envs/env-data-schema.ytt.yaml

@@ -1,38 +0,0 @@
-#@data/values-schema
----
-#@overlay/match missing_ok=True
-cluster:
-  domain: ""
-  ingress:
-    className: ""
-  tls:
-    issuer: ""
-  storageClass:
-    block: ""
-    local: ""
-
-#@overlay/match missing_ok=True
-backups:
-  enabled: false
-  s3:
-    endpoint: ""
-    region: ""
-  storagebox:
-    enabled: false
-
-#@overlay/match missing_ok=True
-ocis:
-  insecure: false
-  s3:
-    external: false
-    endpoint: ""
-    region: ""
-    bucket: ""
-
-#@overlay/match missing_ok=True
-forgejo:
-  sshPort: 22
-  #@schema/type any=True
-  nodeSelector: {}
-  backup:
-    s3Bucket: ""

envs/minikube/env-data.ytt.yaml

@@ -1,42 +0,0 @@
-#@data/values
----
-environment:
-  id: minikube
-  applications:
-    - proto: cert-manager
-    - proto: kubernetes-secret-generator
-    - proto: traefik
-    - proto: cloudnative-pg
-    - proto: garage
-    - proto: victoria-metrics-single
-    - proto: kube-state-metrics
-    - proto: node-exporter
-    - proto: metrics-server
-    - proto: grafana
-    - proto: ocis
-
-cluster:
-  domain: minikube
-  ingress:
-    className: traefik
-  tls:
-    issuer: mkcert
-  storageClass:
-    block: standard
-    local: standard
-
-backups:
-  enabled: false
-  s3:
-    endpoint: ""
-    region: ""
-  storagebox:
-    enabled: false
-
-ocis:
-  insecure: true
-  s3:
-    external: false
-    endpoint: http://garage.garage.svc:3900
-    region: garage
-    bucket: ocis-minikube

envs/production/env-data.ytt.yaml

@@ -1,5 +1,3 @@
-#@ load("@ytt:overlay", "overlay")
-
 #@data/values
 ---
 environment:
@@ -18,36 +16,3 @@ environment:
     - proto: cloudnative-pg
     - proto: metrics-server
     - proto: ocis
-
-cluster:
-  domain: tr1ceracop.de
-  ingress:
-    className: traefik
-  tls:
-    issuer: letsencrypt
-  storageClass:
-    block: hcloud-volumes
-    local: local-path
-
-backups:
-  enabled: true
-  s3:
-    endpoint: https://fsn1.your-objectstorage.com
-    region: fsn1
-  storagebox:
-    enabled: true
-
-ocis:
-  s3:
-    external: true
-    endpoint: https://nbg1.your-objectstorage.com
-    region: nbg1
-    bucket: ocis-tr1ceracop
-
-forgejo:
-  sshPort: 222
-  #@overlay/replace
-  nodeSelector:
-    kubernetes.io/hostname: ubuntu-4gb-nbg1-3
-  backup:
-    s3Bucket: k8s-and-chill-backups

flake.nix

@@ -14,7 +14,6 @@
       {
         devShells.default = pkgs.mkShell {
           packages = with pkgs; [
-            mkcert
             talosctl
             kubectl
             kubernetes-helm
@@ -22,9 +21,6 @@
             hcloud
             sops
             age
-            minikube
-            docker
-            postgresql
           ];
         };
       });

prototypes/argocd/app-data.ytt.yaml

@@ -3,4 +3,3 @@
 #@overlay/match-child-defaults missing_ok=True
 application:
   namespace: argocd
-  subdomain: argocd

prototypes/argocd/helm/argo-cd.yaml

@@ -1,12 +1,10 @@
-#@ load("@ytt:data", "data")
-#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
 ---
 crds:
   install: true
   keep: true
 
 global:
-  domain: #@ host
+  domain: argocd.tr1ceracop.de
 
 configs:
   params:
@@ -32,10 +30,10 @@ server:
     enabled: true
   ingress:
     enabled: true
-    ingressClassName: #@ data.values.cluster.ingress.className
+    ingressClassName: traefik
     tls: true
     annotations:
-      cert-manager.io/cluster-issuer: #@ data.values.cluster.tls.issuer
+      cert-manager.io/cluster-issuer: letsencrypt
 
 repoServer:
   metrics:

prototypes/cert-manager/ytt/clusterissuer.ytt.yaml

@@ -1,7 +1,5 @@
 #@ load("@ytt:overlay", "overlay")
-#@ load("@ytt:data", "data")
 
-#@ if data.values.cluster.tls.issuer == "letsencrypt":
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
@@ -16,5 +14,4 @@ spec:
     solvers:
       - http01:
           ingress:
-            ingressClassName: #@ data.values.cluster.ingress.className
+            ingressClassName: traefik
-#@ end

prototypes/cert-manager/ytt/mkcert-ca-precheck-job.ytt.yaml

@@ -1,85 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-
-#@ if data.values.cluster.tls.issuer == "mkcert":
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: mkcert-ca-precheck
-  namespace: #@ ns
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: mkcert-ca-precheck
-  namespace: #@ ns
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: mkcert-ca-precheck
-  namespace: #@ ns
-subjects:
-  - kind: ServiceAccount
-    name: mkcert-ca-precheck
-    namespace: #@ ns
-roleRef:
-  kind: Role
-  name: mkcert-ca-precheck
-  apiGroup: rbac.authorization.k8s.io
-
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mkcert-ca-precheck
-  namespace: #@ ns
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
-    argocd.argoproj.io/sync-options: Replace=true
-spec:
-  ttlSecondsAfterFinished: 300
-  template:
-    spec:
-      serviceAccountName: mkcert-ca-precheck
-      restartPolicy: OnFailure
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: precheck
-          image: alpine/k8s:1.32.3
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              if ! kubectl get secret mkcert-ca -n "${NAMESPACE}" >/dev/null 2>&1; then
-                echo "ERROR: External secret mkcert-ca must be created in ${NAMESPACE} before deploying cert-manager."
-                echo "Run: mkcert -install && kubectl -n ${NAMESPACE} create secret tls mkcert-ca --cert=\"\$(mkcert -CAROOT)/rootCA.pem\" --key=\"\$(mkcert -CAROOT)/rootCA-key.pem\""
-                exit 1
-              fi
-              echo "OK: mkcert-ca exists"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-              - ALL
-#@ end

prototypes/cert-manager/ytt/mkcert-clusterissuer.ytt.yaml

@@ -1,12 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ if data.values.cluster.tls.issuer == "mkcert":
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: mkcert
-spec:
-  ca:
-    secretName: mkcert-ca
-#@ end

prototypes/forgejo/app-data.ytt.yaml

@@ -3,4 +3,3 @@
 #@overlay/match-child-defaults missing_ok=True
 application:
   namespace: forgejo
-  subdomain: git

prototypes/forgejo/helm/forgejo.yaml

@@ -1,5 +1,3 @@
-#@ load("@ytt:data", "data")
-#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
 ---
 strategy:
   type: Recreate
@@ -19,16 +17,16 @@ persistence:
 ingress:
   enabled: true
   hosts:
-    - host: #@ host
+    - host: git.tr1ceracop.de
       paths:
         - path: /
           pathType: Prefix
   tls:
     - secretName: forgejo-tls
       hosts:
-        - #@ host
+        - git.tr1ceracop.de
   annotations:
-    cert-manager.io/cluster-issuer: #@ data.values.cluster.tls.issuer
+    cert-manager.io/cluster-issuer: letsencrypt
 
 service:
   ssh:
@@ -60,9 +58,9 @@ gitea:
     queue:
       TYPE: level
     server:
-      DOMAIN: #@ host
+      DOMAIN: git.tr1ceracop.de
-      ROOT_URL: #@ "https://{}/".format(host)
+      ROOT_URL: https://git.tr1ceracop.de/
-      SSH_PORT: #@ data.values.forgejo.sshPort
+      SSH_PORT: 222
     service:
       DISABLE_REGISTRATION: true
     actions:

prototypes/forgejo/ytt/argocd-deploy-key-job.ytt.yaml

@@ -1,9 +1,6 @@
 #@ load("@ytt:data", "data")
 
 #@ ns = data.values.application.namespace
-#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
-#@ repo_url = "ssh://git@" + host + ":" + str(data.values.forgejo.sshPort) + "/gitea_admin/k8s-and-chill.git"
-#@ forgejo_url = "https://" + host
 
 ---
 apiVersion: v1
@@ -54,15 +51,6 @@ spec:
       containers:
         - name: init
           image: alpine/k8s:1.32.3
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: REPO_URL
-              value: #@ repo_url
-            - name: FORGEJO_URL
-              value: #@ forgejo_url
           command:
             - sh
             - -c
@@ -71,6 +59,8 @@ spec:
 
               ARGOCD_NS="argocd"
               REPO_SECRET="forgejo-repo"
+              REPO_URL="ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git"
+              FORGEJO_URL="https://git.tr1ceracop.de"
               REPO_OWNER="gitea_admin"
               REPO_NAME="k8s-and-chill"
 
@@ -152,3 +142,8 @@ spec:
               EOSECRET
 
               echo "Created ArgoCD repository secret ${REPO_SECRET} in ${ARGOCD_NS}"
+          env:
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace

prototypes/forgejo/ytt/cnpg-cluster.ytt.yaml

@@ -18,7 +18,7 @@ spec:
 
   storage:
     size: 5Gi
-    storageClass: #@ data.values.cluster.storageClass.block
+    storageClass: hcloud-volumes
 
   resources:
     requests:
@@ -27,11 +27,10 @@ spec:
     limits:
       memory: 512Mi
 
-  #@ if data.values.backups.enabled:
   backup:
     barmanObjectStore:
-      endpointURL: #@ data.values.backups.s3.endpoint
+      endpointURL: https://fsn1.your-objectstorage.com
-      destinationPath: #@ "s3://{}/forgejo/cnpg".format(data.values.forgejo.backup.s3Bucket)
+      destinationPath: s3://k8s-and-chill-backups/forgejo/cnpg
       s3Credentials:
         accessKeyId:
           name: forgejo-backup-s3
@@ -45,7 +44,6 @@ spec:
         compression: gzip
     retentionPolicy: "30d"
     target: prefer-standby
-  #@ end
 
   postgresql:
     parameters:

prototypes/forgejo/ytt/cnpg-scheduled-backup.ytt.yaml

@@ -2,7 +2,6 @@
 
 #@ ns = data.values.application.namespace
 
-#@ if data.values.backups.enabled:
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
@@ -16,4 +15,3 @@ spec:
   method: barmanObjectStore
   backupOwnerReference: cluster
   target: prefer-standby
-#@ end

prototypes/forgejo/ytt/git-pvc.ytt.yaml

@@ -13,7 +13,7 @@ metadata:
 spec:
   accessModes:
     - ReadWriteOnce
-  storageClassName: #@ data.values.cluster.storageClass.block
+  storageClassName: hcloud-volumes
   resources:
     requests:
       storage: 20Gi

