repo migration

2025-05-13 08:49:46 -04:00
commit 21a45f1d09
135 changed files with 2698 additions and 0 deletions
@@ -0,0 +1,15 @@
+talconfig.json
+clusterconfig
+patches/all.yaml
+patches/controlplane.yaml
+patches/worker.yaml
+*patches/all.yaml
+*patches/controlplane.yaml
+*patches/worker.yaml
+all.yaml
+controlplane.yaml
+worker.yaml
+*sopssecret.secret.yaml
+sopssecret.secret.yaml
+cluster/main/kubernetes/**/bootstrap-values.yaml.ct
+*kubeconfig
@@ -0,0 +1,43 @@
+#ENC[AES256_GCM,data:ivlK3YpKOUqjcg9WZBhyONqJSMxwYu1G46U6LbJ9jbgD/omtZy5Ucin/6Vh+2r9980rJ4zomOC2BJ2kQ9+sDdN0=,iv:FnA29cUcvbixPFwiJkDnC0+BxXeOYY0kC8gJKkBYfD0=,tag:UGXMkl7lRqaMPlLbp6DWmQ==,type:comment]
+#ENC[AES256_GCM,data:Bppx2CNz0EZragTJPWXZqfhe13ryCa7Er4+TPprZMEOgexWm/8ooXj2WFR8=,iv:Fq5+IxGM/sQkSjWkU6+737MlzFkqRzxV4RvCceQ09i8=,tag:BTFZ5QxaB0Ykhq++IC3D7A==,type:comment]
+VIP: ENC[AES256_GCM,data:Uv98AXTJXy1On6bWG84=,iv:lx4hIP4qUcf74f3/iFccbVqwyRuwYttS6pCP+rFuX2Q=,tag:/oAq2l1A4JrB5bFpbhsldw==,type:str]
+#ENC[AES256_GCM,data:7L6tWYFr5k4SIsJramEgXk1gMAKlrF2oT/YD,iv:8bt5i4S1q2v4ji8Fi62ZgMxKrxJp7Tuu/KxglNADdzU=,tag:PRQ/cfqxhCosTYCjKmmJAw==,type:comment]
+#ENC[AES256_GCM,data:NSONj2MFQiwmi5/dTH6uXDLAS2T2GUEigzXgV+HYDWg0XJJy5nMyOnZDpy7a1Mc+FYKSALfSL3uqqVdmhhXQSJSbgmTPHAwBydbdODzwjK8f2VC2up8Ub88=,iv:ZrphGBtpT0T5ovdQfhVGCXL27SZJ3tdzbTWpD3WL7c4=,tag:Br7GAul9iu/hPOkNFub+pw==,type:comment]
+MASTER1IP: ENC[AES256_GCM,data:E7MiHC/0BIcGg1m0a1g=,iv:rtSW16TRZ2Y0Um6ynpljTQFpNp5mO+PxdR5/xtFt5hs=,tag:f9cdE2zGGNmIlXQw0w6K0A==,type:str]
+#ENC[AES256_GCM,data:pXAeQ708XL5X038epItt+vKfFfNmzXdZcRARfuNTY4hf0g==,iv:IefEzb6+pgvr3wQuw4JR0QWszALCMV9zM/mksuvfDDw=,tag:bmCyNhzxPEAjyULtxuWagQ==,type:comment]
+GATEWAY: ENC[AES256_GCM,data:jo99rvL/2mZr1QmW,iv:/klNo9RcxOAIaTdfxOB4ECncqkqRYsTOUwFcUOlKPPA=,tag:/bUW/liFM2526SwQL5OPaA==,type:str]
+#ENC[AES256_GCM,data:SQ+c5x0ttyXjb2OEKzapI4D7dDHs6o7UX1hE1XL62kRPOJy90QbrYXDg6XmRNCY=,iv:WT47h4mJXOFxH+dUUtJq1SYn9Escu9eWpPKgG9VFKxU=,tag:hmP0Lene9tpzFxAmmFybIw==,type:comment]
+METALLB_RANGE: ENC[AES256_GCM,data:KOCmXROWGo5FORcJ9yUMFHCYYeBLJgyk6RpICbE=,iv:L+JXilO0WCjwOZm+c1xWzDfljvaW8kEirQ7HYb8vYMs=,tag:TpIdpLTfZapTs2zxYcVpNA==,type:str]
+#ENC[AES256_GCM,data:MET5IzgvYtaCkYKSeEK2Ury8yBEMEoLioD71cUpkvBA/uxf7yDAYa0bKfn0K7E+kRPTnHkx1XMXl4hcwA7Z1eTXhOVuzYENjBHDVPOkDhe4=,iv:LgE01YlqS0fsLpXjniPOzn79SXElbXbqEAVmaV2XwX8=,tag:YVvpwYxW+pIPWul//EoaZg==,type:comment]
+DASHBOARD_IP: ENC[AES256_GCM,data:XP5XyqUH69BYbrMvn3c=,iv:lnGNGmTYIAcTkatwoTuj7JlPdZpS4np7g+heMZzjU2Q=,tag:Z2cZphwUpm/nrfZZ42qlTA==,type:str]
+#ENC[AES256_GCM,data:+AenhvLAoSl1L55niyNp9X9BsAQN2NhSRmyA83uMe5tymNH8B4AZKpjXTDXyARoH3fwIR5EHWW8=,iv:iWAWt1Rsr5/eJ0phPw1z/5yv3mBoLbCED0qilxlKaf0=,tag:WFhPlyXF2o5Mu+4AsSWjeQ==,type:comment]
+#ENC[AES256_GCM,data:uz0Nzd6XawwKY7J8UNxCWh7nZ9hFwhswow==,iv:l3Y8jyHx6YxQgE0OTQDtHX9cSpud2nqci6bxy1qGZr4=,tag:SdARU5q0vYbymnpl04RsTQ==,type:comment]
+#ENC[AES256_GCM,data:b5AFePED60sjR300CX6DQoKLneb9YWDT9Q7qW5woAg6yqWyfZOYY6QbtxCx3T4zYksHRn8vUkcJ0ASZSNQOf9swGFVW0xl+o7i3fclQ=,iv:+tguqQ69hAB+NNNnKfex+RmZNSntxcEhU+dUGmvn4m0=,tag:FD/gG3zgdIdFNXJtH+X5mA==,type:comment]
+GITHUB_REPOSITORY: ""
+#ENC[AES256_GCM,data:V75/HDxAPDmk+Z4lOee8nBwjRTmizrOE+s2Xlg16k47GclREPlYZ/622Ccm2TTs+QFgQZtnXF44qjckgaiTWKseIeGyNJmw=,iv:24vvye0kwWfTyL6G4I4bUn433Xvg07c85VSWf2UdpYo=,tag:dP7kjyfvusmLUKeQxSku1Q==,type:comment]
