k8s/infra-core: move to flux · aly.codes/infra@47f075c

+1

.github/workflows/check-config.yml

··· 57 57 for dir in \ 58 58 k8s/flux/system \ 59 59 k8s/flux/sources \ 60 + k8s/flux/secrets \ 60 61 k8s/flux/infra-crds \ 61 62 k8s/flux/infra-core \ 62 63 k8s/flux/platform \

+1 -1

.justfile

··· 178 178 [group('kubes')] 179 179 check: 180 180 bun scripts/check.ts 181 - for dir in k8s/flux/system k8s/flux/sources k8s/flux/infra-crds k8s/flux/infra-core k8s/flux/platform k8s/flux/apps k8s/flux/external-routes; do kubectl kustomize "$dir" >/dev/null; done 181 + for dir in k8s/flux/system k8s/flux/sources k8s/flux/secrets k8s/flux/infra-crds k8s/flux/infra-core k8s/flux/platform k8s/flux/apps k8s/flux/external-routes; do kubectl kustomize "$dir" >/dev/null; done 182 182 nix flake check --impure 183 183 184 184 # Bump a digest-pinned chart image to its current upstream digest.

+1

PLAN.md

··· 175 175 ```bash 176 176 kustomize build k8s/flux/system 177 177 kustomize build k8s/flux/sources 178 + kustomize build k8s/flux/secrets 178 179 kustomize build k8s/flux/infra-crds 179 180 kustomize build k8s/flux/infra-core 180 181 kustomize build k8s/flux/platform

-8

k8s/charts/cert-manager-issuers/templates/cf-token-secret.yaml

··· 1 - apiVersion: v1 2 - kind: Secret 3 - metadata: 4 - name: cloudflare-api-token 5 - namespace: cert-manager 6 - type: Opaque 7 - stringData: 8 - api-token: {{ .Values.cloudflare.apiToken | quote }}

-12

k8s/charts/longhorn-creds/templates/secret.yaml

··· 1 - apiVersion: v1 2 - kind: Secret 3 - metadata: 4 - name: {{ .Values.secret.name }} 5 - labels: 6 - app: longhorn-creds 7 - type: Opaque 8 - stringData: 9 - AWS_ACCESS_KEY_ID: {{ .Values.secret.keyId | quote }} 10 - AWS_SECRET_ACCESS_KEY: {{ .Values.secret.appKey | quote }} 11 - AWS_ENDPOINTS: {{ .Values.secret.endpoint | quote }} 12 - VIRTUAL_HOSTED_STYLE: {{ .Values.secret.virtualHostedStyle | quote }}

+23

k8s/flux/infra-core/cert-manager-issuers.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: cert-manager-issuers 5 + namespace: flux-system 6 + spec: 7 + dependsOn: 8 + - name: cert-manager 9 + interval: 15m 10 + releaseName: cert-manager-issuers 11 + targetNamespace: cert-manager 12 + chart: 13 + spec: 14 + chart: ./k8s/charts/cert-manager-issuers 15 + interval: 15m 16 + sourceRef: 17 + kind: GitRepository 18 + name: cute-haus 19 + namespace: flux-system 20 + valuesFrom: 21 + - kind: ConfigMap 22 + name: cute-haus-global 23 + valuesKey: values.yaml

+22

k8s/flux/infra-core/intel-device-plugins-operator.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: intel-device-plugins-operator 5 + namespace: flux-system 6 + spec: 7 + dependsOn: 8 + - name: node-feature-discovery 9 + interval: 15m 10 + releaseName: intel-device-plugins-operator 11 + targetNamespace: intel-device-plugin 12 + install: 13 + createNamespace: true 14 + chart: 15 + spec: 16 + chart: intel-device-plugins-operator 17 + interval: 15m 18 + sourceRef: 19 + kind: HelmRepository 20 + name: intel 21 + namespace: flux-system 22 + version: 0.36.0

+22

k8s/flux/infra-core/intel-gpu-plugin.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: intel-gpu-plugin 5 + namespace: flux-system 6 + spec: 7 + dependsOn: 8 + - name: intel-device-plugins-operator 9 + interval: 15m 10 + releaseName: intel-gpu-plugin 11 + targetNamespace: intel-device-plugin 12 + chart: 13 + spec: 14 + chart: intel-device-plugins-gpu 15 + interval: 15m 16 + sourceRef: 17 + kind: HelmRepository 18 + name: intel 19 + namespace: flux-system 20 + version: 0.36.0 21 + values: 22 + sharedDevNum: 4

+8 -1

k8s/flux/infra-core/kustomization.yaml

··· 1 1 apiVersion: kustomize.config.k8s.io/v1beta1 2 2 kind: Kustomization 3 3 resources: 4 - - placeholder.yaml 4 + - cert-manager-issuers.yaml 5 + - intel-device-plugins-operator.yaml 6 + - intel-gpu-plugin.yaml 7 + - longhorn-creds.yaml 8 + - longhorn.yaml 9 + - node-feature-discovery.yaml 10 + - tailscale-operator.yaml 11 + - traefik.yaml

+26

k8s/flux/infra-core/longhorn-creds.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: longhorn-creds 5 + namespace: flux-system 6 + spec: 7 + dependsOn: 8 + - name: longhorn 9 + - name: tailscale-operator 10 + interval: 15m 11 + releaseName: longhorn-creds 12 + targetNamespace: longhorn-system 13 + install: 14 + createNamespace: true 15 + chart: 16 + spec: 17 + chart: ./k8s/charts/longhorn-creds 18 + interval: 15m 19 + sourceRef: 20 + kind: GitRepository 21 + name: cute-haus 22 + namespace: flux-system 23 + valuesFrom: 24 + - kind: ConfigMap 25 + name: cute-haus-global 26 + valuesKey: values.yaml

+40

k8s/flux/infra-core/longhorn.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: longhorn 5 + namespace: flux-system 6 + spec: 7 + interval: 15m 8 + releaseName: longhorn 9 + targetNamespace: longhorn-system 10 + install: 11 + createNamespace: true 12 + chart: 13 + spec: 14 + chart: longhorn 15 + interval: 15m 16 + sourceRef: 17 + kind: HelmRepository 18 + name: longhorn 19 + namespace: flux-system 20 + version: 1.12.0 21 + values: 22 + defaultSettings: 23 + defaultDataPath: /var/lib/longhorn 24 + defaultReplicaCount: 3 25 + replicaSoftAntiAffinity: false 26 + replicaZoneSoftAntiAffinity: true 27 + replicaAutoBalance: best-effort 28 + concurrentReplicaRebuildPerNodeLimit: 3 29 + nodeDownPodDeletionPolicy: delete-both-statefulset-and-deployment-pod 30 + allowRecurringJobWhileVolumeDetached: true 31 + defaultBackupStore: 32 + backupTarget: s3://aly-backups@us-east-005/cute.haus/longhorn 33 + backupTargetCredentialSecret: longhorn-b2 34 + pollInterval: 300 35 + persistence: 36 + defaultClass: false 37 + defaultClassReplicaCount: 2 38 + defaultDataLocality: best-effort 39 + ingress: 40 + enabled: false

+20

k8s/flux/infra-core/node-feature-discovery.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: node-feature-discovery 5 + namespace: flux-system 6 + spec: 7 + interval: 15m 8 + releaseName: node-feature-discovery 9 + targetNamespace: node-feature-discovery 10 + install: 11 + createNamespace: true 12 + chart: 13 + spec: 14 + chart: node-feature-discovery 15 + interval: 15m 16 + sourceRef: 17 + kind: HelmRepository 18 + name: nfd 19 + namespace: flux-system 20 + version: 0.18.3

-9

k8s/flux/infra-core/placeholder.yaml

··· 1 - apiVersion: v1 2 - kind: ConfigMap 3 - metadata: 4 - name: flux-layer-infra-core-placeholder 5 - namespace: flux-system 6 - labels: 7 - cute.haus/flux-layer-placeholder: "true" 8 - data: 9 - note: Remove this placeholder when infra-core has real resources.

+24

k8s/flux/infra-core/tailscale-operator.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: tailscale-operator 5 + namespace: flux-system 6 + spec: 7 + interval: 15m 8 + releaseName: tailscale-operator 9 + targetNamespace: tailscale 10 + install: 11 + createNamespace: true 12 + chart: 13 + spec: 14 + chart: tailscale-operator 15 + interval: 15m 16 + sourceRef: 17 + kind: HelmRepository 18 + name: tailscale 19 + namespace: flux-system 20 + version: 1.98.4 21 + valuesFrom: 22 + - kind: Secret 23 + name: tailscale-operator-values 24 + valuesKey: values.yaml

+64

k8s/flux/infra-core/traefik.yaml

··· 1 + apiVersion: helm.toolkit.fluxcd.io/v2 2 + kind: HelmRelease 3 + metadata: 4 + name: traefik 5 + namespace: flux-system 6 + spec: 7 + interval: 15m 8 + releaseName: traefik 9 + targetNamespace: kube-system 10 + chart: 11 + spec: 12 + chart: traefik 13 + interval: 15m 14 + sourceRef: 15 + kind: HelmRepository 16 + name: traefik 17 + namespace: flux-system 18 + version: 41.0.1 19 + values: 20 + deployment: 21 + kind: DaemonSet 22 + service: 23 + type: ClusterIP 24 + ports: 25 + web: 26 + hostPort: 80 27 + transport: 28 + respondingTimeouts: 29 + readTimeout: 600s 30 + writeTimeout: 0s 31 + websecure: 32 + hostPort: 443 33 + transport: 34 + respondingTimeouts: 35 + readTimeout: 600s 36 + writeTimeout: 0s 37 + ssh: 38 + port: 2222 39 + hostPort: 2222 40 + expose: 41 + default: true 42 + exposedPort: 2222 43 + protocol: TCP 44 + updateStrategy: 45 + type: RollingUpdate 46 + rollingUpdate: 47 + maxUnavailable: 1 48 + maxSurge: 0 49 + additionalArguments: 50 + - --entrypoints.web.http.middlewares=default-error-pages@kubernetescrd 51 + - --entrypoints.websecure.http.middlewares=default-error-pages@kubernetescrd 52 + nodeSelector: 53 + cute.haus/ingress: "true" 54 + tolerations: 55 + - key: CriticalAddonsOnly 56 + operator: Exists 57 + - key: node-role.kubernetes.io/control-plane 58 + operator: Exists 59 + effect: NoSchedule 60 + priorityClassName: system-cluster-critical 61 + providers: 62 + kubernetesIngress: 63 + publishedService: 64 + enabled: true

+3

k8s/flux/secrets/README.md

··· 6 6 7 7 The `flux-system/sops-age` private key Secret is a bootstrap artifact. Do not 8 8 store that private key in this repository. 9 + 10 + This directory is reconciled as its own Flux layer before chart layers, so 11 + first-class Secrets exist before HelmReleases that reference them.

