Automated image update

Files:
- monitoring/controllers/base/kube-prometheus-stack/kube-prometheus-stack.yaml
Objects:
- HelmRelease kube-prometheus-stack
  Changes:
    - 91.7.1 -> 91.8.0

components/admission/controllers/base/kyverno.yaml

@@ -18,7 +18,7 @@ spec:
   interval: 1h
   chart:
     spec:
-      version: "3.6.0" # {"$imagepolicy": "flux-system:kyverno:tag"}
+      version: "3.9.1" # {"$imagepolicy": "flux-system:kyverno:tag"}
       chart: kyverno
       sourceRef:
         kind: HelmRepository

components/monitoring/configs/dev-arm64/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
-  - ../base
+resources: []
+  # - ../base

components/monitoring/controllers/base/grafana-auth-secret.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: flux-grafana-auth-secret
-  namespace: monitoring
-type: Opaque
-stringData:
-  values.yaml: ENC[AES256_GCM,data:HnTnJaBjhQyp1sM/tYlFV8NXMpIyWlfmEu/5rvZHTQ+zH/4B+44I,iv:WXsGW84AJpgx67CxTeIADMiIdw7dKkqR/HrvzZMHlTc=,tag:o0p4kayo88kPGgbY97Z/6A==,type:str]
-sops:
-  age:
-      - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
-        enc: |
-          -----BEGIN AGE ENCRYPTED FILE-----
-          YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5QitXVlk5MG9iVm8zRkFt
-          WTJYaTYwa0JJb3dseUZLcFVISzF6aEFUaERZClZtd3hDYXNpc25zaWhkd3pSNFVi
-          bUtGY3pUVTdWMVFOS1AxbHc1SDZoNlkKLS0tIDRWUUd0M2hiajFicWpHejlGb005
-          Yk9LN0VBNjdOS3N1SnRTdEF2MnVicm8KKjve/Asmq+bFD+jWAJ1Wj4XfRk2Pnoff
-          tLnT4TjqBuAlhRYkUaETeSP2KiriZgTV2I8JNdAJPSGl7m+scSxrGg==
-          -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2025-11-15T22:43:54Z"
-  mac: ENC[AES256_GCM,data:lvdJNCdS5v85oZNV8JzIgtIfdLFdC8QMR4tmz1PuYBGAGCOqqwF6aP09aCujBoKPujMOJeZyVRSvsnoH0Nc7K6kRmUNU7LIDcjUerJ48uHsh2zxbLoHcH2nZ4U91V/BxZt5nSGzZp0TNzRTZc7RBtS7JCjEmgSLk62g+ziM568A=,iv:AWd4Ev8NNxoSLKVKF8k1Al6Zusz/q29q7g3X8/0EiHg=,tag:lr2uBg7cUU0066dh5cnlFg==,type:str]
-  encrypted_regex: ^(stringData)$
-  version: 3.11.0

components/monitoring/controllers/base/kube-prometheus-stack.yaml

@@ -1,63 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: prometheus-community
-    namespace: monitoring
-spec:
-    interval: 12h
-    type: oci
-    url: oci://ghcr.io/prometheus-community/charts
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: kube-prometheus-stack
-    namespace: monitoring
-spec:
-    serviceAccountName: flux
-    interval: 1h
-    chart:
-        spec:
-            version: 79.4.1
-            chart: kube-prometheus-stack
-            sourceRef:
-                kind: HelmRepository
-                name: prometheus-community
-            interval: 12h
-    install:
-        crds: Create
-        timeout: 9m
-    upgrade:
-        crds: CreateReplace
-        timeout: 9m
-    driftDetection:
-        mode: enabled
-        ignore:
-            - paths:
-                - /metadata/annotations/prometheus-operator-validated
-              target:
-                kind: PrometheusRule
-    valuesFrom:
-        - kind: ConfigMap
-          name: flux-kube-state-metrics-config
-          valuesKey: kube-state-metrics-config.yaml
-        - kind: Secret
-          name: flux-grafana-auth-secret
-          valuesKey: values.yaml
-    values:
-        alertmanager:
-            enabled: false
-        prometheus:
-            prometheusSpec:
-                retention: 12h
-                resources:
-                    requests:
-                        cpu: 200m
-                        memory: 200Mi
-                podMonitorNamespaceSelector: {}
-                podMonitorSelector:
-                    matchLabels:
-                        app.kubernetes.io/component: monitoring
-        grafana:
-            defaultDashboardsEnabled: false
-

