refactor: oci repo

2025-09-17 18:24:14 +02:00 · 2025-06-20 23:34:59 +02:00
parent f3fa524d28
commit 41fc590000
18 changed files with 48 additions and 124 deletions
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/app/externalsecret.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/app/externalsecret.yaml
@@ -1,27 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1.json
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: actions-runner-controller-auth
-  namespace: actions-runner-system
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: actions-runner-controller-auth-secret
-    template:
-      engineVersion: v2
-      data:
-        ACTION_RUNNER_CONTROLLER_GITHUB_APP_ID: |-
-          {{ .ACTION_RUNNER_CONTROLLER_GITHUB_APP_ID }}
-        ACTION_RUNNER_CONTROLLER_GITHUB_INSTALLATION_ID: |-
-          {{ .ACTION_RUNNER_CONTROLLER_GITHUB_INSTALLATION_ID }}
-        ACTION_RUNNER_CONTROLLER_GITHUB_PRIVATE_KEY: |-
-          {{ .ACTION_RUNNER_CONTROLLER_GITHUB_PRIVATE_KEY }}
-        ACTION_RUNNER_CONTROLLER_GITHUB_WEBHOOK_SECRET_TOKEN: |-
-          {{ .ACTION_RUNNER_CONTROLLER_GITHUB_WEBHOOK_SECRET_TOKEN }}
-  dataFrom:
-    - extract:
-        key: actions-runner-controller
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/app/helmrelease.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/app/helmrelease.yaml
@@ -1,28 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: actions-runner-controller
-  namespace: actions-runner-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: gha-runner-scale-set-controller
-      version: 0.11.0
-      sourceRef:
-        kind: HelmRepository
-        name: actions-runner-controller
-        namespace: flux-system
-  install:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/app/kustomization.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/app/kustomization.yaml
@@ -1,8 +0,0 @@
---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: actions-runner-system
-resources:
-  - ./externalsecret.yaml
-  - ./helmrelease.yaml
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/ks.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/ks.yaml
@@ -1,55 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app actions-runner-controller
-  namespace: &namespace actions-runner-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: external-secrets-stores
-      namespace: external-secrets
-  interval: 1h
-  path: ./kubernetes/apps/actions-runner-system/actions-runner-controller/app
-  postBuild:
-    substitute:
-      APP: *app
-  prune: true
-  retryInterval: 2m
-  sourceRef:
-    kind: GitRepository
-    name: home-ops-kubernetes
-    namespace: flux-system
-  targetNamespace: *namespace
-  timeout: 5m
-  wait: false
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app actions-runner-controller-runners
-  namespace: &namespace actions-runner-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: actions-runner-controller
-  interval: 1h
-  path: ./kubernetes/apps/actions-runner-system/actions-runner-controller/runners
-  postBuild:
-    substitute:
-      APP: *app
-  prune: true
-  retryInterval: 2m
-  sourceRef:
-    kind: GitRepository
-    name: home-ops-kubernetes
-    namespace: flux-system
-  targetNamespace: *namespace
-  timeout: 5m
-  wait: false
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/helmrelease.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/helmrelease.yaml
@@ -1,55 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: arc-home-ops
-  namespace: actions-runner-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: gha-runner-scale-set
-      version: 0.11.0
-      sourceRef:
-        kind: HelmRepository
-        name: actions-runner-controller
-        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
-  valuesFrom:
-    - targetPath: githubConfigSecret.github_app_id
-      kind: Secret
-      name: actions-runner-controller-auth-secret
-      valuesKey: ACTION_RUNNER_CONTROLLER_GITHUB_APP_ID
-    - targetPath: githubConfigSecret.github_app_installation_id
-      kind: Secret
-      name: actions-runner-controller-auth-secret
-      valuesKey: ACTION_RUNNER_CONTROLLER_GITHUB_INSTALLATION_ID
-    - targetPath: githubConfigSecret.github_app_private_key
-      kind: Secret
-      name: actions-runner-controller-auth-secret
-      valuesKey: ACTION_RUNNER_CONTROLLER_GITHUB_PRIVATE_KEY
-  values:
-    runnerScaleSetName: arc-runner-set-home-ops
-    githubConfigUrl: https://github.com/auricom/home-ops
-    minRunners: 1
-    maxRunners: 6
-    containerMode:
-      type: dind
-    template:
-      spec:
-        containers:
-          - name: runner
-            image: ghcr.io/actions/actions-runner:2.325.0@sha256:deb54a88ead0a86beedec6ac949e8b28f77478835b9c6434ccc237390a6e3e4f
-            command: ["/home/runner/run.sh"]
-    controllerServiceAccount:
-      name: actions-runner-controller-gha-rs-controller
-      namespace: actions-runner-system
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/kustomization.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/kustomization.yaml
@@ -1,7 +0,0 @@
---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: actions-runner-system
-resources:
-  - ./helmrelease.yaml
--- a/kubernetes/apps/actions-runner-system/kustomization.yaml
