
forbidden otherwise
|
||||
rule: (self.type in ['http','keyword','json-query']) == has(self.http)
|
||||
- message: keyword is required for type keyword and forbidden otherwise
|
||||
rule: (self.type == 'keyword') == has(self.keyword)
|
||||
- message: jsonQuery is required for type json-query and forbidden otherwise
|
||||
rule: (self.type == 'json-query') == has(self.jsonQuery)
|
||||
- message: dns is required for type dns and forbidden otherwise
|
||||
rule: (self.type == 'dns') == has(self.dns)
|
||||
- message: port is required for type port and forbidden otherwise
|
||||
rule: (self.type == 'port') == has(self.port)
|
||||
- message: type group takes no type blocks
|
||||
rule: self.type != 'group' || !(has(self.http) || has(self.keyword)
|
||||
|| has(self.jsonQuery) || has(self.dns) || has(self.port))
|
||||
status:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
monitorID:
|
||||
format: int64
|
||||
type: integer
|
||||
observedGeneration:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,72 @@
|
||||
---
|
||||
# kuma-sync: KumaMonitor -> Uptime Kuma monitors on kuma.renner.uno (ci/images/kuma-sync).
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
namespace: kuma-sync
|
||||
labels:
|
||||
app.kubernetes.io/name: kuma-sync
|
||||
annotations:
|
||||
secret.reloader.stakater.com/reload: kuma-sync-kuma
|
||||
spec:
|
||||
replicas: 1
|
||||
# One writer against Kuma at a time; the controller runs without leader election.
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kuma-sync
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kuma-sync
|
||||
spec:
|
||||
serviceAccountName: kuma-sync
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: controller
|
||||
image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0545 # {"$imagepolicy": "flux-system:kuma-sync"}
|
||||
env:
|
||||
- name: KUMA_URL
|
||||
value: https://kuma.renner.uno
|
||||
- name: KUMA_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: kuma-sync-kuma
|
||||
key: username
|
||||
- name: KUMA_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: kuma-sync-kuma
|
||||
key: password
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 8080
|
||||
- name: probes
|
||||
containerPort: 8081
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: probes
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: probes
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
terminationGracePeriodSeconds: 30
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
# Uptime Kuma login for kuma-sync; OpenBao homelab/infrastructure/kuma-sync.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: kuma-sync-kuma
|
||||
namespace: kuma-sync
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: openbao
|
||||
target:
|
||||
name: kuma-sync-kuma
|
||||
data:
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
key: infrastructure/kuma-sync
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: infrastructure/kuma-sync
|
||||
property: password
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- crd-kumamonitors.yaml
|
||||
- externalsecret.yaml
|
||||
- rbac.yaml
|
||||
- deployment.yaml
|
||||
- smoke-kumamonitor.yaml
|
||||
@@ -0,0 +1,43 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
namespace: kuma-sync
|
||||
labels:
|
||||
app.kubernetes.io/name: kuma-sync
|
||||
---
|
||||
# Cluster-wide: KumaMonitor objects live in every app namespace.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
rules:
|
||||
- apiGroups: ["uptime.renner.uno"]
|
||||
resources: ["kumamonitors"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["uptime.renner.uno"]
|
||||
resources: ["kumamonitors/status"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: ["uptime.renner.uno"]
|
||||
resources: ["kumamonitors/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kuma-sync
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kuma-sync
|
||||
namespace: kuma-sync
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: uptime.renner.uno/v1alpha1
|
||||
kind: KumaMonitor
|
||||
metadata:
|
||||
name: www-renner-uno
|
||||
namespace: kuma-sync
|
||||
spec:
|
||||
type: keyword
|
||||
displayName: www.renner.uno
|
||||
http:
|
||||
url: https://www.renner.uno/
|
||||
expiryNotification: true
|
||||
keyword:
|
||||
keyword: Familie Renner
|
||||
@@ -32,7 +32,7 @@ spec:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: review-bot
|
||||
image: gitea.renner.uno/gitea_admin/review-bot:2026-10-18-0706 # {"$imagepolicy": "flux-system:review-bot"}
|
||||
image: gitea.renner.uno/gitea_admin/review-bot:2026-10-19-0540 # {"$imagepolicy": "flux-system:review-bot"}
|
||||
env:
|
||||
- name: REPOS
|
||||
value: k.renner/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m
|
||||
retryInterval: 2m
|
||||
timeout: 5m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
path: ./kubernetes/apps/hermes
|
||||
prune: true
|
||||
wait: true
|
||||
dependsOn:
