Change uid whisper translate

longhorn/volume-snapshot.yaml

@@ -2,6 +2,8 @@ kind: VolumeSnapshotClass
 apiVersion: snapshot.storage.k8s.io/v1
 metadata:
   name: longhorn-backup-vsc
+  labels:
+    velero.io/csi-volumesnapshot-class: "true"
 driver: driver.longhorn.io
 deletionPolicy: Delete
 parameters:

minio/helm-minio-operator.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: minio-operator
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true 
-    automated:
-      selfHeal: true
-      prune: true
-  project: default
-  sources:
-    - chart: operator
-      repoURL: https://operator.min.io
-      targetRevision: 6.0.3
-      helm:
-        valueFiles:
-          - $values/minio/values-operator.yaml
-    - repoURL: https://github.com/rubenhensen/k8scd.git
-      targetRevision: HEAD
-      ref: values
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: minio-operator

minio/helm-minio-tenant.yaml

@@ -1,30 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: minio-tenant
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true 
-    automated:
-      selfHeal: true
-      prune: true
-  project: default
-  sources:
-    - chart: tenant
-      repoURL: https://operator.min.io
-      targetRevision: 6.0.3
-      helm:
-        valueFiles:
-          - $values/minio/values-tenant.yaml
-    - repoURL: https://github.com/rubenhensen/k8scd.git
-      targetRevision: HEAD
-      ref: values
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: minio-tenant
-
-

minio/minio-tenant-es.yaml

@@ -1,31 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: minio-tenant-es
-  namespace: minio-tenant
-spec:
-  refreshInterval: "15s"
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  target:
-    name: minio-env-configuration
-    
-  data:
-  - secretKey: config.env
-    remoteRef:
-      key: minio-tenant-root
-      property: config.env
-
-  # # metadataPolicy to fetch all the labels in JSON format
-  # - secretKey: tags
-  #   remoteRef:
-  #     metadataPolicy: Fetch
-  #     key: foo
-
-  # # metadataPolicy to fetch a specific label (dev) from the source secret
-  # - secretKey: developer
-  #   remoteRef:
-  #     metadataPolicy: Fetch
-  #     key: foo
-  #     property: dev