+#ENC[AES256_GCM,data:6Z2muYxNZ3T8khpSCQ9KGwbNG4KmMFp+5MikXwii/anULJ0GAsDHj3bNq08YuA6oTX3rItuq,iv:xXrsqPXoxibPPhFnRwyYdJyUi3JLNbW/n/rkOD2TKQc=,tag:3GwrxTkcfGrg9YfMujmOGA==,type:comment]
+#ENC[AES256_GCM,data:8qIATB8dT/lar5TRnvX/RXjr2OpjaXIOa0vdCxb/MFay9+Y=,iv:darE3gv5X7LlG43gP4ZSrN4MQAi43OUYicZ6kI2SNCE=,tag:9KQzt412IqnqEthF7kvDqg==,type:comment]
+#ENC[AES256_GCM,data:N3E5+UhvkdKOSWxSNlwb1CGMsHRY+PzNQMNuR+AXfk3qaj+N2oid,iv:MUXmT25hGIkqYkUyIilthR0+E+0J4dGmYTZVudDxpQg=,tag:gLZ6LKzhNvR/Z6QvQXbGuw==,type:comment]
+#ENC[AES256_GCM,data:UPZOh94uHTQ6O8ypX78=,iv:NBLUXe3ZzSUJuix+1y/qdflEI/cLx4CNO6uiRfouzyI=,tag:T6NkesW3tZTTNqrN2yCd9g==,type:comment]
+PODNET: ENC[AES256_GCM,data:6bhhVR+yZ4HV3wf5Zg==,iv:GN13FZVqzOWfIa6FWqSb9ti3cm5dduwpW5XAJjs+hnc=,tag:DJtGCpIscYs40l3kOIgcrw==,type:str]
+SVCNET: ENC[AES256_GCM,data:+Aw9NaKtqw48ardNKg==,iv:F0I8wPiMkb4TCmMqgmr6mNEJufZoy2p+v08pHTBNS9Y=,tag:5aq1bExpYCyt7uQn0oD40g==,type:str]
+sops:
+    shamir_threshold: 3
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNTXRyWjl5QVE5M2hxNHVS
+            UWRGRkFFNHdZcDNVb1lyWWdkOWE5UW5pL0RvCmFOZlZDV3BERmZkVnBud25YVjJ3
+            bDNySGhScjN6bHp4Mit3UFZPSit4VzAKLS0tIEtrcUNNM3B1aldLMStXSCtZUEhx
+            WWt1c052cjE4RzJIZ1NRbDFzTHpWN1kKRCMjS4EVveIsE9so1pJpZgeM5Ub/8rQj
+            WPz2XvrIpL7h+WY88JAP8JPDk3dIfYu41ZrmjykwLwpIAY4AJCGSRw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-05T18:25:50Z"
+    mac: ENC[AES256_GCM,data:FHqoHJ2/jG5AY63yxHM8yx6QcriMHwahF150xHAzPIVcZmYml7mB27b+pH1jMtdWK7t3JLtl3ZPRszrBm1NGqXW4FDwlJdpfgnQjRp434KUoENjWgzH/C6L8voLWqZS8HiJ86PpKaxp5s/V+BhjSv4eNkF7iZVNpGueF64b14LM=,iv:rN362UoGmejMWRm4a5ph40S0eMx6pf0Ocg3EfMJD8+g=,tag:yS9YrRhCTHVI5vW5yzn6Ew==,type:str]
+    pgp: []
+    version: 3.9.1
@@ -0,0 +1,39 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: kubernetes-dashboard
+      version: 1.10.0
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  driftDetection:
+    mode: warn
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    service:
+      main:
+        type: LoadBalancer
+        loadBalancerIP: ${DASHBOARD_IP}
+        ports:
+          main:
+            port: 80
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: kubernetes-dashboard
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kubernetes-dashboard
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/apps/kubernetes-dashboard/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - kubernetes-dashboard/ks.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - kyverno-policies/ks.yaml
+  - metallb-config/ks.yaml
+  - system-upgrade-controller-plans/ks.yaml
@@ -0,0 +1,53 @@
+## This Can be enabled in the kustomization.yaml file.
+## Please note not every chart or application is compatible with this behavior
+## Primarily operators spinning their own pods, might include conflicting validation
+## Add manual exclusions where needed
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: resolve-image-to-digest
+  annotations:
+    policies.kyverno.io/title: Resolve Image to Digest
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/severity: medium
+    kyverno.io/kyverno-version: 1.6.0
+    policies.kyverno.io/minversion: 1.6.0
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Image tags are mutable and the change of an image can result in the same tag.
+      This policy resolves the image digest of each image in a container and replaces
+      the image with the fully resolved reference which includes the digest rather than tag.