|
||||
- name: infrastructure
|
||||
- name: infrastructure-crds
|
||||
@@ -0,0 +1,25 @@
|
||||
# kuma-sync controller: KumaMonitor -> Uptime Kuma monitors. Ships no KumaMonitor objects.
|
||||
# healthCheckExprs: Flux has no status reader for ExternalSecret; fail only on the non-retrying reasons.
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m
|
||||
retryInterval: 2m
|
||||
timeout: 5m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
path: ./kubernetes/apps/kuma-sync
|
||||
prune: true
|
||||
wait: true
|
||||
healthCheckExprs:
|
||||
- apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
failed: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'False' && (c.reason == 'SecretOwnedByOther' || c.reason == 'SecretImmutable'))"
|
||||
current: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'True')"
|
||||
dependsOn:
|
||||
- name: infrastructure
|
||||
- name: infrastructure-crds
|
||||
@@ -44,6 +44,7 @@ existing `flux-system` GitRepository whose Secret was created by
|
||||
| netbird-ingress | `0.x` | `-rootless` suffix filter; pre-1.0, bounded to the `0.x` major |
|
||||
| wyoming-{whisper,openwakeword,speech-to-phrase} | `3.x` / `2.x` / `1.x` | |
|
||||
| authentik-gate-sync | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml); newest tag wins |
|
||||
| kuma-sync | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml); newest tag wins |
|
||||
| gatus | `5.x` | v-prefix filter |
|
||||
| velero-plugin-for-aws | `1.13.x` | Tight: must match velero server major.minor |
|
||||
| gotenberg | `8.x` | Plain-variant filter (rejects `-libreoffice`/`-chromium`/`-cloudrun`/`-aws-lambda`) |
|
||||
|
||||
@@ -4,7 +4,7 @@ metadata:
|
||||
name: gitea-mcp
|
||||
namespace: flux-system
|
||||
spec:
|
||||
image: docker.gitea.com/gitea-mcp-server
|
||||
image: docker.gitea.com/gitea-mcp-server@sha256:20701c3dcf3b71df384417d04f9f6382205b7f362380b258fb8e4dcf9599091f
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImageRepository
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: flux-system
|
||||
spec:
|
||||
image: nousresearch/hermes-agent
|
||||
interval: 1h
|
||||
---
|
||||
# v-prefix tags (v0.22.2). The filter skips rc.*, -desktop and per-arch tags.
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImagePolicy
|
||||
metadata:
|
||||
name: hermes
|
||||
namespace: flux-system
|
||||
spec:
|
||||
imageRepositoryRef:
|
||||
name: hermes
|
||||
filterTags:
|
||||
pattern: '^v(?P<ver>\d+\.\d+\.\d+)$'
|
||||
extract: '$ver'
|
||||
policy:
|
||||
semver:
|
||||
range: ">=0.22.2"
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImageRepository
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
image: gitea.renner.uno/gitea_admin/kuma-sync
|
||||
interval: 30m
|
||||
---
|
||||
# build-ci-images.yml tags each build YYYY-MM-DD-HHMM; newest wins.
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImagePolicy
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
imageRepositoryRef:
|
||||
name: kuma-sync
|
||||
filterTags:
|
||||
pattern: '^\d{4}-\d{2}-\d{2}-\d{4}$'
|
||||
policy:
|
||||
alphabetical:
|
||||
order: asc
|
||||
@@ -10,8 +10,10 @@ resources:
|
||||
- gatus.yaml
|
||||
- gitea-mcp.yaml
|
||||
- gotenberg.yaml
|
||||
- hermes.yaml
|
||||
- home-assistant.yaml
|
||||
- immich.yaml
|
||||
- kuma-sync.yaml
|
||||
- lidarr.yaml
|
||||
- matter-server.yaml
|
||||
- mmwave-configurator.yaml
|
||||
|
||||
@@ -288,3 +288,18 @@ apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: renovate
|
||||
---
|
||||
# kuma-sync controller; declared here because it has a CiliumNetworkPolicy applied by infrastructure-crds.
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kuma-sync
|
||||
---
|
||||
# Hermes Agent (kubernetes/apps/hermes). Declared here so it exists before
|
||||
# infrastructure-crds applies its CNPs. No pod-security labels: the image's
|
||||
# s6-overlay init starts as root and drops to the `hermes` user, which the
|
||||
# cluster's default `baseline` enforcement allows.
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: hermes
|
||||
|
||||
@@ -0,0 +1,137 @@
|
||||
---
|
||||
# Baseline policy for the `hermes` namespace (Hermes Agent, apps/hermes).
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
namespace: hermes
|
||||
spec:
|
||||
endpointSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": hermes
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": monitoring
|
||||
- fromEntities:
|
||||
- host
|
||||
- remote-node
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.kubernetes.pod.namespace
|
||||
operator: Exists
|
||||
icmps:
|
||||
- fields:
|
||||
- { type: 0, family: IPv4 }
|
||||
- { type: 3, family: IPv4 }
|
||||
- { type: 8, family: IPv4 }
|
||||
- { type: 11, family: IPv4 }
|
||||
- { type: 12, family: IPv4 }
|
||||
- { type: 1, family: IPv6 }
|
||||
- { type: 2, family: IPv6 }
|
||||
- { type: 3, family: IPv6 }
|
||||
- { type: 4, family: IPv6 }
|
||||
- { type: 128, family: IPv6 }
|
||||
- { type: 129, family: IPv6 }
|
||||
- { type: 133, family: IPv6 }
|
||||
- { type: 134, family: IPv6 }
|
||||
- { type: 135, family: IPv6 }
|
||||
- { type: 136, family: IPv6 }
|
||||
- { type: 143, family: IPv6 }
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": hermes
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- port: "53"