+220

k8s/flux/secrets/cloudflare-api-token.sops.yaml

··· 1 + apiVersion: ENC[AES256_GCM,data:GaY=,iv:2sJ4+zFe0Z0gB0NRCvv89je2n6rr5SCW7L43sQViV7Y=,tag:4EMNASmZ5cUq49ei/DDLvA==,type:str] 2 + data: 3 + api-token: ENC[AES256_GCM,data:JQ6Zs8q6wddJB7yUrXBqCKMjM66YP6SP9OMUhI3g1pyrNV1CNGP+QW1LOV4SWsSfyTMa09Evgm0lN4X8MEHv3fvMcoLMOakq,iv:OMtyeOt043Bl6IuOJlVFsR7l9IUyuFQkWiL8OamMC90=,tag:EFkja/Q7ww4CigIOzx5Bmw==,type:str] 4 + kind: ENC[AES256_GCM,data:aFZ6gNhw,iv:BbBVKPpnpGu4XWdB3RQ/4rOPnNHAyCp9iPZJC0NvjDU=,tag:x4XBwZryR+JSWyAwgLpDRg==,type:str] 5 + metadata: 6 + name: ENC[AES256_GCM,data:dWpTZRAUmWYrc6YBFsESwWJBzsQ=,iv:ij2e3HXy2Ra7s48HocOZ7J7NZwmProZdO+nGYMWNq5s=,tag:K3i3ap0SlFykRCNEy9lHMg==,type:str] 7 + namespace: ENC[AES256_GCM,data:DpTEoqd6eJ5+MAjZ,iv:Eld0oAp/NJ+dLMEi+lLW2r0QG4FZqyBoePB6BgmMcYs=,tag:v7OZBmGRI6N94rbmfC1P4A==,type:str] 8 + sops: 9 + age: 10 + - enc: | 11 + -----BEGIN AGE ENCRYPTED FILE----- 12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQ25lbzhvL1doMCtjYksv 13 + aUJIYTJ1VitxbUtOc1EvYXRaVzNOVlZXRGc0CnBSaUNqUjdhV2hJTCs1K1ZQdk8z 14 + enhTdjAzZWJGQXUyemw2OFpSaldlN2MKLS0tIDhaQkRRRWRPUGlyWjdkK05Ma1pB 15 + dVl1bGdPcGh1UExFeEp2QnZoOVRSODQKPXSuhIFkj/Sc93WXcKjlIpkuvE18KU/P 16 + 35Idf0sbPfpLWfU/keBj9ShIdA/oyQvLNqSgb7hLuuk5hUTKy0MXiw== 17 + -----END AGE ENCRYPTED FILE----- 18 + recipient: age1g79dfm0p44q5yxzhwd9syg965lupdu3n5lgyltdannmul5v5v5aszzz3gs 19 + - enc: | 20 + -----BEGIN AGE ENCRYPTED FILE----- 21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxS2w5ZHh2ek9zN01ya3RS 22 + aHlrMEZNS1BDM2RySkZaWkJRc0dKRVZVdzBVCkVOSDdYVC94WitNemZVZ1JxcWg2 23 + K0tTRmc1WUlETmRPei9uaWZxalJ0Qk0KLS0tIHBIbkFQVkNoblpmR0hFNVJDa2VH 24 + U2ZxS1Vxd1BabFdOS1JRSEZpdnJJeE0K3A9czcd+lcyU3+aBbHw+ocp/dldrdqb+ 25 + noQNS7S7pPIKi7rn51KB5XbFHKNU9KBrzXs8SazJE+cr6UjiJ0eCvQ== 26 + -----END AGE ENCRYPTED FILE----- 27 + recipient: age1cpcg5t420nf72k0c9rrx7amg0szch98uzqu273exj7lw3yu0j99q6vcckn 28 + - enc: | 29 + -----BEGIN AGE ENCRYPTED FILE----- 30 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBranpKLy94MGFpZytSN2Np 31 + T2k2d3ZpYTNIL3k0dzdIS3JpbWlJVnkwUWxNCnFxeUdicktQelZkeklUL0pNUU9l 32 + T3p3eVdHUkltRGtYcWFBK1RqVTJHZVEKLS0tIHlTQmZ0R3M1blBKMlV6ZU15b0ts 33 + a1lZT3dGd2NzRmRSQzVzQ09pOUpCWUEK7R54Tm9jsm59SL7SYx4spXl9XmNcFwII 34 + PzqpefHYLdcxt3So+wbYA/gSjCv+uDXDapDPNM0iorhWU+92PeXEpA== 35 + -----END AGE ENCRYPTED FILE----- 36 + recipient: age1w4mzwe89aqgs56mn8zg7dd2l623kwmw80k90wr2sa6dnlcdmhcnsp4kt54 37 + - enc: | 38 + -----BEGIN AGE ENCRYPTED FILE----- 39 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjM2puRlMrb0Z1YkVFNHpp 40 + N3ZVeVJLci9zMUFYbWFGNjlpVkkzbmNXdUhvCkhLcDZrczdNSDFWUUNzL2dwRUJa 41 + NzJEa3UwTWdhS3dCZjRBc3FjdlRFUm8KLS0tIFFzMmxUMjFQMHkya2dUdE1Kb3F0 42 + ZDV4MHF2blJJa0t6b1kwemNLaXBLeW8K/yUgIFPR4JvDNKUQhgtVb0oWtx20UYwv 43 + i5oMWGktAvuI0zwOSFIKUcGZy02YHaxX6TqhTOPX7UZ88AcmHhQHQQ== 44 + -----END AGE ENCRYPTED FILE----- 45 + recipient: age1e5a0aaueyk34klry2qk094zrwfsvga0uft93mwweye30xhqhvfzs3jgqku 46 + - enc: | 47 + -----BEGIN AGE ENCRYPTED FILE----- 48 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQk5xMHFac2VneVg5RGln 49 + aDNiU1Z0OVpSd3cyM2cva0ErZlQvanIvbUdvCngzTjd1V3U4VDZFMEJEdUUzUytq 50 + MnpzMDEyeG1CMjdtTXlGVDBKMDk2eWcKLS0tIDA4VS9SQnFvT3dmSkxuRUh0bVE4 51 + dVV3ajRub0NrTFFEWUJUTU1oZ1pobWMKc2TJsc8WBfJskFD4eKqapJ+BL+ff3SDv 52 + lH6sG3xNYfXPNTB01zgr8HbdaLmN06hl1rWa056c1Sq6nSdyPBocqA== 53 + -----END AGE ENCRYPTED FILE----- 54 + recipient: age1j9jju3whwj72udhge7v4c77gk6v6w2cq8zjngzyppwtptfsz499qyywu9a 55 + - enc: | 56 + -----BEGIN AGE ENCRYPTED FILE----- 57 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYK1IzbERvOEQvRmR6bWc1 58 + NEpPak9VOUJKVVE3ZWVsN3JxRkRQMVZFbnpvClowT2pXZ2ZvWmt1VGJHWmdLVFda 59 + MUhwM3gva2VaSVBmbWJ4U2VTQWRVeEkKLS0tIFlQUnczRWdscFhyajZ6MlF3UVd2 60 + M09IYmU0NlpjRDlPWWk4SzYrSTh0NVkKtRlsXoWpU+nbnD2srVcICrcwSL68XUsF 61 + VoHroRNVPJb3E8qtMAafPzRrAeliGobwJjlGJMXpqdG8V+4MH/90Sw== 62 + -----END AGE ENCRYPTED FILE----- 63 + recipient: age162sx8kppp90mjxw88eqs78hgnpkddf8k9kgtksmmexzvcdxknpkspmkgaf 64 + - enc: | 65 + -----BEGIN AGE ENCRYPTED FILE----- 66 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMHFNK2VpWVpKeDM5WldC 67 + eXF4VjdBb3REdlMyQkliRzJkOWtqN3pxSEQ4CjJJdzJEU2Y4N2xjeGhpT2VqVU4y 68 + VFB2OWs2dUlGOTlBM3pCYXdFMnV1UmcKLS0tIHBydXRQcHQ0YVViQ0FzUXpWL0Ew 69 + dTNKZUZNV1ExVFRsVTdNbEtIQzFsMlEKy9c80dSDyH++Je/q7aOMJUBeBHKTOnud 70 + /38mCUuuVdO7+nOKdbhGXWJmxW5u2p+d8bS3JPuVGqJgXa5AL4VIcA== 71 + -----END AGE ENCRYPTED FILE----- 72 + recipient: age1hhvzccxzrysq6ak2ktuks00vy3smr6rhey9swhncq8850epftpjqt3c7f3 73 + - enc: | 74 + -----BEGIN AGE ENCRYPTED FILE----- 75 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNQW04ZHZtYUEwUm1kRkQz 76 + YTlLUUFZM09sQ2xKYWZrNWlsalFjM1YxQTNjCjV4cm5RaXloT0tYeGFaSDZsNStM 77 + UWc2cXMvK0UrSEVKNWk0MHo4bFhrVDAKLS0tIEFPbEVNOUxRMktBcm5neHBzTnU3 78 + SXprSWpZZ2V0amVFT3dsYnlhMWM0UlEKI4gtAS0R4CtutFT91JGS4lRromuMe9oz 79 + cWdzxxGrZkrX8Ber3EoRZKWwmNuB8UOY1LcNqb1BQJU5d9ZPAOGDng== 80 + -----END AGE ENCRYPTED FILE----- 81 + recipient: age1mpcyeqjcl8j0dd4sj6f0vufs2vpus3xn4dvxe3cr8g8rgcm0nfxq03ds4y 82 + - enc: | 83 + -----BEGIN AGE ENCRYPTED FILE----- 84 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUY28xc2lJTHRXK2VwUjFS 85 + cVErZkFEMy9oZXJSMUNCNlVhdWQwZWlTMGhJCk5RV1FPU2h2b1JTanRFQzFBSEta 86 + TDJ4c3VtQjZ1RGxtUVd1aks3QUF4WGsKLS0tIGkyeHFNUk9YNXlnSjkvd08xcGVF 87 + Vlc4OVlhb1RVU3JmVkpCQURyZEVkUlUK3HQxab8QwQSlvqVNR/jFQfnaYe92T0Xo 88 + kq8n0M5/ODSvI1E7s4Akd1XXe/Ve+YmICBlmI60EZJpEmhAh9m8MJQ== 89 + -----END AGE ENCRYPTED FILE----- 90 + recipient: age1zj2aq2a2v3ngcer7s3jz6pufhh8ula8pw56etmy28dy25wrkk3vq59hu2s 91 + - enc: | 92 + -----BEGIN AGE ENCRYPTED FILE----- 93 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkdlF2K3dJeUZnUi9aY1Zu 94 + dEcySkQ4YzZOd3ZoWXpENFJqY0JPd0tsaUJRCmtzRGRiTVlsc0hWM3dhKys5eDBQ 95 + bmI4MDhCc0YvWGd1VzFhV2Q2cERqMzgKLS0tIFhpaXBQS2ptUDJRcXlqWlJNZzBz 96 + UDhNek9zUXhKaWRJTFo1b2p4MXYyNEUKFiqfzh89sBAlI8aAsPGBXw+Pg9SSZSgw 97 + muizw+P8wGof5zSErs5TY5jz75heA3p2HVEUyRImWU1t6Op93jJd3w== 98 + -----END AGE ENCRYPTED FILE----- 99 + recipient: age15td0jk5e2qeq2pexvxguhuuaxuaa7nhql7mhx9jr79caska6t4pqdv5spl 100 + - enc: | 101 + -----BEGIN AGE ENCRYPTED FILE----- 102 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYXJWMytLb3NFN2VBbVlI 103 + TUVyNEc1TXp5OXlpMHV6NTEyMzY1dktJRzBVCmoxSFQvb0JDWlk1dFptclJkRHdY 104 + TVZDaHRZbm1sWTVEMkQzN0pQelpxUTgKLS0tIEl6dmpNY0ZEblM2WWJTb2hSclNC 105 + d1dzd2Yrem9QazV1blRWRUhiSUNmazQKVTM9VYbRkUwN0C8zIHu2L4RZhoHwPOSd 106 + rT01FdHdOAFhgLSJt0puesL9CbQe07YVXJnT9WrIjoP+lRUlnDx3rw== 107 + -----END AGE ENCRYPTED FILE----- 108 + recipient: age15mhrzghrmprq387xqsln6996yx3ja2e2zpamh9mtuu9zqmxahunqg9qugw 109 + - enc: | 110 + -----BEGIN AGE ENCRYPTED FILE----- 111 