+spec:
+  background: false
+  rules:
+  - name: resolve-to-digest
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    exclude:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              name: '*cnpg*'
+    preconditions:
+      all:
+      - key: "{{request.operation || 'BACKGROUND'}}"
+        operator: NotEquals
+        value: DELETE
+    mutate:
+      foreach:
+      - list: "request.object.spec.containers"
+        context:
+          - name: resolvedRef
+            imageRegistry:
+              reference: "{{ element.image }}"
+              jmesPath: "resolvedImage"
+        patchStrategicMerge:
+          spec:
+            containers:
+            - name: "{{ element.name }}"
+              image: "{{ resolvedRef }}"
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - schematic-to-pod.yaml
+  # - ensure-digest.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: kyverno.io/v2beta1
+kind: ClusterPolicy
+metadata:
+  name: mutate-pod-binding
+  annotations:
+    pod-policies.kyverno.io/autogen-controllers: none
+    policies.kyverno.io/title: Mutate Pod Add Schematic
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.10.0
+    policies.kyverno.io/minversion: 1.10.0
+    kyverno.io/kubernetes-version: "1.30"
+spec:
+  background: false
+  rules:
+    - name: project-foo
+      match:
+        any:
+        - resources:
+            kinds:
+            - Pod/binding
+            names:
+            - apply-talos*
+      context:
+      - name: node
+        variable:
+          jmesPath: request.object.target.name
+          default: ''
+      - name: schematic
+        apiCall:
+          urlPath: "/api/v1/nodes/{{node}}"
+          jmesPath: "metadata.annotations.\"extensions.talos.dev/schematic\" || 'empty'"
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              extensions.talos.dev/schematic: "{{ schematic }}"
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/core/kyverno-policies/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,42 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metallb-config
+  namespace: metallb-config
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: metallb-config
+      version: 8.2.2
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  driftDetection:
+    mode: warn
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    L2Advertisements:
+      - name: main
+        addressPools:
+          - main
+    ipAddressPools:
+      - name: main
+        autoAssign: false
+        avoidBuggyIPs: true
+        addresses:
+          - ${METALLB_RANGE}
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: metallb-config
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-config
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/core/metallb-config/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,52 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: kubernetes
+  namespace: system-upgrade
+spec:
+  version: ${KUBERNETES_VERSION}
+  serviceAccountName: system-upgrade
+  secrets:
+  - name: talos
+    path: /var/run/secrets/talos.dev
+    ignoreUpdates: true
+  concurrency: 1
+  exclusive: true
+  nodeSelector:
+    matchExpressions:
+      - key: feature.node.kubernetes.io/system-os_release.ID
+        operator: In
+        values: ["talos"]
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+      - key: feature.node.kubernetes.io/system-os_release.VERSION_ID
+        operator: In
+        values: ["${TALOS_VERSION}"]
+      - key: kubernetes.io/hostname
+        operator: In
+        values: ["k8s-control-1"]
+  tolerations:
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+  prepare: &prepare
+    image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
+    envs:
+      - name: NODE_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.hostIP
+    args:
+      - --nodes=$(NODE_IP)
+      - health
+      - --server=false
+  upgrade:
+    <<: *prepare
+    args:
+      - --nodes=$(NODE_IP)
+      - upgrade-k8s
+      - --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - schematics.yaml
+  - kubernetes.yaml
+  - talos.yaml
@@ -0,0 +1,53 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: talos
+  namespace: system-upgrade
+spec:
+  version: ${TALOS_VERSION}
+  serviceAccountName: system-upgrade
+  secrets:
+    - name: talos
+      path: /var/run/secrets/talos.dev
+      ignoreUpdates: true
+  concurrency: 1
+  exclusive: true
+  nodeSelector:
+    matchExpressions:
+      - key: feature.node.kubernetes.io/system-os_release.ID
+        operator: In
+        values: ["talos"]
+      - key: feature.node.kubernetes.io/system-os_release.VERSION_ID
+        operator: NotIn
+        values: ["${TALOS_VERSION}"]
+  tolerations:
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  prepare: &prepare
+    image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
+    envs:
+      - name: NODE_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.hostIP
+      - name: SCHEMATIC
+        valueFrom:
+          fieldRef:
+            fieldPath: metadata.annotations['extensions.talos.dev/schematic']
+    args:
+      - --nodes=$(NODE_IP)
+      - health
+      - --server=false
+  upgrade:
+    <<: *prepare
+    args:
+      - --nodes=$(NODE_IP)
+      - upgrade
+      - --image=factory.talos.dev/installer/$(SCHEMATIC):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
+      - --preserve=true
+      - --wait=false
+      - --force
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: system-upgrade-controller-plans
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/core/system-upgrade-controller-plans/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,43 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-entry
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./clusters/main/kubernetes