prototypes/forgejo/ytt/git-snapshot-cronjob.ytt.yaml

@@ -2,43 +2,6 @@
 
 #@ ns = data.values.application.namespace
 
-#@ s3_endpoint = data.values.backups.s3.endpoint
-#@ s3_bucket = data.values.forgejo.backup.s3Bucket
-
-#@ backup_script = """\
-#@ set -e
-#@ apk add --no-cache rclone > /dev/null 2>&1
-#@
-#@ mkdir -p /tmp/rclone
-#@ cat > /tmp/rclone/rclone.conf <<CONF
-#@ [s3]
-#@ type = s3
-#@ provider = Other
-#@ access_key_id = ${ACCESS_KEY_ID}
-#@ secret_access_key = ${SECRET_ACCESS_KEY}
-#@ endpoint = """ + s3_endpoint + """
-#@ acl = private
-#@ CONF
-#@
-#@ echo "Syncing git repositories to S3..."
-#@ rclone sync /data/git/ s3:""" + s3_bucket + """/forgejo/git/ \\
-#@   --config /tmp/rclone/rclone.conf \\
-#@   --transfers 4 \\
-#@   -v
-#@
-#@ echo "Syncing gitea data (avatars, attachments, keys)..."
-#@ rclone sync /data/gitea/ s3:""" + s3_bucket + """/forgejo/gitea/ \\
-#@   --config /tmp/rclone/rclone.conf \\
-#@   --exclude 'conf/**' \\
-#@   --exclude 'queues/**' \\
-#@   --transfers 4 \\
-#@   -v
-#@
-#@ rm -rf /tmp/rclone
-#@ echo "Backup complete."
-#@ """
-
-#@ if data.values.backups.enabled:
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -64,14 +27,45 @@ spec:
         spec:
           restartPolicy: OnFailure
           serviceAccountName: forgejo-git-backup
-          nodeSelector: #@ data.values.forgejo.nodeSelector
+          nodeSelector:
+            kubernetes.io/hostname: ubuntu-4gb-nbg1-3
           containers:
             - name: backup
               image: alpine:3.20
               command:
                 - sh
                 - -c
-                - #@ backup_script
+                - |
+                  set -e
+                  apk add --no-cache rclone > /dev/null 2>&1
+
+                  mkdir -p /tmp/rclone
+                  cat > /tmp/rclone/rclone.conf <<CONF
+                  [s3]
+                  type = s3
+                  provider = Other
+                  access_key_id = ${ACCESS_KEY_ID}
+                  secret_access_key = ${SECRET_ACCESS_KEY}
+                  endpoint = https://fsn1.your-objectstorage.com
+                  acl = private
+                  CONF
+
+                  echo "Syncing git repositories to S3..."
+                  rclone sync /data/git/ s3:k8s-and-chill-backups/forgejo/git/ \
+                    --config /tmp/rclone/rclone.conf \
+                    --transfers 4 \
+                    -v
+
+                  echo "Syncing gitea data (avatars, attachments, keys)..."
+                  rclone sync /data/gitea/ s3:k8s-and-chill-backups/forgejo/gitea/ \
+                    --config /tmp/rclone/rclone.conf \
+                    --exclude 'conf/**' \
+                    --exclude 'queues/**' \
+                    --transfers 4 \
+                    -v
+
+                  rm -rf /tmp/rclone
+                  echo "Backup complete."
               env:
                 - name: ACCESS_KEY_ID
                   valueFrom:
@@ -91,4 +85,3 @@ spec:
             - name: data
               persistentVolumeClaim:
                 claimName: forgejo-git-storage
-#@ end

prototypes/forgejo/ytt/ingress-fix.ytt.yaml

@@ -1,7 +1,4 @@
 #@ load("@ytt:overlay", "overlay")
-#@ load("@ytt:data", "data")
-
-#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
 
 #@overlay/match by=overlay.subset({"kind": "Ingress"}), expects="0+"
 ---
@@ -9,7 +6,7 @@ apiVersion: networking.k8s.io/v1
 spec:
   #@overlay/replace
   rules:
-    - host: #@ host
+    - host: git.tr1ceracop.de
       http:
         paths:
           - path: /

prototypes/forgejo/ytt/ssh-hostport.ytt.yaml

@@ -1,5 +1,4 @@
 #@ load("@ytt:overlay", "overlay")
-#@ load("@ytt:data", "data")
 
 #! Add hostPort 22 to the SSH container port and pin to the DNS target node
 #@overlay/match by=overlay.subset({"kind": "Deployment", "metadata": {"name": "forgejo"}})
@@ -8,10 +7,11 @@ spec:
   template:
     spec:
       #@overlay/match missing_ok=True
-      nodeSelector: #@ data.values.forgejo.nodeSelector
+      nodeSelector:
+        kubernetes.io/hostname: ubuntu-4gb-nbg1-3
       containers:
         #@overlay/match by=overlay.subset({"name": "forgejo"})
         - ports:
             #@overlay/match by=overlay.subset({"name": "ssh"})
             #@overlay/match-child-defaults missing_ok=True
-            - hostPort: #@ data.values.forgejo.sshPort
+            - hostPort: 222

prototypes/garage/app-data.ytt.yaml

@@ -1,14 +0,0 @@
-#@data/values-schema
----
-#@overlay/match-child-defaults missing_ok=True
-application:
-  namespace: garage
-  image: dxflrs/garage:v1.0.1
-  storage:
-    size: 5Gi
-  bucket:
-    name: ocis-minikube
-    keyName: ocis
-  ocis:
-    namespace: ocis
-    secretName: ocis-s3-credentials

prototypes/garage/ytt/configmap.ytt.yaml

@@ -1,36 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: garage-config
-  namespace: #@ ns
-data:
-  garage.toml: |
-    metadata_dir = "/var/lib/garage/meta"
-    data_dir = "/var/lib/garage/data"
-    db_engine = "lmdb"
-
-    replication_factor = 1
-
-    rpc_bind_addr = "[::]:3901"
-    rpc_public_addr = "127.0.0.1:3901"
-    rpc_secret_file = "/etc/garage/rpc_secret"
-
-    [s3_api]
-    s3_region = "garage"
-    api_bind_addr = "[::]:3900"
-    root_domain = ".s3.garage.local"
-
-    [s3_web]
-    bind_addr = "[::]:3902"
-    root_domain = ".web.garage.local"
-    index = "index.html"
-
-    [admin]
-    api_bind_addr = "[::]:3903"
-    admin_token_file = "/etc/garage/admin_token"
-    metrics_token_file = "/etc/garage/admin_token"

prototypes/garage/ytt/init-job.ytt.yaml

@@ -1,167 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-#@ app = data.values.application
-
-#@ init_script = """\
-#@ set -eu
-#@
-#@ ADMIN_TOKEN=$(cat /etc/garage/admin_token)
-#@ AUTH="Authorization: Bearer ${ADMIN_TOKEN}"
-#@ ADMIN="http://garage.""" + ns + """.svc:3903"
-#@ OCIS_NS=\"""" + app.ocis.namespace + """\"
-#@ OCIS_SECRET=\"""" + app.ocis.secretName + """\"
-#@ BUCKET_NAME=\"""" + app.bucket.name + """\"
-#@ KEY_NAME=\"""" + app.bucket.keyName + """\"
-#@
-#@ echo "[garage-init] checking k8s secret ${OCIS_SECRET} in ${OCIS_NS}..."
-#@ EXISTING_AK=$(kubectl get secret "${OCIS_SECRET}" -n "${OCIS_NS}" -o jsonpath='{.data.accessKey}' 2>/dev/null || echo "")
-#@ EXISTING_SK=$(kubectl get secret "${OCIS_SECRET}" -n "${OCIS_NS}" -o jsonpath='{.data.secretKey}' 2>/dev/null || echo "")
-#@ if [ -n "${EXISTING_AK}" ] && [ -n "${EXISTING_SK}" ]; then
-#@   echo "[garage-init] ${OCIS_SECRET} already populated; skipping (idempotent exit)"
-#@   exit 0
-#@ fi
-#@
-#@ echo "[garage-init] waiting for admin API..."
-#@ until curl -fsS "${ADMIN}/health" >/dev/null 2>&1; do sleep 2; done
-#@
-#@ echo "[garage-init] checking cluster layout..."
-#@ STATUS=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/status")
-#@ NODE_ID=$(echo "${STATUS}" | jq -r '.nodes[0].id')
-#@ CUR_VERSION=$(echo "${STATUS}" | jq -r '.layoutVersion // 0')
-#@
-#@ if [ "${CUR_VERSION}" = "0" ] || [ "${CUR_VERSION}" = "null" ]; then
-#@   echo "[garage-init] applying initial layout for node ${NODE_ID}"
-#@   curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
-#@     -d "[{\\"id\\":\\"${NODE_ID}\\",\\"zone\\":\\"dc1\\",\\"capacity\\":1073741824,\\"tags\\":[]}]" \\
-#@     "${ADMIN}/v1/layout"
-#@   curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
-#@     -d '{"version":1}' \\
-#@     "${ADMIN}/v1/layout/apply"
-#@   echo "[garage-init] layout applied, waiting for cluster ready..."
-#@   for i in $(seq 1 30); do
-#@     READY=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/status" | jq -r '.layoutVersion')
-#@     if [ "${READY}" = "1" ]; then break; fi
-#@     sleep 2
-#@   done
-#@ else
-#@   echo "[garage-init] layout already at version ${CUR_VERSION}, skipping"
-#@ fi
-#@
-#@ echo "[garage-init] ensuring bucket ${BUCKET_NAME}..."
-#@ BUCKET_ID=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/bucket?globalAlias=${BUCKET_NAME}" 2>/dev/null | jq -r '.id // empty')
-#@ if [ -z "${BUCKET_ID}" ]; then
-#@   BUCKET_ID=$(curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
-#@     -d "{\\"globalAlias\\":\\"${BUCKET_NAME}\\"}" \\
-#@     "${ADMIN}/v1/bucket" | jq -r '.id')
-#@   echo "[garage-init] created bucket ${BUCKET_ID}"
-#@ else
-#@   echo "[garage-init] bucket exists: ${BUCKET_ID}"
-#@ fi
-#@
-#@ echo "[garage-init] resetting key ${KEY_NAME} (need fresh secret)..."
-#@ EXISTING_KEY_ID=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/key?search=${KEY_NAME}" 2>/dev/null | jq -r '.accessKeyId // empty')
-#@ if [ -n "${EXISTING_KEY_ID}" ]; then
-#@   echo "[garage-init] deleting stale key ${EXISTING_KEY_ID}"
-#@   curl -fsS -X DELETE -H "${AUTH}" "${ADMIN}/v1/key?id=${EXISTING_KEY_ID}" >/dev/null
-#@ fi
-#@ KEY_INFO=$(curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
-#@   -d "{\\"name\\":\\"${KEY_NAME}\\"}" \\
-#@   "${ADMIN}/v1/key")
-#@ ACCESS_KEY=$(echo "${KEY_INFO}" | jq -r '.accessKeyId')
-#@ SECRET_KEY=$(echo "${KEY_INFO}" | jq -r '.secretAccessKey')
-#@ if [ -z "${ACCESS_KEY}" ] || [ -z "${SECRET_KEY}" ] || [ "${SECRET_KEY}" = "null" ]; then
-#@   echo "[garage-init] failed to create key: ${KEY_INFO}"
-#@   exit 1
-#@ fi
-#@ echo "[garage-init] created key ${ACCESS_KEY}"
-#@
-#@ echo "[garage-init] granting bucket permissions..."
-#@ curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
-#@   -d "{\\"bucketId\\":\\"${BUCKET_ID}\\",\\"accessKeyId\\":\\"${ACCESS_KEY}\\",\\"permissions\\":{\\"read\\":true,\\"write\\":true,\\"owner\\":true}}" \\
-#@   "${ADMIN}/v1/bucket/allow" >/dev/null
-#@
-#@ echo "[garage-init] writing ${OCIS_SECRET} to ${OCIS_NS}..."
-#@ kubectl create secret generic "${OCIS_SECRET}" \\
-#@   -n "${OCIS_NS}" \\
-#@   --from-literal=accessKey="${ACCESS_KEY}" \\
-#@   --from-literal=secretKey="${SECRET_KEY}" \\
-#@   --dry-run=client -o yaml | kubectl apply -f -
-#@
-#@ echo "[garage-init] done."
-#@ """
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: garage-init
-  namespace: #@ ns
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: garage-init-ocis-secret
-  namespace: #@ app.ocis.namespace
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "patch", "update"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: garage-init-ocis-secret
-  namespace: #@ app.ocis.namespace
-subjects:
-  - kind: ServiceAccount
-    name: garage-init
-    namespace: #@ ns
-roleRef:
-  kind: Role
-  name: garage-init-ocis-secret
-  apiGroup: rbac.authorization.k8s.io
-
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: garage-init
-  namespace: #@ ns
-  annotations:
-    argocd.argoproj.io/sync-options: Replace=true,Force=true
-spec:
-  ttlSecondsAfterFinished: 300
-  backoffLimit: 30
-  template:
-    spec:
-      serviceAccountName: garage-init
-      restartPolicy: OnFailure
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: init
-          image: alpine/k8s:1.32.3
-          command: ["sh", "-c"]
-          args:
-            - #@ init_script
-          volumeMounts:
-            - name: garage-secrets
-              mountPath: /etc/garage
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-      volumes:
-        - name: garage-secrets
-          secret:
-            secretName: garage-secrets