minio/values-operator.yaml

@@ -1,319 +0,0 @@
-###
-# Root key for Operator Helm Chart
-operator:
-  ###
-  # An array of environment variables to pass to the Operator deployment.
-  # Pass an empty array to start Operator with defaults.
-  # 
-  # For example:
-  #
-  # .. code-block:: yaml
-  #
-  #    env:
-  #    - name: MINIO_OPERATOR_DEPLOYMENT_NAME
-  #      valueFrom:
-  #        fieldRef:
-  #          fieldPath: metadata.labels['app.kubernetes.io/name']
-  #    - name: MINIO_CONSOLE_TLS_ENABLE
-  #      value: "off"
-  #    - name: CLUSTER_DOMAIN
-  #      value: "cluster.domain"
-  #    - name: WATCHED_NAMESPACE
-  #      value: ""
-  #    - name: MINIO_OPERATOR_RUNTIME
-  #      value: "OpenShift" 
-  #
-  # See `Operator environment variables <https://github.com/minio/operator/blob/master/docs/env-variables.md>`__ for a list of all supported values.
-  env:
-    - name: OPERATOR_STS_ENABLED
-      value: "on"
-  ###
-  # Specify the Operator container image to use for the deployment.
-  # ``image.tag`` 
-  # For example, the following sets the image to the ``quay.io/minio/operator`` repo and the v5.0.11 tag.
-  # The container pulls the image if not already present:
-  #
-  # .. code-block:: yaml
-  # 
-  #    image:
-  #      repository: quay.io/minio/operator
-  #      tag: v5.0.11
-  #      pullPolicy: IfNotPresent
-  #
-  # The chart also supports specifying an image based on digest value:
-  # 
-  # .. code-block:: yaml
-  #
-  #    image:
-  #      repository: quay.io/minio/operator@sha256
-  #      digest: 28c80b379c75242c6fe793dfbf212f43c602140a0de5ebe3d9c2a3a7b9f9f983
-  #      pullPolicy: IfNotPresent
-  #
-  image:
-    repository: quay.io/minio/operator
-    tag: v5.0.11
-    pullPolicy: IfNotPresent
-  ###
-  #
-  # An array of Kubernetes secrets to use for pulling images from a private ``image.repository``.
-  # Only one array element is supported at this time.
-  imagePullSecrets: [ ]
-  ###
-  #
-  # The name of a custom `Container Runtime <https://kubernetes.io/docs/concepts/containers/runtime-class/>`__ to use for the Operator pods.
-  runtimeClassName: ~
-  ###
-  # An array of `initContainers <https://kubernetes.io/docs/concepts/workloads/pods/init-containers/>`__ to start up before the Operator pods.
-  # Exercise care as ``initContainer`` failures prevent Operator pods from starting.
-  # Pass an empty array to start the Operator normally.
-  initContainers: [ ]
-  ###
-  # The number of Operator pods to deploy.
-  # Higher values increase availability in the event of worker node failures.
-  #
-  # The cluster must have sufficient number of available worker nodes to fulfill the request.
-  # Operator pods deploy with pod anti-affinity by default, preventing Kubernetes from scheduling multiple pods onto a single Worker node.
-  replicaCount: 1
-  ###
-  # The Kubernetes `SecurityContext <https://kubernetes.io/docs/tasks/configure-pod-container/security-context/>`__ to use for deploying Operator resources.
-  #
-  # You may need to modify these values to meet your cluster's security and access settings.
-  securityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    runAsNonRoot: true
-    fsGroup: 1000
-  ###
-  # The Kubernetes `SecurityContext <https://kubernetes.io/docs/tasks/configure-pod-container/security-context/>`__ to use for deploying Operator containers.
-  # You may need to modify these values to meet your cluster's security and access settings.
-  containerSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    runAsNonRoot: true
-  ###
-  # An array of `Volumes <https://kubernetes.io/docs/concepts/storage/volumes/>`__ which the Operator can mount to pods.
-  #
-  # The volumes must exist *and* be accessible to the Operator pods.
-  volumes: [ ]
-  ###
-  # An array of volume mount points associated to each Operator container.
-  # 
-  # Specify each item in the array as follows:
-  #
-  # .. code-block:: yaml
-  #
-  #    volumeMounts:
-  #    - name: volumename
-  #      mountPath: /path/to/mount
-  #
-  # The ``name`` field must correspond to an entry in the ``volumes`` array.
-  volumeMounts: [ ]
-  ###
-  # Any `Node Selectors <https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/>`__ to apply to Operator pods.
-  #
-  # The Kubernetes scheduler uses these selectors to determine which worker nodes onto which it can deploy Operator pods.
-  #
-  # If no worker nodes match the specified selectors, the Operator deployment will fail.
-  nodeSelector: { }
-  ###
-  #
-  # The `Pod Priority <https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/>`__ to assign to Operator pods.
-  priorityClassName: ""
-  ###
-  #
-  # The `affinity <https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/>`__ or anti-affinity settings to apply to Operator pods.
-  #
-  # These settings determine the distribution of pods across worker nodes and can help prevent or allow colocating pods onto the same worker nodes.
-  affinity:
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchExpressions:
-              - key: name
-                operator: In
-                values:
-                  - minio-operator
-          topologyKey: kubernetes.io/hostname
-  ###
-  #
-  # An array of `Toleration labels <https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/>`__ to associate to Operator pods.
-  #
-  # These settings determine the distribution of pods across worker nodes.
-  tolerations: [ ]
-  ###
-  #
-  # An array of `Topology Spread Constraints <https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/>`__ to associate to Operator pods.
-  #
-  # These settings determine the distribution of pods across worker nodes.
-  topologySpreadConstraints: [ ]
-  ###
-  # 
-  # The `Requests or Limits <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>`__ for resources to associate to Operator pods.
-  #
-  # These settings can control the minimum and maximum resources requested for each pod.
-  # If no worker nodes can meet the specified requests, the Operator may fail to deploy.
-  resources:
-    requests:
-      cpu: 200m
-      memory: 256Mi
-      ephemeral-storage: 500Mi
-
-###
-# Root key for Operator Console
-console:
-  ###
-  # Specify ``false`` to disable the Operator Console.
-  #