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-config
+  patches:
+    - patch: |-
+        apiVersion: kustomize.toolkit.fluxcd.io/v1
+        kind: Kustomization
+        metadata:
+          name: not-used
+        spec:
+          decryption:
+            provider: sops
+            secretRef:
+              name: sops-age
+          postBuild:
+            substituteFrom:
+              - kind: ConfigMap
+                name: cluster-config
+              - kind: ConfigMap
+                name: upgrade-settings
+      target:
+        group: kustomize.toolkit.fluxcd.io
+        kind: Kustomization
+        labelSelector: substitution.flux.home.arpa/disabled notin (true)
@@ -0,0 +1,62 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - github.com/fluxcd/flux2/manifests/install?ref=v2.3.0
+  - ./deploykey.secret.yaml
+  - ./clustersettings.secret.yaml
+patches:
+  # Remove the built-in network policies
+  - target:
+      group: networking.k8s.io
+      kind: NetworkPolicy
+    patch: |
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: NetworkPolicy
+      metadata:
+        name: not-used
+  # Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
+  - target:
+      kind: ResourceQuota
+      name: critical-pods
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: critical-pods-flux-system
+  - target:
+      kind: ClusterRoleBinding
+      name: cluster-reconciler
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: cluster-reconciler-flux-system
+  - target:
+      kind: ClusterRoleBinding
+      name: crd-controller
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: crd-controller-flux-system
+  - target:
+      kind: ClusterRole
+      name: crd-controller
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: crd-controller-flux-system
+  - target:
+      kind: ClusterRole
+      name: flux-edit
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: flux-edit-flux-system
+  - target:
+      kind: ClusterRole
+      name: flux-view
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: flux-view-flux-system
@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+    name: cluster-config
+    namespace: flux-system
+data:
+    #ENC[AES256_GCM,data:6niImlDSQviFNVT+wpv5whjt7ZguY+f54tf/PrF0hAfGkSMtDiIhCgr6Et/YAFISMl5T749cMpURqs8tV1zeVgk=,iv:NVFPacP85GuM8UmX6ZFrNRrmtKLVRCCo9EXOszcmJAY=,tag:UBCBIF+HQdRjK8tXWmbKcg==,type:comment]
+    #ENC[AES256_GCM,data:akDxDmJ6Cv9hl27tOna6FrweZuGDIAxcmKgaJw3U+3n+Ur7BB99NjTqX1ZM=,iv:l4vLnUDcZOIxO9U1Wyhd8JVZ9vkpvQorgXtayM3v9ME=,tag:VOmz6x1wlU/dggtcYK5xAw==,type:comment]
+    VIP: ENC[AES256_GCM,data:jbuffX6q+hSIdovsBts=,iv:sfi9HYiKKuVKvCkaVpTMD0/v05JwpjIKhTv8cohpvmo=,tag:uyrAdF3No00Ha40FqAyJlg==,type:str]
+    #ENC[AES256_GCM,data:5G6PwTJ6afWfXC2juUtWFxaPnbQv6hty+48D,iv:107g3C7zLAIMPnTl6E6a8876rEj3Ktx7F/LcVemGQCs=,tag:07aa6W3IiPm2nGyXtMJDNg==,type:comment]
+    #ENC[AES256_GCM,data:4NKPCDJWoGd6BzrwSqKrwwLRwgSh8YSwS3/g+bwoULUG6MH6XiHV4HQ7RhYyq2mKvgSSu4rrgco12TK489v+K6kNo9f5eqKk9iXjDepM/eHTV9xECBzkoA4=,iv:X6cYcGVyD0F3aH9Y2zFveVI0XZqz10/j8skua+FDjfg=,tag:2hgXM4ep1ypNDKtYRhTRcg==,type:comment]
+    MASTER1IP: ENC[AES256_GCM,data:9TqnldHD1QMT13aKLwI=,iv:SsOmDkDgRdZDUrFxXK9uM01mzdBab7ukv7/oirfqcGI=,tag:vO2BwNjDGqnsPIxDqQig7Q==,type:str]
+    #ENC[AES256_GCM,data:B6V8Ts98f3ODrIpwnkMio0sPy6HYowl091ENhsAiuy6uEQ==,iv:8IwF6gB8N2oCwJ7SVhHPC8qiqdUNkoXZGQBnjZsghrc=,tag:8XfkNXg5lz5GvRRl4V2fxA==,type:comment]
+    GATEWAY: ENC[AES256_GCM,data:dwRSmkaQ7Z8SlMns,iv:sQUNWkRj8DbtYAMkaJ065wor/vCqEUDtHkOi9H7ckbI=,tag:InqxnwFE/2nT71BCSwEoHQ==,type:str]
+    #ENC[AES256_GCM,data:S88nu3SeeGJjADqto4w0g3iUAcnlR8nf14CMuOJXhJQxXDr4JgznAF3fIEc9UPQ=,iv:eaizFGe4ID3Fp/5d+6uIyoWVpdBHOCD6CGL++k+bXdg=,tag:9pJ7F+XtX+zb92B7Af0Eyg==,type:comment]
+    METALLB_RANGE: ENC[AES256_GCM,data:iKzw4CwM//ML26rwXmLM9UR0fnKGj2N3rBEfqos=,iv:aC/kAd4uejXNd0G8o84XW9jN1hKWuuFcarq7F/9xcj8=,tag:lIur2oQjzuhKsZ+xz8Yraw==,type:str]
+    #ENC[AES256_GCM,data:WFPGMGFllHwO3vFsbeMEnyWY/oEwEn2jyLPwvvjKqaNtc9ebtG9cqqV3/zLLP2yYUtnGfmjmAmoQiBgTVOQOb+y6VUty1OQPA0v73xYtNM8=,iv:SJ4Y2RlrPNSMs8WG2VgWEO1kIyYLDs6HQlXsWl5VLqA=,tag:bCXqgHsKQb+MHUXDFngKog==,type:comment]
+    DASHBOARD_IP: ENC[AES256_GCM,data:8xnbx9Ia+va2jlZ+EgI=,iv:mPAhjRH6hYD4kH0HTBNUMqbznytodakRfVKXm5CQR0c=,tag:bpBWLEJpuQL2vvX6Fqdw9A==,type:str]
+    #ENC[AES256_GCM,data:Sk8XfYXVLw9gdg4ttflghvml9PtnR+WsGb4y1Xb9aXa47DBzTkzMbz/o9hSg5y3z528i8wUeCK4=,iv:CPzT3IpTCk1nTD03UuVQycZDyaDyHuN4mvzK7h7MhAM=,tag:fv56PV3Qwja1tVPEdA9q8A==,type:comment]
+    #ENC[AES256_GCM,data:7EzBlNF5OGXHSKGGZUyIsBXPznEgmIH/JQ==,iv:WncKNSiaVFBz+n1WwsGsINCo/CSUlc46WnWknPKLwoQ=,tag:P6ffhRSOI8gY0FvcKIJCMw==,type:comment]
+    #ENC[AES256_GCM,data:zETwKu0C/izvA/yac7NXzIh/hUBZ9O12uvhpEa/xLWQCw3HR83aFYxOeALK/4yio/YRBmW525laSbawBe7sJ8rYRMhbs+f/0/JorJ4A=,iv:L3yOFifUWMSe0djQbMD+cbjwPtDn/q7KuW7RABmUigY=,tag:QAMYNeUJML0omyrgt6m+IA==,type:comment]
+    GITHUB_REPOSITORY: ""
+    #ENC[AES256_GCM,data:ACa3nQrqwjGZmlK5flUrZGwXxfFBjEYSjh1Epkh6sUp+De6FYrDJdiXcoHFcRBzUPOABiiHp5dPZjSZsLuE8azje74epxNI=,iv:ADMSMkzvqDzUGVv2M3uSlD82MQi9Gi5KLrT1AkxYyvo=,tag:sr4zTcydQGobL7+Muj8WvQ==,type:comment]
+    #ENC[AES256_GCM,data:RJFxS5mGXqnxI5G0B/FcL5MxY/3CXv9CvpFZHNmiZBIOeTiX5OUZsE3eNSeD3ja6KShQXUWp,iv:2D9CEtn1zH3+Rdln/qz00as66009PYdEORi5kK4fW+A=,tag:aWqc/IX5kXUS60Zn02scGg==,type:comment]
+    #ENC[AES256_GCM,data:KbpFKs+ijAQy0q/OM1kTiAqxVrYqD9AbxkMsSjkWCIV6DLo=,iv:P1W1MU42pfl2NRQ5d5YQjVeed+VjXt2ggpY7V1aP2qk=,tag:haGA0I65BTdV9AgalqS5Kg==,type:comment]
+    #ENC[AES256_GCM,data:9nTD4v8T/VEDTHFsWWPf5ZO83SlOWbpkVnkCFt/Y6nyk2UVs/KI0,iv:txxfhJyprXgbVsYXhJfEo1X5qqzlSuMVjSNj1Mbl8WM=,tag:Yeal+o/LfjIjptsCo6IWLQ==,type:comment]
+    #ENC[AES256_GCM,data:V+d/Qs89lqeqjEeLeJc=,iv:oWskIshGu/GsOyhLTO58GhmokgFoRlq95RXxFWkY4x8=,tag:Am+I8CsmieIBomnrhEgtnA==,type:comment]
+    PODNET: ENC[AES256_GCM,data:ewO6HIksqTvSSV3Kqg==,iv:ypzdCZaqOG9hTktbjSDGhAjPGlhQx3CFPGC00CpHZ2U=,tag:/VQL28wnkmJyrsCcfNvohA==,type:str]