prototypes/garage/ytt/ns.ytt.yaml

@@ -1,18 +0,0 @@
-#@ load("@ytt:data", "data")
-#@ load("@ytt:overlay", "overlay")
-
-#@ ns = data.values.application.namespace
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: #@ ns
-  labels:
-    pod-security.kubernetes.io/enforce: restricted
-
-#@overlay/match by=overlay.all, expects="1+"
----
-metadata:
-  #@overlay/match missing_ok=True
-  namespace: #@ ns

prototypes/garage/ytt/secrets.ytt.yaml

@@ -1,15 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: garage-secrets
-  namespace: #@ ns
-  annotations:
-    secret-generator.v1.mittwald.de/autogenerate: rpc_secret,admin_token
-    secret-generator.v1.mittwald.de/encoding: hex
-    secret-generator.v1.mittwald.de/length: "64"
-type: Opaque

prototypes/garage/ytt/statefulset.ytt.yaml

@@ -1,118 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-#@ app = data.values.application
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: garage
-  namespace: #@ ns
-spec:
-  type: ClusterIP
-  selector:
-    app: garage
-  ports:
-    - name: s3-api
-      port: 3900
-      targetPort: 3900
-    - name: rpc
-      port: 3901
-      targetPort: 3901
-    - name: s3-web
-      port: 3902
-      targetPort: 3902
-    - name: admin
-      port: 3903
-      targetPort: 3903
-
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: garage
-  namespace: #@ ns
-spec:
-  replicas: 1
-  serviceName: garage
-  selector:
-    matchLabels:
-      app: garage
-  template:
-    metadata:
-      labels:
-        app: garage
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: garage
-          image: #@ app.image
-          imagePullPolicy: IfNotPresent
-          command: ["/garage"]
-          args: ["server"]
-          ports:
-            - name: s3-api
-              containerPort: 3900
-            - name: rpc
-              containerPort: 3901
-            - name: s3-web
-              containerPort: 3902
-            - name: admin
-              containerPort: 3903
-          volumeMounts:
-            - name: data
-              mountPath: /var/lib/garage
-            - name: config
-              mountPath: /etc/garage.toml
-              subPath: garage.toml
-              readOnly: true
-            - name: secrets
-              mountPath: /etc/garage
-              readOnly: true
-          env:
-            - name: GARAGE_CONFIG_FILE
-              value: /etc/garage.toml
-            - name: GARAGE_ALLOW_WORLD_READABLE_SECRETS
-              value: "true"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              memory: 512Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 3903
-            initialDelaySeconds: 5
-            periodSeconds: 5
-      volumes:
-        - name: config
-          configMap:
-            name: garage-config
-        - name: secrets
-          secret:
-            secretName: garage-secrets
-            defaultMode: 0400
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: #@ data.values.cluster.storageClass.local
-        resources:
-          requests:
-            storage: #@ app.storage.size

prototypes/garage/ytt/zz-cross-ns-rbac-fix.ytt.yaml

@@ -1,20 +0,0 @@
-#@ load("@ytt:data", "data")
-#@ load("@ytt:overlay", "overlay")
-
-#! ns.ytt.yaml runs first (alphabetical) and rewrites every resource's
-#! namespace to data.values.application.namespace. The Role/RoleBinding
-#! created by init-job.ytt.yaml live in the ocis namespace (so the
-#! garage init Job can write ocis-s3-credentials there) — re-pin them
-#! after ns.ytt.yaml clobbered the namespace.
-
-#@ ocis_ns = data.values.application.ocis.namespace
-
-#@overlay/match by=overlay.subset({"kind": "Role", "metadata": {"name": "garage-init-ocis-secret"}}), expects="1+"
----
-metadata:
-  namespace: #@ ocis_ns
-
-#@overlay/match by=overlay.subset({"kind": "RoleBinding", "metadata": {"name": "garage-init-ocis-secret"}}), expects="1+"
----
-metadata:
-  namespace: #@ ocis_ns

prototypes/grafana/app-data.ytt.yaml

@@ -3,4 +3,3 @@
 #@overlay/match-child-defaults missing_ok=True
 application:
   namespace: monitoring
-  subdomain: grafana

prototypes/grafana/helm/grafana.yaml

@@ -1,5 +1,3 @@
-#@ load("@ytt:data", "data")
-#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
 ---
 admin:
   existingSecret: grafana-admin
@@ -17,19 +15,19 @@ resources:
 persistence:
   enabled: true
   size: 2Gi
-  storageClassName: #@ data.values.cluster.storageClass.local
+  storageClassName: local-path
 
 ingress:
   enabled: true
-  ingressClassName: #@ data.values.cluster.ingress.className
+  ingressClassName: traefik
   hosts:
-    - #@ host
+    - grafana.tr1ceracop.de
   tls:
     - secretName: grafana-tls
       hosts:
-        - #@ host
+        - grafana.tr1ceracop.de
   annotations:
-    cert-manager.io/cluster-issuer: #@ data.values.cluster.tls.issuer
+    cert-manager.io/cluster-issuer: letsencrypt
 
 datasources:
   datasources.yaml:

prototypes/grafana/ytt/admin-secret.ytt.yaml

@@ -1,14 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: grafana-admin
-  namespace: #@ ns
-  annotations:
-    secret-generator.v1.mittwald.de/autogenerate: admin-user,admin-password
-    secret-generator.v1.mittwald.de/length: "32"
-type: Opaque

prototypes/ocis/app-data.ytt.yaml

@@ -3,4 +3,3 @@
 #@overlay/match-child-defaults missing_ok=True
 application:
   namespace: ocis
-  subdomain: drive

prototypes/ocis/helm/ocis.yaml

@@ -1,22 +1,15 @@
-#@ load("@ytt:data", "data")
-#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
 ---
-externalDomain: #@ host
+externalDomain: drive.tr1ceracop.de
-
-insecure:
-  oidcIdpInsecure: #@ data.values.ocis.insecure
-  ocisHttpApiInsecure: #@ data.values.ocis.insecure
-  ocmInsecure: #@ data.values.ocis.insecure
 
 ingress:
   enabled: true
-  ingressClassName: #@ data.values.cluster.ingress.className
+  ingressClassName: traefik
   annotations:
-    cert-manager.io/cluster-issuer: #@ data.values.cluster.tls.issuer
+    cert-manager.io/cluster-issuer: letsencrypt
   tls:
     - secretName: ocis-tls
       hosts:
-        - #@ host
+        - drive.tr1ceracop.de
 
 features:
   emailNotifications:
@@ -58,12 +51,12 @@ services:
       driver: s3ng
       driverConfig:
         s3ng:
-          endpoint: #@ data.values.ocis.s3.endpoint
+          endpoint: https://nbg1.your-objectstorage.com
-          region: #@ data.values.ocis.s3.region
+          region: nbg1
-          bucket: #@ data.values.ocis.s3.bucket
+          bucket: ocis-tr1ceracop
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.block
+      storageClassName: hcloud-volumes
       size: 10Gi
       accessModes:
         - ReadWriteOnce
@@ -71,7 +64,7 @@ services:
   storagesystem:
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.block
+      storageClassName: hcloud-volumes
       size: 10Gi
       accessModes:
         - ReadWriteOnce
@@ -83,7 +76,7 @@ services:
         cpu: 10m
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.block
+      storageClassName: hcloud-volumes
       size: 10Gi
       accessModes:
         - ReadWriteOnce
@@ -95,7 +88,7 @@ services:
         cpu: 10m
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.local
+      storageClassName: local-path
       size: 1Gi
       accessModes:
         - ReadWriteOnce
@@ -103,25 +96,25 @@ services:
   search:
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.local
+      storageClassName: local-path
       size: 5Gi
       accessModes:
         - ReadWriteOnce
 
   web:
-    #! GOTCHA: if this PVC is recreated, /branding/logo POST/DELETE will
+    # GOTCHA: if this PVC is recreated, /branding/logo POST/DELETE will
-    #! 500 with "permission denied". The chart mounts an `apps` emptyDir
+    # 500 with "permission denied". The chart mounts an `apps` emptyDir
-    #! at /var/lib/ocis/web/assets/apps; kubelet auto-creates the parent
+    # at /var/lib/ocis/web/assets/apps; kubelet auto-creates the parent
-    #! dirs as root:root 0755 *after* fsGroup runs, and local-path's
+    # dirs as root:root 0755 *after* fsGroup runs, and local-path's
-    #! hostPath PV doesn't get fsGroup recursion — so user 1000 can't
+    # hostPath PV doesn't get fsGroup recursion — so user 1000 can't
-    #! mkdir themes/ to store the uploaded logo. Was masked while ocis
+    # mkdir themes/ to store the uploaded logo. Was masked while ocis
-    #! ran as PSS=privileged (root); surfaced after PSS=restricted.
+    # ran as PSS=privileged (root); surfaced after PSS=restricted.
-    #! Remediation: one-shot privileged Job in kube-system, hostPath-
+    # Remediation: one-shot privileged Job in kube-system, hostPath-
-    #! mount the local-path PV directory, `chown -R 1000:1000` it.
+    # mount the local-path PV directory, `chown -R 1000:1000` it.
-    #! Permanent fix: switch to a CSI storageClass (hcloud-volumes).
+    # Permanent fix: switch to a CSI storageClass (hcloud-volumes).
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.local
+      storageClassName: local-path
       size: 1Gi
       accessModes:
         - ReadWriteOnce
@@ -138,7 +131,7 @@ services:
         cpu: 10m
     persistence:
       enabled: true
-      storageClassName: #@ data.values.cluster.storageClass.local
+      storageClassName: local-path
       size: 2Gi
       accessModes:
         - ReadWriteOnce

