remove ontime-dev cluster

clusters/ontime-dev/configs/cluster-issuer.yaml

@@ -1,27 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: lets-encrypt-staging
-spec:
-  acme:
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: lets-encrypt-staging-account-key
-    solvers:
-    - http01:
-        ingress:
-          ingressClassName: nginx
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: lets-encrypt-prod
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: lets-encrypt-prod-account-key
-    solvers:
-    - http01:
-        ingress:
-          ingressClassName: nginx

clusters/ontime-dev/configs/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cluster-issuer.yaml
-  - storageclass.yaml

clusters/ontime-dev/configs/storageclass.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: nfs-csi
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 10.0.0.17
-  share: /volume1/docker/ontime-k8s
-  # csi.storage.k8s.io/provisioner-secret is only needed for providing mountOptions in DeleteVolume
-  # csi.storage.k8s.io/provisioner-secret-name: "mount-options"
-  # csi.storage.k8s.io/provisioner-secret-namespace: "default"
-reclaimPolicy: Delete
-volumeBindingMode: Immediate
-allowVolumeExpansion: true
-mountOptions:
-  - nfsvers=4.1

clusters/ontime-dev/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: main
-  secretRef:
-    name: flux-system
-  url: ssh://git@git.jwetzell.com/jwetzell/ontime-k8s
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./clusters/ontime-dev
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

clusters/ontime-dev/flux-system/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml

clusters/ontime-dev/infrastructure.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infrastructure
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 1m
-  timeout: 5m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./infrastructure/ontime-dev
-  prune: true
-  wait: true

infrastructure/ontime-dev/cert-manager/cert-manager.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 5m0s
-  url: oci://quay.io/jetstack/charts/cert-manager
-  layerSelector:
-    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
-    operation: copy
-  ref:
-    tag: "v1.19.1"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 30m
-  chartRef:
-    kind: OCIRepository
-    name: cert-manager
-    namespace: cert-manager
-  values:
-    crds:
-      enabled: true

infrastructure/ontime-dev/csi-driver-nfs/csi-driver-nfs.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: csi-driver-nfs
-  namespace: kube-system
-spec:
-  interval: 24h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: csi-driver-nfs
-  namespace: kube-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: csi-driver-nfs
-      version: "4.12.1"
-      sourceRef:
-        kind: HelmRepository
-        name: csi-driver-nfs
-        namespace: kube-system
-      interval: 12h

infrastructure/ontime-dev/ontime-operator/cluster-role-binding.yaml

@@ -1,34 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: edit-namespaces
-rules:
-- apiGroups: [""]
-  resources: ["namespaces"]
-  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: edit-stages-clusterrolebinding
-subjects:
-- kind: ServiceAccount
-  name: stage-editor
-  namespace: ontime-operator
-roleRef:
-  kind: ClusterRole
-  name: ontime-operator-stage-editor-role
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: edit-namespaces-clusterrolebinding
-subjects:
-- kind: ServiceAccount
-  name: stage-editor
-  namespace: ontime-operator
-roleRef:
-  kind: ClusterRole
-  name: edit-namespaces
-  apiGroup: rbac.authorization.k8s.io