components/monitoring/controllers/base/kube-prometheus-stack/grafana-auth-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: flux-grafana-auth-secret
+    namespace: monitoring
+type: Opaque
+stringData:
+    values.yaml: ENC[AES256_GCM,data:92+CCaQRpzVoOmOB3KEVnvEvUQQmm+TeeZ49SQLZjPJQrZtZMvZa,iv:GEH+lFkOge6YdlVQJAerA/quKcq2FDHWvTq1NlcBlZs=,tag:AGA/M8jR6uDNDFF4QEn8cg==,type:str]
+sops:
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFU1BqYjZaUncyZTRVanZs
+            NURaVlhsczgyVGtneDNSNXFBelN4dTUwK1hzCnE5TmVxQTdUb040eUVyclBGSUs5
+            aURKUDdHYm5mWEtSUlkrQ1BGUm90QU0KLS0tIEhOVXI1N2I3OHExazNRaWh3OG92
+            VFVGcVJiU3JnWTdlVU9VaEVlQjJJS0kKEwflCvuyRJGVE82FQJYv11eQGR3RBTVc
+            remCV/a2JBbc6FHr6CFA2UK9utgiqjLgdEIV7op9qnEB+VPK/WrV3A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-01T13:30:30Z"
+    mac: ENC[AES256_GCM,data:npYGp6HghCG6EtCkLWTQWcF/NkxxTZ7goT5S8YN5msGDb8f8z9Ky336aKJExYbp07UqMtloAncCdKsmF9Kf2BkKAqgjtq/0LJPN8cy2963ITK4JGRgLrvDMiYIx7MjEkJl5bSi00gOG5wLNnl802xL1vRSjrjv5frkx7X0aTeQA=,iv:ScUuhHPIU5WtxKi6l2vHqmG2VLiOsbRTwTrzp/5VY58=,tag:MHh1rOWLJbCg2LOH+cVmZA==,type:str]
+    encrypted_regex: ^(stringData)$
+    version: 3.11.0

components/monitoring/controllers/base/kube-prometheus-stack/kube-prometheus-stack.yaml

@@ -0,0 +1,63 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: monitoring
+spec:
+  interval: 12h
+  type: oci
+  url: oci://ghcr.io/prometheus-community/charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+  namespace: monitoring
+spec:
+  serviceAccountName: flux
+  interval: 1h
+  chart:
+    spec:
+      version: 91.8.0 # {"$imagepolicy": "flux-system:kube-prometheus-stack:tag"}
+      chart: kube-prometheus-stack
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+      interval: 12h
+  install:
+    crds: Create
+    timeout: 9m
+  upgrade:
+    crds: CreateReplace
+    timeout: 9m
+  driftDetection:
+    mode: enabled
+    ignore:
+    - paths:
+      - /metadata/annotations/prometheus-operator-validated
+      target:
+        kind: PrometheusRule
+  valuesFrom:
+  - kind: ConfigMap
+    name: flux-kube-state-metrics-config
+    valuesKey: kube-state-metrics-config.yaml
+  - kind: Secret
+    name: flux-grafana-auth-secret
+    valuesKey: values.yaml
+  values:
+    alertmanager:
+      enabled: false
+    prometheus:
+      prometheusSpec:
+        retention: 12h
+        resources:
+          requests:
+            cpu: 200m
+            memory: 200Mi
+        podMonitorNamespaceSelector: {}
+        podMonitorSelector:
+          matchLabels:
+            app.kubernetes.io/component: monitoring
+    grafana:
+      defaultDashboardsEnabled: false
+      replicas: 1

components/monitoring/controllers/base/kube-prometheus-stack/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Namespace is specified in each file in this case due to an issue with the RoleBinding
+# namespace: monitoring
+resources:
+  - grafana-auth-secret.yaml
+  - kube-prometheus-stack.yaml
+  - cm/
+configurations:
+  - kustomizeconfig.yaml

components/monitoring/controllers/base/kustomization.yaml

@@ -5,9 +5,3 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - rbac.yaml
-  - grafana-auth-secret.yaml
-  - kube-prometheus-stack.yaml
-  - metrics-server.yaml
-  - cm/
-configurations:
-  - kustomizeconfig.yaml

components/monitoring/controllers/base/metrics-server/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Namespace is specified in each file in this case due to an issue with the RoleBinding
+# namespace: monitoring
+resources:
+  - metrics-server.yaml

components/monitoring/controllers/base/metrics-server/metrics-server.yaml

@@ -10,7 +10,7 @@ spec:
     mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
     operation: copy
   ref:
-    tag: "3.13.0" # {"$imagepolicy": "flux-system:metrics-server:tag"}
+    tag: "3.14.0" # {"$imagepolicy": "flux-system:metrics-server:tag"}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease

components/monitoring/controllers/base/rbac.yaml

@@ -9,22 +9,6 @@ metadata:
     toolkit.fluxcd.io/tenant: platform-team
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: monitoring
-    toolkit.fluxcd.io/tenant: platform-team
-  name: flux-monitoring
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: flux
-    namespace: monitoring
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
@@ -42,6 +26,52 @@ subjects:
   namespace: monitoring
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:metrics-server
+  labels:
+    app.kubernetes.io/component: monitoring
+    toolkit.fluxcd.io/tenant: platform-team
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "nodes/stats", "nodes/log", "services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["nodes/metrics"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-server-subjectaccessreview
+rules:
+- apiGroups: ["authorization.k8s.io"]
+  resources: ["subjectaccessreviews"]
+  verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: monitoring
+    toolkit.fluxcd.io/tenant: platform-team
+  name: flux-monitoring
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: flux
+    namespace: monitoring
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
@@ -56,3 +86,17 @@ subjects:
 - kind: ServiceAccount
   name: metrics-server
   namespace: monitoring
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-server-subjectaccessreview-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: metrics-server-subjectaccessreview
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: monitoring

components/monitoring/controllers/dev-amd64/kustomization.yaml

@@ -2,6 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - ../base/metrics-server
+  - ../base/kube-prometheus-stack
 patches:
   - patch: |
       - op: replace

components/monitoring/controllers/dev-arm64/kustomization.yaml

@@ -2,14 +2,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 
   - ../base/
-patches:
-  - patch: |
-      - op: replace
-        path: /spec/values/prometheus/prometheusSpec/retention
-        value: 24h
-    target:
-        kind: HelmRelease
-        name: kube-prometheus-stack
+  - ../base/metrics-server
+  
+# patches:
+#   - patch: |
+#       - op: replace
+#         path: /spec/values/prometheus/prometheusSpec/retention
+#         value: 24h
+#     target:
+#         kind: HelmRelease
+#         name: kube-prometheus-stack
 # Remove subcomponent based on environment
 #  - patch: |
 #      $patch: delete

components/networking/configs/base/cilium/.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: ip-pool.yaml$
+    encrypted_regex: "^(spec)$"
+    age: 
+      - age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq

components/networking/configs/base/cilium/ip-pool.yaml

@@ -1,8 +1,47 @@
-apiVersion: "cilium.io/v2"
+apiVersion: cilium.io/v2
 kind: CiliumLoadBalancerIPPool
 metadata:
-  name: "1st-pool"
+    name: 1st-pool
 spec:
     blocks:
-  - start: "192.168.0.10"
-    stop: "192.168.0.19"
+        - start: ENC[AES256_GCM,data:26y0zfU3PAIY3X56,iv:bZhfz8YbxzOdRlYyo8djYhAbLVT4tZr86sch5LuUwS8=,tag:qd09uoW/55qdory1H9JqMw==,type:str]
+          stop: ENC[AES256_GCM,data:1ncnUkw+V2sqiJXt,iv:RT9RCMXD5fWn9XAaHA2XTsdYcd0E2x9R8X3dgr3n6cI=,tag:ljeCi0OHNIbYkNJinJQ/Og==,type:str]
+sops:
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNdC9kNThXR1pYNXdndSsr
+            amVxdEZYQjV6WjV6Q01lWHVlMUtUVjRQMGhBClRCK1ljaDFiQnhacXJ1RXIrUlVY
+            enJ5T0taQTdDSkRqaGF6K0p3NlI1RGsKLS0tIEUzUVdtV2orek9OUVFSbzltajMv
+            UFFyMUpQREhSbTZEYWtUa0M1Mkk3WE0KlQrgJjFa7z3WkRfiQGQLwuD9vh7vqsAR
+            wLGPL4Xmz5MTL6/FScij3lZJBlm+4Tn2/VLznuJATIT+rgD9V56IRQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-01T15:46:05Z"
+    mac: ENC[AES256_GCM,data:RFrfcBBUIKaB1ALiMP0OO1tUTu457FxMqVL4vYkLPrLnMhcgCN/oyTp6mxVNxzMMr0gH0wLUy5iZao9Qjjy8MvmPuD9TxXwZXtXwb2dnRK6SzzGHNYJ2glV9Pktp7s1seeg9uImMExp8kHjs/j9mMNZFz05CGOjYU25B7I7Go6I=,iv:Uw4u+sOIZ0he3r16peODlkNd+oDFexlCdNUUIEQNRgY=,tag:uG89R6DqqScbalEJQmhumw==,type:str]
+    encrypted_regex: ^(spec)$
+    version: 3.11.0
+---
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+    name: default-l2-announcement-policy
+    namespace: kube-system
+spec:
+    externalIPs: ENC[AES256_GCM,data:UbMC+w==,iv:JcLNojC5qSRmDQgDtlWSMCl2KQCSASxtOb7+ZapKjY4=,tag:SpoUA20u3MszDUj79tUXqw==,type:bool]
+    loadBalancerIPs: ENC[AES256_GCM,data:ypiEtQ==,iv:CZna6f6TeW1W8kjDQFE5lYBMAam2n58iNyByMnUQu10=,tag:w2AVMVc7bxWU3W3g7oHO/w==,type:bool]
+sops:
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNdC9kNThXR1pYNXdndSsr
+            amVxdEZYQjV6WjV6Q01lWHVlMUtUVjRQMGhBClRCK1ljaDFiQnhacXJ1RXIrUlVY
+            enJ5T0taQTdDSkRqaGF6K0p3NlI1RGsKLS0tIEUzUVdtV2orek9OUVFSbzltajMv
+            UFFyMUpQREhSbTZEYWtUa0M1Mkk3WE0KlQrgJjFa7z3WkRfiQGQLwuD9vh7vqsAR
+            wLGPL4Xmz5MTL6/FScij3lZJBlm+4Tn2/VLznuJATIT+rgD9V56IRQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-01T15:46:05Z"
+    mac: ENC[AES256_GCM,data:RFrfcBBUIKaB1ALiMP0OO1tUTu457FxMqVL4vYkLPrLnMhcgCN/oyTp6mxVNxzMMr0gH0wLUy5iZao9Qjjy8MvmPuD9TxXwZXtXwb2dnRK6SzzGHNYJ2glV9Pktp7s1seeg9uImMExp8kHjs/j9mMNZFz05CGOjYU25B7I7Go6I=,iv:Uw4u+sOIZ0he3r16peODlkNd+oDFexlCdNUUIEQNRgY=,tag:uG89R6DqqScbalEJQmhumw==,type:str]
+    encrypted_regex: ^(spec)$
+    version: 3.11.0