prototypes/ocis/ytt/admin-user-id-init-job.ytt.yaml

@@ -1,121 +0,0 @@
-#@ load("@ytt:data", "data")
-
-#@ ns = data.values.application.namespace
-
-#! mittwald can't generate UUIDs and ocis-settings rejects non-UUID user-ids
-#! with "must be in a valid format". This Job ensures the admin secret's
-#! user-id is a valid UUID v4, generating one if missing/invalid. Idempotent:
-#! a valid existing UUID is preserved (so production's pre-existing admin
-#! user-id is not rotated).
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ocis-admin-user-id-init
-  namespace: #@ ns
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/sync-wave: "-2"
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ocis-admin-user-id-init
-  namespace: #@ ns
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/sync-wave: "-2"
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "patch"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ocis-admin-user-id-init
-  namespace: #@ ns
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/sync-wave: "-2"
-subjects:
-  - kind: ServiceAccount
-    name: ocis-admin-user-id-init
-    namespace: #@ ns
-roleRef:
-  kind: Role
-  name: ocis-admin-user-id-init
-  apiGroup: rbac.authorization.k8s.io
-
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ocis-admin-user-id-init
-  namespace: #@ ns
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/sync-wave: "-1"
-    argocd.argoproj.io/sync-options: Replace=true
-spec:
-  ttlSecondsAfterFinished: 300
-  backoffLimit: 10
-  template:
-    spec:
-      serviceAccountName: ocis-admin-user-id-init
-      restartPolicy: OnFailure
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: ensure-uuid
-          image: alpine/k8s:1.32.3
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              UUID_RE='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
-
-              for i in $(seq 1 30); do
-                if kubectl -n "${NAMESPACE}" get secret ocis-admin-user >/dev/null 2>&1; then break; fi
-                echo "[admin-user-id-init] waiting for ocis-admin-user secret..."
-                sleep 2
-              done
-
-              CUR_B64=$(kubectl -n "${NAMESPACE}" get secret ocis-admin-user -o jsonpath='{.data.user-id}' 2>/dev/null || echo "")
-              if [ -n "${CUR_B64}" ]; then
-                CUR=$(echo "${CUR_B64}" | base64 -d)
-                if echo "${CUR}" | grep -Eq "${UUID_RE}"; then
-                  echo "[admin-user-id-init] user-id is a valid UUID, leaving alone"
-                  exit 0
-                fi
-                echo "[admin-user-id-init] user-id present but not a valid UUID; replacing"
-              else
-                echo "[admin-user-id-init] user-id missing; generating"
-              fi
-
-              NEW_UUID=$(cat /proc/sys/kernel/random/uuid)
-              NEW_B64=$(printf '%s' "${NEW_UUID}" | base64 -w0)
-              kubectl -n "${NAMESPACE}" patch secret ocis-admin-user --type=json \
-                -p "[{\"op\":\"replace\",\"path\":\"/data/user-id\",\"value\":\"${NEW_B64}\"}]" \
-                || kubectl -n "${NAMESPACE}" patch secret ocis-admin-user --type=json \
-                  -p "[{\"op\":\"add\",\"path\":\"/data/user-id\",\"value\":\"${NEW_B64}\"}]"
-              echo "[admin-user-id-init] set user-id to ${NEW_UUID}"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL

prototypes/ocis/ytt/external-secret-precheck-job.ytt.yaml

@@ -2,15 +2,6 @@
 
 #@ ns = data.values.application.namespace
 
-#@ secrets = []
-#@ if data.values.ocis.s3.external:
-#@   secrets.append("ocis-s3-credentials")
-#@ end
-#@ if data.values.backups.enabled and data.values.backups.storagebox.enabled:
-#@   secrets.append("ocis-storagebox-credentials")
-#@ end
-
-#@ if len(secrets) > 0:
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -81,7 +72,15 @@ spec:
           command:
             - sh
             - -c
-            - #@ "set -e\nfor s in " + " ".join(secrets) + "; do\n  if ! kubectl get secret \"$s\" -n \"${NAMESPACE}\" >/dev/null 2>&1; then\n    echo \"ERROR: External secret $s must be created manually before deploying ocis\"\n    exit 1\n  fi\n  echo \"OK: $s exists\"\ndone\n"
+            - |
+              set -e
+              for s in ocis-s3-credentials ocis-storagebox-credentials; do
+                if ! kubectl get secret "$s" -n "${NAMESPACE}" >/dev/null 2>&1; then
+                  echo "ERROR: External secret $s must be created manually before deploying ocis"
+                  exit 1
+                fi
+                echo "OK: $s exists"
+              done
           env:
             - name: NAMESPACE
               valueFrom:
@@ -93,4 +92,3 @@ spec:
             capabilities:
               drop:
               - ALL
-#@ end

prototypes/ocis/ytt/random-secrets.ytt.yaml

@@ -3,7 +3,7 @@
 #@ ns = data.values.application.namespace
 
 #@ secrets = [
-#@   ("ocis-admin-user", "password"),
+#@   ("ocis-admin-user", "password,user-id"),
 #@   ("ocis-jwt-secret", "jwt-secret"),
 #@   ("ocis-machine-auth-api-key", "machine-auth-api-key"),
 #@   ("ocis-storage-system-jwt-secret", "storage-system-jwt-secret"),

prototypes/ocis/ytt/s3-backup-cronjob.ytt.yaml

@@ -2,7 +2,6 @@
 
 #@ ns = data.values.application.namespace
 
-#@ if data.values.backups.enabled and data.values.backups.storagebox.enabled:
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -111,4 +110,3 @@ spec:
                   - key: ssh-key
                     path: ssh-key
                 defaultMode: 0440
-#@ end

prototypes/ocis/ytt/volume-backup-cronjob.ytt.yaml

@@ -19,7 +19,6 @@
 #@   {"app": "storagesystem", "pvc": "storagesystem-data"},
 #@ ]
 
-#@ if data.values.backups.enabled and data.values.backups.storagebox.enabled:
 #@ for t in targets:
 ---
 apiVersion: batch/v1
@@ -119,4 +118,3 @@ spec:
                     path: ssh-key
                 defaultMode: 0440
 #@ end
-#@ end

prototypes/victoria-metrics-single/helm/victoria-metrics-single.yaml

@@ -1,4 +1,3 @@
-#@ load("@ytt:data", "data")
 ---
 server:
   resources:
@@ -10,7 +9,7 @@ server:
   persistentVolume:
     enabled: true
     size: 10Gi
-    storageClassName: #@ data.values.cluster.storageClass.local
+    storageClassName: local-path
   scrape:
     enabled: true
     config:

rendered/argocd/minikube/app-cert-manager.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-cert-manager
-  namespace: argocd
-spec:
-  destination:
-    namespace: cert-manager
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/cert-manager
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-cloudnative-pg.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-cloudnative-pg
-  namespace: argocd
-spec:
-  destination:
-    namespace: cloudnative-pg
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/cloudnative-pg
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-garage.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-garage
-  namespace: argocd
-spec:
-  destination:
-    namespace: garage
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/garage
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-grafana.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-grafana
-  namespace: argocd
-spec:
-  destination:
-    namespace: grafana
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/grafana
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-kube-state-metrics.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-kube-state-metrics
-  namespace: argocd
-spec:
-  destination:
-    namespace: kube-state-metrics
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/kube-state-metrics
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-kubernetes-secret-generator.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-kubernetes-secret-generator
-  namespace: argocd
-spec:
-  destination:
-    namespace: kubernetes-secret-generator
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/kubernetes-secret-generator
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-metrics-server.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-metrics-server
-  namespace: argocd
-spec:
-  destination:
-    namespace: metrics-server
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/metrics-server
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-node-exporter.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-node-exporter
-  namespace: argocd
-spec:
-  destination:
-    namespace: node-exporter
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/node-exporter
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-ocis.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-ocis
-  namespace: argocd
-spec:
-  destination:
-    namespace: ocis
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/ocis
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-traefik.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-traefik
-  namespace: argocd
-spec:
-  destination:
-    namespace: traefik
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/traefik
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/app-victoria-metrics-single.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    myks.dev/environment: minikube
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: app-minikube-victoria-metrics-single
-  namespace: argocd
-spec:
-  destination:
-    namespace: victoria-metrics-single
-    server: https://kubernetes.default.svc
-  project: env-minikube
-  source:
-    path: rendered/envs/minikube/victoria-metrics-single
-    repoURL: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

rendered/argocd/minikube/env-minikube.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: env-minikube
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-  annotations:
-    myks.dev/environment: minikube
-spec:
-  description: Project for "minikube" environment
-  clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
-  destinations:
-  - namespace: '*'
-    server: https://kubernetes.default.svc
-  namespaceResourceWhitelist:
-  - group: '*'
-    kind: '*'
-  sourceRepos:
-  - '*'

rendered/envs/minikube/cert-manager/clusterissuer-mkcert.yaml

@@ -1,10 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  name: mkcert
-  namespace: cert-manager
-spec:
-  ca:
-    secretName: mkcert-ca

rendered/envs/minikube/cert-manager/clusterissuer-selfsigned.yaml

@@ -1,9 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  name: selfsigned
-  namespace: cert-manager
-spec:
-  selfSigned: {}

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-cainjector.yaml

@@ -1,72 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cainjector
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cainjector
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - get
-      - create
-      - update
-      - patch
-  - apiGroups:
-      - admissionregistration.k8s.io
-    resources:
-      - validatingwebhookconfigurations
-      - mutatingwebhookconfigurations
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-      - patch
-  - apiGroups:
-      - apiregistration.k8s.io
-    resources:
-      - apiservices
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-      - patch
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-      - patch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-cluster-view.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-    rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
-  name: cert-manager-cluster-view
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - clusterissuers
-    verbs:
-      - get
-      - list
-      - watch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-approve_cert-manager-io.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-approve:cert-manager-io
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resourceNames:
-      - issuers.cert-manager.io/*
-      - clusterissuers.cert-manager.io/*
-    resources:
-      - signers
-    verbs:
-      - approve

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-certificates.yaml

@@ -1,73 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-certificates
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-      - certificates/status
-      - certificaterequests
-      - certificaterequests/status
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-      - certificaterequests
-      - clusterissuers
-      - issuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates/finalizers
-      - certificaterequests/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - orders
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - delete
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-certificatesigningrequests.yaml

@@ -1,47 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-certificatesigningrequests
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - certificates.k8s.io
-    resources:
-      - certificatesigningrequests
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - certificates.k8s.io
-    resources:
-      - certificatesigningrequests/status
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - certificates.k8s.io
-    resourceNames:
-      - issuers.cert-manager.io/*
-      - clusterissuers.cert-manager.io/*
-    resources:
-      - signers
-    verbs:
-      - sign
-  - apiGroups:
-      - authorization.k8s.io
-    resources:
-      - subjectaccessreviews
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-challenges.yaml

@@ -1,109 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-challenges
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - challenges
-      - challenges/status
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - challenges
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - issuers
-      - clusterissuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - delete
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - delete
-      - update
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - httproutes
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - delete
-      - update
-  - apiGroups:
-      - route.openshift.io
-    resources:
-      - routes/custom-host
-    verbs:
-      - create
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - challenges/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-clusterissuers.yaml

@@ -1,50 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-clusterissuers
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - clusterissuers
-      - clusterissuers/status
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - clusterissuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-ingress-shim.yaml