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwclp0ZkUxd0xnYlplaUpO 112 + TGtCcEJsQU9GQWRCTGQ1cnVEbWtiTTlmWFFVCklUalFyYkhhU09nWE1yaG9xSkYz 113 + bmpvWEoydVBXeFpadXBrd0t3bWxRaE0KLS0tIDZ0SFRUMU5hY2l5L1NyaHUyOC9S 114 + NHZILzJDcWlIN0FmdVNEZDhEaXhEN1UKmC5Q/G6TZxpRaGp9ToJLqfOZcT7DTosj 115 + yvdsy80eWtD5Ion6kVbgc9uevOLhHjlolhtuy9EOrSdoKvPvQDosKA== 116 + -----END AGE ENCRYPTED FILE----- 117 + recipient: age1su5lre6favcv6gdc50yh7ecv33qgfp0tm6klunpuasa3q79kmqtsykaq0d 118 + - enc: | 119 + -----BEGIN AGE ENCRYPTED FILE----- 120 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjK011WDZFMnRuQUFDT2tO 121 + cXNzenNSM0NmZ1RsUHpHdm93TWxMMnZKMUI4ClU3YjEvemV6ZTVsVTdBMGhVTkhi 122 + VkhhQVZQYUZBL0paNU5uWStadEtHcjAKLS0tIHRvM0dPWWJyUzczRkFDaFlIYVZ0 123 + UGhOODI0cC9ncTlXNUZWUWsrdU1rMkUKAwiJW+ZpPrne1CFBiAAPMqmVgalXf02Y 124 + jYp1ysrDGMqtJXT/dAfj/Rt6kKA1szhyq8nKAyULUUXeU1Rp4w0poA== 125 + -----END AGE ENCRYPTED FILE----- 126 + recipient: age1v4x5alkmvxsx5jsrwpecx0tne0ch2rwfkk0rq5w8x578j2pf5urssg5gx2 127 + - enc: | 128 + -----BEGIN AGE ENCRYPTED FILE----- 129 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0cnJ2RnYyeWdxNnNENnlD 130 + V3RLZGhoYlAxYm03OVM1TjRrcXJLd2FBK3dZCkRXU0ZWU3FjNWM2dm1KMi9VSDVv 131 + ZUhSNFA0Rnp5cFNuS1NUYkwvMGo0WmMKLS0tIHZieXBvSkZNYkZJNkJyeTN2aUc2 132 + aEFDMzRUeTZ4aVhPdzFsU1lxL0NwWHcK50BtNkbz+tfWzO5Khyu2Cmc97GQoV37e 133 + hTFJShaQUC7oMBok7V9NDkh2YQ+MaVRW6LW1s+KOEQmk9SfsctrRTw== 134 + -----END AGE ENCRYPTED FILE----- 135 + recipient: age1f9hd8fu0694rc3tr6hwxz3ldfpepref937rmvqdxvvsr0kfcjdxswyzvw3 136 + - enc: | 137 + -----BEGIN AGE ENCRYPTED FILE----- 138 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RXFxTWtjZ2dIeS83RHYw 139 + aW1EZGNLMUJ1a1VOaVh2ZGtmSU8zWHpyU2pFCmJ4TUxCZ2NJc3BGa2J1dVBycWl4 140 + Y3NvdTc0SS9hWXV3UzhqYkJSRXZmaTAKLS0tICtMN2VOVlpOUW1ZU3ZXYWdvWm9w 141 + YWZWM1FFOXh6QXUvdGEzRmlqaXBwUk0KYrHRHOXCwgpbxl3+IamC08/a/yFEAQi+ 142 + UxPds/Yu0++ukhkNn3CRDLYLbpCXJT3LGPXSoLvCvzQf1bgtJjqcUg== 143 + -----END AGE ENCRYPTED FILE----- 144 + recipient: age157en2pt286a22pxzyugt84ak6rn2at89tpma88juqfgj84lme5csq4999g 145 + - enc: | 146 + -----BEGIN AGE ENCRYPTED FILE----- 147 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaDJHWW9HNWZ3VlBFalMy 148 + eTBYUDd5N2ZnbCtQZjMwUmUxZkdNUHBOZkdNCjZOVnF6RVdkcjh2TmxWRDdMT1JY 149 + VWQvd2xWUmpIZkx2T2VTRmJpN1RtQ0EKLS0tIFA0eVU5R3RDM1dBRXNwSmZlWWxp 150 + V2lnbjFrSHJML05lMW9hL0xlTHRHb1UKFHUXCjGf1xmrl2m4iLt89uzfzNp5iDEe 151 + bjAGFvtwiOqUjQ4jnPkDIFOUrJFYStqTI9kQDJif5EK3bQcH6qHB1A== 152 + -----END AGE ENCRYPTED FILE----- 153 + recipient: age1axn36h9356ena7rq6y2xa4rcm250w9h0m9pz6x0677gla0v4f4dsj92yfm 154 + - enc: | 155 + -----BEGIN AGE ENCRYPTED FILE----- 156 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZDFINnF1c3dXVE5Ra284 157 + bG1EbFo2QUhEbGNIaUhMb1dkMjZ6TFhQOURFCjR6dG11dFJKaTBvdkFWVktNT3ZY 158 + NFMvR0p2M0t2RTZRMlg5K3pNa2J1dDAKLS0tIENqSVdXRGd2cGpZdjI3WkFpdjJx 159 + MlJjY2VuR0xCNFlLUTFnTDcrT0x4cjgKlXTv1UJUPcGiZh67W3awnGxTlFUJ1wrU 160 + jDL7GnGviVnaerDivO5cXq/06m5tfcH3UlpSOLeu6tba3R3QrSWOWw== 161 + -----END AGE ENCRYPTED FILE----- 162 + recipient: age1xwlrtfu3du4jxg2l6eemzqeed8tflhdkjn0q5j9pzpecshtp3cpsh60l4j 163 + - enc: | 164 + -----BEGIN AGE ENCRYPTED FILE----- 165 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaYzBMeG5pMWRHbW0yQ1lS 166 + QlVXbDRGVmFqdkVQc3kvOUcxTXlaNFQxTFc0CjdQQmF1NUJqQk83c2h0RDE2aHRr 167 + SzZmT0tNS1h2VmdFNkY4bkhOYkUzVXMKLS0tIG5sTWFyOEErWDllbHhmODZTRmJV 168 + Q1k3NW9nYmpBSWtKUzA2TjBVd2Q0TncKk4959bosR7YpIEC2KIK023D7AsSjhejq 169 + hHnguzCZZSHlVcunXfWS9a2+KXnxWpBZ4pq8N8DcWeLswVF1CBueyg== 170 + -----END AGE ENCRYPTED FILE----- 171 + recipient: age1kgp3x48wn0dmzwqp0vdpfsdw42rej0ypkj0qavs7c2t2tgdud5zqcmhl40 172 + - enc: | 173 + -----BEGIN AGE ENCRYPTED FILE----- 174 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQ0xtVnFQdm5STDJpZGxp 175 + dTk4MGhOeEdqcmo0am85d0xCaHRPRUxuQzJrCmg0ekRvcjlKc0hJYnhnM1FyYzF1 176 + ZXVsbWJGc0hNc0tMRlJNQnlzNDZ3ZmcKLS0tIHdLVnRHbHFHL2RvS2tuR1d5c1JX 177 + M1NRbm9HTHhjN2dENWZiMHRBQjFEcFUK8YLmrDSPPTKY6DriUSzz1VN5sMGjPnK3 178 + mEzzIGavKSzUDWLGNDfpnAQKYZ6cu4zjFhDH2U/SHIEnW73dhxkoGw== 179 + -----END AGE ENCRYPTED FILE----- 180 + recipient: age1sukfru07msq8fm5ddgym23yal9lfm99090p999p09mxgrrwh9aqs6zp4fy 181 + - enc: | 182 + -----BEGIN AGE ENCRYPTED FILE----- 183 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4MnpmdENoczE3SkJxNkxF 184 + ZzJEZVdla1Fwc04rQk9Nd3hFMStzekxjNnc4CkFIbFhwTzA2RkYrNnB2ZzlEbzFT 185 + OEpMdWRVcCtyazhpaHBoVVBKN0Rqc0kKLS0tIDQ4b2J1MzFoamJ3QVdCQ0pkRnJj 186 + ZHNUQkN5Q29oUVEwVE04dWg3YkhyY1kKntJUyGqrkqz6LeMB6P4ybWpwrbnpuSvm 187 + GFxMblxFsisOlwm7rHt1HwOPsFntlDOU8A+wu1rIaoqbxfjzZMyJsQ== 188 + -----END AGE ENCRYPTED FILE----- 189 + recipient: age1ephzrpgftmvq4cul9766q2r3mss38xu6un74ryfmw0729afysghsh0a3qg 190 + - enc: | 191 + -----BEGIN AGE ENCRYPTED FILE----- 192 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWTBWTTVpN2pDT1NYT0RW 193 + QjArY0huVFJJUExVdkNsWkthcFBXWkhCdVZNCmRWa25FTkh3T3h4UDNBTm1NYXNT 194 + S0ZpeC81Y3N4MGFXVThkTUVMMnIyblkKLS0tIGVkZmJIeVJjWklYV0VoTkNFckp6 195 + KzUvSzZBZHUvTEVjclQwZTFIdXBIUEUKPvxeoGqpRFZg5C2Aq1mVo2cyFnUIF+i0 196 + vb3qiAqARy8YTVYnFdNw/preNVBg9IRHCpbSmaS1HyzMiN5H5Bq97Q== 197 + -----END AGE ENCRYPTED FILE----- 198 + recipient: age1stsuakfyj3gkee4sm328ky2crmymyuzwjjmxrpvnm754sdt2zvnshf68jx 199 + - enc: | 200 + -----BEGIN AGE ENCRYPTED FILE----- 201 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NFFoSWxXL0hvK0d0eXNw 202 + aStFMW9PZlhuRUJzdEUwM2ZHcWtycUpEWUZJCm5EVDgybENnc2Q2Q1pJcW5IekVi 203 + VDNzbWlZeUdaQVpDdUlFMHdjaWxrUlUKLS0tIC9jU0ltTG0wZGp0cVhHY0M0bFRx 204 + eUQ5cW5Fc0VWcFFPM3ZuUWJqQzM0bUkKUMhIDoKqWR6+elQvUst10DwBuGklRR6k 205 + xBIklmv7ATH+kgJg5VxRG8NYXYLy/R5AFuMJkbhjwqqrH1QELyHQ3g== 206 + -----END AGE ENCRYPTED FILE----- 207 + recipient: age1s7ecrfntus8rvyprzhffjpqk2tmrc259knf9xqajlrqvewfp8d6svwp9pp 208 + - enc: | 209 + -----BEGIN AGE ENCRYPTED FILE----- 210 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQzJoVWtvaElmL1BrUlZn 211 + OWdVRGZlYlRMOHpXeXN0OVlRc1RkMXI5aXpnClhVcmJjS25rSnJxak1PY3UrOFpW 212 + cjEybE9sdEpkZ2t5cnlBTmxjVVJZeTQKLS0tIHhPYVJDTjFLYmJZSkFzTkk4S1ZR 213 + WG5ZY0Q0T2RhVU1iak9zdUZVRndNdVUKAGp5yOnvcvDhDet12pdMkhliRsf0loa4 214 + IBMvSrMcFVxLy8v/MZb5IJpjvRCgAEuvogWS+23D89ugsia8LZljew== 215 + -----END AGE ENCRYPTED FILE----- 216 + recipient: age1yq47x0cyf95jg372v84ttptgnppsrfmxshsua6p58ecmgzxc5c0s5stfth 217 + lastmodified: "2026-07-01T19:24:47Z" 218 + mac: ENC[AES256_GCM,data:h7oBPRXh7kolfgs7nV588bPLbW1IDvEWObglBTT6yDydxnJVKr210jNMPCLvcS2FNvMDSSU1uZRUB8r7Pb2D9C0JZYpS/FBR2A+oDsuY+/lVsgS8WrK+MB4IX0Fof+RUN4FjWkMsyz8YpJrN4HBYybCbTKh4IDEx6ZeG9E5TP44=,iv:GhFdtpXFQlJ7qBXpK08mctXOH8UENuTwwLjimWJSIz0=,tag:NUm1R1Jti7iE8C60la1byg==,type:str] 219 + unencrypted_suffix: _unencrypted 220 + version: 3.13.1