+    SVCNET: ENC[AES256_GCM,data:CpGlBxFc7KtvKP0w1g==,iv:MFTqQbuoHy2//wQORRecOyBmyOLtheePJpk+MftyNW0=,tag:mSzr04c2Tf6xD8wR0JIIzA==,type:str]
+    CLUSTERNAME: ENC[AES256_GCM,data:Zqa1ew==,iv:gbTl6h/YadrBoAvU8/sp8xQ1eEjbUPjl6QtRoccJja8=,tag:D4/nRuF6RyX4pJBOncZdqA==,type:str]
+sops:
+    shamir_threshold: 3
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlM3owZ3F6WHhQWE96QzZH
+            VVJzQjhUc2dGRTNMNXhGdHBVSU9tb004RDJVCnNUT2pYY3hzSVVEVjg5R29PMnpI
+            ZnNtdjBZSXdML0FIZ2NUWXZQQmhwdUEKLS0tIDM3eXRkSmtXak9tT3g1NU92YzFI
+            bGxJMDA4WWppZm1uL2l5QkRXUDZFbjAKhhOuASw+0mTaN817fRlCaMGCdeAFezm9
+            FKHTVUHi03UXu6kwyZ3sa4x7V1Bw8hGroroL3Sp4BibrAwfYgGQxng==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-05T18:25:50Z"
+    mac: ENC[AES256_GCM,data:t+YlmYlUx9noaOr4id/+ZRmpkv2JR4I7jzdwm/p7UQLmByr11KgdakTQGhYY0mfqYZgGWzeQNeZVzjFoNFCIkSCJef7WdBeT7yzRRxscYovnlUZ0dBGTTuc1pWsYjDPc3kbHel7AdeDBB2l0qbMxD4At1r1UbvvOi0cdL/OoYFQ=,iv:RB3vdWiQcnywVxUGf+4jpP5t606akBnsf0REENzUF/U=,tag:aQGqxTgqrM7voYxnglqKGg==,type:str]
+    pgp: []
+    encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))
+    version: 3.9.1
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: deploy-key
+    namespace: flux-system
+stringData:
+    identity: ENC[AES256_GCM,data:a+OyM/CAfSbL82Ii8FFc0pnmOS339fjx0MY6TcS5hxnq/o6T/ZRT5wyuEdAizQh1fg57iQfK5M3JB5V64I7Vf2/eUd6gQFMMG9DBS6xpbIdlrAq5fg51zlrQ0GdcdwtBE0TMQx9RARvgFRCM0Ibl5To9ztM5Dg5DSdYwO967VY8HhNa7RYt4ta6A/fD5xgSytVS2iChNk7bPGv40QS4tjam1gjInh4eA8K0YsBdz2L2IVotmDp3rfDbkSlgafAowcnwm5yHY8zMJMEAKGGdPz7ZTAUB/npM1AqZ5Xea4pO1WsgvmhX7j5zGmbLm3POyDEfKU12GI3RetKqPr1HKA/dXe+y5yJAf9Ryt16hFM+yff8OerYNPYOzSu7XH5omir,iv:VW6/5kReBh0BZBRXqaOVGhsAPQX9Z2b80J/eUHi2dvk=,tag:DSBJ6JP4cEg5LjqGjc6GpQ==,type:str]
+    identity.pub: ENC[AES256_GCM,data:1lsFtoFsl94Bn51rG6ltUq2xKcSJ16C8g8DK+nwZ7/k5sfUxtEEuDve1EuxuUcPt7jt2OqF1rWiQ0FR1mNhj9PeBmyewlON5MinuMaZ0yTLsCdZC25cYJ+Dz6nB66ihPbq2cCi3VdURQLhPOgdFELXmJ1sdaYLllk5II5otXKVSyJe2N/QJ6oQzlPHwIzr63GrB/YGpFtMEOwzH2MmK0tn8boG9PJ/HpLFKU/Z3NGrbjU1wo+UiiLYRE5YdRMwiT5x29ot/iMd6adyop4A==,iv:zuCnmxG+eLeofXkI42mYS4QlUxKFPVvpQjKHJklr6z0=,tag:scJIB2ZK9i5fhGFvMgqfcA==,type:str]
+    known_hosts: ENC[AES256_GCM,data:RM4p4j4LMRjezS3V/GzU45LA7pH2+E5wv575f2SUSmyNb03zrq6Ll+6c1ez2h/6ik6NxgU7goLBKy1F/szdRVu/Cc3P7E2/u8qRgld6lGU+yNjifbc9yu5YQk9SXEduyALVMgk/A0o/1nFfJloTaVOCgOQ8/leucwAsqRoBGmaqms2Hs8fhlpNuKHzgQE7H26422y6OhkkFZzNSsN5hFdwDjiOXIz8U+FIHu,iv:FVEqEqPUk8dRrEReV8aaAhBJRNew+TYbH9uorleTkeU=,tag:R5iJuxOCOYXYG7J3gj6Ecg==,type:str]
+type: Opaque
+sops:
+    shamir_threshold: 3
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDc0M3bWpvOTI3WDY3UURT
+            amd1dnNGd2dyQjRSYXhIVUZhajdyNWNpYkNFCjNDU3dOTTJXNWtJVkEwOXh3bVg3
+            WVR0Z3VRdzlpamlGcTliRURmR0x4RmsKLS0tIHpmUk1MTjB0dXBOOGtsSE5zdFRq
+            QTRiNzhFQ0Q1MjNyMENNMzd4T29mdXcKUTurohm+cx2NJDwhAd03bfI8JGFdVNbx
+            eIamNTnvt/xEI8665fd2piuxe9BTljp8Jgxul+k/n4ZT1V4wnX2tJg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-05T18:25:50Z"
+    mac: ENC[AES256_GCM,data:TiLcKT3Khdne8sep2FqTYgm9zVMzQupJneUmzjPqz3M3W0/itiOQtlQvn/DzAZ1nIm36wzBZL80mZ+2Yj5SPAeJ3QE1NJH7FBJ3fUszKQNgzqWO95W2E0OYR+2BjOtkq7hUoq2jBY2ZeqSHYR+WX04b5X6+H1Vwt8cfHIwYONlU=,iv:wqQa+2gW3wpIN4PpVq0+ATwC9ExGYSeqDTD1AyBC+fA=,tag:UoaGeYkUkQGpaoR/A5RWPw==,type:str]
+    pgp: []
+    encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))
+    version: 3.9.1
@@ -0,0 +1,87 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./
+  prune: true
+  wait: true
+  sourceRef:
+    kind: OCIRepository
+    name: flux-manifests
+  patches:
+    # Remove the network policies that does not work with k3s
+    - patch: |
+        $patch: delete
+        apiVersion: networking.k8s.io/v1
+        kind: NetworkPolicy
+        metadata:
+          name: not-used
+      target:
+        group: networking.k8s.io
+        kind: NetworkPolicy
+    # Increase the number of reconciliations that can be performed in parallel and bump the resources limits
+    # Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#increase-the-number-of-workers
+    - patch: |
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --concurrent=12
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --kube-api-qps=500
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --kube-api-burst=1000
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --requeue-dependency=5s
+      target:
+        kind: Deployment
+        name: (kustomize-controller|helm-controller|source-controller)
+    - patch: |
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: not-used
+        spec:
+          template:
+            spec:
+              containers:
+                - name: manager
+                  resources:
+                    limits:
+                      memory: 2Gi
+      target:
+        kind: Deployment
+        name: (kustomize-controller|helm-controller|source-controller)
+    # Enable in-memory-kustomize builds
+    # Ref: https://fluxcd.io/flux/installation/configuration/vertical-scaling/#enable-in-memory-kustomize-builds
+    - patch: |
+        - op: replace
+          path: /spec/template/spec/volumes/0
+          value:
+            name: temp
+            emptyDir:
+              medium: Memory
+      target:
+        kind: Deployment
+        name: kustomize-controller
+    # Enable Helm near OOM detection
+    # Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#enable-helm-near-oom-detection
+    - patch: |
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --feature-gates=OOMWatch=true
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --oom-watch-memory-threshold=95
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --oom-watch-interval=500ms
+      target:
+        kind: Deployment
+        name: helm-controller