@@ -1,73 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-ingress-shim
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-      - certificaterequests
-    verbs:
-      - create
-      - update
-      - delete
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-      - certificaterequests
-      - issuers
-      - clusterissuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - gateways
-      - httproutes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - gateways/finalizers
-      - httproutes/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-issuers.yaml

@@ -1,50 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-issuers
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - issuers
-      - issuers/status
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - issuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-controller-orders.yaml

@@ -1,70 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-orders
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - orders
-      - orders/status
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - orders
-      - challenges
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - clusterissuers
-      - issuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - challenges
-    verbs:
-      - create
-      - delete
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - orders/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-edit.yaml

@@ -1,47 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-  name: cert-manager-edit
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-      - certificaterequests
-      - issuers
-    verbs:
-      - create
-      - delete
-      - deletecollection
-      - patch
-      - update
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates/status
-    verbs:
-      - update
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - challenges
-      - orders
-    verbs:
-      - create
-      - delete
-      - deletecollection
-      - patch
-      - update

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-view.yaml

@@ -1,39 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-  name: cert-manager-view
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificates
-      - certificaterequests
-      - issuers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - acme.cert-manager.io
-    resources:
-      - challenges
-      - orders
-    verbs:
-      - get
-      - list
-      - watch

rendered/envs/minikube/cert-manager/clusterrole-cert-manager-webhook_subjectaccessreviews.yaml

@@ -1,22 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook:subjectaccessreviews
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - authorization.k8s.io
-    resources:
-      - subjectaccessreviews
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-cainjector.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cainjector
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cainjector
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-cainjector
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager-cainjector
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-approve_cert-manager-io.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-approve:cert-manager-io
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-approve:cert-manager-io
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-certificates.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-certificates
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-certificates
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-certificatesigningrequests.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-certificatesigningrequests
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-certificatesigningrequests
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-challenges.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-challenges
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-challenges
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-clusterissuers.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-clusterissuers
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-clusterissuers
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-ingress-shim.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-ingress-shim
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-ingress-shim
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-issuers.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-issuers
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-issuers
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-controller-orders.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-controller-orders
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-controller-orders
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/clusterrolebinding-cert-manager-webhook_subjectaccessreviews.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook:subjectaccessreviews
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-webhook:subjectaccessreviews
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager-webhook
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/customresourcedefinition-certificaterequests.cert-manager.io.yaml

@@ -1,317 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    helm.sh/resource-policy: keep
-  labels:
-    app: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: certificaterequests.cert-manager.io
-  namespace: cert-manager
-spec:
-  group: cert-manager.io
-  names:
-    categories:
-      - cert-manager
-    kind: CertificateRequest
-    listKind: CertificateRequestList
-    plural: certificaterequests
-    shortNames:
-      - cr
-      - crs
-    singular: certificaterequest
-  scope: Namespaced
-  versions:
-    - additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Approved")].status
-          name: Approved
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Denied")].status
-          name: Denied
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          type: string
-        - jsonPath: .spec.username
-          name: Requester
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A CertificateRequest is used to request a signed certificate from one of the
-            configured issuers.
-
-            All fields within the CertificateRequest's `spec` are immutable after creation.
-            A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
-            condition and its `status.failureTime` field.
-
-            A CertificateRequest is a one-shot resource, meaning it represents a single
-            point in time request for a certificate and cannot be re-used.
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: |-
-                Specification of the desired state of the CertificateRequest resource.
-                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              properties:
-                duration:
-                  description: |-
-                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
-                    issuer may choose to ignore the requested duration, just like any other
-                    requested attribute.
-                  type: string
-                extra:
-                  additionalProperties:
-                    items:
-                      type: string
-                    type: array
-                  description: |-
-                    Extra contains extra attributes of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: object
-                groups:
-                  description: |-
-                    Groups contains group membership of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  items:
-                    type: string
-                  type: array
-                  x-kubernetes-list-type: atomic
-                isCA:
-                  description: |-
-                    Requested basic constraints isCA value. Note that the issuer may choose
-                    to ignore the requested isCA value, just like any other requested attribute.
-
-                    NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
-                    it must have the same isCA value as specified here.
-
-                    If true, this will automatically add the `cert sign` usage to the list
-                    of requested `usages`.
-                  type: boolean
-                issuerRef:
-                  description: |-
-                    Reference to the issuer responsible for issuing the certificate.
-                    If the issuer is namespace-scoped, it must be in the same namespace
-                    as the Certificate. If the issuer is cluster-scoped, it can be used
-                    from any namespace.
-
-                    The `name` field of the reference must always be specified.
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                  required:
-                    - name
-                  type: object
-                request:
-                  description: |-
-                    The PEM-encoded X.509 certificate signing request to be submitted to the
-                    issuer for signing.
-
-                    If the CSR has a BasicConstraints extension, its isCA attribute must
-                    match the `isCA` value of this CertificateRequest.
-                    If the CSR has a KeyUsage extension, its key usages must match the
-                    key usages in the `usages` field of this CertificateRequest.
-                    If the CSR has a ExtKeyUsage extension, its extended key usages
-                    must match the extended key usages in the `usages` field of this
-                    CertificateRequest.
-                  format: byte
-                  type: string
-                uid:
-                  description: |-
-                    UID contains the uid of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: string
-                usages:
-                  description: |-
-                    Requested key usages and extended key usages.
-
-                    NOTE: If the CSR in the `Request` field has uses the KeyUsage or
-                    ExtKeyUsage extension, these extensions must have the same values
-                    as specified here without any additional values.
-
-                    If unset, defaults to `digital signature` and `key encipherment`.
-                  items:
-                    description: |-
-                      KeyUsage specifies valid usage contexts for keys.
-                      See:
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
-                      Valid KeyUsage values are as follows:
-                      "signing",
-                      "digital signature",
-                      "content commitment",
-                      "key encipherment",
-                      "key agreement",
-                      "data encipherment",
-                      "cert sign",
-                      "crl sign",
-                      "encipher only",
-                      "decipher only",
-                      "any",
-                      "server auth",
-                      "client auth",
-                      "code signing",
-                      "email protection",
-                      "s/mime",
-                      "ipsec end system",
-                      "ipsec tunnel",
-                      "ipsec user",
-                      "timestamping",
-                      "ocsp signing",
-                      "microsoft sgc",
-                      "netscape sgc"
-                    enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
-                    type: string
-                  type: array
-                username:
-                  description: |-
-                    Username contains the name of the user that created the CertificateRequest.
-                    Populated by the cert-manager webhook on creation and immutable.
-                  type: string
-              required:
-                - issuerRef
-                - request
-              type: object
-            status:
-              description: |-
-                Status of the CertificateRequest.
-                This is set and managed automatically.
-                Read-only.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              properties:
-                ca:
-                  description: |-
-                    The PEM encoded X.509 certificate of the signer, also known as the CA
-                    (Certificate Authority).
-                    This is set on a best-effort basis by different issuers.
-                    If not set, the CA is assumed to be unknown/not available.
-                  format: byte
-                  type: string
-                certificate:
-                  description: |-
-                    The PEM encoded X.509 certificate resulting from the certificate
-                    signing request.
-                    If not set, the CertificateRequest has either not been completed or has
-                    failed. More information on failure can be found by checking the
-                    `conditions` field.
-                  format: byte
-                  type: string
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of a CertificateRequest.
-                    Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
-                  items:
-                    description: CertificateRequestCondition contains condition information for a CertificateRequest.
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        format: date-time
-                        type: string
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                        type: string
-                      type:
-                        description: |-
-                          Type of the condition, known values are (`Ready`, `InvalidRequest`,
-                          `Approved`, `Denied`).
-                        type: string
-                    required:
-                      - status
-                      - type
-                    type: object
-                  type: array
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-                failureTime:
-                  description: |-
-                    FailureTime stores the time that this CertificateRequest failed. This is
-                    used to influence garbage collection and back-off.
-                  format: date-time
-                  type: string
-              type: object
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}

rendered/envs/minikube/cert-manager/customresourcedefinition-certificates.cert-manager.io.yaml

