rename old cluster

flux/old_cluster/apps/gitops/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - renovate

flux/old_cluster/apps/gitops/renovate/external-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: renovate
+  namespace: gitops
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: renovate
+  data:
+    - secretKey: RENOVATE_TOKEN
+      remoteRef:
+        key: gitops/renovate
+        property: gitea_token
+    - secretKey: GITHUB_COM_TOKEN
+      remoteRef:
+        key: gitops/renovate
+        property: github_token

flux/old_cluster/apps/gitops/renovate/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - external-secret.yaml
+  - renovate-infrastructure.yaml

flux/old_cluster/apps/gitops/renovate/renovate-infrastructure.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: renovate-infrastructure
+  namespace: gitops
+spec:
+  schedule: "@hourly"
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+            - name: config-volume
+              configMap:
+                name: renovate-config
+            - name: work-volume
+              emptyDir: {}
+          containers:
+            - name: renovate
+              image: renovate/renovate:32.135
+              volumeMounts:
+                - name: config-volume
+                  mountPath: /opt/renovate/
+                - name: work-volume
+                  mountPath: /tmp/renovate/
+              env:
+                - name: LOG_LEVEL
+                  value: debug
+                - name: RENOVATE_ENDPOINT
+                  value: "https://git.0x76.dev/api/v1/"
+                - name: RENOVATE_PLATFORM
+                  value: gitea
+                - name: RENOVATE_AUTODISCOVER
+                  value: "false"
+                - name: RENOVATE_GIT_AUTHOR
+                  value: "Renovate Bot <renovate@xirion.net>"
+                - name: RENOVATE_CONFIG_FILE
+                  value: "/opt/renovate/config.js"
+                - name: RENOVATE_BASE_DIR
+                  value: "/tmp/renovate"
+              envFrom:
+                - secretRef:
+                    name: renovate
+          restartPolicy: Never
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: renovate-config
+  namespace: gitops
+data:
+  config.js: |-
+    module.exports = {
+      "binarySource": "install",
+      "repositories": ["v/infrastructure"],
+      "flux": {
+        "fileMatch": ["flux/.+\\.ya?ml$"]
+      },
+      "helm-values": {
+        "fileMatch": ["flux/.+\\.ya?ml$"]
+      },
+      "kubernetes": {
+        "fileMatch": ["flux/.+\\.ya?ml$"]
+      },
+      "hostRules": [
+        {
+          "hostType": "docker",
+          "matchHost": "ghcr.io",
+          "username": "NULLx76",
+          "password": process.env.GITHUB_COM_TOKEN
+        }
+      ],
+      "packageRules": [
+        {
+          "automerge": true,
+          "automergeType": "branch",
+          "matchPackageNames": [
+            "renovate/renovate"
+          ]
+        }
+      ],
+      // ignore individual fluxcd images
+      "ignoreDeps": [
+        "ghcr.io/fluxcd/helm-controller",
+        "ghcr.io/fluxcd/image-automation-controller",
+        "ghcr.io/fluxcd/image-reflector-controller",
+        "ghcr.io/fluxcd/kustomize-controller",
+        "ghcr.io/fluxcd/notification-controller",
+        "ghcr.io/fluxcd/source-controller"
+      ],
+      "regexManagers": [
+        {
+          "fileMatch": [
+            "flux/cluster/crds/traefik/.+\\.ya?ml$"
+          ],
+          "matchStrings": [
+            "registryUrl=(?<registryUrl>.*?) chart=(?<depName>.*?)\n *tag: v(?<currentValue>.*)\n"
+          ],
+          "datasourceTemplate": "helm"
+        },
+        {
+          "fileMatch": [
+            "flux/cluster/crds/external-secrets/.+\\.ya?ml$"
+          ],
+          "matchStrings": [
+            "registryUrl=(?<registryUrl>.*?) chart=(?<depName>.*?)\n *tag: helm-chart-(?<currentValue>.*)\n"
+          ],
+          "datasourceTemplate": "helm"
+        },
+      ]
+    };

flux/old_cluster/apps/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - networking
+  - presidential-paradise
+  - gitops
+  - olympus

flux/old_cluster/apps/networking/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - traefik