-  # If the Operator Console is disabled, all management of Operator Tenants must be done through the Kubernetes API.
-  enabled: true
-  ###
-  # Specify the Operator Console container image to use for the deployment.
-  # ``image.tag`` 
-  # For example, the following sets the image to the ``quay.io/minio/operator`` repo and the v5.0.11 tag.
-  # The container pulls the image if not already present:
-  #
-  # .. code-block:: yaml
-  # 
-  #    image:
-  #      repository: quay.io/minio/operator
-  #      tag: v5.0.11
-  #      pullPolicy: IfNotPresent
-  #
-  # The chart also supports specifying an image based on digest value:
-  # 
-  # .. code-block:: yaml
-  #
-  #    image:
-  #      repository: quay.io/minio/operator@sha256
-  #      digest: 28c80b379c75242c6fe793dfbf212f43c602140a0de5ebe3d9c2a3a7b9f9f983
-  #      pullPolicy: IfNotPresent
-  #
-  # The specified values should match that of ``operator.image`` to ensure predictable operations.
-  image:
-    repository: quay.io/minio/operator
-    tag: v5.0.11
-    pullPolicy: IfNotPresent
-  ###
-  # An array of environment variables to pass to the Operator Console deployment.
-  # Pass an empty array to start Operator Console with defaults.
-  env: [ ]
-  ###
-  #
-  # An array of Kubernetes secrets to use for pulling images from a private ``image.repository``.
-  imagePullSecrets: [ ]
-  ###
-  #
-  # The name of a custom `Container Runtime <https://kubernetes.io/docs/concepts/containers/runtime-class/>`__ to use for the Operator Console pods.
-  runtimeClassName: ~
-  ###
-  # An array of `initContainers <https://kubernetes.io/docs/concepts/workloads/pods/init-containers/>`__ to start up before the Operator Console pods.
-  # Exercise care as ``initContainer`` failures prevent Console pods from starting.
-  # Pass an empty array to start the Console normally.
-  initContainers: [ ]
-  ###
-  # The number of Operator Console pods to deploy.
-  # Higher values increase availability in the event of worker node failures.
-  #
-  # The cluster must have sufficient number of available worker nodes to fulfill the request.
-  # Console pods deploy with pod anti-affinity by default, preventing Kubernetes from scheduling multiple pods onto a single Worker node.
-  replicaCount: 1
-  ###
-  # Any `Node Selectors <https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/>`__ to apply to Operator Console pods.
-  #
-  # The Kubernetes scheduler uses these selectors to determine which worker nodes onto which it can deploy Console pods.
-  #
-  # If no worker nodes match the specified selectors, the Console deployment will fail.
-  nodeSelector: { }
-  ###
-  #
-  # The `affinity <https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/>`__ or anti-affinity settings to apply to Operator Console pods.
-  #
-  # These settings determine the distribution of pods across worker nodes and can help prevent or allow colocating pods onto the same worker nodes.
-  affinity:
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchExpressions:
-              - key: name
-                operator: In
-                values:
-                  - minio-operator
-          topologyKey: kubernetes.io/hostname
-  ###
-  #
-  # An array of `Toleration labels <https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/>`__ to associate to Operator Console pods.
-  #
-  # These settings determine the distribution of pods across worker nodes.
-  tolerations: [ ]
-  ###
-  #
-  # An array of `Topology Spread Constraints <https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/>`__ to associate to Operator Console pods.
-  #
-  # These settings determine the distribution of pods across worker nodes.
-  topologySpreadConstraints: [ ]
-  ###
-  # 
-  # The `Requests or Limits <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>`__ for resources to associate to Operator Console pods.
-  #
-  # These settings can control the minimum and maximum resources requested for each pod.
-  # If no worker nodes can meet the specified requests, the Console may fail to deploy.
-  resources:
-    requests:
-      cpu: 0.25
-      memory: 512Mi
-  ###
-  # The Kubernetes `SecurityContext <https://kubernetes.io/docs/tasks/configure-pod-container/security-context/>`__ to use for deploying Operator Console resources.
-  #
-  # You may need to modify these values to meet your cluster's security and access settings.
-  securityContext:
-    runAsUser: 1000
-    runAsNonRoot: true
-  ###
-  # The Kubernetes `SecurityContext <https://kubernetes.io/docs/tasks/configure-pod-container/security-context/>`__ to use for deploying Operator Console containers.
-  # You may need to modify these values to meet your cluster's security and access settings.
-  containerSecurityContext:
-    runAsUser: 1000
-    runAsNonRoot: true
-  ###
-  # Configures `Ingress <https://kubernetes.io/docs/concepts/services-networking/ingress/>`__ for the Operator Console.
-  #
-  # Set the keys to conform to the Ingress controller and configuration of your choice.
-  # ingress:
-  #   enabled: true
-  #   ingressClassName: nginx
-  #   labels: { }
-  #   annotations: 
-  #     cert-manager.io/cluster-issuer: prod-cluster-issuer
-  #     # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-  #     nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-  #   tls: 
-  #     # TLS secretName used on ClusterIssuer
-  #     - secretName:  letsencrypt-prod
-  #       hosts:
-  #         - minio-console.hensen.io
-  #   host: minio-console.hensen.io
-  #   path: /
-  #   pathType: Prefix
-  ###
-  # An array of `Volumes <https://kubernetes.io/docs/concepts/storage/volumes/>`__ which the Operator Console can mount to pods.
-  #
-  # The volumes must exist *and* be accessible to the Console pods.
-  volumes:
-    - name: tmp
-      emptyDir: {}
-  ###
-  # An array of volume mount points associated to each Operator Console container.
-  # 
-  # Specify each item in the array as follows:
-  #
-  # .. code-block:: yaml
-  #
-  #    volumeMounts:
-  #    - name: volumename
-  #      mountPath: /path/to/mount
-  #
-  # The ``name`` field must correspond to an entry in the ``volumes`` array.
-  volumeMounts:
-    - name: tmp
-      readOnly: false
-      mountPath: /tmp/certs/CAs

