Update Helm release postgres-operator to v1.14.0

apps-kustomized/1password-connect/deploy.yaml

@@ -46,7 +46,7 @@ spec:
           value: "8080"
         - name: OP_LOG_LEVEL
           value: info
-        image: 1password/connect-api:1.7.3
+        image: 1password/connect-api:1.7.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
@@ -92,7 +92,7 @@ spec:
           value: localhost:11220
         - name: OP_LOG_LEVEL
           value: info
-        image: 1password/connect-sync:1.7.3
+        image: 1password/connect-sync:1.7.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

apps-kustomized/external-dns/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:      
 - name: external-dns
   repo: https://kubernetes-sigs.github.io/external-dns
-  version: 1.15.2
+  version: 1.15.0
   releaseName: external-dns
   namespace: external-dns
   valuesInline:

apps-kustomized/jellyfin/deployment.yaml

@@ -66,7 +66,7 @@ spec:
       dnsPolicy: ClusterFirst
       nodeSelector:
         intel.feature.node.kubernetes.io/gpu: "true"
-        kubernetes.io/hostname: talos-llu-kx3
+        kubernetes.io/hostname: talos-e48-wv7
       terminationGracePeriodSeconds: 30
       volumes:
       - name: jellyfin-config

apps-kustomized/lms/statefulset.yaml

@@ -71,16 +71,6 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - talos-llu-kx3
       terminationGracePeriodSeconds: 30
       volumes:
       - name: config

apps-kustomized/nvidiastuff/kustomization.yaml

@@ -10,7 +10,7 @@ helmCharts:
   includeCRDs: true
   namespace: nvidia-device-plugin
   releaseName:  nvidia-device-plugin
-  version: 0.17.1
+  version: 0.17.0
   repo: https://nvidia.github.io/k8s-device-plugin
   valuesInline:
     nodeSelector: "feature.node.kubernetes.io/pci-0300_10de_13c0_1569_13c0.present=true"

apps-kustomized/rook-cluster-ssd/blockpool-ssd.yaml

@@ -0,0 +1,9 @@
+apiVersion: ceph.rook.io/v1
+kind: CephBlockPool
+metadata:
+  name: replicapool-ssd
+  namespace: rook-ceph
+spec:
+  failureDomain: host
+  replicated:
+    size: 2

apps-kustomized/rook-cluster-ssd/cluster-ssd.yaml

@@ -0,0 +1,47 @@
+apiVersion: ceph.rook.io/v1
+kind: CephCluster
+metadata:
+  name: ssd-cluster
+  namespace: rook-ceph # namespace:cluster
+spec:
+  dataDirHostPath: /var/lib/rook-cluster-ssd
+  cephVersion:
+    image: quay.io/ceph/ceph:v18
+    allowUnsupported: true
+  mon:
+    count: 1
+    allowMultiplePerNode: true
+  mgr:
+    count: 1
+    allowMultiplePerNode: true
+  dashboard:
+    enabled: true
+  crashCollector:
+    disable: true
+  storage:
+    useAllNodes: false
+    useAllDevices: false
+    #deviceFilter:
+    nodes:
+    - name: "talos-7oq-vur"
+      devices:
+      - name: "sda"
+        config:
+          osdsPerDevice: "1"
+    - name: "talos-iqd-ysy"
+      devices:
+      - name: "sda"
+        config:
+          osdsPerDevice: "1"
+  monitoring:
+    enabled: false
+  healthCheck:
+    daemonHealth:
+      mon:
+        interval: 45s
+        timeout: 600s
+  priorityClassNames:
+    all: system-node-critical
+    mgr: system-cluster-critical
+  disruptionManagement:
+    managePodBudgets: true

apps-kustomized/rook-cluster-ssd/configmap.yaml

@@ -0,0 +1,13 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: rook-config-override
+  namespace: rook-ceph # namespace:cluster
+data:
+  config: |
+    [global]
+    osd_pool_default_size = 1
+    mon_warn_on_pool_no_redundancy = false
+    bdev_flock_retry = 20
+    bluefs_buffered_io = false
+    mon_data_avail_warn = 10