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deploykey.secret.yaml
+  - ./clustersettings.secret.yaml
+  - ./flux.yaml
+  - ./upgradesettings.yaml
+  - ./namespace.yaml
+  # - sopssecret.secret.yaml
@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: flux-system
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+    name: upgrade-settings
+    namespace: flux-system
+data:
+  # renovate: datasource=docker depName=ghcr.io/siderolabs/installer
+  TALOS_VERSION: v1.8.2
+  # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+  KUBERNETES_VERSION: v1.31.2
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - flux
@@ -0,0 +1,3 @@
+## DO NOT ALTER THIS FILE, CHANGE DO NOT PERSIST. Alter clusterenv.yaml instead.
+hubble:
+  enabled: false
@@ -0,0 +1,80 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: cilium
+    namespace: kube-system
+    annotations:
+        meta.helm.sh/release-name: cilium
+        meta.helm.sh/release-namespace: kube-system
+    labels:
+        app.kubernetes.io/managed-by: Helm
+spec:
+    interval: 15m
+    chart:
+        spec:
+            chart: cilium
+            version: 1.16.3
+            sourceRef:
+                kind: HelmRepository
+                name: cilium
+                namespace: flux-system
+            interval: 15m
+    timeout: 20m
+    maxHistory: 3
+    driftDetection:
+      mode: warn
+    install:
+        remediation:
+            retries: 3
+    upgrade:
+        cleanupOnFail: true
+        remediation:
+            retries: 3
+            remediateLastFailure: true
+    uninstall:
+        keepHistory: false
+    values:
+      # autoDirectNodeRoutes: true
+      # routingMode: native
+      hubble:
+        enabled: false
+      cluster:
+         name: ${CLUSTERNAME}
+         id: 1
+      ipv4NativeRoutingCIDR: ${PODNET}
+      securityContext:
+        privileged: true
+        capabilities:
+          ciliumAgent:
+            - CHOWN
+            - KILL
+            - NET_ADMIN
+            - NET_RAW
+            - IPC_LOCK
+            - SYS_ADMIN
+            - SYS_RESOURCE
+            - DAC_OVERRIDE
+            - FOWNER
+            - SETGID
+            - SETUID
+          cleanCiliumState:
+            - NET_ADMIN
+            - SYS_ADMIN
+            - SYS_RESOURCE
+      cgroup:
+        automount:
+          enabled: false
+        hostRoot: /sys/fs/cgroup
+      enableRuntimeDeviceDetection: true
+      endpointRoutes:
+        enabled: true
+      ipam:
+        mode: kubernetes
+      k8sServiceHost: 127.0.0.1
+      k8sServicePort: 7445
+      kubeProxyReplacement: true
+      kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
+      localRedirectPolicy: true
+      operator:
+        rollOutPods: true
+      rollOutCiliumPods: true
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/kube-system/cilium/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,68 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: descheduler
+    namespace: kube-system
+spec:
+    interval: 15m
+    chart:
+        spec:
+            chart: descheduler
+            version: 0.1.0
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 15m
+    timeout: 20m
+    maxHistory: 3
+    driftDetection:
+      mode: warn
+    install:
+        createNamespace: true
+        remediation:
+            retries: 3
+    upgrade:
+        cleanupOnFail: true
+        remediation:
+            retries: 3
+    uninstall:
+        keepHistory: false
+    values:
+
+        kind: Deployment
+        deschedulerPolicy:
+            strategies:
+                RemoveDuplicates:
+                    enabled: true
+                RemovePodsViolatingNodeTaints:
+                    enabled: true
+                RemovePodsViolatingNodeAffinity:
+                    enabled: true
+                    params:
+                        nodeAffinityType:
+                            - requiredDuringSchedulingIgnoredDuringExecution
+                RemovePodsViolatingTopologySpreadConstraint:
+                    enabled: true
+                    params:
+                        includeSoftConstraints: true
+                RemovePodsViolatingInterPodAntiAffinity:
+                    enabled: true
+                    params:
+                        nodeFit: true
+                LowNodeUtilization:
+                    enabled: false
+                RemoveFailedPods:
+                    enabled: true
+                    params:
+                        failedPods:
+                            includingInitContainers: true
+                            excludeOwnerKinds:
+                                - Job
+                            minPodLifetimeSeconds: 3600
+                RemovePodsHavingTooManyRestarts:
+                    enabled: true
+                    params:
+                        podsHavingTooManyRestarts:
+                            podRestartThreshold: 100
+                            includingInitContainers: true
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: descheduler
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/kube-system/descheduler/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,3 @@
+metrics:
+  main:
+    enabled: false
@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: kubelet-csr-approver
+    namespace: kube-system
+spec:
+    interval: 30m
+    chart:
+        spec:
+            chart: kubelet-csr-approver
+            version: 1.1.2
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 30m
+    values: {}
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kubelet-csr-approver
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/kube-system/kubelet-csr-approver/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - cilium/ks.yaml
+  - descheduler/ks.yaml
+  - kubelet-csr-approver/ks.yaml
+  - metrics-server/ks.yaml