infrastructure/ontime-dev/ontime-operator/deploy.yaml

@@ -1,396 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-    control-plane: controller-manager
-  name: ontime-operator
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: stages.cloud.getontime.no
-spec:
-  group: cloud.getontime.no
-  names:
-    kind: Stage
-    listKind: StageList
-    plural: stages
-    singular: stage
-  scope: Namespaced
-  versions:
-  - name: v1
-    schema:
-      openAPIV3Schema:
-        description: Stage is the Schema for the stages API
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Spec defines the desired state of Stage
-            type: object
-            x-kubernetes-preserve-unknown-fields: true
-          status:
-            description: Status defines the observed state of Stage
-            type: object
-            x-kubernetes-preserve-unknown-fields: true
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-controller-manager
-  namespace: ontime-operator
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-leader-election-role
-  namespace: ontime-operator
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - list
-  - watch
-  - create
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - get
-  - list
-  - watch
-  - create
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ontime-operator-manager-role
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - '*'
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages
-  - stages/status
-  - stages/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - services
-  - persistentvolumeclaims
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - '*'
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - '*'
-- apiGroups:
-  - gateway.networking.k8s.io
-  resources:
-  - httproutes
-  verbs:
-  - '*'
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ontime-operator-metrics-auth-role
-rules:
-- apiGroups:
-  - authentication.k8s.io
-  resources:
-  - tokenreviews
-  verbs:
-  - create
-- apiGroups:
-  - authorization.k8s.io
-  resources:
-  - subjectaccessreviews
-  verbs:
-  - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ontime-operator-metrics-reader
-rules:
-- nonResourceURLs:
-  - /metrics
-  verbs:
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-stage-admin-role
-rules:
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages
-  verbs:
-  - '*'
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages/status
-  verbs:
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-stage-editor-role
-rules:
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages/status
-  verbs:
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-stage-viewer-role
-rules:
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - cloud.getontime.no
-  resources:
-  - stages/status
-  verbs:
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-leader-election-rolebinding
-  namespace: ontime-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ontime-operator-leader-election-role
-subjects:
-- kind: ServiceAccount
-  name: ontime-operator-controller-manager
-  namespace: ontime-operator
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-  name: ontime-operator-manager-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ontime-operator-manager-role
-subjects:
-- kind: ServiceAccount
-  name: ontime-operator-controller-manager
-  namespace: ontime-operator
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ontime-operator-metrics-auth-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ontime-operator-metrics-auth-role
-subjects:
-- kind: ServiceAccount
-  name: ontime-operator-controller-manager
-  namespace: ontime-operator
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-    control-plane: controller-manager
-  name: ontime-operator-controller-manager-metrics-service
-  namespace: ontime-operator
-spec:
-  ports:
-  - name: https
-    port: 8443
-    protocol: TCP
-    targetPort: 8443
-  selector:
-    app.kubernetes.io/name: ontime-operator
-    control-plane: controller-manager
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: ontime-operator
-    control-plane: controller-manager
-  name: ontime-operator-controller-manager
-  namespace: ontime-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: ontime-operator
-      control-plane: controller-manager
-  template:
-    metadata:
-      annotations:
-        kubectl.kubernetes.io/default-container: manager
-      labels:
-        app.kubernetes.io/name: ontime-operator
-        control-plane: controller-manager
-    spec:
-      containers:
-      - args:
-        - --metrics-require-rbac
-        - --metrics-secure
-        - --metrics-bind-address=:8443
-        - --leader-elect
-        - --leader-election-id=ontime-operator
-        - --health-probe-bind-address=:8081
-        image: git.jwetzell.com/jwetzell/ontime-operator:v1.6.2
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 8081
-          initialDelaySeconds: 15
-          periodSeconds: 20
-        name: manager
-        ports: []
-        readinessProbe:
-          httpGet:
-            path: /readyz
-            port: 8081
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        resources:
-          limits:
-            cpu: 500m
-            memory: 128Mi
-          requests:
-            cpu: 10m
-            memory: 64Mi
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-        volumeMounts: []
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      serviceAccountName: ontime-operator-controller-manager
-      terminationGracePeriodSeconds: 10
-      volumes: []

infrastructure/ontime-dev/ontime-operator/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-    - ./cluster-role-binding.yaml
-    - ./deploy.yaml
-    - ./namespace-prefix-policy.yaml
-    - ./service-account.yaml

infrastructure/ontime-dev/ontime-operator/namespace-prefix-policy.yaml

@@ -1,98 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "force-ns-prefix-for-stage-editor"
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:   [""]
-      apiVersions: ["v1"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["namespaces"]
-  matchConditions:
-    - name: 'only-stage-editor'
-      expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator:stage-editor'"
-  validations:
-    - expression: "object.metadata.name.startsWith('team-')"
-      message: "All namespaces managed by stage-editor must start with 'team-'"
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "force-ns-prefix-for-stage-editor-binding"
-spec:
-  policyName: "force-ns-prefix-for-stage-editor"
-  validationActions: [Deny]
-  matchResources:
-    resourceRules:
-    - apiGroups:   [""]
-      apiVersions: ["v1"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["namespaces"]
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "force-ns-prefix-for-stage-create-update"
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:   ["cloud.getontime.no"]
-      apiVersions: ["v1"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["stages"]
-  matchConditions:
-    - name: 'only-stage-editor'
-      expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator:stage-editor'"
-  validations:
-    - expression: "object.metadata.namespace.startsWith('team-')"
-      message: "Stages must be managed in namespaces starting with 'team-'"
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "force-ns-prefix-for-stage-create-update-binding"
-spec:
-  policyName: "force-ns-prefix-for-stage-create-update"
-  validationActions: [Deny]
-  matchResources:
-    resourceRules:
-    - apiGroups:   ["cloud.getontime.no"]
-      apiVersions: ["v1"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["stages"]
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "force-ns-prefix-for-stage-editor-delete"
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:   ["cloud.getontime.no"]
-      apiVersions: ["v1"]
-      operations:  ["DELETE"]
-      resources:   ["stages"]
-  matchConditions:
-    - name: 'only-stage-editor'
-      expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator:stage-editor'"
-  validations:
-    - expression: "request.namespace.startsWith('team-')"
-      message: "Stages must be managed in namespaces starting with 'team-'"
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "force-ns-prefix-for-stage-editor-delete-binding"
-spec:
-  policyName: "force-ns-prefix-for-stage-editor-delete"
-  validationActions: [Deny]
-  matchResources:
-    resourceRules:
-    - apiGroups:   ["cloud.getontime.no"]
-      apiVersions: ["v1"]
-      operations:  ["DELETE"]
-      resources:   ["stages"]

infrastructure/ontime-dev/ontime-operator/service-account.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: stage-editor
-  namespace: ontime-operator