apps-kustomized/rook-cluster-ssd/deploy-toolbox.yaml

@@ -0,0 +1,130 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rook-ceph-tools
+  namespace: rook-ceph # namespace:cluster
+  labels:
+    app: rook-ceph-tools
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rook-ceph-tools
+  template:
+    metadata:
+      labels:
+        app: rook-ceph-tools
+    spec:
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+        - name: rook-ceph-tools
+          image: quay.io/ceph/ceph:v17.2.6
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Replicate the script from toolbox.sh inline so the ceph image
+              # can be run directly, instead of requiring the rook toolbox
+              CEPH_CONFIG="/etc/ceph/ceph.conf"
+              MON_CONFIG="/etc/rook/mon-endpoints"
+              KEYRING_FILE="/etc/ceph/keyring"
+
+              # create a ceph config file in its default location so ceph/rados tools can be used
+              # without specifying any arguments
+              write_endpoints() {
+                endpoints=$(cat ${MON_CONFIG})
+
+                # filter out the mon names
+                # external cluster can have numbers or hyphens in mon names, handling them in regex
+                # shellcheck disable=SC2001
+                mon_endpoints=$(echo "${endpoints}"| sed 's/[a-z0-9_-]\+=//g')
+
+                DATE=$(date)
+                echo "$DATE writing mon endpoints to ${CEPH_CONFIG}: ${endpoints}"
+                  cat <<EOF > ${CEPH_CONFIG}
+              [global]
+              mon_host = ${mon_endpoints}
+
+              [client.admin]
+              keyring = ${KEYRING_FILE}
+              EOF
+              }
+
+              # watch the endpoints config file and update if the mon endpoints ever change
+              watch_endpoints() {
+                # get the timestamp for the target of the soft link
+                real_path=$(realpath ${MON_CONFIG})
+                initial_time=$(stat -c %Z "${real_path}")
+                while true; do
+                  real_path=$(realpath ${MON_CONFIG})
+                  latest_time=$(stat -c %Z "${real_path}")
+
+                  if [[ "${latest_time}" != "${initial_time}" ]]; then
+                    write_endpoints
+                    initial_time=${latest_time}
+                  fi
+
+                  sleep 10
+                done
+              }
+
+              # read the secret from an env var (for backward compatibility), or from the secret file
+              ceph_secret=${ROOK_CEPH_SECRET}
+              if [[ "$ceph_secret" == "" ]]; then
+                ceph_secret=$(cat /var/lib/rook-ceph-mon/secret.keyring)
+              fi
+
+              # create the keyring file
+              cat <<EOF > ${KEYRING_FILE}
+              [${ROOK_CEPH_USERNAME}]
+              key = ${ceph_secret}
+              EOF
+
+              # write the initial config file
+              write_endpoints
+
+              # continuously update the mon endpoints if they fail over
+              watch_endpoints
+          imagePullPolicy: IfNotPresent
+          tty: true
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 2016
+            runAsGroup: 2016
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: ROOK_CEPH_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: rook-ceph-mon
+                  key: ceph-username
+          volumeMounts:
+            - mountPath: /etc/ceph
+              name: ceph-config
+            - name: mon-endpoint-volume
+              mountPath: /etc/rook
+            - name: ceph-admin-secret
+              mountPath: /var/lib/rook-ceph-mon
+              readOnly: true
+      volumes:
+        - name: ceph-admin-secret
+          secret:
+            secretName: rook-ceph-mon
+            optional: false
+            items:
+              - key: ceph-secret
+                path: secret.keyring
+        - name: mon-endpoint-volume
+          configMap:
+            name: rook-ceph-mon-endpoints
+            items:
+              - key: data
+                path: mon-endpoints
+        - name: ceph-config
+          emptyDir: {}
+      tolerations:
+        - key: "node.kubernetes.io/unreachable"
+          operator: "Exists"
+          effect: "NoExecute"
+          tolerationSeconds: 5

apps-kustomized/rook-cluster-ssd/fs.yaml

@@ -0,0 +1,17 @@
+apiVersion: ceph.rook.io/v1
+kind: CephFilesystem
+metadata:
+  name: ssdfs
+  namespace: rook-ceph
+spec:
+  metadataPool:
+    replicated:
+      size: 1
+  dataPools:
+    - name: replicated
+      replicated:
+        size: 1
+  preserveFilesystemOnDelete: true
+  metadataServer:
+    activeCount: 1
+    activeStandby: true

apps-kustomized/rook-cluster-ssd/storageclass-ssd-fs.yaml

@@ -0,0 +1,24 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+   name: rook-cephfs-ssd
+# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
+provisioner: rook-ceph.cephfs.csi.ceph.com
+parameters:
+    # clusterID is the namespace where the rook cluster is running
+    clusterID: rook-ceph
+    fsName: ssdfs
+
+    # Ceph pool into which the image shall be created
+    pool: ssdfs-replicated
+
+    # The secrets contain Ceph admin credentials.
+    csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
+    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
+    csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
+    csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
+    csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
+    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
+
+# Delete the rbd volume when a PVC is deleted
+reclaimPolicy: Delete