@@ -1,779 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    helm.sh/resource-policy: keep
-  labels:
-    app: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: certificates.cert-manager.io
-  namespace: cert-manager
-spec:
-  group: cert-manager.io
-  names:
-    categories:
-      - cert-manager
-    kind: Certificate
-    listKind: CertificateList
-    plural: certificates
-    shortNames:
-      - cert
-      - certs
-    singular: certificate
-  scope: Namespaced
-  versions:
-    - additionalPrinterColumns:
-        - jsonPath: .status.conditions[?(@.type=="Ready")].status
-          name: Ready
-          type: string
-        - jsonPath: .spec.secretName
-          name: Secret
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          priority: 1
-          type: string
-        - jsonPath: .status.conditions[?(@.type=="Ready")].message
-          name: Status
-          priority: 1
-          type: string
-        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1
-      schema:
-        openAPIV3Schema:
-          description: |-
-            A Certificate resource should be created to ensure an up to date and signed
-            X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
-
-            The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: |-
-                Specification of the desired state of the Certificate resource.
-                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              properties:
-                additionalOutputFormats:
-                  description: |-
-                    Defines extra output formats of the private key and signed certificate chain
-                    to be written to this Certificate's target Secret.
-
-                    This is a Beta Feature enabled by default. It can be disabled with the
-                    `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-                    the controller and webhook components.
-                  items:
-                    description: |-
-                      CertificateAdditionalOutputFormat defines an additional output format of a
-                      Certificate resource. These contain supplementary data formats of the signed
-                      certificate chain and paired private key.
-                    properties:
-                      type:
-                        description: |-
-                          Type is the name of the format type that should be written to the
-                          Certificate's target Secret.
-                        enum:
-                          - DER
-                          - CombinedPEM
-                        type: string
-                    required:
-                      - type
-                    type: object
-                  type: array
-                commonName:
-                  description: |-
-                    Requested common name X509 certificate subject attribute.
-                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-                    NOTE: TLS clients will ignore this value when any subject alternative name is
-                    set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
-
-                    Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
-                    Cannot be set if the `literalSubject` field is set.
-                  type: string
-                dnsNames:
-                  description: Requested DNS subject alternative names.
-                  items:
-                    type: string
-                  type: array
-                duration:
-                  description: |-
-                    Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
-                    issuer may choose to ignore the requested duration, just like any other
-                    requested attribute.
-
-                    If unset, this defaults to 90 days.
-                    Minimum accepted duration is 1 hour.
-                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
-                  type: string
-                emailAddresses:
-                  description: Requested email subject alternative names.
-                  items:
-                    type: string
-                  type: array
-                encodeUsagesInRequest:
-                  description: |-
-                    Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
-
-                    This option defaults to true, and should only be disabled if the target
-                    issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
-                  type: boolean
-                ipAddresses:
-                  description: Requested IP address subject alternative names.
-                  items:
-                    type: string
-                  type: array
-                isCA:
-                  description: |-
-                    Requested basic constraints isCA value.
-                    The isCA value is used to set the `isCA` field on the created CertificateRequest
-                    resources. Note that the issuer may choose to ignore the requested isCA value, just
-                    like any other requested attribute.
-
-                    If true, this will automatically add the `cert sign` usage to the list
-                    of requested `usages`.
-                  type: boolean
-                issuerRef:
-                  description: |-
-                    Reference to the issuer responsible for issuing the certificate.
-                    If the issuer is namespace-scoped, it must be in the same namespace
-                    as the Certificate. If the issuer is cluster-scoped, it can be used
-                    from any namespace.
-
-                    The `name` field of the reference must always be specified.
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                  required:
-                    - name
-                  type: object
-                keystores:
-                  description: Additional keystore output formats to be stored in the Certificate's Secret.
-                  properties:
-                    jks:
-                      description: |-
-                        JKS configures options for storing a JKS keystore in the
-                        `spec.secretName` Secret resource.
-                      properties:
-                        alias:
-                          description: |-
-                            Alias specifies the alias of the key in the keystore, required by the JKS format.
-                            If not provided, the default alias `certificate` will be used.
-                          type: string
-                        create:
-                          description: |-
-                            Create enables JKS keystore creation for the Certificate.
-                            If true, a file named `keystore.jks` will be created in the target
-                            Secret resource, encrypted using the password stored in
-                            `passwordSecretRef` or `password`.
-                            The keystore file will be updated immediately.
-                            If the issuer provided a CA certificate, a file named `truststore.jks`
-                            will also be created in the target Secret resource, encrypted using the
-                            password stored in `passwordSecretRef`
-                            containing the issuing Certificate Authority
-                          type: boolean
-                        password:
-                          description: |-
-                            Password provides a literal password used to encrypt the JKS keystore.
-                            Mutually exclusive with passwordSecretRef.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          type: string
-                        passwordSecretRef:
-                          description: |-
-                            PasswordSecretRef is a reference to a non-empty key in a Secret resource
-                            containing the password used to encrypt the JKS keystore.
-                            Mutually exclusive with password.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                          required:
-                            - name
-                          type: object
-                      required:
-                        - create
-                      type: object
-                    pkcs12:
-                      description: |-
-                        PKCS12 configures options for storing a PKCS12 keystore in the
-                        `spec.secretName` Secret resource.
-                      properties:
-                        create:
-                          description: |-
-                            Create enables PKCS12 keystore creation for the Certificate.
-                            If true, a file named `keystore.p12` will be created in the target
-                            Secret resource, encrypted using the password stored in
-                            `passwordSecretRef` or in `password`.
-                            The keystore file will be updated immediately.
-                            If the issuer provided a CA certificate, a file named `truststore.p12` will
-                            also be created in the target Secret resource, encrypted using the
-                            password stored in `passwordSecretRef` containing the issuing Certificate
-                            Authority
-                          type: boolean
-                        password:
-                          description: |-
-                            Password provides a literal password used to encrypt the PKCS#12 keystore.
-                            Mutually exclusive with passwordSecretRef.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          type: string
-                        passwordSecretRef:
-                          description: |-
-                            PasswordSecretRef is a reference to a non-empty key in a Secret resource
-                            containing the password used to encrypt the PKCS#12 keystore.
-                            Mutually exclusive with password.
-                            One of password or passwordSecretRef must provide a password with a non-zero length.
-                          properties:
-                            key:
-                              description: |-
-                                The key of the entry in the Secret resource's `data` field to be used.
-                                Some instances of this field may be defaulted, in others it may be
-                                required.
-                              type: string
-                            name:
-                              description: |-
-                                Name of the resource being referred to.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                          required:
-                            - name
-                          type: object
-                        profile:
-                          description: |-
-                            Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
-                            used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
-
-                            If provided, allowed values are:
-                            `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
-                            `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
-                            `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-                            (eg. because of company policy). Please note that the security of the algorithm is not that important
-                            in reality, because the unencrypted certificate and private key are also stored in the Secret.
-                          enum:
-                            - LegacyRC2
-                            - LegacyDES
-                            - Modern2023
-                          type: string
-                      required:
-                        - create
-                      type: object
-                  type: object
-                literalSubject:
-                  description: |-
-                    Requested X.509 certificate subject, represented using the LDAP "String
-                    Representation of a Distinguished Name" [1].
-                    Important: the LDAP string format also specifies the order of the attributes
-                    in the subject, this is important when issuing certs for LDAP authentication.
-                    Example: `CN=foo,DC=corp,DC=example,DC=com`
-                    More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
-                    More info: https://github.com/cert-manager/cert-manager/issues/3203
-                    More info: https://github.com/cert-manager/cert-manager/issues/4424
-
-                    Cannot be set if the `subject` or `commonName` field is set.
-                  type: string
-                nameConstraints:
-                  description: |-
-                    x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
-                    More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
-
-                    This is an Alpha Feature and is only enabled with the
-                    `--feature-gates=NameConstraints=true` option set on both
-                    the controller and webhook components.
-                  properties:
-                    critical:
-                      description: if true then the name constraints are marked critical.
-                      type: boolean
-                    excluded:
-                      description: |-
-                        Excluded contains the constraints which must be disallowed. Any name matching a
-                        restriction in the excluded field is invalid regardless
-                        of information appearing in the permitted
-                      properties:
-                        dnsDomains:
-                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
-                          items:
-                            type: string
-                          type: array
-                        emailAddresses:
-                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
-                          items:
-                            type: string
-                          type: array
-                        ipRanges:
-                          description: |-
-                            IPRanges is a list of IP Ranges that are permitted or excluded.
-                            This should be a valid CIDR notation.
-                          items:
-                            type: string
-                          type: array
-                        uriDomains:
-                          description: URIDomains is a list of URI domains that are permitted or excluded.
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    permitted:
-                      description: Permitted contains the constraints in which the names must be located.
-                      properties:
-                        dnsDomains:
-                          description: DNSDomains is a list of DNS domains that are permitted or excluded.
-                          items:
-                            type: string
-                          type: array
-                        emailAddresses:
-                          description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
-                          items:
-                            type: string
-                          type: array
-                        ipRanges:
-                          description: |-
-                            IPRanges is a list of IP Ranges that are permitted or excluded.
-                            This should be a valid CIDR notation.
-                          items:
-                            type: string
-                          type: array
-                        uriDomains:
-                          description: URIDomains is a list of URI domains that are permitted or excluded.
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                  type: object
-                otherNames:
-                  description: |-
-                    `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
-                    Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
-                    Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
-                    You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
-                  items:
-                    properties:
-                      oid:
-                        description: |-
-                          OID is the object identifier for the otherName SAN.
-                          The object identifier must be expressed as a dotted string, for
-                          example, "1.2.840.113556.1.4.221".
-                        type: string
-                      utf8Value:
-                        description: |-
-                          utf8Value is the string value of the otherName SAN.
-                          The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
-                        type: string
-                    type: object
-                  type: array
-                privateKey:
-                  description: |-
-                    Private key options. These include the key algorithm and size, the used
-                    encoding and the rotation policy.
-                  properties:
-                    algorithm:
-                      description: |-
-                        Algorithm is the private key algorithm of the corresponding private key
-                        for this certificate.
-
-                        If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
-                        If `algorithm` is specified and `size` is not provided,
-                        key size of 2048 will be used for `RSA` key algorithm and
-                        key size of 256 will be used for `ECDSA` key algorithm.
-                        key size is ignored when using the `Ed25519` key algorithm.
-                      enum:
-                        - RSA
-                        - ECDSA
-                        - Ed25519
-                      type: string
-                    encoding:
-                      description: |-
-                        The private key cryptography standards (PKCS) encoding for this
-                        certificate's private key to be encoded in.
-
-                        If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
-                        and PKCS#8, respectively.
-                        Defaults to `PKCS1` if not specified.
-                      enum:
-                        - PKCS1
-                        - PKCS8
-                      type: string
-                    rotationPolicy:
-                      description: |-
-                        RotationPolicy controls how private keys should be regenerated when a
-                        re-issuance is being processed.
-
-                        If set to `Never`, a private key will only be generated if one does not
-                        already exist in the target `spec.secretName`. If one does exist but it
-                        does not have the correct algorithm or size, a warning will be raised
-                        to await user intervention.
-                        If set to `Always`, a private key matching the specified requirements
-                        will be generated whenever a re-issuance occurs.
-                        Default is `Never` for backward compatibility.
-                      enum:
-                        - Never
-                        - Always
-                      type: string
-                    size:
-                      description: |-
-                        Size is the key bit size of the corresponding private key for this certificate.
-
-                        If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
-                        and will default to `2048` if not specified.
-                        If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
-                        and will default to `256` if not specified.
-                        If `algorithm` is set to `Ed25519`, Size is ignored.
-                        No other values are allowed.
-                      type: integer
-                  type: object
-                renewBefore:
-                  description: |-
-                    How long before the currently issued certificate's expiry cert-manager should
-                    renew the certificate. For example, if a certificate is valid for 60 minutes,
-                    and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
-                    50 minutes after it was issued (i.e. when there are 10 minutes remaining until
-                    the certificate is no longer valid).
-
-                    NOTE: The actual lifetime of the issued certificate is used to determine the
-                    renewal time. If an issuer returns a certificate with a different lifetime than
-                    the one requested, cert-manager will use the lifetime of the issued certificate.
-
-                    If unset, this defaults to 1/3 of the issued certificate's lifetime.
-                    Minimum accepted value is 5 minutes.
-                    Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
-                    Cannot be set if the `renewBeforePercentage` field is set.
-                  type: string
-                renewBeforePercentage:
-                  description: |-
-                    `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
-                    rather than an absolute duration. For example, if a certificate is valid for 60
-                    minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
-                    renew the certificate 45 minutes after it was issued (i.e. when there are 15
-                    minutes (25%) remaining until the certificate is no longer valid).
-
-                    NOTE: The actual lifetime of the issued certificate is used to determine the
-                    renewal time. If an issuer returns a certificate with a different lifetime than
-                    the one requested, cert-manager will use the lifetime of the issued certificate.
-
-                    Value must be an integer in the range (0,100). The minimum effective
-                    `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
-                    minutes.
-                    Cannot be set if the `renewBefore` field is set.
-                  format: int32
-                  type: integer
-                revisionHistoryLimit:
-                  description: |-
-                    The maximum number of CertificateRequest revisions that are maintained in
-                    the Certificate's history. Each revision represents a single `CertificateRequest`
-                    created by this Certificate, either when it was created, renewed, or Spec
-                    was changed. Revisions will be removed by oldest first if the number of
-                    revisions exceeds this number.
-
-                    If set, revisionHistoryLimit must be a value of `1` or greater.
-                    If unset (`nil`), revisions will not be garbage collected.
-                    Default value is `nil`.
-                  format: int32
-                  type: integer
-                secretName:
-                  description: |-
-                    Name of the Secret resource that will be automatically created and
-                    managed by this Certificate resource. It will be populated with a
-                    private key and certificate, signed by the denoted issuer. The Secret
-                    resource lives in the same namespace as the Certificate resource.
-                  type: string
-                secretTemplate:
-                  description: |-
-                    Defines annotations and labels to be copied to the Certificate's Secret.
-                    Labels and annotations on the Secret will be changed as they appear on the
-                    SecretTemplate when added or removed. SecretTemplate annotations are added
-                    in conjunction with, and cannot overwrite, the base set of annotations
-                    cert-manager sets on the Certificate's Secret.
-                  properties:
-                    annotations:
-                      additionalProperties:
-                        type: string
-                      description: Annotations is a key value map to be copied to the target Kubernetes Secret.
-                      type: object
-                    labels:
-                      additionalProperties:
-                        type: string
-                      description: Labels is a key value map to be copied to the target Kubernetes Secret.
-                      type: object
-                  type: object
-                subject:
-                  description: |-
-                    Requested set of X509 certificate subject attributes.
-                    More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-
-                    The common name attribute is specified separately in the `commonName` field.
-                    Cannot be set if the `literalSubject` field is set.
-                  properties:
-                    countries:
-                      description: Countries to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                    localities:
-                      description: Cities to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                    organizationalUnits:
-                      description: Organizational Units to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                    organizations:
-                      description: Organizations to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                    postalCodes:
-                      description: Postal codes to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                    provinces:
-                      description: State/Provinces to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                    serialNumber:
-                      description: Serial number to be used on the Certificate.
-                      type: string
-                    streetAddresses:
-                      description: Street addresses to be used on the Certificate.
-                      items:
-                        type: string
-                      type: array
-                  type: object
-                uris:
-                  description: Requested URI subject alternative names.
-                  items:
-                    type: string
-                  type: array
-                usages:
-                  description: |-
-                    Requested key usages and extended key usages.
-                    These usages are used to set the `usages` field on the created CertificateRequest
-                    resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
-                    will additionally be encoded in the `request` field which contains the CSR blob.
-
-                    If unset, defaults to `digital signature` and `key encipherment`.
-                  items:
-                    description: |-
-                      KeyUsage specifies valid usage contexts for keys.
-                      See:
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-                      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
-                      Valid KeyUsage values are as follows:
-                      "signing",
-                      "digital signature",
-                      "content commitment",
-                      "key encipherment",
-                      "key agreement",
-                      "data encipherment",
-                      "cert sign",
-                      "crl sign",
-                      "encipher only",
-                      "decipher only",
-                      "any",
-                      "server auth",
-                      "client auth",
-                      "code signing",
-                      "email protection",
-                      "s/mime",
-                      "ipsec end system",
-                      "ipsec tunnel",
-                      "ipsec user",
-                      "timestamping",
-                      "ocsp signing",
-                      "microsoft sgc",
-                      "netscape sgc"
-                    enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
-                    type: string
-                  type: array
-              required:
-                - issuerRef
-                - secretName
-              type: object
-            status:
-              description: |-
-                Status of the Certificate.
-                This is set and managed automatically.
-                Read-only.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-              properties:
-                conditions:
-                  description: |-
-                    List of status conditions to indicate the status of certificates.
-                    Known condition types are `Ready` and `Issuing`.
-                  items:
-                    description: CertificateCondition contains condition information for a Certificate.
-                    properties:
-                      lastTransitionTime:
-                        description: |-
-                          LastTransitionTime is the timestamp corresponding to the last status
-                          change of this condition.
-                        format: date-time
-                        type: string
-                      message:
-                        description: |-
-                          Message is a human readable description of the details of the last
-                          transition, complementing reason.
-                        type: string
-                      observedGeneration:
-                        description: |-
-                          If set, this represents the .metadata.generation that the condition was
-                          set based upon.
-                          For instance, if .metadata.generation is currently 12, but the
-                          .status.condition[x].observedGeneration is 9, the condition is out of date
-                          with respect to the current state of the Certificate.
-                        format: int64
-                        type: integer
-                      reason:
-                        description: |-
-                          Reason is a brief machine readable explanation for the condition's last
-                          transition.
-                        type: string
-                      status:
-                        description: Status of the condition, one of (`True`, `False`, `Unknown`).
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                        type: string
-                      type:
-                        description: Type of the condition, known values are (`Ready`, `Issuing`).
-                        type: string
-                    required:
-                      - status
-                      - type
-                    type: object
-                  type: array
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
-                failedIssuanceAttempts:
-                  description: |-
-                    The number of continuous failed issuance attempts up till now. This
-                    field gets removed (if set) on a successful issuance and gets set to
-                    1 if unset and an issuance has failed. If an issuance has failed, the
-                    delay till the next issuance will be calculated using formula
-                    time.Hour * 2 ^ (failedIssuanceAttempts - 1).
-                  type: integer
-                lastFailureTime:
-                  description: |-
-                    LastFailureTime is set only if the latest issuance for this
-                    Certificate failed and contains the time of the failure. If an
-                    issuance has failed, the delay till the next issuance will be
-                    calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
-                    1). If the latest issuance has succeeded this field will be unset.
-                  format: date-time
-                  type: string
-                nextPrivateKeySecretName:
-                  description: |-
-                    The name of the Secret resource containing the private key to be used
-                    for the next certificate iteration.
-                    The keymanager controller will automatically set this field if the
-                    `Issuing` condition is set to `True`.
-                    It will automatically unset this field when the Issuing condition is
-                    not set or False.
-                  type: string
-                notAfter:
-                  description: |-
-                    The expiration time of the certificate stored in the secret named
-                    by this resource in `spec.secretName`.
-                  format: date-time
-                  type: string
-                notBefore:
-                  description: |-
-                    The time after which the certificate stored in the secret named
-                    by this resource in `spec.secretName` is valid.
-                  format: date-time
-                  type: string
-                renewalTime:
-                  description: |-
-                    RenewalTime is the time at which the certificate will be next
-                    renewed.
-                    If not set, no upcoming renewal is scheduled.
-                  format: date-time
-                  type: string
-                revision:
-                  description: |-
-                    The current 'revision' of the certificate as issued.
-
-                    When a CertificateRequest resource is created, it will have the
-                    `cert-manager.io/certificate-revision` set to one greater than the
-                    current value of this field.
-
-                    Upon issuance, this field will be set to the value of the annotation
-                    on the CertificateRequest resource used to issue the certificate.
-
-                    Persisting the value on the CertificateRequest resource allows the
-                    certificates controller to know whether a request is part of an old
-                    issuance or if it is part of the ongoing revision's issuance by
-                    checking if the revision value in the annotation is greater than this
-                    field.
-                  type: integer
-              type: object
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}