+  - node-feature-discovery/ks.yaml
@@ -0,0 +1,31 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: metrics-server
+    namespace: kube-system
+spec:
+  interval: 15m
+  chart:
+      spec:
+          chart: metrics-server
+          version: 0.1.0
+          sourceRef:
+              kind: HelmRepository
+              name: truecharts
+              namespace: flux-system
+          interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  driftDetection:
+    mode: warn
+  install:
+      createNamespace: true
+      remediation:
+          retries: 3
+  upgrade:
+      remediation:
+          retries: 3
+  uninstall:
+      keepHistory: false
+  values:
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metrics-server
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/kube-system/metrics-server/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: kube-system
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,34 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: node-feature-discovery
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: node-feature-discovery
+      version: 0.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    worker:
+      config:
+        core:
+          sources: ["pci", "system", "usb"]
+    prometheus:
+      enable: true
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: node-feature-discovery
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/kube-system/node-feature-discovery/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - apps
+  - core
+  - flux-entry.yaml
+  - flux-system
+  - kube-system
+  - system
@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: cert-manager
+    namespace: cert-manager
+spec:
+    interval: 5m
+    chart:
+        spec:
+
+            chart: cert-manager
+            version: 6.2.2
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 5m
+    install:
+        createNamespace: true
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    upgrade:
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    values:
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/cert-manager/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: cloudnative-pg
+    namespace: cloudnative-pg
+spec:
+    interval: 5m
+    chart:
+        spec:
+
+            chart: cloudnative-pg
+            version: 8.2.0
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 5m
+    install:
+        createNamespace: true
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    upgrade:
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    values:
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cloudnative-pg
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/cloudnative-pg/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,31 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: kubernetes-reflector
+    namespace: snapshot-controller
+spec:
+    interval: 15m
+    chart:
+        spec:
+            chart: kubernetes-reflector
+            version: 6.2.1
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 15m
+    timeout: 20m
+    maxHistory: 3
+    driftDetection:
+      mode: warn
+    install:
+        createNamespace: true
+        remediation:
+            retries: 3
+    upgrade:
+        cleanupOnFail: true
+        remediation:
+            retries: 3
+    uninstall:
+        keepHistory: false
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kubernetes-reflector
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/kubernetes-reflector/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cert-manager/ks.yaml
+  - cloudnative-pg/ks.yaml
+  - kubernetes-reflector/ks.yaml
+  - kyverno/ks.yaml
+  - longhorn/ks.yaml
+  - metallb/ks.yaml
+  - openebs/ks.yaml
+  - prometheus-operator/ks.yaml
+  - snapshot-controller/ks.yaml
+  - spegel/ks.yaml
+  - system-upgrade-controller/ks.yaml
+  - traefik-crds/ks.yaml
+  - volsync/ks.yaml
@@ -0,0 +1,198 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kyverno
+  namespace: kyverno
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: kyverno
+      version: 3.3.2
+      sourceRef:
+        kind: HelmRepository
+        name: kyverno
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  driftDetection:
+    mode: warn
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+
+    crds:
+      install: true
+    grafana:
+      enabled: true
+      annotations:
+        grafana_folder: System
+    backgroundController:
+      serviceMonitor:
+        enabled: true
+      rbac:
+        clusterRole:
+          extraResources:
+            - apiGroups:
+                - ""
+              resources:
+                - ingresses
+                - pods
+                - nodes
+              verbs:
+                - create
+                - update
+                - patch
+                - delete
+                - get
+                - list
+    cleanupController:
+      serviceMonitor:
+        enabled: true
+    reportsController:
+      serviceMonitor:
+        enabled: true
+    admissionController:
+      replicas: 3
+      serviceMonitor:
+        enabled: true
+      rbac:
+        clusterRole:
+          extraResources:
+            - apiGroups:
+                - ""
+              resources:
+                - ingresses
+                - pods
+                - nodes
+              verbs:
+                - get
+                - create
+                - update
+                - delete
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: kyverno
+              app.kubernetes.io/component: kyverno
+
+    config:
+      # -- Resource types to be skipped by the Kyverno policy engine.
+      # Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list.
+      # These are joined together without spaces, run through `tpl`, and the result is set in the config map.