apps-kustomized/rook-cluster-ssd/storageclass-ssd.yaml

@@ -0,0 +1,32 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+   name: rook-ceph-block-ssd
+   annotations:
+       storageclass.kubernetes.io/is-default-class: true
+# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
+provisioner: rook-ceph.rbd.csi.ceph.com
+parameters:
+    # clusterID is the namespace where the rook cluster is running
+    clusterID: rook-ceph
+    # Ceph pool into which the RBD image shall be created
+    pool: replicapool-ssd
+
+    # RBD image format. Defaults to "2".
+    imageFormat: "2"
+
+    # RBD image features. Available for imageFormat: "2". CSI RBD currently supports only `layering` feature.
+    imageFeatures: layering
+
+    # The secrets contain Ceph admin credentials.
+    csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
+    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
+    csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
+    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
+
+    # Specify the filesystem type of the volume. If not specified, csi-provisioner
+    # will set default as `ext4`.
+    csi.storage.k8s.io/fstype: xfs
+
+# Delete the rbd volume when a PVC is deleted
+reclaimPolicy: Delete

apps-kustomized/spoolman/deploy.yaml

@@ -1,49 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: spoolman
-  name: spoolman
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: spoolman
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: spoolman
-    spec:
-      containers:
-      - image: ghcr.io/donkie/spoolman:0.22
-        env:
-        - name: SPOOLMAN_DB_TYPE
-          value: postgres
-        - name: SPOOLMAN_DB_HOST
-          value: postgres-spoolman
-        - name: SPOOLMAN_DB_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: spoolman.postgres-spoolman.credentials.postgresql.acid.zalan.do
-              key: username
-        - name: SPOOLMAN_DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: spoolman.postgres-spoolman.credentials.postgresql.acid.zalan.do
-              key: password
-        imagePullPolicy: IfNotPresent
-        name: spoolman
-        resources: {}
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-status: {}

apps-kustomized/spoolman/postgres.yaml

@@ -1,22 +0,0 @@
-apiVersion: "acid.zalan.do/v1"
-kind: postgresql
-metadata:
-  name: postgres-spoolman
-spec:
-  teamId: spoolman 
-  volume:
-    size: 8Gi
-    storageClass: longhorn-fast
-  numberOfInstances: 1
-  users:
-    spoolman:
-    - superuser
-    - createdb
-  databases:
-    spoolman: spoolman  # dbname: owner
-  postgresql:
-    version: "15"
-  resources:
-    requests:
-      cpu: 10m
-      memory: 1Mi

apps-kustomized/spoolman/svc.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: spoolman
-  name: k8s-spoolman
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: spoolman.martyn.berlin
-spec:
-  ports:
-  - port: 80
-    targetPort: 8000
-  selector:
-    app: spoolman
-  type: LoadBalancer

everything-app/app-ingress-nginx.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     chart: ingress-nginx
     repoURL: https://kubernetes.github.io/ingress-nginx
-    targetRevision: 4.12.1
+    targetRevision: 4.12.0
     helm:
       parameters:
       - name: controller.ingressClassResource.default

everything-app/app-secrets-store-csi-driver.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     chart: secrets-store-csi-driver
     repoURL: https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
-    targetRevision: 1.4.8
+    targetRevision: 1.3.4
   syncPolicy:
     automated:
       selfHeal: true

everything-app/postgres-operator.yaml

@@ -11,4 +11,4 @@ spec:
   source:
     chart: postgres-operator
     repoURL: https://opensource.zalando.com/postgres-operator/charts/postgres-operator
-    targetRevision: 1.10.1
+    targetRevision: 1.14.0

everything-app/project-apps.yaml

@@ -16,7 +16,6 @@ spec:
     - https://k8s-at-home.com/charts/
     - https://charts.bitnami.com/bitnami
     - https://charts.gabe565.com
-    - https://ideaplexus.gitlab.io/charts
   destinations:
     - name: '*'
       namespace: '*'

everything-app/samba-longhorn-ssd.yaml

@@ -24,16 +24,6 @@ spec:
           users:
           - username: martyn
             password: "564628"
-        affinity:
-          nodeAffinity:
-            preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 1
-              preference:
-                matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                  - talos-llu-kx3
         persistence:
           extraPVCShares:
           - name: oldspace

everything-app/spoolman.yaml

@@ -1,17 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: spoolman
-  namespace: argocd
-spec:
-  destination:
-    namespace: spoolman
-    server: https://kubernetes.default.svc
-  project: apps
-  source:
-    path: apps-kustomized/spoolman
-    repoURL: https://git.martyn.berlin/martyn/infra4talos
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      selfHeal: true