components/networking/configs/base/cilium/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kube-system
-resources: []
+resources:
+  - ip-pool.yaml

components/networking/configs/base/metal-lb/.sops.yaml

@@ -1,5 +1,5 @@
 creation_rules:
-  - path_regex: metal-lb-ip-pool.yaml$
+  - path_regex: ip-pool.yaml$
     encrypted_regex: "^(spec)$"
     age: 
       - age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq

components/networking/configs/base/metal-lb/ip-pool.yaml

@@ -5,20 +5,20 @@ metadata:
     namespace: metallb-system
 spec:
     addresses:
-        - ENC[AES256_GCM,data:tP4f/TFwbAcdAr2Gb+S4oKXvwKPJOYwIy5ve,iv:ouTd5THMWaVBkQJtNK7zRUupZu0jeQ66qblE9YRXnuU=,tag:xG7f0R0RPzYh04p18m+/FQ==,type:str]
+        - ENC[AES256_GCM,data:2JfDDPBooVrhzSfhmi3XbSX5S+7WharHng3z,iv:nVd3gY5hGufg9nC+NOEITuk/A51LSfVW3m17tKaaWdE=,tag:GR+//ceTKR4+DApaQokp+w==,type:str]
 sops:
     age:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdDZzb3NRSlJPUW92dnZE
-            emUrUE1LYklYSUpGYVcycUZUaHZaKzNJRm1ZCkFLVjFtVmNFRVphTUFuYmVBWEth
-            U01YZ0laZmF5WHFiOXN1WlB5YmYyVGsKLS0tIEZNd2dmZTZ3a2NXS3haTnk0NlpS
-            N3lVSC9oKzN0eU9Fa0NDMTY2QTl2ckUKTFKY8eIXReEM+L/sE8Y+T7/vZQkaP2Rn
-            c8AAbozJRwuWNQ7yJu1Kva9mj8TNaHi+HrPTYnHAoSOQakoOVO7j6g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCekpuOTNjSWVNcUozK01p
+            a2FOcHloaUV1c0RxRXBLS2hUcktQZFl0emg4CjlJcWh0NEdNQTV2eW4xbzNYMndt
+            U0dqRS9qcTFsV3dpY045OFhLcHZKQWMKLS0tIGJkVCtzak5mNktpUzV5aGovdEdK
+            K1d3MHlpb05LMkpDOXJMUVJ3aTNKdlUKUgpj2JO9yhoa3DONXp3891sIBW8pgOHD
+            +fFhYp4c0e6prTrt5Gy/sg/iz/Rw/iK5CM+g63bCDOZynpb5pN2R6Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-29T15:32:48Z"
-    mac: ENC[AES256_GCM,data:1L/aBWL8/lY4DpCBihvpw2Gb8mtMNvSCQKeH99yEVWtDcijtXeTcTOXQWNjclyNrM6ChceWJKdFoGTPR2RiSk4zthcqqUPMzypRGXKY/F82zFahaINrRzdAVx6il0GuPBeOhxdbIub0+gWFnHJCosBh4q+n/6/C8c7ekWP7b3CI=,iv:slTOpas98PPMR5PRyeLTh5PoAA7OAArVtTYQg0Rduj8=,tag:9ixYDvqfoMi9gPHOorgH5g==,type:str]
+    lastmodified: "2026-02-01T15:46:17Z"
+    mac: ENC[AES256_GCM,data:HAoc9WYqp8zuZWKPOPpw8VlR7/zA5ZYkbFBfeghYFlOWnv05EiBdICCb41VTnKyhjFz+Vaizv+DGxfhtrF1BK8Vvk1R8YGeSoAyCCgtnmYZVSzSZIgUeWcXchhQbBlY13drJq4q26arEmXr0u0Wb18dSn2TX8p4XAV6zKTBKbdU=,iv:e6cP6YDYaHrHK9RndftopffeMcsIsVC9eLEALT3FKwc=,tag:03wX0WC0VnQ/hVSp629FBw==,type:str]
     encrypted_regex: ^(spec)$
     version: 3.11.0
 ---
@@ -29,19 +29,19 @@ metadata:
     namespace: metallb-system
 spec:
     ipAddressPools:
-        - ENC[AES256_GCM,data:e2KiGNLv2BY=,iv:kd6NWV8M3yuV8+NALCH6AQLBswxiigklY+SsRlL3m0A=,tag:eM9KMcehxPo7j7cdIUSmsA==,type:str]
+        - ENC[AES256_GCM,data:Zq/dneuU9TU=,iv:ndq1ZId44lKMM0miSjY3SxrcmGh5YsFydMNeCDY7mKs=,tag:hS+DeXKNJqSjX3bmdwzkKA==,type:str]
 sops:
     age:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdDZzb3NRSlJPUW92dnZE
-            emUrUE1LYklYSUpGYVcycUZUaHZaKzNJRm1ZCkFLVjFtVmNFRVphTUFuYmVBWEth
-            U01YZ0laZmF5WHFiOXN1WlB5YmYyVGsKLS0tIEZNd2dmZTZ3a2NXS3haTnk0NlpS
-            N3lVSC9oKzN0eU9Fa0NDMTY2QTl2ckUKTFKY8eIXReEM+L/sE8Y+T7/vZQkaP2Rn
-            c8AAbozJRwuWNQ7yJu1Kva9mj8TNaHi+HrPTYnHAoSOQakoOVO7j6g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCekpuOTNjSWVNcUozK01p
+            a2FOcHloaUV1c0RxRXBLS2hUcktQZFl0emg4CjlJcWh0NEdNQTV2eW4xbzNYMndt
+            U0dqRS9qcTFsV3dpY045OFhLcHZKQWMKLS0tIGJkVCtzak5mNktpUzV5aGovdEdK
+            K1d3MHlpb05LMkpDOXJMUVJ3aTNKdlUKUgpj2JO9yhoa3DONXp3891sIBW8pgOHD
+            +fFhYp4c0e6prTrt5Gy/sg/iz/Rw/iK5CM+g63bCDOZynpb5pN2R6Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-29T15:32:48Z"
-    mac: ENC[AES256_GCM,data:1L/aBWL8/lY4DpCBihvpw2Gb8mtMNvSCQKeH99yEVWtDcijtXeTcTOXQWNjclyNrM6ChceWJKdFoGTPR2RiSk4zthcqqUPMzypRGXKY/F82zFahaINrRzdAVx6il0GuPBeOhxdbIub0+gWFnHJCosBh4q+n/6/C8c7ekWP7b3CI=,iv:slTOpas98PPMR5PRyeLTh5PoAA7OAArVtTYQg0Rduj8=,tag:9ixYDvqfoMi9gPHOorgH5g==,type:str]
+    lastmodified: "2026-02-01T15:46:17Z"
+    mac: ENC[AES256_GCM,data:HAoc9WYqp8zuZWKPOPpw8VlR7/zA5ZYkbFBfeghYFlOWnv05EiBdICCb41VTnKyhjFz+Vaizv+DGxfhtrF1BK8Vvk1R8YGeSoAyCCgtnmYZVSzSZIgUeWcXchhQbBlY13drJq4q26arEmXr0u0Wb18dSn2TX8p4XAV6zKTBKbdU=,iv:e6cP6YDYaHrHK9RndftopffeMcsIsVC9eLEALT3FKwc=,tag:03wX0WC0VnQ/hVSp629FBw==,type:str]
     encrypted_regex: ^(spec)$
     version: 3.11.0

