♻️ substitutions

archive/kubernetes/attic/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-attic-appiserver
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/attic/apiserver
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -26,12 +32,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-attic-garbage-collector
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-attic-appiserver
   path: ./kubernetes/apps/default/attic/garbage-collector
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/gitea/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-gitea
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/gitea/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/kyverno/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-kyverno
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kyverno/kyverno/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -23,12 +29,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-cluster-policies
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-kyverno
   path: ./kubernetes/apps/kyverno/kyverno/policies
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/pushover-notifier/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-pushover-notifier
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/pushover-notifier/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/semaphore/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-semaphore
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-cloudnative-pg-app
   path: ./kubernetes/apps/default/semaphore/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/smartctl-exporter/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-smartctl-exporter
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/monitoring/smartctl-exporter/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/trivy-system/trivy-operator/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-trivy-operator
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/trivy-system/trivy-operator/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

archive/kubernetes/vector/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-vector-aggregator
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-loki-app
   path: ./kubernetes/apps/monitoring/vector/aggregator
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -25,12 +31,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-vector-agent
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-vector-aggregator
   path: ./kubernetes/apps/monitoring/vector/agent
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/actions-runner-system/actions-runner-controller/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-actions-runner-controller
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/actions-runner-system/actions-runner-controller/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -26,12 +32,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-actions-runner-controller-runners
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-actions-runner-controller
   path: ./kubernetes/apps/actions-runner-system/actions-runner-controller/runners
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-cert-manager
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/cert-manager/cert-manager/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -23,13 +29,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-cert-manager-webhook-ovh
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cert-manager
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/cert-manager/cert-manager/webhook-ovh
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/atuin/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-atuin
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/atuin/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/authelia/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-authelia-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-authelia-redis
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/authelia/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/babybuddy/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-babybuddy
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/babybuddy/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/bazarr/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-bazarr-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/bazarr/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/calibre/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-calibre
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/calibre/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/cloudnative-pg/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-cloudnative-pg-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/cloudnative-pg/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -25,12 +31,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-cloudnative-pg-cluster
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-app
   path: ./kubernetes/apps/default/cloudnative-pg/cluster
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/emqx/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-emqx-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/emqx/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/flood/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-flood-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-qbittorrent-app
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/flood/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/freshrss/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-freshrss
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/freshrss/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/frigate/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-frigate
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-node-feature-discovery-rules
   path: ./kubernetes/apps/default/frigate/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/ghostfolio/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-ghostfolio
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/ghostfolio/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/hajimari/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-hajimari
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/hajimari/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/home-assistant/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-home-assistant-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-app
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/home-assistant/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -28,10 +34,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-home-assistant-code
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/home-assistant/code
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/homebox/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-homebox
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/homebox/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/homelab/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-homnelab-minio
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/homelab/minio
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -25,10 +31,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-homnelab-opnsense
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/homelab/opnsense
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -45,10 +57,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-homnelab-truenas
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/homelab/truenas
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/immich/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-immich-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/immich/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/invidious/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-invidious
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/invidious/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/jellyfin/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-jellyfin-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/jellyfin/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/joplin/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-joplin
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/joplin/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/komf/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-komf
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/komf/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/komga/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-komga
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/komga/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/kresus/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-kresus
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/kresus/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/kubernetes-schemas/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-kubernetes-schemas
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/kubernetes-schemas/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/libmedium/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-libmedium
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/libmedium/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/libreddit/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-libreddit
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/libreddit/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/lidarr/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-lidarr-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/lidarr/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/linkding/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-linkding
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/linkding/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/lldap/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-lldap
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
   path: ./kubernetes/apps/default/lldap/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/lychee/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-lychee
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/lychee/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/mailrise/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-mailrise
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/mailrise/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/media-browser/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-media-browser
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/media-browser/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/music-transcode/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-music-transcode-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/music-transcode/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/navidrome/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-navidrome
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/navidrome/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/outline/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-outline
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/outline/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/paperless/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-paperless
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/paperless/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/pgadmin/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-pgadmin
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/pgadmin/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/prowlarr/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-prowlarr-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/prowlarr/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/pushover-notifier/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-pushover-notifier
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/default/pushover-notifier/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/pyload/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-pyload-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/pyload/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/qbittorrent/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-qbittorrent-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/qbittorrent/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/radarr/ks.yaml

@@ -5,8 +5,6 @@ kind: Kustomization
 metadata:
   name: cluster-apps-radarr-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
@@ -14,6 +12,14 @@ spec:
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/radarr/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/recyclarr/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-recyclarr-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-radarr-app
     - name: cluster-apps-sonarr-app
   path: ./kubernetes/apps/default/recyclarr/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/resilio-sync/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-resilio-claude
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/resilio-sync/claude
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -26,10 +32,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-resilio-helene
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/resilio-sync/helene
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/sabnzbd/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-sabnzbd-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/sabnzbd/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/sharry/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-sharry
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/sharry/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/smtp-relay/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-smtp-relay
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/smtp-relay/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   dependsOn:
     - name: cluster-apps-external-secrets-stores

kubernetes/apps/default/sonarr/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-sonarr-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/sonarr/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/tandoor/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-tandoor
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/tandoor/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/unifi/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-unifi
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/unifi/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/vaultwarden/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-vaultwarden
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/vaultwarden/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/vikunja/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-vikunja
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/vikunja/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/wallabag/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-wallabag
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/wallabag/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/whoogle/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-whoogle
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/default/whoogle/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/zigbee2mqtt/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-zigbee2mqtt-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-node-feature-discovery
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/zigbee2mqtt/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/default/zwave-js-ui/ks.yaml

