Move all helmrepositories next to release

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -1,27 +1,35 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: cert-manager
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: v1.17.1
+  url: oci://quay.io/jetstack/charts/cert-manager
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: cert-manager
 spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: cert-manager
-      version: v1.17.1
-      sourceRef:
-        kind: HelmRepository
-        name: jetstack
-        namespace: flux-system
+  interval: 1h
+  chartRef:
+    kind: OCIRepository
+    name: cert-manager
   install:
     remediation:
-      retries: 3
+      retries: -1
   upgrade:
     cleanupOnFail: true
     remediation:
-      strategy: rollback
       retries: 3
   valuesFrom:
     - kind: ConfigMap
-      name: cert-manager-helm-values
+      name: cert-manager-values

kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml

@@ -4,9 +4,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+  - ./prometheusrule.yaml
 configMapGenerator:
-  - name: cert-manager-helm-values
+  - name: cert-manager-values
     files:
-      - values.yaml=./helm-values.yaml
+      - values.yaml=./helm/values.yaml
 configurations:
-  - kustomizeconfig.yaml
+  - ./helm/kustomizeconfig.yaml

kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml

@@ -0,0 +1,51 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/monitoring.coreos.com/prometheusrule_v1.json
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cert-manager-rules
+spec:
+  groups:
+    - name: cert-manager.rules
+      rules:
+        - alert: CertManagerAbsent
+          expr: |
+            absent(up{job="cert-manager"})
+          for: 5m
+          annotations:
+            summary: >-
+              Cert Manager has dissapeared from Prometheus service discovery
+          labels:
+            severity: critical
+
+    - name: certificates
+      rules:
+        - alert: CertManagerCertExpirySoon
+          expr: |
+            avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
+          for: 5m
+          annotations:
+            summary: >-
+              The cert {{ $labels.name }} is {{ $value | humanizeDuration }} from expiry, it should have renewed over a week ago
+          labels:
+            severity: critical
+
+        - alert: CertManagerCertNotReady
+          expr: |
+            max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
+          for: 5m
+          annotations:
+            summary: >-
+              The cert {{ $labels.name }} is not ready to serve traffic
+          labels:
+            severity: critical
+
+        - alert: CertManagerHittingRateLimits
+          expr: |
+            sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
+          for: 5m
+          annotations:
+            summary: >-
+              Cert manager hitting LetsEncrypt rate limits
+          labels:
+            severity: critical

kubernetes/apps/cert-manager/cert-manager/tls/certificates.yaml

@@ -12,6 +12,5 @@ spec:
   commonName: "martinbjeldbak.com"
   dnsNames:
     - "martinbjeldbak.com"
-    - "*.kube.local.martinbjeldbak.com"
     - "*.local.martinbjeldbak.com"
     - "*.martinbjeldbak.com"

kubernetes/apps/cnpg-system/cloudnative-pg/app/helmrelease.yaml

@@ -1,19 +1,28 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: cloudnative-pg
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.23.2
+  url: oci://ghcr.io/cloudnative-pg/charts/cloudnative-pg
+---
 # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: cloudnative-pg
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: cloudnative-pg
-      version: 0.23.2
-      sourceRef:
-        kind: HelmRepository
-        name: cnpg
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: cloudnative-pg
   install:
     remediation:
       retries: 3

kubernetes/apps/csi-proxmox/proxmox-csi/app/helmrelease.yaml

@@ -1,19 +1,28 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: proxmox-csi-plugin
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.3.5
+  url: oci://ghcr.io/sergelogvinov/charts/proxmox-csi-plugin
+---
 # yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: proxmox-csi
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: proxmox-csi-plugin
-      version: 0.3.5
-      sourceRef:
-        kind: HelmRepository
-        name: csi-proxmox
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: proxmox-csi-plugin
   install:
     remediation:
       retries: 3

kubernetes/apps/default/authentik/app/helmrelease.yaml

@@ -1,19 +1,28 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: authentik
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 2025.2.3
+  url: oci://ghcr.io/goauthentik/helm-charts/authentik
+---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: authentik
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: authentik
-      version: 2025.2.3
-      sourceRef:
-        kind: HelmRepository
-        name: authentik
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: authentik
   install:
     remediation:
       retries: 3

kubernetes/apps/default/autobrr/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: autobrr
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   install:
     remediation:
       retries: 3

kubernetes/apps/default/bazarr/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: &app bazarr
 spec:
   interval: 1h
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   install:
     remediation:
       retries: 3

kubernetes/apps/default/emqx/app/helmrelease.yaml

@@ -1,19 +1,28 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: emqx-operator
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 2.2.28
+  url: oci://ghcr.io/home-operations/charts-mirror/emqx-operator
+---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: emqx
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: emqx-operator
-      version: 2.2.28
-      sourceRef:
-        kind: HelmRepository
-        name: emqx
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: emqx-operator
   install:
     remediation:
       retries: 3

kubernetes/apps/default/epicgames-freegames/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: epicgames-freegames
 spec:
   interval: 1h
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   values:
     controllers:
       epicgames:

kubernetes/apps/default/esphome/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: esphome
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   values:
     controllers:
       esphome:

kubernetes/apps/default/home-assistant/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: home-assistant
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   install:
     remediation:
       retries: 3

kubernetes/apps/default/homebox/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: homebox
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   install:
     remediation:
       retries: 3

kubernetes/apps/default/homepage/app/helmrelease.yaml

@@ -6,14 +6,9 @@ metadata:
   name: homepage
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.7.3
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
+  chartRef:
+    kind: OCIRepository
+    name: app-template
   install:
     remediation:
       retries: 3