flux/old_cluster/apps/networking/traefik/helm-release.yaml

@@ -0,0 +1,74 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: networking
+spec:
+  interval: 5m
+  chart:
+    spec:
+      # renovate: registryUrl=https://helm.traefik.io/traefik
+      chart: traefik
+      version: 10.24.0
+      sourceRef:
+        kind: HelmRepository
+        name: traefik-charts
+        namespace: flux-system
+      interval: 5m
+  values:
+    image:
+      name: traefik
+    deployment:
+      kind: Deployment
+      replicas: 2
+    service:
+      enabled: true
+      type: LoadBalancer
+      spec:
+        externalIPs:
+          - 10.42.42.150
+        externalTrafficPolicy: Local
+    logs:
+      general:
+        level: WARN
+    ingressClass:
+      enabled: true
+      isDefaultClass: true
+      fallbackApiVersion: v1
+    globalArguments: []
+    additionalArguments:
+      - "--providers.kubernetesingress.ingressclass=traefik"
+      - "--providers.kubernetesingress.ingressendpoint.ip=10.42.42.150"
+      - "--entryPoints.web.forwardedHeaders.insecure=true"
+      - "--entryPoints.websecure.forwardedHeaders.insecure=true"
+    ports:
+      traefik:
+        port: 9000
+        expose: true
+      web:
+        port: 8000
+        exposedPort: 8000
+        expose: true
+      websecure:
+        port: 8443
+        exposedPort: 8443
+        expose: true
+    pilot:
+      enabled: false
+    experimental:
+      plugins:
+        enabled: false
+    affinity: {}
+    providers:
+      kubernetesCRD:
+        enabled: true
+        namespaces:
+          - networking
+          - olympus
+    resources:
+      requests:
+        memory: 100Mi
+        cpu: 500m
+      limits:
+        memory: 500Mi

flux/old_cluster/apps/networking/traefik/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml

flux/old_cluster/apps/olympus/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - xirion-registry-creds.yaml
+  - umami

flux/old_cluster/apps/olympus/umami/deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: umami
+  namespace: olympus
+  labels:
+    app: umami
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: umami
+  template:
+    metadata:
+      labels:
+        app: umami
+    spec:
+      containers:
+        - name: umami
+          imagePullPolicy: IfNotPresent
+          image: ghcr.io/mikecao/umami:postgresql-v1.31.0
+          ports:
+            - containerPort: 3000
+              name: web
+          env:
+            - name: DATABASE_TYPE
+              value: postgres
+            - name: DATABASE_URL
+              value: "postgresql://umami@10.42.42.26/umami"
+          envFrom:
+            - secretRef:
+                name: umami

flux/old_cluster/apps/olympus/umami/external-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: umami
+  namespace: olympus
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: umami
+  data:
+    - secretKey: HASH_SALT
+      remoteRef:
+        key: olympus/umami
+        property: hash_salt

flux/old_cluster/apps/olympus/umami/ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: umami
+  namespace: olympus
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: olympus-umamijs@kubernetescrd
+spec:
+  rules:
+    - host: "msg.0x76.dev"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: umami
+                port:
+                  number: 80

flux/old_cluster/apps/olympus/umami/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - external-secret.yaml
+  - ingress.yaml
+  - svc.yaml
+  - middleware.yaml

flux/old_cluster/apps/olympus/umami/middleware.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: umamijs
+  namespace: olympus
+spec:
+  replacePathRegex:
+    regex: ^/script\.js
+    replacement: /umami.js

flux/old_cluster/apps/olympus/umami/svc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: umami
+  namespace: olympus
+spec:
+  selector:
+    app: umami
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: web

flux/old_cluster/apps/olympus/xirion-registry-creds.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: xirion-registry-creds
+  namespace: olympus
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: xirion-registry-creds
+    template:
+      type: kubernetes.io/dockerconfigjson
+  data:
+    - secretKey: .dockerconfigjson
+      remoteRef:
+        key: xirion-registry-creds
+        property: dockerconfigjson