components/networking/controllers/base/cilium/cilium.yaml

@@ -37,6 +37,10 @@ spec:
     k8sServiceHost: localhost
     k8sServicePort: 7445
     kubeProxyReplacement: true
+    l2announcements:
+      enabled: true
+    externalIPs:
+      enabled: true
     securityContext:
       capabilities:
         ciliumAgent:

components/networking/controllers/base/cilium/kustomization.yaml

@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kube-system
 resources: 
-  - rbac.yaml
   - cilium.yaml
 

components/networking/controllers/base/ingress-nginx/ingress-nginx.yaml

@@ -0,0 +1,30 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+  namespace: kube-system
+spec:
+  interval: 12h
+  type: default
+  url: https://kubernetes.github.io/ingress-nginx
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: kube-system
+spec:
+  serviceAccountName: flux
+  interval: 1h
+  chart:
+    spec:
+      version: 4.12.2
+      chart: ingress-nginx
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+      interval: 12h
+  values:
+    controller:
+      config:
+        strict-validate-path-type: "false"

components/networking/controllers/base/ingress-nginx/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress-nginx.yaml

components/networking/controllers/base/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rbac.yaml

components/networking/controllers/base/rbac.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     app.kubernetes.io/component: networking
     toolkit.fluxcd.io/tenant: platform-team
-  name: flux-security
+  name: flux-networking
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

components/networking/controllers/dev-amd64/kustomization.yaml

@@ -1,4 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 
+  - ../base
   - ../base/cilium
+  - ../base/ingress-nginx

components/networking/controllers/dev-arm64/kustomization.yaml

@@ -1,4 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 
+  - ../base
   - ../base/metal-lb
+  - ../base/ingress-nginx

components/security/configs/base/.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: cert-manager-issuers.yaml$
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    age: 
+      - age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq

components/security/configs/base/cert-manager-issuers.yaml

@@ -1,31 +1,30 @@
----
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
     name: letsencrypt-staging
 spec:
     acme:
-        email: ENC[AES256_GCM,data:n3PMXRaaOw3mHTE+,iv:AdKUp2cgIs6/4wM2n2WXI9xZ1dPzzrPQhtRgsOaI2Ug=,tag:x74U/+A85Z5v3N7zCEAdMw==,type:str]
-        server: ENC[AES256_GCM,data:LHJVbmwjg8iwAKE2yR46R/hivMKCvQGI8HHTnROjPMtUdpiMyoGXslJeck89/qVdW6hgTBGb,iv:8uCZu9xWblgu7sRWvVP1i6q+YRQFLHZffL/XJGCmcpg=,tag:PJdmgsDtwkK5CmA3r7AW5A==,type:str]
+        email: ENC[AES256_GCM,data:YqOjX7qe1wmEPl7c,iv:fjKZIy4P9LhOeQEa2jbzAX6FBqEPq3Cz0lz14h2jOyg=,tag:qdY9y8ouPl2AbHWkDWfbDA==,type:str]
+        server: ENC[AES256_GCM,data:LCgLx35YyViA47qKsY8q3+70jSRkMHfs7INxrzL19NPQ3ePGeeZiCAp789/6EOTxQRHJQDSS,iv:ooe5aF7rwdFsix3WSbcb2ZmkAE8boDC4FrYZ7lS3EY4=,tag:cIyWhlnHAXM40CiTwYLTwA==,type:str]
         privateKeySecretRef:
-            name: ENC[AES256_GCM,data:Vg4c9Mu5V159/QXz2I3qe45cTQ==,iv:aUvbj+Kx3VmDmxx+QWIjpfo3C4Nc08phZhQwWpfNE88=,tag:90ey7W5TL2G+hPtEG3THZw==,type:str]
+            name: ENC[AES256_GCM,data:S6lMfFyxX+OIwoIzLd31S0HUqg==,iv:jpBGHY8Fnko4gDrhemr8p+x3lFojd/DVGLrXPXUZkME=,tag:IyePts+acrcVAuNZwF9dEQ==,type:str]
         solvers:
             - http01:
                 ingress:
-                    class: ENC[AES256_GCM,data:zIu3D/s=,iv:+Uv62H9i0VGkSufnt3cjjX4VBvr6ONo6tvQzH6r8BxU=,tag:pY57Mbuyg/wwzCTkLoFx4A==,type:str]
+                    class: ENC[AES256_GCM,data:scHkNT0=,iv:B9X58ltjN69bNQt4pW4MDCwwH3fEGQ6VoPTPcTZY528=,tag:RzCVgfJi/H8KbkV46WLIOw==,type:str]
 sops:
     age:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa1B0c2F2TG85RUZqVkRu
-            RmpYY1d4Rm01NlJPZlVHcDQ1cEl3ZzR3OENBClgzTXAwdDJuZTJ3dGF0N3hzVXJY
-            VkZEdENaMForSVFIbTg2YmVGelhBMncKLS0tIEJtTmFvKzNYRHEyZk94cGMrTnF6
-            ZTVLMnBudHVqTzB4eUNrQXBid0c1SUEKEMhX2k0MNYt5rrgMRy3QTIOiIuP0lwJ7
-            2Pyg7kj2RTQu2plwRZBNzQ2kBfCBkx06MBaJASHHsBQIPUZhtMLelA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVRzFWM2g3bGE4Mkpqb280
+            RWRucytlbmt6a0doZU1wditHRU81RFhjamdjCkt5UTBtY1pKQjRKN3lqOXlnR2d2
+            S1RlTHQrOWFGMVZDcVpyRmZYbEFBcUUKLS0tIEJIVjVGUE81R0JJZ1lncGo1NEk0
+            VS9IZ3VJQlVLNTJwOFNNKy9WZ2c4czgKysx7Jg41wa7VZumU10Xxt8mVTUcef5ya
+            h0Nuxr+3IOGlLvLy417ik6OpM8CqbMbAGWaLSN7YyS0tRIOAn88y/g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-15T23:47:15Z"
-    mac: ENC[AES256_GCM,data:B1opGlOCwM0nCFRWLdpteNuCAb06emGf0I0KKOhlNh0u36DTr1aVRzGV57sJRi8b4rSwPBucP2WzIKFAHY5yKincGdHwPwQ40dun0TreaJrtXiJagz19n2nqc2vZfzlE9G8QdG6Bnos17UaB5b+I5dWYlz1XM8oYOk0pdzrCGas=,iv:fuC+7nKNxHfn+Q7psFQmweRIUFzIcBuZN3rESFmnJL0=,tag:IEVeHB4Kol9GNHJOolamRA==,type:str]
+    lastmodified: "2026-02-01T15:44:55Z"
+    mac: ENC[AES256_GCM,data:e9P3FsxkSJurAjgSbjqiIBEAKMUTNIvdO1mgs/pmPpLnTHRoO3dWWtksKRv2mk2SbFy9/QZ/iV5acBtCxobS+vQBIjOqQwY+0BpbcGTcrqEUPAQ7IylyNoJnTMXkalkRvkz4zdVPixT3Zu6jErcSjbG7uxBG1AHhIGPX3WBT0Sc=,iv:W77bGAYFfW9XkWlgY1QoG29o9t1y6pZ996pdj3VdsME=,tag:T1RHeXfZdkBlykEWBEGZcA==,type:str]