+7

k8s/flux/secrets/kustomization.yaml

··· 1 + apiVersion: kustomize.config.k8s.io/v1beta1 2 + kind: Kustomization 3 + resources: 4 + - namespaces.yaml 5 + - cloudflare-api-token.sops.yaml 6 + - longhorn-b2.sops.yaml 7 + - tailscale-operator-values.sops.yaml

+223

k8s/flux/secrets/longhorn-b2.sops.yaml

··· 1 + apiVersion: ENC[AES256_GCM,data:ngg=,iv:41HQ/aGWe4NBy0TtC8CYWxYMXhUpgcZMUxtAT/zdm8A=,tag:JOOuuXmRFjblHT0xMbhbHg==,type:str] 2 + data: 3 + AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Adr0Zs+OfvQ7ZWzXY7LQH97xbcDJA0mqAWHobYqz2Cq+K3xf,iv:7qXo7UqaFXlTxCjC5YBiIPwT0GfkSVTmnh4VQyXT8Do=,tag:6igLl20tuu5WFFro9OTqFw==,type:str] 4 + AWS_ENDPOINTS: ENC[AES256_GCM,data:VeaIGzhNCha0XI1X3wDJ4t783+n5uRRO3UdXbbd4mhEMflDtGzOpL6q5iEj/AU32AFEa+A==,iv:JFS0OTztGRYTOWVwuf9qKohkx+pdsh0mneNBM/pf95o=,tag:xvqjQ0F+Qe49WiAy7eiXxQ==,type:str] 5 + AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:LvOa38nl2V9mZdgDMP2g9VrL7QgMozgRTAe8nknFgnBHCf4yc7XCw3LsoVs=,iv:SB9PESa5djwOPTq0A6LSo4YNMImCImILuJueCoX5xv4=,tag:6Qbg9qIA//4wd6Mqmd2oXA==,type:str] 6 + VIRTUAL_HOSTED_STYLE: ENC[AES256_GCM,data:0gn3WQi0Puk=,iv:fMI5rF9+oVCglWl5ZARfyO8CTSFp1+0hu0jmDct0qIE=,tag:lIQYR4ZsMG3h0IJN7iVyKg==,type:str] 7 + kind: ENC[AES256_GCM,data:HqqvIdOU,iv:NVVSyGMjv8LLqfMGoC/lCZUtZfVrjWrgiBLsxb23AXw=,tag:4LvFY4medr5pP1R4sexBFA==,type:str] 8 + metadata: 9 + name: ENC[AES256_GCM,data:CjlOCKTmpjzDl8I=,iv:ikFXlMzpN5qFaKXmpB85i90GQkLPQMqwAzTWK56Ehv0=,tag:R2pmsvOI4TndZlWewNqSVw==,type:str] 10 + namespace: ENC[AES256_GCM,data:G3sanb10cQvObO1tPqEp,iv:qPyCZMVOeN3wteBXi7MLx5VHxyLfULgnpnastaowJw8=,tag:JlSXChdYMIYyRfbi35pucw==,type:str] 11 + sops: 12 + age: 13 + - enc: | 14 + -----BEGIN AGE ENCRYPTED FILE----- 15 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZkJSeTg0dEhjUVd1OUYx 16 + OGMxYlFmWm1tSTFmWTA5bTUzTzBmczhJQkhFCjdyNDhTRkRBaHVWdEVwUzhOVEIy 17 + dXArK1dlNnNoUGRjUjBqNEwwYllpWlUKLS0tIEZ4dzlNY2FQTG9YSysxamJDZWhu 18 + ZXJ2MUFuY25RODZMTkJjSzFZemhCSncKMwJ1z55TDVb0Bz+BHuM2TS+y2mGurNQK 19 + fnWu/0konbkXmtaznz0RSDt9rBwJQkAiyB7EkfRcBXLwaRHj4t2jmg== 20 + -----END AGE ENCRYPTED FILE----- 21 + recipient: age1g79dfm0p44q5yxzhwd9syg965lupdu3n5lgyltdannmul5v5v5aszzz3gs 22 + - enc: | 23 + -----BEGIN AGE ENCRYPTED FILE----- 24 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWZmNlR1oyT0pUU0RpOE0x 25 + c2pWM0U2aFFhU0FYMS9mYUtaY0lPZUk3SURJCjc1WEdhZzE5b1ozOEtoK1U1SDRr 26 + Z1BSMkVpNktSbnp4cmtwN05lT29TbzAKLS0tIG9veFVUZWlDa0NQcVlmOE96U1J3 27 + OVFibm1NN2I4Z1NydEJyL3lKa1J5OTgKOpHr3Rbbs1IOh7JkQN7RZnkhDqKQAfGP 28 + +PbwBjBaXUgrXCrp2m4tlTKkpwUo3OPDC+R+6I3TLn5GXGQqiAeGxg== 29 + -----END AGE ENCRYPTED FILE----- 30 + recipient: age1cpcg5t420nf72k0c9rrx7amg0szch98uzqu273exj7lw3yu0j99q6vcckn 31 + - enc: | 32 + -----BEGIN AGE ENCRYPTED FILE----- 33 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvS0xCSThxcFlNdmRtcjBR 34 + aWE0RG56K1VjZlZhdDRtRDAxS09TQVZCbmhNCkxFV2dCR0JhekovVHVZUytYSGtp 35 + Uld2ZTB6L1laNGJjb0F0Qk40RFNRSVEKLS0tIHlhcGFMejdjU1kwd2g2aWVka3Rx 36 + YWc3MGx5UVkyRStUMGFwWTl1OFNZREUKCpmBQtcKpnR8cTWMtYsT3tcpPex3FMZ7 37 + FzQPW7XxspWRAA/flAagAni/+X486E1X6HKbUBYDguGR2zeT0ND+sg== 38 + -----END AGE ENCRYPTED FILE----- 39 + recipient: age1w4mzwe89aqgs56mn8zg7dd2l623kwmw80k90wr2sa6dnlcdmhcnsp4kt54 40 + - enc: | 41 + -----BEGIN AGE ENCRYPTED FILE----- 42 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaQ1ArYnBhd1V3N0hjT2JK 43 + LzhSNE9XWTRNLzhaa2c0M2E5UmtNQ1BDY2pNCktSRlEyUU0rdG1qMEpKbGVicERX 44 + N3lxblgzNlNPT3FCaDY5Zy9pbEpadDgKLS0tIENETkFpa0RPa0V6UHpmemNFZDFT 45 + WFFvRUd0dGlLMGtvenJaR1NwNUtxa1kKlUZwyuvEM55BQVUnFZn/hIocya+yIyOe 46 + xA98cMKYhPgxmPT3NlbgMCEDwd5RHtC2t0apk/6rPlTxsjABjUfvMA== 47 + -----END AGE ENCRYPTED FILE----- 48 + recipient: age1e5a0aaueyk34klry2qk094zrwfsvga0uft93mwweye30xhqhvfzs3jgqku 49 + - enc: | 50 + -----BEGIN AGE ENCRYPTED FILE----- 51 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOcWpZWXo5Yk5pd0FWbDR1 52 + Rkp5WUdPeG1NeVBGNndDZ3JhbzBRai9mL2dJCkVVVVRHWkFsNmJLUGw1V3N2Wkhl 53 + a3l1NCsyaWdkTjhBMjVNSHYxS05tblUKLS0tIGNXSTVJU2Q1TExESXpJMHV3ZW9O 54 + WDh4eXZRWkZacEd2S2wrZlBIenlEYWcKtVRFuXiFHIGlOt0v/SFi2ZvDVeXeTjCq 55 + MkVPawaMJimtzhg0i1wnF5FhPHXPCCV5Njj9g+fkPWtMuCc0DusniA== 56 + -----END AGE ENCRYPTED FILE----- 57 + recipient: age1j9jju3whwj72udhge7v4c77gk6v6w2cq8zjngzyppwtptfsz499qyywu9a 58 + - enc: | 59 + -----BEGIN AGE ENCRYPTED FILE----- 60 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBORkFnRE5EOFgwTmh3RVVB 61 + NHpOY2gxU0ZlSGxyNEdhRzUrZWRDNldMU1NRClYzVHBwNkR6MnBlZVQzakZ3VmhK 62 + bEdlZjgxWmtCZnNaME83eEpjSHNKVHcKLS0tIGg1UytGRlJSbnBkQjJKOC8rOHNP 63 + QVRKUnBRSnZYZHhyK2h0RnNsclFNRFEK+EfQAW+4TYoxIxb3U/UzPV1MBZ60HbW8 64 + MY2vtE4FCQMJeqeNNbYYma+lFpvxc8o7mE+r/tvn7OxTidhiYRVAZQ== 65 + -----END AGE ENCRYPTED FILE----- 66 + recipient: age162sx8kppp90mjxw88eqs78hgnpkddf8k9kgtksmmexzvcdxknpkspmkgaf 67 + - enc: | 68 + -----BEGIN AGE ENCRYPTED FILE----- 69 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYUdBMzlQS0pBSk9MNVNr 70 + eEFpRWw1aHRaN3JKYkJoTjg1dTFYWFdyQnc4CmtZTzUydloyL2lFMHZDQU4zd2hu 71 + a2xXZE5FRTFuTktaRDdVZnRNSUpVdEUKLS0tIEJ6aHlIMUlCTllad3VFS0kyQ0pp 72 + STZkTFJkQlN4R2FrSG1NU3UxVWdheU0K/VzU6Xtrs8R/i4/KTXYVNLqp1Y81VykH 73 + qFeZ9DvE/dLgCUkcbkKBeq0sCZ0jLQKzZsq20fFn/uGM7t5Fo3GGmQ== 74 + -----END AGE ENCRYPTED FILE----- 75 + recipient: age1hhvzccxzrysq6ak2ktuks00vy3smr6rhey9swhncq8850epftpjqt3c7f3 76 + - enc: | 77 + -----BEGIN AGE ENCRYPTED FILE----- 78 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXQ1dmVEh1MW9GU1VDTkw5 79 + WkliL0FBQ3p3em9lYmczbXRYczdKR3Q0S2dNClJzczhpblZCdndRNXhSSGRrdnB0 80 + L2FyWE42REZRMTcxRFJqamdSNHdBYm8KLS0tIDlFbGthQ0NBcE9jREFzMzJEZG9n 81 + L29IZUZoWGRzZGlyZnRrTDhnYkl6a1UKbJxLWpuB0ri915V1sRaKXx6zvMQelgS6 82 + w8xXI9g9dQKd/TyyCG2sxs0YIMopSBF2iDJ6KKk2ig7OHjXEx6zJAA== 83 + -----END AGE ENCRYPTED FILE----- 84 + recipient: age1mpcyeqjcl8j0dd4sj6f0vufs2vpus3xn4dvxe3cr8g8rgcm0nfxq03ds4y 85 + - enc: | 86 + -----BEGIN AGE ENCRYPTED FILE----- 87 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBabElXckhRK2ZNREpuRVg1 88 + TWdONHpXbmZqU2w2TVZHMjQ3bWUxRmlTTGtnCmRaSmpPMXh1a0tqQndLRDVnTDd1 89 + b3JZSmNmYlNkdTZnTkdSaEZ0anl6OHMKLS0tIG5QRk1yNjZ6cHNHOFhiTEo2NU9P 90 + Vk5rUFVMR2c5d3hWdzg4UENnZTBsalkKWAZsXEftw14ega9hAXCwriAgvFOkN9n4 91 + 4N31i9RDP8mhCnwIY9ry2chDCD38FlO1hUsvKhI2U+NaadWqZFVFVg== 92 + -----END AGE ENCRYPTED FILE----- 93 + recipient: age1zj2aq2a2v3ngcer7s3jz6pufhh8ula8pw56etmy28dy25wrkk3vq59hu2s 94 + - enc: | 95 + -----BEGIN AGE ENCRYPTED FILE----- 96 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0dFUvWURhdUtKQ3d5eEph 97 + a0xXVk5kNHBmRXdVU3lQSkRhUmdCeWR2QWpZCjg0UWFKL1N2R3hlTjhlSVI0ZnRv 98 + RGlpMzl0d1psWnRub2RlemVTTUVYWG8KLS0tIGNYQ1lZOW1HckF2RzRERWR4aTRW 99 + aU1RNkdMSDVEYkFxMmhTeEs1eVdseWMKht/AnSK62t8gDtsIa82dFLo8J3mdKF5o 100 + fGrpTtL+vRkChiSZY0J+DqGBkM5Q1HCjGXiqjd4R38XKBL25BBWgTQ== 101 + -----END AGE ENCRYPTED FILE----- 102 + recipient: age15td0jk5e2qeq2pexvxguhuuaxuaa7nhql7mhx9jr79caska6t4pqdv5spl 103 + - enc: | 104 + -----BEGIN AGE ENCRYPTED FILE----- 105 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOWJiYTBXTGVZL1Vqbk5F 106 + Y3VXbHdkYjRacHJEaVdSU2RXRnZWcE1iQnhFCjNJMVNKUThjYmtEV2pHajVKWTdZ 107 + enZIRGJySHJKMjRpbVNFYXY0OUlEZW8KLS0tIDNQZ0dsUHg3T283VDk5YnZWclVX 108 + K29UaXE2SlUzTlU4WHlaUGZBTXNUN1EKobjcYRVPq+IRHmQE1tx8TEaAAX9dLW5Q 109 + j1nt8I1T0rI0wDTtoHrGJOMG5JRzX5CNWfW0mwPoXtlyZGHxU1FIYQ== 110 + -----END AGE ENCRYPTED FILE----- 111 + recipient: age15mhrzghrmprq387xqsln6996yx3ja2e2zpamh9mtuu9zqmxahunqg9qugw 112 + - enc: | 113 + -----BEGIN AGE ENCRYPTED FILE----- 114 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOU3kyTkNvQzFFdmpzYml5 115 + b0dZMVlwVUQ1VDhEdnZtbFgwMHFkdy8vSkd3ClV5YUdkWjQ4T0xJWGpGa3V5dU1l 116 + QlF3UHdBSldXYVpqVk1UaDRraTYwVG8KLS0tIHhTWlJ6cG9OVGhCd3hKNENqOG5Q 117 + Q1lUbkVMSE9JakYwSU5YMk1wMUVrRzQKKPcBhehJWbXfFeyOZjm+niByALFv0Cnu 118 + CMiIPRvcydi94H+3x3BmDhH6SOipSiBesA/mnb/f/JM0in0JigdDvA== 119 + -----END AGE ENCRYPTED FILE----- 120 + recipient: age1su5lre6favcv6gdc50yh7ecv33qgfp0tm6klunpuasa3q79kmqtsykaq0d 121 + - enc: | 122 + -----BEGIN AGE ENCRYPTED FILE----- 123 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMDIyeExaanN2TmxWdTFX 124 + YWJQY3Y2KzFJY0xBZ1pIcGtYVTIwU3dpM1JFCitWa0tKQzJXdTcrUmk3RldaQ3I4 125 + eTJHRUFhdktETlFValRSVElBMzB0MjgKLS0tIFZhYUtjVkxLam9TSUxmUFNLK3dv 126 + eHU0eWdza1cyZWZ1VDlaaEU2Y0o3SWcKVXePJbZlgNlFH1OFc3zAqdWBW8kCH5ib 127 + svbdwhIrr4rz/40G1Wz/gu3/VuIdknn3wmKJzJ5dySzr/SeMkpVmgg== 128 + -----END AGE ENCRYPTED FILE----- 129 + recipient: age1v4x5alkmvxsx5jsrwpecx0tne0ch2rwfkk0rq5w8x578j2pf5urssg5gx2 130 + - enc: | 131 + -----BEGIN AGE ENCRYPTED FILE----- 132 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RXNQRlZxV0psSUtqd0dj 133 + STZnQzgvSVBuRXNWQkJkcTVyeHdIMjJCUEYwClZxU3g3SElJZnF2RThGYU5aSlJZ 134 + VTE5anBnVEdTVVE0Rm1NOVlRQVYwZ0EKLS0tIGdhWmprdkU3R1JzUk5GSktNMWwz 135 + Tm9rNVVlRG1TZjAwaVlJdXBCeXZTUU0KEBZJrdMfGPFphyC+q8mCva/p4eZClkZ+ 136 + ev7hh0S2yFBzp41JQaYc3AUxJ33LnYCcxaBkqhjhOW4XdGWmJ9hf2g== 137 + -----END AGE ENCRYPTED FILE----- 138 + recipient: age1f9hd8fu0694rc3tr6hwxz3ldfpepref937rmvqdxvvsr0kfcjdxswyzvw3 139 + - enc: | 140 + -----BEGIN AGE ENCRYPTED FILE----- 141 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRNFRRRGt0aFNhZVlvWlhK 142 + bmpacXcvci9JVTRvSS93Ujc3c1dNLzhNTGhVCmQ0dXpoRVBTQTMyNTlNc0tZdjVa 143 + dFlLM0VtQURBMHZ4eHBTMG84TGUxTEkKLS0tIHcvVVlnVHdvc3BTeGlTSC95eml0 144 + d3BiK1RxeEVwdkN3TWNId3g5STBBczgKr7sJM56Ud/t3aYRztc/0xPbvz7GMlAEd 145 + +LUfHtZf3dAitheoKNT5bSujx0pQHUaD/YmL4ZHMsnxrQeEgcSlezQ== 146 + -----END AGE ENCRYPTED FILE----- 147 + recipient: age157en2pt286a22pxzyugt84ak6rn2at89tpma88juqfgj84lme5csq4999g 148 + - enc: | 149 + -----BEGIN AGE ENCRYPTED FILE----- 150 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZXdTZmpwNzBpUERyNTFK 151 + TURpdDZ5ZG92Q2JWbkQrSlFmd0F3RG95MmxjCmNLNlIwMGtqU09ZbWtCRXdZU1Ba 152 + dlNQa2ZOVW1uMlp4bGVoMHVPeEYvRUkKLS0tIDhZVVFKVUNPcXJ4Q0pLek13Zzlm 153 + bHByS0tCYllIb0NrWkF2dXo5bHE2UmMKTtQ8LgPWIr2gs04RXeX2ITDgjIRSxPuw 154 + 2ERYEmxMHdq+MV2BiaL50SOhNoUEYBcNl9zC1N3ShxKRWhdEq8SMBg== 155 + -----END AGE ENCRYPTED FILE----- 156 + recipient: age1axn36h9356ena7rq6y2xa4rcm250w9h0m9pz6x0677gla0v4f4dsj92yfm 157 + - enc: | 158 + -----BEGIN AGE ENCRYPTED FILE----- 159 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpZUdYWWgvQUsveTdaS0lo 160 + UnZwOFZyTUx3Mi9zYjNOaUZmR1BscDhFTlZzCnF0T1FSYTdlYjRoTEEwVDBhRVlT 161 + RHQxeUxDampNSnVjQTJIeHU1ZnpXMVUKLS0tIFNGTm9vemxmaFNsbjNuS29ORDkr 162 + ZE1NazRBemIxNW5qcHpBTFkzNEwvMGcKKNnv7XlwBXfDRXEeVZFNJxrNX7A/TORl 163 + EnaqVbsv1Vtiklx45krJwKUhe4F2HZTNB3f6+/gyHUDW13Wa5Va+1g== 164 + -----END AGE ENCRYPTED FILE----- 165 + recipient: age1xwlrtfu3du4jxg2l6eemzqeed8tflhdkjn0q5j9pzpecshtp3cpsh60l4j 166 + - enc: | 167 + -----BEGIN AGE ENCRYPTED FILE----- 168 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0QVU4VTlqZGVlRi84VDNV 169 + N1VZc2d6M3dCYit1UTh4blBHS0k1K3U4Y1djClA2VVVKcWVYRUp2RWNhQXk4OC81 170 + QWpQcXdIbXZhaUhCamp4cmhVL2RFWGMKLS0tIDl6aWlOSHFjVVM5SzVHV3Excnc4 171 + aFlkUHk4ODZpdW5rQ3ZjbHJRMWRNT0kKLCChEohQi1AbRuUc0ySEu/xyBhLDGduY 172 + 33scin78pw/ruJV38Q66h3+869zY14AVBbqaSnITP4TStRUc+83Yww== 173 + -----END AGE ENCRYPTED FILE----- 174 + recipient: age1kgp3x48wn0dmzwqp0vdpfsdw42rej0ypkj0qavs7c2t2tgdud5zqcmhl40 175 + - enc: | 176 + -----BEGIN AGE ENCRYPTED FILE----- 177 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPNlMwZzNXV3cwb2Zxekc1 178 + d0Fsc1NzRi9XZ2Y1c0R0VVAzU2dwUU5oUDF3CnVkTGdtUmVNRG1TMnpWbGVuYjc1 179 + SEdheVNzMlJ0cngrMkIrQVFmbUdJLzgKLS0tIEwxVDRtRXowUkpiRkxpMEpaN05Q 180 + MC9IZURSVjBtYVk5Q0dMK1dGREhOcUUKeDvVVWSYSnkmGdyLOwkNmif5z3U58/oY 181 + VbuUYc6fmv/w61ET5ltdqHpzKwc11y0yvpMhpVCGLLxgNZdXuYFvqw== 182 + -----END AGE ENCRYPTED FILE----- 183 + recipient: age1sukfru07msq8fm5ddgym23yal9lfm99090p999p09mxgrrwh9aqs6zp4fy 184 + - enc: | 185 + -----BEGIN AGE ENCRYPTED FILE----- 186 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTk1tNWdUdWdveGRUU2hX 187 + Vmd4UzR4ZkVqWFdjVFUrTWhqTDZLWDRobmxzCnBicFIvM3VEYm4rUC9LRmZGemYy 188 + cFBTM0R3UmorMzFzU1BGeWtLa3BqZmsKLS0tIFdTcWxRU1FzY1FENUdXdDB5NSs2 189 + djRaSk5Zd1JzT3M0dXZ5V0VkRm1SMTQK3MUaMZl56X9Cd0HjZ9VA1Km9FRgF+hKZ 190 + 40GUY7a0LARln2mzfK4XFowHK9LHjlqSZbNbfkJdu7OAQw8RB49yEg== 191 + -----END AGE ENCRYPTED FILE----- 192 + recipient: age1ephzrpgftmvq4cul9766q2r3mss38xu6un74ryfmw0729afysghsh0a3qg 193 + - enc: | 194 + -----BEGIN AGE ENCRYPTED FILE----- 195 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhTTRlcTBSSTVucXcyY0to 196 + VzZZSmVvQ1FJcUdkYU03N290NCtFUkZNWlMwCjQ2WDA5MWtzYUNYMlQ4bmtFOUR4 197 + SXBZMUxkVk5peCtBTVdvazNuM3Z4T2MKLS0tIERtMktRUEhOdGRZYWpmZUREZUcr 198 + VWxYR3gxdFdCOU9ISmFSUDFSSkY4RFkKVQx7Kw1pqu3GnxwV9723aIFqQI7yAnH5 199 + mT7PLcwpfvL/yvmUCH0kDyqxtWZY7fTXX2F1H+ZBiPW8wyfdY0s8GQ== 200 + -----END AGE ENCRYPTED FILE----- 201 + recipient: age1stsuakfyj3gkee4sm328ky2crmymyuzwjjmxrpvnm754sdt2zvnshf68jx 202 + - enc: | 203 + -----BEGIN AGE ENCRYPTED FILE----- 204 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTXhHZ0MzcitjNWg4OU4x 205 + dXdWVmRFMGMwdTl0L1kwMGNOK2pKcWlneVhrCmgxU3RybVlja2R3M1RTbUZ5TFBB 206 + Y01QS2MzQjZBKy96UTh4K05tUm8vb00KLS0tIHc0VHFFOCsxbFBid3FLZzdpQ3hY 207 + M1BseDNCY3VYK05NRE5NaUh2UGxaZ2sKYmOgTFQEWDLsas2K5urwjK9+e96ps19V 208 + sYgp1qcJksOlqCxnaUdxIaqlpDp6ymBFDiBIUDJXVfBtTUCv9IkJVw== 209 + -----END AGE ENCRYPTED FILE----- 210 + recipient: age1s7ecrfntus8rvyprzhffjpqk2tmrc259knf9xqajlrqvewfp8d6svwp9pp 211 + - enc: | 212 + -----BEGIN AGE ENCRYPTED FILE----- 213 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVYXVEQVJGUm8wZ25VQlF0 214 + ZWloRDdwRXBXMTB0ZGFiekxrUy9CckdmQkRFCkdnQmNIUnk0Yk1kNkNXOEoxcGxm 215 + VkJXT0hmZFB3U1JuR1BCTEk0MjJPdTAKLS0tIDdrYkpNNlROalBUOGxSUk1HUmxT 216 + bWFIMHFqYmxVRllmZEVzL2pyeGlWS2MKyi2JpJSOgBDgXQy+Qc5mKJ8FHyb4A312 217 + GNbHNlQkxr1LC+nQZiDd9XEmQeRCV/S35R/2UIO6Y1dDG3nBGMdEkQ== 218 + -----END AGE ENCRYPTED FILE----- 219 + recipient: age1yq47x0cyf95jg372v84ttptgnppsrfmxshsua6p58ecmgzxc5c0s5stfth 220 + lastmodified: "2026-07-01T19:24:47Z" 221 + mac: ENC[AES256_GCM,data:LqvQIhp8t7tR9TJsGeN8USEkpWELPOcgTJyn4hltB8nbUQmal9SCaVCOFOJeaHJHEDYZ7Jwb00dTmAvTzRyaERWroSQXc4r7zncp6OqVwsdtWvgOs/ue8KgLW+rFTwLIDW9dUKGuxaLrqooplJcj+B0uXVIXEWLv0t1b7c6XQfs=,iv:E3alANpPKiTga+j+mAIHh0Qa9v/sYFKK1yXXkeX0a1U=,tag:zFzWIHMfiWrbgUdyj6AyZQ==,type:str] 222 + unencrypted_suffix: _unencrypted 223 + version: 3.13.1