flux/old_cluster/apps/presidential-paradise/0x76dev/0x76.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: x76dev
+  namespace: presidential-paradise
+  labels:
+    app: x76dev
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: x76dev
+  template:
+    metadata:
+      labels:
+        app: x76dev
+    spec:
+      containers:
+        - name: x76dev
+          image: registry.xirion.net/library/0x76.dev
+          ports:
+            - containerPort: 8080
+      imagePullSecrets:
+        - name: xirion-registry-creds
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: x76dev-service
+  namespace: presidential-paradise
+spec:
+  selector:
+    app: x76dev
+  ports:
+    - protocol: TCP
+      port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: x76dev-ingress
+  namespace: presidential-paradise
+spec:
+  ingressClassName: "traefik"
+  rules:
+    - host: "0x76.dev"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: x76dev-service
+                port:
+                  number: 8080

flux/old_cluster/apps/presidential-paradise/0x76dev/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - 0x76.yaml

flux/old_cluster/apps/presidential-paradise/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - xirion-registry-creds.yaml
+  - 0x76dev

flux/old_cluster/apps/presidential-paradise/xirion-registry-creds.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: xirion-registry-creds
+  namespace: presidential-paradise
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: xirion-registry-creds
+    template:
+      type: kubernetes.io/dockerconfigjson
+  data:
+    - secretKey: .dockerconfigjson
+      remoteRef:
+        key: xirion-registry-creds
+        property: dockerconfigjson

flux/old_cluster/base/apps.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: apps
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  dependsOn:
+    - name: core
+  path: ./flux/cluster/apps
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

flux/old_cluster/base/core.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: core
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  dependsOn:
+    - name: crds
+  path: ./flux/cluster/core
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

flux/old_cluster/base/crds.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: crds
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./flux/cluster/crds
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

flux/old_cluster/base/flux-system/charts/helm/drone-charts.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: drone-charts
+  namespace: flux-system
+spec:
+  interval: 15m
+  url: https://charts.drone.io
+  timeout: 3m

flux/old_cluster/base/flux-system/charts/helm/external-secrets-charts.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: external-secrets-charts
+  namespace: flux-system
+spec:
+  interval: 15m0s
+  url: https://charts.external-secrets.io
+

flux/old_cluster/base/flux-system/charts/helm/fairwinds-charts.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: fairwinds-charts
+  namespace: flux-system
+spec:
+  interval: 15m
+  url: https://charts.fairwinds.com/stable
+  timeout: 3m

flux/old_cluster/base/flux-system/charts/helm/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - metallb-charts.yaml
+  - traefik-charts.yaml
+  - external-secrets-charts.yaml
+  - fairwinds-charts.yaml
+  - drone-charts.yaml

flux/old_cluster/base/flux-system/charts/helm/metallb-charts.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: metallb-charts
+  namespace: flux-system
+spec:
+  interval: 15m0s
+  url: https://metallb.github.io/metallb
+

flux/old_cluster/base/flux-system/charts/helm/traefik-charts.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: traefik-charts
+  namespace: flux-system
+spec:
+  interval: 15m
+  url: https://helm.traefik.io/traefik
+  timeout: 3m

flux/old_cluster/base/flux-system/charts/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm
+

flux/old_cluster/base/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: ssh://gitea@git.0x76.dev:42/v/infrastructure.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./flux/cluster/base
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

flux/old_cluster/base/flux-system/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gotk-components.yaml
+  - gotk-sync.yaml
+  - xirion-registry-creds.yaml
+  - charts

flux/old_cluster/base/flux-system/xirion-registry-creds.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: xirion-registry-creds
+  namespace: flux-system
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: xirion-registry-creds
+    template:
+      type: kubernetes.io/dockerconfigjson
+  data:
+    - secretKey: .dockerconfigjson
+      remoteRef:
+        key: xirion-registry-creds
+        property: dockerconfigjson

flux/old_cluster/core/external-secrets/external-secrets/helm-release.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: 5m
+  chart:
+    spec:
+      # renovate: registryUrl=https://charts.external-secrets.io
+      chart: external-secrets
+      version: 0.5.8
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets-charts
+        namespace: flux-system
+      interval: 5m
+  values:
+    installCRDs: false
+  install:
+    crds: Skip
+  upgrade:
+    crds: Skip

flux/old_cluster/core/external-secrets/external-secrets/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - vault-secret-store.yaml