+++ b/kubernetes/apps/actions-runner-system/kustomization.yaml
@@ -1,9 +0,0 @@
---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: actions-runner-system
-components:
-  - ../../components/common
-resources:
-  - ./actions-runner-controller/ks.yaml
--- a/kubernetes/apps/database/crunchy-postgres-operator/operator/helmrelease.yaml
+++ b/kubernetes/apps/database/crunchy-postgres-operator/operator/helmrelease.yaml
@@ -1,24 +1,35 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: pgo
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 5.8.2
+  url: oci://registry.developers.crunchydata.com/crunchydata/pgo
+---
 # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: crunchy-postgres-operator
 spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: pgo
-      version: 5.8.2
-      sourceRef:
-        kind: HelmRepository
-        name: crunchydata
-        namespace: flux-system
-      interval: 5m
+  interval: 1h
+  chartRef:
+    kind: OCIRepository
+    name: pgo
  install:
-    crds: CreateReplace
+    remediation:
+      retries: -1
  upgrade:
-    crds: CreateReplace
+    cleanupOnFail: true
+    remediation:
+      retries: 3
  dependsOn:
    - name: openebs
      namespace: openebs-system
--- a/kubernetes/apps/flux-system/repositories/helm/actions-runner-controller.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/actions-runner-controller.yaml
@@ -1,11 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: actions-runner-controller
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/actions/actions-runner-controller-charts
--- a/kubernetes/apps/flux-system/repositories/helm/aqua.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/aqua.yaml
@@ -1,10 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: aqua
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://aquasecurity.github.io/helm-charts/
--- a/kubernetes/apps/flux-system/repositories/helm/backube.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/backube.yaml
@@ -1,10 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: backube
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://backube.github.io/helm-charts/
--- a/kubernetes/apps/flux-system/repositories/helm/cloudnative-pg.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/cloudnative-pg.yaml
@@ -1,10 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cloudnative-pg
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://cloudnative-pg.github.io/charts
--- a/kubernetes/apps/flux-system/repositories/helm/crowdsec.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/crowdsec.yaml
@@ -1,10 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: crowdsec
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://crowdsecurity.github.io/helm-charts
--- a/kubernetes/apps/flux-system/repositories/helm/crunchydata.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/crunchydata.yaml
@@ -1,12 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: crunchydata
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 30m
-  url: oci://registry.developers.crunchydata.com/crunchydata
-  timeout: 3m
--- a/kubernetes/apps/flux-system/repositories/helm/dysnix.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/dysnix.yaml
@@ -1,10 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: dysnix
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://dysnix.github.io/charts
--- a/kubernetes/apps/flux-system/repositories/helm/kustomization.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/kustomization.yaml
@@ -3,14 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./actions-runner-controller.yaml
-  - ./aqua.yaml
-  - ./backube.yaml
  - ./cert-manager-webhook-ovh.yaml
-  - ./cloudnative-pg.yaml
-  - ./crunchydata.yaml
-  - ./crowdsec.yaml
-  - ./dysnix.yaml
  - ./emxq.yaml
  - ./external-dns.yaml
  - ./external-secrets.yaml
@@ -21,7 +14,6 @@ resources:
  - ./k8s-gateway.yaml
  - ./kyverno.yaml
  - ./openebs.yaml
-  - ./piraeus.yaml
  - ./postfinance.yaml
  - ./prometheus-community.yaml
  - ./rook-ceph.yaml
--- a/kubernetes/apps/flux-system/repositories/helm/piraeus.yaml
+++ b/kubernetes/apps/flux-system/repositories/helm/piraeus.yaml
@@ -1,10 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: piraeus
-  namespace: flux-system
-spec:
-  interval: 2h
-  url: https://piraeus.io/helm-charts/
--- a/kubernetes/apps/volsync/volsync/app/helmrelease.yaml
+++ b/kubernetes/apps/volsync/volsync/app/helmrelease.yaml
@@ -1,28 +1,41 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: volsync
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.12.1
+  url: oci://ghcr.io/home-operations/charts-mirror/volsync
+---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: volsync
-  namespace: volsync
 spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: volsync
-      version: 0.12.1
-      sourceRef:
-        kind: HelmRepository
-        name: backube
-        namespace: flux-system
+  interval: 1h
+  chartRef:
+    kind: OCIRepository
+    name: volsync
  install:
-    createNamespace: true
    remediation:
-      retries: 3
+      retries: -1
  upgrade:
+    cleanupOnFail: true
    remediation:
      retries: 3
  values:
    manageCRDs: true
+    replicaCount: 2
    metrics:
      disableAuth: true
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000