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.11.0
 ---
@@ -35,26 +34,26 @@ metadata:
     name: letsencrypt-prod
 spec:
     acme:
-        email: ENC[AES256_GCM,data:WROzrrll22ZOAA4i,iv:6c6oni+U4kJO7wKSPVmnkvIyesYR/vYvK0qTY/9RslQ=,tag:d4thMfoyWRU8kPOCaptTng==,type:str]
-        server: ENC[AES256_GCM,data:hr4tgxj0GJM9oKaMaUjqUBdWByhOwYAQaavPiIYO/vVthmTTG6BY5/5iWa/xMA==,iv:hkuwiVGelzxSeIEBHNpe1tFQm1LjpiQIPfC2hliMQLg=,tag:b9sN3ffRKq9/y+QuBkl0og==,type:str]
+        email: ENC[AES256_GCM,data:Dh5rc5Wak2MnQqR7,iv:uLmnMlYhjg1X91vwfIHdubVV61u/3tQGKaquIEG2p1k=,tag:vLEWQ6pP6goAwKE5R06uqg==,type:str]
+        server: ENC[AES256_GCM,data:gMaHtIORxKiv6WuLDygFvr8GhMjbqW6NWqWZSTCLoSi6cQaULD3/j1l30A9IPQ==,iv:mPOqGFikZGsqT6widt0EIc3KXreZXApuZtdjXBK7HuE=,tag:iJLVIOiOd7iwIyjDIRa1vA==,type:str]
         privateKeySecretRef:
-            name: ENC[AES256_GCM,data:6euJ7/Fiu/4DcLY0CK4f3g==,iv:9hLzhVY7/3uWXKrfgvXAOXudgGMc11JiDFuDD297WvY=,tag:ujjexmTBX7PtClg3iGsaCw==,type:str]
+            name: ENC[AES256_GCM,data:ece7iyTmT7hq5+x1bN225g==,iv:xV0B2Q4ZOwl2itYAtenk/P+9LtJNV2ojuUSXp388Uc0=,tag:uEmv9aKXGTpjr2+HvDgNpA==,type:str]
         solvers:
             - http01:
                 ingress:
-                    class: ENC[AES256_GCM,data:6xOo5yo=,iv:g1GO+PME54KZNzrf1mZC+0G8aw+XJ1CEw+i8NakqVPM=,tag:NaIyYrnJOMPsLdoNBCqMFQ==,type:str]
+                    class: ENC[AES256_GCM,data:HIwSVYg=,iv:suD5+sQF4uOsWyr/C7RaG+WXuFf38kh2XHKulAxbcPU=,tag:wgT4E5/2Zpn1fETnu0zWpw==,type:str]
 sops:
     age:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSGhmM2F4Y0VSRzhWSWRX
-            cU95OGFNRUxNM1FucTBVOFlpUHdBbFIwSWs0ClZvblN0OGtSbWdSZ0RUTVZHV3FK
-            QW9mck9TOWt4ejdiT0ZHak9BdWlnemMKLS0tIHpNNUh3b0NFNlBQckZQZzc4cVgx
-            ais3c3orMDcxbjlIUnZlbEZyVVZUTTQKbOMIUUOKX4b3qDsQhrkqWpsuJcSISc9R
-            Zg3Y5Ph5iJxrxmftDA4rxl0WFfGhI67JCTKPDpN0Dzfm663eMnKe1g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVRzFWM2g3bGE4Mkpqb280
+            RWRucytlbmt6a0doZU1wditHRU81RFhjamdjCkt5UTBtY1pKQjRKN3lqOXlnR2d2
+            S1RlTHQrOWFGMVZDcVpyRmZYbEFBcUUKLS0tIEJIVjVGUE81R0JJZ1lncGo1NEk0
+            VS9IZ3VJQlVLNTJwOFNNKy9WZ2c4czgKysx7Jg41wa7VZumU10Xxt8mVTUcef5ya
+            h0Nuxr+3IOGlLvLy417ik6OpM8CqbMbAGWaLSN7YyS0tRIOAn88y/g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-15T23:47:15Z"
-    mac: ENC[AES256_GCM,data:pUXu12zIDvUG1+Qfu2gvYmnLfSMNAl3DU4Z1ZPIYVBg0XX6btEyO8o9TXssoG6efIH+FrMkNVj41BMIdJnp12zcjMyUcD9GKvlJIYQla59uy/XBVArgvgYF8iBaz6PfzTFVYPUoP2WPi7Q9L3w12jsw1wRyEpYshAFtVJxtvhCg=,iv:o9oatVlXBl682FYCnFbqcNxQ0sKLlj2qI4m1k1seVKE=,tag:t46aEUU7RWHA/vPTFPinew==,type:str]
+    lastmodified: "2026-02-01T15:44:55Z"
+    mac: ENC[AES256_GCM,data:e9P3FsxkSJurAjgSbjqiIBEAKMUTNIvdO1mgs/pmPpLnTHRoO3dWWtksKRv2mk2SbFy9/QZ/iV5acBtCxobS+vQBIjOqQwY+0BpbcGTcrqEUPAQ7IylyNoJnTMXkalkRvkz4zdVPixT3Zu6jErcSjbG7uxBG1AHhIGPX3WBT0Sc=,iv:W77bGAYFfW9XkWlgY1QoG29o9t1y6pZ996pdj3VdsME=,tag:T1RHeXfZdkBlykEWBEGZcA==,type:str]
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.11.0