rendered/envs/minikube/cert-manager/customresourcedefinition-orders.acme.cert-manager.io.yaml

@@ -1,265 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    helm.sh/resource-policy: keep
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: crds
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: orders.acme.cert-manager.io
-  namespace: cert-manager
-spec:
-  group: acme.cert-manager.io
-  names:
-    categories:
-      - cert-manager
-      - cert-manager-acme
-    kind: Order
-    listKind: OrderList
-    plural: orders
-    singular: order
-  scope: Namespaced
-  versions:
-    - additionalPrinterColumns:
-        - jsonPath: .status.state
-          name: State
-          type: string
-        - jsonPath: .spec.issuerRef.name
-          name: Issuer
-          priority: 1
-          type: string
-        - jsonPath: .status.reason
-          name: Reason
-          priority: 1
-          type: string
-        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1
-      schema:
-        openAPIV3Schema:
-          description: Order is a type to represent an Order with an ACME server
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              properties:
-                commonName:
-                  description: |-
-                    CommonName is the common name as specified on the DER encoded CSR.
-                    If specified, this value must also be present in `dnsNames` or `ipAddresses`.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  type: string
-                dnsNames:
-                  description: |-
-                    DNSNames is a list of DNS names that should be included as part of the Order
-                    validation process.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  items:
-                    type: string
-                  type: array
-                duration:
-                  description: |-
-                    Duration is the duration for the not after date for the requested certificate.
-                    this is set on order creation as pe the ACME spec.
-                  type: string
-                ipAddresses:
-                  description: |-
-                    IPAddresses is a list of IP addresses that should be included as part of the Order
-                    validation process.
-                    This field must match the corresponding field on the DER encoded CSR.
-                  items:
-                    type: string
-                  type: array
-                issuerRef:
-                  description: |-
-                    IssuerRef references a properly configured ACME-type Issuer which should
-                    be used to create this Order.
-                    If the Issuer does not exist, processing will be retried.
-                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
-                    Order will be marked as failed.
-                  properties:
-                    group:
-                      description: Group of the resource being referred to.
-                      type: string
-                    kind:
-                      description: Kind of the resource being referred to.
-                      type: string
-                    name:
-                      description: Name of the resource being referred to.
-                      type: string
-                  required:
-                    - name
-                  type: object
-                request:
-                  description: |-
-                    Certificate signing request bytes in DER encoding.
-                    This will be used when finalizing the order.
-                    This field must be set on the order.
-                  format: byte
-                  type: string
-              required:
-                - issuerRef
-                - request
-              type: object
-            status:
-              properties:
-                authorizations:
-                  description: |-
-                    Authorizations contains data returned from the ACME server on what
-                    authorizations must be completed in order to validate the DNS names
-                    specified on the Order.
-                  items:
-                    description: |-
-                      ACMEAuthorization contains data returned from the ACME server on an
-                      authorization that must be completed in order validate a DNS name on an ACME
-                      Order resource.
-                    properties:
-                      challenges:
-                        description: |-
-                          Challenges specifies the challenge types offered by the ACME server.
-                          One of these challenge types will be selected when validating the DNS
-                          name and an appropriate Challenge resource will be created to perform
-                          the ACME challenge process.
-                        items:
-                          description: |-
-                            Challenge specifies a challenge offered by the ACME server for an Order.
-                            An appropriate Challenge resource can be created to perform the ACME
-                            challenge process.
-                          properties:
-                            token:
-                              description: |-
-                                Token is the token that must be presented for this challenge.
-                                This is used to compute the 'key' that must also be presented.
-                              type: string
-                            type:
-                              description: |-
-                                Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
-                                'tls-sni-01', etc.
-                                This is the raw value retrieved from the ACME server.
-                                Only 'http-01' and 'dns-01' are supported by cert-manager, other values
-                                will be ignored.
-                              type: string
-                            url:
-                              description: |-
-                                URL is the URL of this challenge. It can be used to retrieve additional
-                                metadata about the Challenge from the ACME server.
-                              type: string
-                          required:
-                            - token
-                            - type
-                            - url
-                          type: object
-                        type: array
-                      identifier:
-                        description: Identifier is the DNS name to be validated as part of this authorization
-                        type: string
-                      initialState:
-                        description: |-
-                          InitialState is the initial state of the ACME authorization when first
-                          fetched from the ACME server.
-                          If an Authorization is already 'valid', the Order controller will not
-                          create a Challenge resource for the authorization. This will occur when
-                          working with an ACME server that enables 'authz reuse' (such as Let's
-                          Encrypt's production endpoint).
-                          If not set and 'identifier' is set, the state is assumed to be pending
-                          and a Challenge will be created.
-                        enum:
-                          - valid
-                          - ready
-                          - pending
-                          - processing
-                          - invalid
-                          - expired
-                          - errored
-                        type: string
-                      url:
-                        description: URL is the URL of the Authorization that must be completed
-                        type: string
-                      wildcard:
-                        description: |-
-                          Wildcard will be true if this authorization is for a wildcard DNS name.
-                          If this is true, the identifier will be the *non-wildcard* version of
-                          the DNS name.
-                          For example, if '*.example.com' is the DNS name being validated, this
-                          field will be 'true' and the 'identifier' field will be 'example.com'.
-                        type: boolean
-                    required:
-                      - url
-                    type: object
-                  type: array
-                certificate:
-                  description: |-
-                    Certificate is a copy of the PEM encoded certificate for this Order.
-                    This field will be populated after the order has been successfully
-                    finalized with the ACME server, and the order has transitioned to the
-                    'valid' state.
-                  format: byte
-                  type: string
-                failureTime:
-                  description: |-
-                    FailureTime stores the time that this order failed.
-                    This is used to influence garbage collection and back-off.
-                  format: date-time
-                  type: string
-                finalizeURL:
-                  description: |-
-                    FinalizeURL of the Order.
-                    This is used to obtain certificates for this order once it has been completed.
-                  type: string
-                reason:
-                  description: |-
-                    Reason optionally provides more information about a why the order is in
-                    the current state.
-                  type: string
-                state:
-                  description: |-
-                    State contains the current state of this Order resource.
-                    States 'success' and 'expired' are 'final'
-                  enum:
-                    - valid
-                    - ready
-                    - pending
-                    - processing
-                    - invalid
-                    - expired
-                    - errored
-                  type: string
-                url:
-                  description: |-
-                    URL of the Order.
-                    This will initially be empty when the resource is first created.
-                    The Order controller will populate this field when the Order is first processed.
-                    This field will be immutable after it is initially set.
-                  type: string
-              type: object
-          required:
-            - metadata
-            - spec
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}