@@ -5,14 +5,20 @@ kind: Kustomization
 metadata:
   name: cluster-apps-zwave-js-ui-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-node-feature-discovery
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-volsync-app
   path: ./kubernetes/apps/default/zwave-js-ui/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/flux-system/addons/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-flux-monitoring
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/flux-system/addons/monitoring
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -24,10 +30,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-flux-notifications
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/flux-system/addons/notifications
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -43,10 +55,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-flux-webhooks
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/flux-system/addons/webhooks
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/flux-system/weave-gitops/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-weave-gitops
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/flux-system/weave-gitops/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/cilium/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-cilium-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/cilium/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: false
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/descheduler/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-descheduler
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/descheduler/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/external-secrets/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-external-secrets
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/external-secrets/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -24,12 +30,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-external-secrets-stores
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets
   path: ./kubernetes/apps/kube-system/external-secrets/stores
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/intel-device-plugin/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-intel-device-plugin
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/intel-device-plugin/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -23,10 +29,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-intel-device-plugin-gpu
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/intel-device-plugin/gpu
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -41,10 +53,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-intel-device-plugin-exporter
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/intel-device-plugin/exporter
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-kubelet-csr-approver
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/kubelet-csr-approver/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/metrics-server/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-metrics-server
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/metrics-server/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/node-feature-discovery/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-node-feature-discovery
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/node-feature-discovery/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -23,12 +29,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-node-feature-discovery-rules
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-node-feature-discovery
   path: ./kubernetes/apps/kube-system/node-feature-discovery/rules
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/reloader/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-reloader
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/reloader/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/snapshot-controller/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-snapshot-controller
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/snapshot-controller/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/kube-system/spegel/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-spegel
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/kube-system/spegel/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/monitoring/gatus/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-gatus
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/monitoring/gatus/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/monitoring/grafana/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-grafana
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cloudnative-pg-app
   path: ./kubernetes/apps/monitoring/grafana/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/monitoring/kube-prometheus-stack/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-kube-prometheus-stack-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-thanos-app
   path: ./kubernetes/apps/monitoring/kube-prometheus-stack/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/monitoring/loki/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-loki
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/monitoring/loki/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/monitoring/thanos/ks.yaml

@@ -5,13 +5,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-thanos-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
     - name: cluster-apps-rook-ceph-cluster
   path: ./kubernetes/apps/monitoring/thanos/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/monitoring/vector/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-vector
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/monitoring/vector
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/networking/external-dns/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-external-dns
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/networking/external-dns/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/networking/ingress-nginx/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-ingress-nginx-certificates
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-cert-manager-webhook-ovh
   path: ./kubernetes/apps/networking/ingress-nginx/certificates
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -26,13 +32,19 @@ kind: Kustomization
 metadata:
   name: cluster-apps-ingress-nginx
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-ingress-nginx-certificates
     - name: cluster-apps-kyverno
   path: ./kubernetes/apps/networking/ingress-nginx/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/networking/k8s-gateway/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-k8s-gateway
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/networking/k8s-gateway/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/ngnode/landing-page/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-ngnode-landing-page
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/ngnode/landing-page/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/rook-ceph/rook-ceph/ks.yaml

@@ -5,10 +5,16 @@ kind: Kustomization
 metadata:
   name: cluster-apps-rook-ceph-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   path: ./kubernetes/apps/rook-ceph/rook-ceph/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -23,12 +29,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-rook-ceph-cluster
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-app
   path: ./kubernetes/apps/rook-ceph/rook-ceph/cluster
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -43,12 +55,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-rook-ceph-toolbox
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-rook-ceph-cluster
   path: ./kubernetes/apps/rook-ceph/rook-ceph/toolbox
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/volsync/snapscheduler/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-snapscheduler
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-snapshot-controller
   path: ./kubernetes/apps/volsync/snapscheduler/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository
@@ -25,12 +31,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-snapscheduler-schedules
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-snapscheduler
   path: ./kubernetes/apps/volsync/snapscheduler/schedules
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/apps/volsync/volsync/ks.yaml

@@ -5,12 +5,18 @@ kind: Kustomization
 metadata:
   name: cluster-apps-volsync-app
   namespace: flux-system
-  labels:
-    substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
     - name: cluster-apps-snapshot-controller
   path: ./kubernetes/apps/volsync/volsync/app
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+        optional: false
+      - kind: Secret
+        name: cluster-secrets
+        optional: false
   prune: true
   sourceRef:
     kind: GitRepository