+      # @default -- See [values.yaml](values.yaml)
+      resourceFilters:
+        - '[Event,*,*]'
+        - '[*/*,kube-system,*]'
+        - '[*/*,kube-public,*]'
+        - '[*/*,kube-node-lease,*]'
+        - '[Node,*,*]'
+        - '[Node/*,*,*]'
+        - '[APIService,*,*]'
+        - '[APIService/*,*,*]'
+        - '[TokenReview,*,*]'
+        - '[SubjectAccessReview,*,*]'
+        - '[SelfSubjectAccessReview,*,*]'
+        - '[ReplicaSet,*,*]'
+        - '[ReplicaSet/*,*,*]'
+        # exclude resources from the chart
+        - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
+        - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
+        - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
+        - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
+        - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
+        - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
+        - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
+        - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
+        - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
+        - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
+        - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
+        - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
+        - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
+        - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
+        - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
+        - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
+        - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
+        - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: kyverno
+    labels:
+        kustomize.toolkit.fluxcd.io/prune: disabled
+        goldilocks.fairwinds.com/enabled: "true"
+        pod-security.kubernetes.io/enforce: privileged
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/kyverno/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,38 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: longhorn
+    namespace: longhorn-system
+spec:
+    interval: 5m
+    releaseName: longhorn
+    chart:
+        spec:
+
+            chart: longhorn
+            version: 1.7.2
+            sourceRef:
+                kind: HelmRepository
+                name: longhorn
+                namespace: flux-system
+    install:
+        createNamespace: true
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    upgrade:
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    values:
+      defaultSettings:
+        # Increase to 3 for a multi-node cluster
+        defaultReplicaCount: 1
+        # Overprovisioning might be needed when using volsync
+        storageOverProvisioningPercentage: 100000
+        # v2DataEngine: true
+      persistence:
+        # Set to false to pick another CSI as default
+        defaultClass: true
+        # Increase to 3 for a multi-node cluster
+        defaultClassReplicaCount: 1
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
+  - volumeSnapshotClass.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: longhorn-system
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,11 @@
+---
+kind: VolumeSnapshotClass
+apiVersion: snapshot.storage.k8s.io/v1
+metadata:
+  name: longhorn-snapshot-vsc
+  annotations:
+    snapshot.storage.kubernetes.io/is-default-class: 'true'
+driver: driver.longhorn.io
+deletionPolicy: Delete
+parameters:
+  type: snap
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/longhorn/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,26 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: metallb
+    namespace: metallb
+spec:
+    interval: 5m
+    chart:
+        spec:
+            chart: metallb
+            version: 0.14.8
+            sourceRef:
+                kind: HelmRepository
+                name: metallb
+                namespace: flux-system
+            interval: 5m
+    install:
+        createNamespace: true
+        remediation:
+            retries: 3
+    upgrade:
+        remediation:
+            retries: 3
+    values:
+      speaker:
+        ignoreExcludeLB: true
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: metallb
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/metallb/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,45 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: openebs
+    namespace: openebs
+spec:
+    interval: 5m
+    releaseName: openebs
+    chart:
+        spec:
+
+            chart: openebs
+            version: 4.1.1
+            sourceRef:
+                kind: HelmRepository
+                name: openebs
+                namespace: flux-system
+    install:
+        createNamespace: true
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    upgrade:
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    values:
+      openebs-crds:
+        csi:
+          volumeSnapshots:
+            enabled: false
+            keep: false
+
+      engines:
+        local:
+          # The lvm-localpv backend contains a duplicate of snapshot controller which will cause conflicts
+          lvm:
+            enabled: false
+          # The ZFS backend contains a duplicate of snapshot controller which will cause conflicts
+          zfs:
+            enabled: false
+        replicated:
+          # The Mayastor backend contains a duplicate of snapshot controller which will cause conflicts
+          mayastor:
+            enabled: false
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: openebs
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openebs
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/openebs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: prometheus-operator
+    namespace: prometheus-operator
+spec:
+    interval: 5m
+    chart:
+        spec:
+
+            chart: prometheus-operator
+            version: 8.8.2
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 5m
+    install:
+        createNamespace: true
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    upgrade:
+        crds: CreateReplace
+        remediation:
+            retries: 3
+    values: {}
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prometheus-operator
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/prometheus-operator/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: snapshot-controller
+    namespace: snapshot-controller
+spec:
+    interval: 5m
+    chart:
+        spec:
+            chart: snapshot-controller
+            version: 3.3.1
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 5m
+    install:
+        createNamespace: true
+        remediation:
+            retries: 3
+    upgrade:
+      cleanupOnFail: true
+      crds: CreateReplace
+      remediation:
+        strategy: rollback
+        retries: 3
+    values:
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: snapshot-controller
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/snapshot-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: spegel
+      version: 2.0.7
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values: {}
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: spegel
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: spegel
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/spegel/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,102 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: system-upgrade-controller
+  namespace: system-upgrade
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      system-upgrade-controller:
+        strategy: RollingUpdate
+        containers:
+          app:
+            image:
+              repository: docker.io/rancher/system-upgrade-controller
+              tag: v0.14.1@sha256:7e13a9b2b984f0c0fd6328439b575348723cc6954b91db3453057fcb784e2d29
+            env:
+              SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
+              SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
+              SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
+              SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
+              SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
+              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.1
+              SYSTEM_UPGRADE_JOB_POD_REPLACEMENT_POLICY: Failed
+              SYSTEM_UPGRADE_JOB_PRIVILEGED: true
+              SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
+              SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
+              SYSTEM_UPGRADE_CONTROLLER_NAME: system-update-controller
+              SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
+                valueFrom:
+                  fieldRef:
+                    fieldPath: metadata.namespace
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+              seccompProfile:
+                type: RuntimeDefault
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile: { type: RuntimeDefault }
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+          effect: NoSchedule
+    serviceAccount:
+      create: true
+      name: system-upgrade
+    persistence:
+      tmp:
+        type: emptyDir
+      etc-ssl:
+        type: hostPath
+        hostPath: /etc/ssl
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - readOnly: true
+      etc-pki:
+        type: hostPath
+        hostPath: /etc/pki
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - readOnly: true
+      etc-ca-certificates:
+        type: hostPath
+        hostPath: /etc/ca-certificates
+        hostPathType: DirectoryOrCreate
+        globalMounts:
+          - readOnly: true
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
+  - rbac.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: system-upgrade
+    annotations:
+        volsync.backube/privileged-movers: "true"
+    labels:
+        kustomize.toolkit.fluxcd.io/prune: disabled
+        goldilocks.fairwinds.com/enabled: "true"
+        pod-security.kubernetes.io/enforce: privileged
@@ -0,0 +1,22 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system-upgrade
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: system-upgrade
+    namespace: system-upgrade
+---
+apiVersion: talos.dev/v1alpha1
+kind: ServiceAccount
+metadata:
+  name: talos
+  namespace: system-upgrade
+spec:
+  roles:
+    - os:admin
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: system-upgrade-controller
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/system-upgrade-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,32 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: traefik-crds
+    namespace: system
+spec:
+    interval: 15m
+    chart:
+        spec:
+            chart: traefik-crds
+            version: 3.2.3
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 15m
+    timeout: 20m
+    maxHistory: 3
+    driftDetection:
+      mode: warn
+    install:
+        createNamespace: true
+        remediation:
+            retries: 3
+    upgrade:
+        cleanupOnFail: true
+        remediation:
+            retries: 3
+    uninstall:
+        keepHistory: false
+    values: {}
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: traefik-crds
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/traefik-crds/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,24 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: volsync
+    namespace: volsync
+spec:
+    interval: 5m
+    chart:
+        spec:
+
+            chart: volsync
+            version: 2.4.1
+            sourceRef:
+                kind: HelmRepository
+                name: truecharts
+                namespace: flux-system
+            interval: 5m
+    install:
+        createNamespace: true
+        remediation:
+            retries: 3
+    upgrade:
+        remediation:
+            retries: 3
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: volsync
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: volsync
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/system/volsync/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,2 @@
+main-k8s-control-1.yaml
+talosconfig
--- a/Show More
+++ b/Show More