+14

k8s/flux/secrets/namespaces.yaml

··· 1 + apiVersion: v1 2 + kind: Namespace 3 + metadata: 4 + name: cert-manager 5 + --- 6 + apiVersion: v1 7 + kind: Namespace 8 + metadata: 9 + name: longhorn-system 10 + --- 11 + apiVersion: v1 12 + kind: Namespace 13 + metadata: 14 + name: tailscale

+220

k8s/flux/secrets/tailscale-operator-values.sops.yaml

··· 1 + apiVersion: ENC[AES256_GCM,data:tSs=,iv:9Jxg2iewFJnF2FLmGGAKfvZ3GVaxKKa5vSmdTPvdN2A=,tag:MiYzwAYV5zcDl/B4qQVriQ==,type:str] 2 + data: 3 + values.yaml: ENC[AES256_GCM,data:7dbdaxQ6XElHS82BwL6wbCIVo+tWjVAKUM5QwEGj2O+LoZyuqdxCVHQ0IeF26704/EUTRZphZAhsaGoA/dgHjEpIXxWtygKyyUvXq8XVKB5WWNBAMSBV7WUme7+i884zmbymeJRZ2MpIf1WFc+qneR7fWF8w9PDiHCqmqTYFlobYkP+7ay5wrS0jFPzbNr0+6ehvNsEg7pSTGfCyohVTKjQ5rCbE7qvujZxtHPNtGbC8sgA1mMe2bPMMY2Ly9HCM5jnfWroG4JE05kKeJYurd/K2Px61u9DH9Au1r27wQg0=,iv:imJ1XBFGNdrCzjPQsWTdZJdacnhv7C1NlmmxGO2QXKQ=,tag:kX4MC4szQxyS2zjAPAD8Vw==,type:str] 4 + kind: ENC[AES256_GCM,data:SqZ83+Gf,iv:qW99vd9BS70dj5qBZDUB7uEB2gaVtBxAeG1m+WUhoNg=,tag:KBNqAkEsjTTyY95CjH7+Gw==,type:str] 5 + metadata: 6 + name: ENC[AES256_GCM,data:dyIU2zdYgdLOjYeVMBo85UwAiQ5jLO7cZA==,iv:4VP0GfYxbXcizLp/PXIqh548tDp+sBEluM5oEV9CXVA=,tag:aP+k5gzNdN4fRZ0zACeIkA==,type:str] 7 + namespace: ENC[AES256_GCM,data:4+XMfD/sLWHcZWQ=,iv:6yOmI5SN8V0PAnrE7DXtcUtoZijwEmoXITtoXBpypFQ=,tag:qbFP/OvYY8L01FKIY5b8eQ==,type:str] 8 + sops: 9 + age: 10 + - enc: | 11 + -----BEGIN AGE ENCRYPTED FILE----- 12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFK0ZZc0ZrVXlzMDJ1NVhO 13 + blZyOW1NZUU4bTlqOWQxTVRoYkFZRzFkaXhjCnZpSzVzbHBmT012aHJQb1BWNkk3 14 + K0V2ZWtBZmF3Mmtxcm9GZlhlK1BqMDAKLS0tIEZXd3R4REVLQkplaVhvSndHcFlH 15 + M0ZOVWhQYnlTL2N2Vm5mZkM4YW5talUKQkHsXqOeqshB1qp7LmpEURyey6SwuGBj 16 + QSxp80Ijg2pz97G9NjGN1tvWlTn5ijfR2sw0Zok5kP/8jpz04Kvdww== 17 + -----END AGE ENCRYPTED FILE----- 18 + recipient: age1g79dfm0p44q5yxzhwd9syg965lupdu3n5lgyltdannmul5v5v5aszzz3gs 19 + - enc: | 20 + -----BEGIN AGE ENCRYPTED FILE----- 21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Q2pTTmsyYi82NUlMdjRu 22 + UjBrNmZLbTRHYTJIRFRIS1I2emdrcm5pbW1VCmVPZldlN1NpMHFxelRmMks1T1dj 23 + bXZXOWcyV0tqVGNCS283OWJPbUszNzgKLS0tIEIrWEtKRUlhbnZKdE1uR1dLOU8r 24 + b2VFQTVWa2NhazRCeHFQMlkxTGdraXMKdbtIN9bmIqaK2JDXlg+jJK1dwJjsYgT4 25 + DxQRdhvuvyEiY7gmhsS5IP4LxB17FFz4G5u7A09vUMDVmZOQdqGqwA== 26 + -----END AGE ENCRYPTED FILE----- 27 + recipient: age1cpcg5t420nf72k0c9rrx7amg0szch98uzqu273exj7lw3yu0j99q6vcckn 28 + - enc: | 29 + -----BEGIN AGE ENCRYPTED FILE----- 30 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxZlNnY1lhQ3hReFZZaEUy 31 + WHo4T2tJK2h3VnFNdXk3TjBudnpDejF2YVE0CnhVNUNMcWd2RkQ4TVBleVBWYmg1 32 + YXZaQUxUSWVxQ1VtcEx2SjQwOXJxRVkKLS0tIHNsNXhxRTc5ZXhJL28wMjM4TDZn 33 + ejFtYzBqS3ZVRnRmd2R1SHIrWlhrZGcKko0dplciaS/45h+LWf9I3HDhY434TFMf 34 + CGXL11aWS86UTZdm08TxO/qqMMNVbWt8QYqQWoL39dltsPIl7hJQpg== 35 + -----END AGE ENCRYPTED FILE----- 36 + recipient: age1w4mzwe89aqgs56mn8zg7dd2l623kwmw80k90wr2sa6dnlcdmhcnsp4kt54 37 + - enc: | 38 + -----BEGIN AGE ENCRYPTED FILE----- 39 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzajFGUlFiYUJ5Nmhobm40 40 + VGxEeCtRNTdwNWE0TzBKTlBHQU4rTWpBK0djCmJlK1RVbG9PWkpIVmk2bi9jUmgv 41 + WCtzMjRhVERaQTN2UDd2VjgyMEtBcjgKLS0tIDVBa3VPZnBvZzFiL1JqMGUxS0RP 42 + VHBYaCs0eWQxUkJuSnpGTzdlZGMyMmsK8WpMVAINO5ss6LgMqnMQ9lLbzF6KyoWh 43 + BXt3o+SpOvK2B7mhvPsQrtREVN7Z2GvJAxGgIZVtEd0ewP3G6kGpTw== 44 + -----END AGE ENCRYPTED FILE----- 45 + recipient: age1e5a0aaueyk34klry2qk094zrwfsvga0uft93mwweye30xhqhvfzs3jgqku 46 + - enc: | 47 + -----BEGIN AGE ENCRYPTED FILE----- 48 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSHB5WkZzNzVuREFPaEhT 49 + VXY3bHFxMDZCdDN1SEZIS1dsNndmT0hDZXg4ClV1ZStnUG1EcXBaa1BJQTZWbzFi 50 + bVZOdHg4NHR2N0NCZStHRStLT3dwdHcKLS0tIGJDaUZuaFJGSlFIUmtYVzJEclZP 51 + RWY3ZCtCUDZiK3EwWTRYTFYxbmxDalUKybkcmRdisbAVx7XQomt2ctBV7AylZ7i4 52 + q/RrNgW9eXO416bPEyg9/xyyVVz784TE/ByWq5toeh5lBSBwg6uF+Q== 53 + -----END AGE ENCRYPTED FILE----- 54 + recipient: age1j9jju3whwj72udhge7v4c77gk6v6w2cq8zjngzyppwtptfsz499qyywu9a 55 + - enc: | 56 + -----BEGIN AGE ENCRYPTED FILE----- 57 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbzV6end6aWlDdXNwM21y 58 + K1lhblFoMHBVbm1teGZBR0JQdTJVWGplb3prCkd0NU53WGYwbERqRmZDZ2J5SThm 59 + eWhRTDVjR1JjbXYvVmRaNmp1NjkydTgKLS0tIDY4V3lXMGdyZlhvRWpFLzhCQWFq 60 + bUdwd3ZLWS9mOVVaMGJiZXd4QXpMRkEKzEA8G8Ga2KJ0o5r++5sw6GerkPI3BIvZ 61 + WwecDKEQDHq+vrNKxBK90cZ6yq6Vo5Cv0h6H+EYeLDK4sQvQrthgCg== 62 + -----END AGE ENCRYPTED FILE----- 63 + recipient: age162sx8kppp90mjxw88eqs78hgnpkddf8k9kgtksmmexzvcdxknpkspmkgaf 64 + - enc: | 65 + -----BEGIN AGE ENCRYPTED FILE----- 66 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrcHZlTVk1dlQ2WnBORlp0 67 + UjlJTEo3SlpHNHdGOTdYMXdXRm5LNFBSV0NFCjFacmVObi9mdFFzMlcraDlpTkhL 68 + RXdpUC85NWpoYWQ2cEl2T0pnT0gxSG8KLS0tIHo5cDVlRGZZUitIR2syTE1hZDZW 69 + anM3am5ndEJsSEdsYS8vWTJINVZRUlUKqo2LJMdJtzodNMoIfztB4P1kYKR4HJbO 70 + 3qgxSHPhxEd0hf+PAJO9JiJNLCK17lkLnil3EQoTKkD66WPNCGtS4w== 71 + -----END AGE ENCRYPTED FILE----- 72 + recipient: age1hhvzccxzrysq6ak2ktuks00vy3smr6rhey9swhncq8850epftpjqt3c7f3 73 + - enc: | 74 + -----BEGIN AGE ENCRYPTED FILE----- 75 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSmNyRjN2eUwwVmd0ZFJs 76 + dWpUaEZlYlRwNXNJelNKYVFSY2JMSXBNRmpJCmZIb2hDakxHNEY0dDllTHNEaG9j 77 + dVVpeGFmVE41ODhTcUpsbjhDZm5zbDQKLS0tIHVyczB1Yi9aOU1UNTJZQ3h1OGRi 78 + ZWdVUFkwelBDVkNiNVBQc09aM3IwQlUKxrkEkOidLOQu3MWKrT1G0GlrL6PNrJAz 79 + ko49GGFJy34Yy2u28b42GHUGthenLK4ShoDfZnQCgeTFxHwuEJe2jw== 80 + -----END AGE ENCRYPTED FILE----- 81 + recipient: age1mpcyeqjcl8j0dd4sj6f0vufs2vpus3xn4dvxe3cr8g8rgcm0nfxq03ds4y 82 + - enc: | 83 + -----BEGIN AGE ENCRYPTED FILE----- 84 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBON1FRcTZFL29ocS82Z0Nr 85 + SDZFRDRHajNBMFpobGNTdmdBcldUR2cyVGo0Cks0aGtJd3JaMmVIcHFNUjVuSWFl 86 + M2lUR2RmT0k2bGhtdnRLSnd6SkpETVkKLS0tIHdVK2syYXZVVm43cVlKQ3ZIYU1Z 87 + d1VFa2c2d0dNTEJyd240TFV2NytSSUkKJwivQDLhpq68hmi/o6nQzxcz35rB8Qn0 88 + hIVIWcQEydpr8elsxyvUUirdVDjyHWWTz3VMdjkPnnLdGoGujkSbcg== 89 + -----END AGE ENCRYPTED FILE----- 90 + recipient: age1zj2aq2a2v3ngcer7s3jz6pufhh8ula8pw56etmy28dy25wrkk3vq59hu2s 91 + - enc: | 92 + -----BEGIN AGE ENCRYPTED FILE----- 93 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RFN4UFNuOVpRMFR1dUl0 94 + c0xKUXRkK0RzMzgwK0lVaGFzN2w4WVVkZndvCkFLK1JyUk9JaHA0amIrUGlvV0FI 95 + OEVRNDZJUzJteWhmZ21mUjkxdm9CUFUKLS0tIC9tTWhJZ056K29QUzNTNmhKOWJV 96 + ZlJXZ1ozamdjOGEyZzZpYVY0Qkg3NWMKg5/ja8GYRUMZZI4OBSfYRb1fEb2VW756 97 + /zugbbaPTOkgUPCOCbexu77kqzX/mMLLVuu6YFMmemzIThCDN91Ylw== 98 + -----END AGE ENCRYPTED FILE----- 99 + recipient: age15td0jk5e2qeq2pexvxguhuuaxuaa7nhql7mhx9jr79caska6t4pqdv5spl 100 + - enc: | 101 + -----BEGIN AGE ENCRYPTED FILE----- 102 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5Y0NpQ1huUzJVWGZGK3pJ 103 + K2tUdTkyazZndWlKUk94c0gxRVRidXhUWGdzCmhTdVQ3MFRUWG9KQm5hYlRTclQw 104 + UTIwY1NDM0FwRW1ubEN2cXRvdk1tSTgKLS0tIHJYaVlCN1Q2N0hJVGl0c2NBQzZh 105 + bXdzdmE5ZVVSN2VWeml2RjF1Tm5KVGMKNilLVc4CVCyLQpp/ZIsJL8xctliO+FVz 106 + E5lpvAXbP30JJREypl2mtS93ombmrciXdrPmI6W34Bf+YFDVw2rLCQ== 107 + -----END AGE ENCRYPTED FILE----- 108 + recipient: age15mhrzghrmprq387xqsln6996yx3ja2e2zpamh9mtuu9zqmxahunqg9qugw 109 + - enc: | 110 + -----BEGIN AGE ENCRYPTED FILE----- 111 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmNFBrVlEvRzFFdnFIWmhC 112 + dzZuZkV0cTlIOVR6OHNEVnhBVi9xaWo2b0RnCm1HRW9QTlRnSUZjeWhLcjVXQTAx 113 + eGlUZDlodFp4clV5bzZ0eWgxZWZoQlEKLS0tIDZQSEkvdkUrWmEwS21EYVFsM3Fu 114 + TTFKMlFObWJ5L294Nm1IUmxobzEzb28K3bfGmcwaUW+wffvyy7kCeeqtt0kwnlgr 115 + YZkJHwOS/CebX4ZcV6b1Du7NS2rW1LOz3n81zvLepUH5zSQlt3+EtQ== 116 + -----END AGE ENCRYPTED FILE----- 117 + recipient: age1su5lre6favcv6gdc50yh7ecv33qgfp0tm6klunpuasa3q79kmqtsykaq0d 118 + - enc: | 119 + -----BEGIN AGE ENCRYPTED FILE----- 120 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGRXlvUFpJYlRyVkxRaGRm 121 + L0JmTEdGZjdiNDdvU2x5ckUvdTd4bE5ZTGtzCi9uSUNFbUx5TkFrck9JaU5FVGp4 122 + UWZKczJuV2llYktQUDNLWGZzN1A3OEEKLS0tIHIrTWo3UXBsbGhKak54M285QUE2 123 + Y2lGcGJoVGlNT3RxQUg3YVVmTmpoOW8K8tvRYzbr1//+egV3U+6ZXFmRWKnsE+jo 124 + dsLmNYmHamrXNWbrSYzkgbnesS2aMsRcZlVi6NJ8jmtOOGrSslVb4A== 125 + -----END AGE ENCRYPTED FILE----- 126 + recipient: age1v4x5alkmvxsx5jsrwpecx0tne0ch2rwfkk0rq5w8x578j2pf5urssg5gx2 127 + - enc: | 128 + -----BEGIN AGE ENCRYPTED FILE----- 129 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjRmkvODJYWlJjckUvVGNX 130 + N0s1RVhiUjBObzVOSUlXYzVldUFwaEJ2N25zCnlYZ2xRdWo3bGNPWjZmLzNzNzZX 131 + N0NQK3orRW1Yc3RtalBVckpNTm0rZWsKLS0tIEx2OHdtQndSejF2bWwxNTcwZlNL 132 + WlNqcHZrSWNqQThodC9sT1BsTU9SNm8KJfn89K4cjnZ3BEyolzPjDO9Cd8cpioDU 133 + 1MkucxtNIpgVEwROcNdHaGoyMKHbB+9uZvtKdCNDlFAjEYK6A7rUpA== 134 + -----END AGE ENCRYPTED FILE----- 135 + recipient: age1f9hd8fu0694rc3tr6hwxz3ldfpepref937rmvqdxvvsr0kfcjdxswyzvw3 136 + - enc: | 137 + -----BEGIN AGE ENCRYPTED FILE----- 138 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSCtUalhqd01lajlBeW1F 139 + QThsejY1T0dNa1JHUGh5YTA3YjlPR2ZhdVNjCm1Zc2lpSmFzKzlaekpTVW4xK3FF 140 + T25aZVUvRE9QRlR6VzVxNm01aDdEbzQKLS0tIGt6QjRwcjEvRzF2Vi9BVEF1REpz 141 + RHM0enhTVHFSSTNXdGxxa09vd3EvazgKQ3XvyXkxGSkvHF5v7ehW+g02msLhWxVx 142 + tzhNApc4DssooOjG+BBpAkXBe8lzlgL0N10V7bYIYKdIq/K8NjIBXg== 143 + -----END AGE ENCRYPTED FILE----- 144 + recipient: age157en2pt286a22pxzyugt84ak6rn2at89tpma88juqfgj84lme5csq4999g 145 + - enc: | 146 + -----BEGIN AGE ENCRYPTED FILE----- 147 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTanpIMytWOEJ2UmRma2Jo 148 + cm83SVJIWDlidGNqQjYzRTBheEMvOU9Jc1JnClJxOVNzOUg0ZXU4Rkl2Z1h4N2Vw 149 + dXBod3p0aWpKWlJNb1FMZjRwQ1ZRZDAKLS0tIDlvcDZEVzBIN25WOHB4WGRUd2hk 150 + aDlsVm1NaUJ1UWRnUDR2SWF5NVpvMTAK2G56dk+nZj23U+nAcNZI3yNQ9I/qCPvC 151 + Qw8iE9MR2or5BQzUat9VdlHt4dNb/UdcJsqbF1w2kbUOAnm11gAvUw== 152 + -----END AGE ENCRYPTED FILE----- 153 + recipient: age1axn36h9356ena7rq6y2xa4rcm250w9h0m9pz6x0677gla0v4f4dsj92yfm 154 + - enc: | 155 + -----BEGIN AGE ENCRYPTED FILE----- 156 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpVVFTLzZKeFRVMFNHRjE0 157 + RE02KzczWXdzUWk0eU5QZDR4OWtiZWwzSWs4CmhYRnRFYUFjRG5aRlhQOWFHWGVJ 158 + alhqTWZDbVl6SVdZUkJHSzExSFZqejgKLS0tIEpiSDZBaTBJS3NBc094dmtaZ2F2 159 + cVNRdzdlR3lITlpibS9oY2tyVk8xNkkK2946LsQihSoxIozPXJDmLqaoZHCXMk9v 160 + +rfGkQBwbOUvQUlVEeYQFtc+/w0gjWrxXBwpWwtuxCITHjMDXKu9IQ== 161 + -----END AGE ENCRYPTED FILE----- 162 + recipient: age1xwlrtfu3du4jxg2l6eemzqeed8tflhdkjn0q5j9pzpecshtp3cpsh60l4j 163 + - enc: | 164 + -----BEGIN AGE ENCRYPTED FILE----- 165 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWOVdFSklSOURsTHM5RXQ5 166 + dHlGTWh0U0JOTVNnQStsMkFXa0ZCME1EeDNvCnRrWGVMQ2NIdnV0RlBDNFAweU92 167 + Y2R5QVlWaXFJSzkzVEt1eGVYSXI3ZHcKLS0tIDFwSVk5eU9MNkRsa3h6NnlWK3h1 168 + OCs5MENzR2ZCVWxvTE9jaHlWeW13alkKXKebYWjvaaGHX1XYfvJtTRJT+NCZCOWy 169 + 36EEyJ9baG0NZGorbMc8elqnlrIagp/fqOFqs3k5zQrWGur8adTKJQ== 170 + -----END AGE ENCRYPTED FILE----- 171 + recipient: age1kgp3x48wn0dmzwqp0vdpfsdw42rej0ypkj0qavs7c2t2tgdud5zqcmhl40 172 + - enc: | 173 + -----BEGIN AGE ENCRYPTED FILE----- 174 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMFg5Vi9TS01mNlRFMHdL 175 + WkpxRzN1REVMR0N5N0RWV2pqbEJaQzgrZ0JFCnJZMGJncFhmc3QxZjM1MG1XRGtl 176 + YTZsZ2Nhd1UvcTdIaWJzS0MxNVZ6amcKLS0tIFpuV0J3ZUY1eDY4YkQ1MmhaMnEw 177 + Y25ZQTFyaFhxWHBFWEdGajAyN1g4WFUKwbXDQ1VwiEHdHsn71JZ4u84X9FFSpJ4L 178 + B5alO5RQvgwR3LRiTbUqCc2nJqiDVCS0ufmb8g5IyAEjzVUBreHUAA== 179 + -----END AGE ENCRYPTED FILE----- 180 + recipient: age1sukfru07msq8fm5ddgym23yal9lfm99090p999p09mxgrrwh9aqs6zp4fy 181 + - enc: | 182 + -----BEGIN AGE ENCRYPTED FILE----- 183 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4WHF1THF2ZHhrR2F3Y2FJ 184 + WDl4VGtNYWJwcXE2bjIrYnA4NmNrUnhoT1dJCmNOR1VsVUJBVzlMZVlpbEN3UEJI 185 + ZTkzUU1LVHVlTmFaQlVYOFhzb0E1dDQKLS0tIGxHZnZlalV5TFVuakpWdGllbUNL 186 + bVBpeWp6VkFwQjZrZVpaV2J5bU9PR1kKLk/xKaEQpmehPX4DGh3tJVp08SAkr7v/ 187 + OXaSMRMkLK5/Vby2eZmetwxS3t6FROp5fs5YqNmLWLHs1Tjj47fbqQ== 188 + -----END AGE ENCRYPTED FILE----- 189 + recipient: age1ephzrpgftmvq4cul9766q2r3mss38xu6un74ryfmw0729afysghsh0a3qg 190 + - enc: | 191 + -----BEGIN AGE ENCRYPTED FILE----- 192 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByM0FSS09vdmJTMzJMSjdz 193 + NnpFV1MwMzFrR2ZaOW9RWFZSeloxc3NEQXlNCkZ4aTZqR3VsUkRkTXBZS0xVSFVp 194 + TUovMzJGSlU3T1paWUJPS1lxUUhBSU0KLS0tIEhmNmNvdEE1NHJ6d3ROWWplTDVU 195 + Z1ljaWpiVFBpbERYd2ZOdTZ6U0tUZmsKXEXjaG7kTjPuJXTelstp7JOI4RTqQYkL 196 + p77SoomaqBpazq5dZVnKMDz30d7bZ2Sx+bl6rqWnShjsSIqKl3IyyA== 197 + -----END AGE ENCRYPTED FILE----- 198 + recipient: age1stsuakfyj3gkee4sm328ky2crmymyuzwjjmxrpvnm754sdt2zvnshf68jx 199 + - enc: | 200 + -----BEGIN AGE ENCRYPTED FILE----- 201 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKMnhORzZuWVFkSGhkZmNm 202 + bkd4cjdHOEpSRzRZY2pYS1d6V0JDZE9jOFdvClBzcjl0dHBiVnQ2T1pRU2huSzBO 203 + QVdreVBFOTNUZVdsblVkUC9tR0kydkEKLS0tIDhoSHVkMUYyNTNlMWVKV2tBNTF6 204 + WkJIdTVZaDk3QUxVUXJ3eWxJZ1VESG8KP3w2WeJcvxR5PCvxAdiFagelRAZJvtWe 205 + kCn7AwnMcd9mHy7/G7axr7bMcsoVDfeZ/K3OfxWQsDkH+v97XNd8Vw== 206 + -----END AGE ENCRYPTED FILE----- 207 + recipient: age1s7ecrfntus8rvyprzhffjpqk2tmrc259knf9xqajlrqvewfp8d6svwp9pp 208 + - enc: | 209 + -----BEGIN AGE ENCRYPTED FILE----- 210 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmN1I1RjU0Mk1EbHV6djVy 211 + RXdxRzNSZTNDWFlKdGlOdzV0eFRmOHRYRFhRCklDWGtiRHdhaHVvMlJvOUVXU2h5 212 + SldweGNNSmd6VUVEbGRRQm5kZGxUMm8KLS0tIFhLMFlrbDNGZjRUYUhocEE0OEdV 213 + Y2t5c25IVVU5RENhbnZLOVhTSjVwUTAKlzGi7mp9jP3wqckrV5wjiTsB5Do+i80h 214 + epIgGW+OeYUNg37ZMnKL3lcQ9/Z47FZQwsQViH0YdPJ8o1dclczmRg== 215 + -----END AGE ENCRYPTED FILE----- 216 + recipient: age1yq47x0cyf95jg372v84ttptgnppsrfmxshsua6p58ecmgzxc5c0s5stfth 217 + lastmodified: "2026-07-01T19:24:47Z" 218 + mac: ENC[AES256_GCM,data:Q7KQ05P27ukWzUcWSjfoy3skMnPkTA5GVlRsmeiO3fQVkWc9TI4GhtG7uGGo0a0CdayW925ziHZglVgzjA4F6uRu19hYypNjA1XnUvLXqXAff7hDOlxexHbJwpo9eDnTx14oEK1S0wh37LJhW2tF41Rg6q8GFb7ipukuVYKYFuc=,iv:zZrfMU2qrufP8tdDC1GJQzPyUUUN/gK+wunoAKPBhQ0=,tag:tQBvVHHOH4g9qpiQJEvv9w==,type:str] 219 + unencrypted_suffix: _unencrypted 220 + version: 3.13.1