|
||||
protocol: TCP
|
||||
# Every LAN hostname (gitea, home, auth for the dashboard's OIDC
|
||||
# discovery, matrix) via Traefik.
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": ingress
|
||||
app.kubernetes.io/name: traefik
|
||||
---
|
||||
# The agent itself: model APIs (api.anthropic.com), web tools, messaging
|
||||
# platforms, read-only kubectl, and the monitoring read APIs. The matching
|
||||
# ingress grant on the monitoring side is monitoring-ns.yaml
|
||||
# (monitoring-allow-hermes).
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: hermes-egress
|
||||
namespace: hermes
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hermes
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
- port: "80"
|
||||
protocol: TCP
|
||||
# `kube-apiserver` is its own entity in Cilium; port is the post-DNAT 6443.
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": monitoring
|
||||
app.kubernetes.io/name: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9090"
|
||||
protocol: TCP
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": monitoring
|
||||
app.kubernetes.io/name: alertmanager
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9093"
|
||||
protocol: TCP
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": monitoring
|
||||
app.kubernetes.io/name: loki
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "3100"
|
||||
protocol: TCP
|
||||
---
|
||||
# Traefik serves the dashboard (9119) and the OpenAI-compatible API (8642).
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: hermes-allow-traefik
|
||||
namespace: hermes
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hermes
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": ingress
|
||||
app.kubernetes.io/name: traefik
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9119"
|
||||
protocol: TCP
|
||||
- port: "8642"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,38 @@
|
||||
# Baseline policy for the `kuma-sync` namespace: egress to kube-dns, kube-apiserver and kuma.renner.uno:443; ingress only kubelet probes.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
namespace: kuma-sync
|
||||
spec:
|
||||
endpointSelector: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- host
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8081"
|
||||
protocol: TCP
|
||||
egress:
|
||||
# rules.dns lets Cilium learn the toFQDNs mapping
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- port: "53"
|
||||
protocol: TCP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: "*"
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- toFQDNs:
|
||||
- matchName: "kuma.renner.uno"
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
@@ -32,6 +32,8 @@ resources:
|
||||
- ai-ns.yaml
|
||||
- navidrome-ns.yaml
|
||||
- uptime-monitor-ns.yaml
|
||||
- kuma-sync-ns.yaml
|
||||
- renovate-ns.yaml
|
||||
- hermes-ns.yaml
|
||||
- allow-cilium-health.yaml
|
||||
- kube-system-hubble-relay.yaml
|
||||
|
||||
@@ -57,3 +57,30 @@ spec:
|
||||
- { type: 135, family: IPv6 }
|
||||
- { type: 136, family: IPv6 }
|
||||
- { type: 143, family: IPv6 }
|
||||
---
|
||||
# Hermes Agent (hermes ns) reads metrics, alerts and logs: the Prometheus,
|
||||
# Alertmanager and Loki HTTP APIs, scoped to those pods and ports.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: monitoring-allow-hermes
|
||||
namespace: monitoring
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values: [prometheus, alertmanager, loki]
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
"k8s:io.kubernetes.pod.namespace": hermes
|
||||
app.kubernetes.io/name: hermes
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9090"
|
||||
protocol: TCP
|
||||
- port: "9093"
|
||||
protocol: TCP
|
||||
- port: "3100"
|
||||
protocol: TCP
|
||||
|
||||
@@ -24,7 +24,7 @@ spec:
|
||||
# window. The StatefulSet rolls one pod at a time (updateStrategyType
|
||||
# below). Undo after a pod has run the new server = restore the
|
||||
# snapshot, not a git revert.
|
||||
version: ">=0.30.3 <0.31.0"
|
||||
version: ">=0.30.4 <0.31.0"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: openbao
|
||||
|
||||
@@ -27,6 +27,7 @@ spec:
|
||||
- immich
|
||||
- influxdb
|
||||
- ingress
|
||||
- kuma-sync # kuma-sync-kuma (apps/kuma-sync/externalsecret.yaml)
|
||||
- matrix # synapse-secrets, mx-pg barman creds (apps/matrix)
|
||||
- monitoring
|
||||
- paperless
|
||||
|
||||
@@ -32,7 +32,7 @@ spec:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: backup-verify
|
||||
image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-15 # {"$imagepolicy": "flux-system:backup-verify"}
|
||||
image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-19 # {"$imagepolicy": "flux-system:backup-verify"}
|
||||
command: ["bash", "/script/backup-verify.sh"]
|
||||
env:
|
||||
- name: HOME
|
||||
|
||||
@@ -11,7 +11,7 @@ spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: check
|
||||
image: docker.io/nicolaka/netshoot:v0.13
|
||||
image: docker.io/nicolaka/netshoot:v0.13@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
|
||||
Reference in New Issue
Block a user