rendered/envs/minikube/cert-manager/deployment-cert-manager-cainjector.yaml

@@ -1,67 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cainjector
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cainjector
-  namespace: cert-manager
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: cainjector
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/name: cainjector
-  template:
-    metadata:
-      annotations:
-        prometheus.io/path: /metrics
-        prometheus.io/port: "9402"
-        prometheus.io/scrape: "true"
-      labels:
-        app: cainjector
-        app.kubernetes.io/component: cainjector
-        app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cainjector
-        app.kubernetes.io/version: v1.17.2
-        helm.sh/chart: cert-manager-v1.17.2
-    spec:
-      containers:
-        - args:
-            - --v=2
-            - --leader-election-namespace=cert-manager
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          image: quay.io/jetstack/cert-manager-cainjector:v1.17.2
-          imagePullPolicy: IfNotPresent
-          name: cert-manager-cainjector
-          ports:
-            - containerPort: 9402
-              name: http-metrics
-              protocol: TCP
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      enableServiceLinks: false
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      serviceAccountName: cert-manager-cainjector

rendered/envs/minikube/cert-manager/deployment-cert-manager-webhook.yaml

@@ -1,98 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook
-  namespace: cert-manager
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: webhook
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/name: webhook
-  template:
-    metadata:
-      annotations:
-        prometheus.io/path: /metrics
-        prometheus.io/port: "9402"
-        prometheus.io/scrape: "true"
-      labels:
-        app: webhook
-        app.kubernetes.io/component: webhook
-        app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: webhook
-        app.kubernetes.io/version: v1.17.2
-        helm.sh/chart: cert-manager-v1.17.2
-    spec:
-      containers:
-        - args:
-            - --v=2
-            - --secure-port=10250
-            - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
-            - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
-            - --dynamic-serving-dns-names=cert-manager-webhook
-            - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
-            - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          image: quay.io/jetstack/cert-manager-webhook:v1.17.2
-          imagePullPolicy: IfNotPresent
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /livez
-              port: 6080
-              scheme: HTTP
-            initialDelaySeconds: 60
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-          name: cert-manager-webhook
-          ports:
-            - containerPort: 10250
-              name: https
-              protocol: TCP
-            - containerPort: 6080
-              name: healthcheck
-              protocol: TCP
-            - containerPort: 9402
-              name: http-metrics
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 6080
-              scheme: HTTP
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            successThreshold: 1
-            timeoutSeconds: 1
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      enableServiceLinks: false
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      serviceAccountName: cert-manager-webhook

rendered/envs/minikube/cert-manager/deployment-cert-manager.yaml

@@ -1,83 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/name: cert-manager
-  template:
-    metadata:
-      annotations:
-        prometheus.io/path: /metrics
-        prometheus.io/port: "9402"
-        prometheus.io/scrape: "true"
-      labels:
-        app: cert-manager
-        app.kubernetes.io/component: controller
-        app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cert-manager
-        app.kubernetes.io/version: v1.17.2
-        helm.sh/chart: cert-manager-v1.17.2
-    spec:
-      containers:
-        - args:
-            - --v=2
-            - --cluster-resource-namespace=$(POD_NAMESPACE)
-            - --leader-election-namespace=cert-manager
-            - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.17.2
-            - --max-concurrent-challenges=60
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          image: quay.io/jetstack/cert-manager-controller:v1.17.2
-          imagePullPolicy: IfNotPresent
-          livenessProbe:
-            failureThreshold: 8
-            httpGet:
-              path: /livez
-              port: http-healthz
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 15
-          name: cert-manager-controller
-          ports:
-            - containerPort: 9402
-              name: http-metrics
-              protocol: TCP
-            - containerPort: 9403
-              name: http-healthz
-              protocol: TCP
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      enableServiceLinks: false
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      serviceAccountName: cert-manager

rendered/envs/minikube/cert-manager/job-cert-manager-startupapicheck.yaml

@@ -1,60 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    helm.sh/hook: post-install
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-    helm.sh/hook-weight: "1"
-  labels:
-    app: startupapicheck
-    app.kubernetes.io/component: startupapicheck
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: startupapicheck
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-startupapicheck
-  namespace: cert-manager
-spec:
-  backoffLimit: 4
-  template:
-    metadata:
-      labels:
-        app: startupapicheck
-        app.kubernetes.io/component: startupapicheck
-        app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: startupapicheck
-        app.kubernetes.io/version: v1.17.2
-        helm.sh/chart: cert-manager-v1.17.2
-    spec:
-      containers:
-        - args:
-            - check
-            - api
-            - --wait=1m
-            - -v
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          image: quay.io/jetstack/cert-manager-startupapicheck:v1.17.2
-          imagePullPolicy: IfNotPresent
-          name: cert-manager-startupapicheck
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      enableServiceLinks: false
-      nodeSelector:
-        kubernetes.io/os: linux
-      restartPolicy: OnFailure
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      serviceAccountName: cert-manager-startupapicheck

rendered/envs/minikube/cert-manager/job-mkcert-ca-precheck.yaml

@@ -1,46 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    argocd.argoproj.io/sync-options: Replace=true
-    argocd.argoproj.io/sync-wave: "-1"
-  name: mkcert-ca-precheck
-  namespace: cert-manager
-spec:
-  template:
-    spec:
-      containers:
-        - command:
-            - sh
-            - -c
-            - |
-              set -e
-              if ! kubectl get secret mkcert-ca -n "${NAMESPACE}" >/dev/null 2>&1; then
-                echo "ERROR: External secret mkcert-ca must be created in ${NAMESPACE} before deploying cert-manager."
-                echo "Run: mkcert -install && kubectl -n ${NAMESPACE} create secret tls mkcert-ca --cert=\"\$(mkcert -CAROOT)/rootCA.pem\" --key=\"\$(mkcert -CAROOT)/rootCA-key.pem\""
-                exit 1
-              fi
-              echo "OK: mkcert-ca exists"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          image: alpine/k8s:1.32.3
-          name: precheck
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      restartPolicy: OnFailure
-      securityContext:
-        runAsGroup: 65532
-        runAsNonRoot: true
-        runAsUser: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      serviceAccountName: mkcert-ca-precheck
-  ttlSecondsAfterFinished: 300

rendered/envs/minikube/cert-manager/mutatingwebhookconfiguration-cert-manager-webhook.yaml

@@ -1,38 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook
-  namespace: cert-manager
-webhooks:
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: cert-manager-webhook
-        namespace: cert-manager
-        path: /mutate
-    failurePolicy: Fail
-    matchPolicy: Equivalent
-    name: webhook.cert-manager.io
-    rules:
-      - apiGroups:
-          - cert-manager.io
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - certificaterequests
-    sideEffects: None
-    timeoutSeconds: 30

rendered/envs/minikube/cert-manager/namespace-cert-manager.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    pod-security.kubernetes.io/enforce: restricted
-  name: cert-manager
-  namespace: cert-manager

rendered/envs/minikube/cert-manager/role-cert-manager-cainjector_leaderelection.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cainjector
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cainjector:leaderelection
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - coordination.k8s.io
-    resourceNames:
-      - cert-manager-cainjector-leader-election
-      - cert-manager-cainjector-leader-election-core
-    resources:
-      - leases
-    verbs:
-      - get
-      - update
-      - patch
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/role-cert-manager-startupapicheck_create-cert.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    helm.sh/hook: post-install
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-    helm.sh/hook-weight: "-5"
-  labels:
-    app: startupapicheck
-    app.kubernetes.io/component: startupapicheck
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: startupapicheck
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-startupapicheck:create-cert
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - cert-manager.io
-    resources:
-      - certificaterequests
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/role-cert-manager-tokenrequest.yaml

@@ -1,24 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-tokenrequest
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - ""
-    resourceNames:
-      - cert-manager
-    resources:
-      - serviceaccounts/token
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/role-cert-manager-webhook_dynamic-serving.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook:dynamic-serving
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - ""
-    resourceNames:
-      - cert-manager-webhook-ca
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/role-cert-manager_leaderelection.yaml

@@ -1,32 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager:leaderelection
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - coordination.k8s.io
-    resourceNames:
-      - cert-manager-controller
-    resources:
-      - leases
-    verbs:
-      - get
-      - update
-      - patch
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - create

rendered/envs/minikube/cert-manager/role-mkcert-ca-precheck.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  name: mkcert-ca-precheck
-  namespace: cert-manager
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get

rendered/envs/minikube/cert-manager/rolebinding-cert-manager-cainjector_leaderelection.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cainjector
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cainjector:leaderelection
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cert-manager-cainjector:leaderelection
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager-cainjector
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/rolebinding-cert-manager-cert-manager-tokenrequest.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cert-manager-tokenrequest
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cert-manager-tokenrequest
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/rolebinding-cert-manager-startupapicheck_create-cert.yaml

@@ -1,26 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-    helm.sh/hook: post-install
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-    helm.sh/hook-weight: "-5"
-  labels:
-    app: startupapicheck
-    app.kubernetes.io/component: startupapicheck
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: startupapicheck
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-startupapicheck:create-cert
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cert-manager-startupapicheck:create-cert
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager-startupapicheck
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/rolebinding-cert-manager-webhook_dynamic-serving.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook:dynamic-serving
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cert-manager-webhook:dynamic-serving
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager-webhook
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/rolebinding-cert-manager_leaderelection.yaml

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager:leaderelection
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cert-manager:leaderelection
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/rolebinding-mkcert-ca-precheck.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  name: mkcert-ca-precheck
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: mkcert-ca-precheck
-subjects:
-  - kind: ServiceAccount
-    name: mkcert-ca-precheck
-    namespace: cert-manager

rendered/envs/minikube/cert-manager/service-cert-manager-cainjector.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: cainjector
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-cainjector
-  namespace: cert-manager
-spec:
-  ports:
-    - name: http-metrics
-      port: 9402
-      protocol: TCP
-  selector:
-    app.kubernetes.io/component: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/name: cainjector
-  type: ClusterIP

rendered/envs/minikube/cert-manager/service-cert-manager-webhook.yaml

@@ -1,30 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
-  labels:
-    app: webhook
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.17.2
-    helm.sh/chart: cert-manager-v1.17.2
-  name: cert-manager-webhook
-  namespace: cert-manager
-spec:
-  ports:
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: https
-    - name: metrics
-      port: 9402
-      protocol: TCP
-      targetPort: http-metrics
-  selector:
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/name: webhook
-  type: ClusterIP