+20 -1

k8s/flux/system/layers.yaml

··· 14 14 apiVersion: kustomize.toolkit.fluxcd.io/v1 15 15 kind: Kustomization 16 16 metadata: 17 + name: secrets 18 + namespace: flux-system 19 + spec: 20 + dependsOn: 21 + - name: sources 22 + decryption: 23 + provider: sops 24 + secretRef: 25 + name: sops-age 26 + interval: 15m 27 + path: ./k8s/flux/secrets 28 + prune: true 29 + sourceRef: 30 + kind: GitRepository 31 + name: flux-system 32 + --- 33 + apiVersion: kustomize.toolkit.fluxcd.io/v1 34 + kind: Kustomization 35 + metadata: 17 36 name: infra-crds 18 37 namespace: flux-system 19 38 spec: 20 39 dependsOn: 21 - - name: sources 40 + - name: secrets 22 41 interval: 15m 23 42 path: ./k8s/flux/infra-crds 24 43 prune: true

-136

k8s/helmfile.yaml

··· 28 28 # Ingress, storage, postgres operator, tailscale operator. These come 29 29 # before any app release that depends on their CRDs / StorageClasses. 30 30 31 - - name: traefik 32 - namespace: kube-system 33 - chart: traefik/traefik 34 - version: 41.0.1 35 - values: 36 - - deployment: 37 - kind: DaemonSet 38 - service: 39 - type: ClusterIP 40 - ports: 41 - web: 42 - hostPort: 80 43 - transport: 44 - respondingTimeouts: 45 - readTimeout: 600s 46 - writeTimeout: 0s 47 - websecure: 48 - hostPort: 443 49 - transport: 50 - respondingTimeouts: 51 - readTimeout: 600s 52 - writeTimeout: 0s 53 - ssh: 54 - port: 2222 55 - hostPort: 2222 56 - expose: 57 - default: true 58 - exposedPort: 2222 59 - protocol: TCP 60 - updateStrategy: 61 - type: RollingUpdate 62 - rollingUpdate: 63 - maxUnavailable: 1 64 - maxSurge: 0 65 - additionalArguments: 66 - - "--entrypoints.web.http.middlewares=default-error-pages@kubernetescrd" 67 - - "--entrypoints.websecure.http.middlewares=default-error-pages@kubernetescrd" 68 - nodeSelector: 69 - cute.haus/ingress: "true" 70 - tolerations: 71 - - key: CriticalAddonsOnly 72 - operator: Exists 73 - - key: node-role.kubernetes.io/control-plane 74 - operator: Exists 75 - effect: NoSchedule 76 - priorityClassName: system-cluster-critical 77 - providers: 78 - kubernetesIngress: 79 - publishedService: 80 - enabled: true 81 - 82 - # B2 credentials Secret for longhorn's S3 backup target. Must exist before 83 - # longhorn references it via defaultSettings.backupTargetCredentialSecret. 84 - - name: longhorn-creds 85 - namespace: longhorn-system 86 - createNamespace: true 87 - chart: ./charts/longhorn-creds 88 - values: 89 - - values/global.yaml 90 - - values/secrets/longhorn-creds.yaml 91 - 92 - - name: longhorn 93 - namespace: longhorn-system 94 - createNamespace: true 95 - chart: longhorn/longhorn 96 - version: 1.12.0 97 - needs: 98 - - longhorn-system/longhorn-creds 99 - values: 100 - - defaultSettings: 101 - defaultDataPath: /var/lib/longhorn 102 - # One replica per zone (cloud, home); soft zone affinity spreads 103 - # across providers. 104 - defaultReplicaCount: 3 105 - replicaSoftAntiAffinity: false 106 - replicaZoneSoftAntiAffinity: true 107 - replicaAutoBalance: best-effort 108 - concurrentReplicaRebuildPerNodeLimit: 3 109 - # When a node goes NotReady, allow Longhorn to force-delete the 110 - # stuck pod so the volume can detach + reattach to the rescheduled 111 - # pod on a healthy node. Cuts failover from ~5min to ~2min. 112 - nodeDownPodDeletionPolicy: delete-both-statefulset-and-deployment-pod 113 - allowRecurringJobWhileVolumeDetached: true 114 - # S3-compatible backup target (B2). bucket@region is the longhorn 115 - # convention; AWS_ENDPOINTS in the longhorn-b2 Secret overrides region. 116 - defaultBackupStore: 117 - backupTarget: s3://aly-backups@us-east-005/cute.haus/longhorn 118 - backupTargetCredentialSecret: longhorn-b2 119 - pollInterval: 300 120 - persistence: 121 - defaultClass: false 122 - defaultClassReplicaCount: 2 123 - defaultDataLocality: best-effort 124 - ingress: 125 - enabled: false 126 - 127 - - name: cert-manager-issuers 128 - namespace: cert-manager 129 - chart: ./charts/cert-manager-issuers 130 - needs: 131 - - cert-manager/cert-manager 132 - values: 133 - - values/global.yaml 134 - - values/secrets/cert-manager.yaml 135 - 136 - - name: tailscale-operator 137 - namespace: tailscale 138 - createNamespace: true 139 - chart: tailscale/tailscale-operator 140 - version: 1.98.4 141 - values: 142 - - values/secrets/tailscale-operator.yaml 143 - 144 - - name: node-feature-discovery 145 - namespace: node-feature-discovery 146 - createNamespace: true 147 - chart: nfd/node-feature-discovery 148 - version: 0.18.3 149 - 150 - - name: intel-device-plugins-operator 151 - namespace: intel-device-plugin 152 - createNamespace: true 153 - chart: intel/intel-device-plugins-operator 154 - version: 0.36.0 155 - needs: 156 - - node-feature-discovery/node-feature-discovery 157 - 158 - - name: intel-gpu-plugin 159 - namespace: intel-device-plugin 160 - chart: intel/intel-device-plugins-gpu 161 - version: 0.36.0 162 - needs: 163 - - intel-device-plugin/intel-device-plugins-operator 164 - values: 165 - - sharedDevNum: 4 166 - 167 31 # Cluster observability. Host-level Grafana/Prometheus/Loki still live on 168 32 # eterna; these releases restore Kubernetes-native metrics and pod logs. 169 33 - name: kubernetes-prometheus

-2

k8s/values/secrets/cert-manager.yaml

··· 1 - cloudflare: 2 - apiToken: ref+sops://../secrets/cloudflare.yaml#/api_token

-3

k8s/values/secrets/longhorn-creds.yaml

··· 1 - secret: 2 - keyId: ref+sops://../secrets/b2.yaml#/B2_KEY_ID 3 - appKey: ref+sops://../secrets/b2.yaml#/B2_APP_KEY

-7

k8s/values/secrets/tailscale-operator.yaml

··· 1 - oauth: 2 - clientId: ref+sops://../secrets/tailscale-operator.yaml#/secret/CLIENT_ID 3 - clientSecret: ref+sops://../secrets/tailscale-operator.yaml#/secret/CLIENT_SECRET 4 - 5 - operatorConfig: 6 - defaultTags: 7 - - tag:k8s

Configure Feed

Configure Feed