minio/values-tenant.yaml

@@ -1,120 +0,0 @@
-tenant:
-  name: myminio
-  image:
-    repository: quay.io/minio/minio
-    tag: RELEASE.2024-08-17T01-24-54Z
-    pullPolicy: IfNotPresent
-  imagePullSecret: { }
-  scheduler: { }
-  configuration:
-    name: minio-env-configuration
-  
-  configSecret: 
-    existingSecret: true
-  
-  pools:
-    - servers: 1
-      name: pool-0
-      volumesPerServer: 1
-      size: 10Gi
-      storageAnnotations: { }
-      annotations: { }
-      labels: { }
-      tolerations: [ ]
-      nodeSelector: { }
-      affinity: { }
-      resources: { }
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        fsGroupChangePolicy: "OnRootMismatch"
-        runAsNonRoot: true
-      containerSecurityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
-        seccompProfile:
-          type: RuntimeDefault
-      topologySpreadConstraints: [ ]
-  mountPath: /export
-  subPath: /data
-  metrics:
-    enabled: false
-    port: 9000
-    protocol: http
-  
-  certificate:
-    externalCaCertSecret: [ ]
-    externalCertSecret: [ ]
-    requestAutoCert: true
-    certConfig: { }
-  features:
-    bucketDNS: false
-    domains: { }
-    enableSFTP: false
-  buckets: [ ]
-  users: [ ]
-  podManagementPolicy: Parallel
-  liveness: { }
-  readiness: { }
-  startup: { }
-  lifecycle: { }
-  exposeServices: { }
-  serviceAccountName: ""
-  prometheusOperator: false
-  logging: { }
-  serviceMetadata: { }
-  env: [ ]
-  priorityClassName: ""
-  additionalVolumes: [ ]
-  additionalVolumeMounts: [ ]
-
-ingress:
-  api:
-    enabled: true
-    ingressClassName: nginx
-    # labels: { }
-    annotations: 
-      cert-manager.io/cluster-issuer: prod-cluster-issuer
-      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    tls: 
-      - secretName:  letsencrypt-prod
-        hosts:
-          - minio.hensen.io
-    host: minio.hensen.io
-    path: /
-    pathType: Prefix
-  console:
-    enabled: true
-    ingressClassName: nginx
-    # labels: { }
-    annotations: 
-      cert-manager.io/cluster-issuer: prod-cluster-issuer
-      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    tls: 
-      - secretName:  letsencrypt-prod-2
-        hosts:
-          - minio-console.hensen.io
-    host: minio-console.hensen.io
-    path: /
-    pathType: Prefix
-
-
-
-
-
-
-
-
-
-
-
-
-

velero/backup-schedule.yaml

@@ -6,11 +6,11 @@ metadata:
 spec:
   schedule: "0 1 * * *"  # Daily at 1 AM
   template:
-    includedNamespaces:
-      - immich
-      - nextcloud
-      - home-assistant
-      - ttrss
+    # includedNamespaces:
+    #   - immich
+    #   - nextcloud
+    #   - home-assistant
+    #   - ttrss
     ttl: 720h  # 30 days
 ---
 apiVersion: velero.io/v1
@@ -21,9 +21,9 @@ metadata:
 spec:
   schedule: "0 0 * * 0"  # Weekly on Sunday at midnight
   template:
-    includedNamespaces:
-      - immich
-      - nextcloud
-      - home-assistant
-      - ttrss
+    # includedNamespaces:
+    #   - immich
+    #   - nextcloud
+    #   - home-assistant
+    #   - ttrss
     ttl: 2160h  # 90 days

whishper/translate-deployment.yaml

@@ -66,6 +66,9 @@ spec:
             - containerPort: 5000
               protocol: TCP
           tty: true
+          securityContext:
+            runAsUser: 1032
+            runAsGroup: 1032
           volumeMounts:
             - mountPath: /home/libretranslate/.local/share
               name: translate-claim0