flux/old_cluster/core/external-secrets/external-secrets/vault-secret-store.yaml

@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: vault
+  namespace: external-secrets
+spec:
+  provider:
+    vault:
+      server: "http://10.42.42.6:8200"
+      path: "k8s"
+      version: "v2"
+      auth:
+        # VaultAppRole authenticates with Vault using the
+        # App Role auth mechanism
+        # https://www.vaultproject.io/docs/auth/approle
+        appRole:
+          # Path where the App Role authentication backend is mounted
+          path: "approle"
+          # RoleID configured in the App Role authentication backend
+          roleId: "bb841a0e-45c1-9dab-36f0-f72647d6aff0"
+          # Reference to a key in a K8 Secret that contains the App Role SecretId
+          # (not commited in git)
+          secretRef:
+            name: "vault-secret-id"
+            namespace: "external-secrets"
+            key: "secret-id"

flux/old_cluster/core/external-secrets/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - external-secrets

flux/old_cluster/core/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespaces
+  - networking
+  - external-secrets
+

flux/old_cluster/core/namespaces/drone-build.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: drone-build

flux/old_cluster/core/namespaces/external-secrets.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets

flux/old_cluster/core/namespaces/gitops.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitops

flux/old_cluster/core/namespaces/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - presidential-paradise.yaml
+  - networking.yaml
+  - external-secrets.yaml
+  - gitops.yaml
+  - monitoring.yaml
+  - olympus.yaml
+  - drone-build.yaml

flux/old_cluster/core/namespaces/monitoring.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

flux/old_cluster/core/namespaces/networking.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: networking

flux/old_cluster/core/namespaces/olympus.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: olympus
+  labels:
+    goldilocks.fairwinds.com/enabled: "true"

flux/old_cluster/core/namespaces/presidential-paradise.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: presidential-paradise
+  labels:
+    goldilocks.fairwinds.com/enabled: "true"

flux/old_cluster/core/networking/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - metallb

flux/old_cluster/core/networking/metallb/address-pool.yaml

@@ -0,0 +1,8 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: main-pool
+  namespace: networking
+spec:
+  addresses:
+    - 10.42.42.150-192.168.42.200

flux/old_cluster/core/networking/metallb/helm-release.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: metallb
+  namespace: networking
+spec:
+  interval: 5m
+  chart:
+    spec:
+      # renovate: registryUrl=https://metallb.github.io/metallb
+      chart: metallb
+      version: 0.13.4
+      sourceRef:
+        kind: HelmRepository
+        name: metallb-charts
+        namespace: flux-system
+      interval: 5m
+  values:
+    crds:
+      enabled: true
+    speaker:
+      tolerations:
+        - effect: "NoExecute"
+          operator: "Exists"
+        - effect: "NoSchedule"
+          operator: "Exists"

flux/old_cluster/core/networking/metallb/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - address-pool.yaml
+  - l2advertisement.yaml

flux/old_cluster/core/networking/metallb/l2advertisement.yaml

@@ -0,0 +1,8 @@
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: main-pool
+  namespace: networking
+spec:
+  ipAddressPools:
+    - main-pool

flux/old_cluster/crds/external-secrets/crds.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: external-secrets-crd-source
+  namespace: flux-system
+spec:
+  interval: 30m
+  url: https://github.com/external-secrets/external-secrets.git
+  ref:
+    # renovate: registryUrl=https://charts.external-secrets.io chart=external-secrets
+    tag: helm-chart-0.5.8
+  ignore: |
+    # exclude all
+    /*
+    # path to crds
+    !/deploy/crds/
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: external-secrets-crds
+  namespace: flux-system
+spec:
+  interval: 15m
+  prune: false
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: external-secrets-crd-source

flux/old_cluster/crds/external-secrets/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crds.yaml

flux/old_cluster/crds/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+ - traefik
+ - external-secrets

flux/old_cluster/crds/traefik/crds.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: traefik-crd-source
+  namespace: flux-system
+spec:
+  interval: 30m
+  url: https://github.com/traefik/traefik-helm-chart.git
+  ref:
+    # renovate: registryUrl=https://helm.traefik.io/traefik chart=traefik
+    tag: v10.24.0
+  ignore: |
+    # exclude all
+    /*
+    # path to crds
+    !/traefik/crds/
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: traefik-crds
+  namespace: flux-system
+spec:
+  interval: 15m
+  prune: false
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: traefik-crd-source

flux/old_cluster/crds/traefik/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crds.yaml