components/security/controllers/base/cert-manager.yaml

@@ -26,6 +26,8 @@ spec:
       interval: 12h
   install:
     crds: Create
+  upgrade:
+    crds: CreateReplace
   values:
     crds:
       enabled: true

components/storage/configs/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: storage
+resources: []
+

components/storage/configs/base/longhorn/ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: longhorn-ingress
+  namespace: stprage
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: longhorn.k8s.local
+    http:
+      paths:
+      - backend:
+          service:
+            name: longhorn-frontend
+            port:
+              number: 80
+        path: /
+        pathType: Prefix

components/storage/configs/base/longhorn/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: storage
+resources: 
+  - ingress.yaml

components/storage/configs/dev-amd64/ingress-patch.yaml

@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/rules/0/host
+  value: longhorn-amd64.k8s.local

components/storage/configs/dev-amd64/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - ../base/longhorn
+
+patches:
+ - target:
+      group: networking.k8s.io
+      version: v1
+      kind: Ingress
+      name: longhorn-ingress
+   path: ingress-patch.yaml

components/storage/configs/dev-arm64/ingress-patch.yaml

@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/rules/0/host
+  value: longhorn-arm64.k8s.local

components/storage/configs/dev-arm64/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base/longhorn
+
+
+patches:
+ - target:
+      group: networking.k8s.io
+      version: v1
+      kind: Ingress
+      name: longhorn-ingress
+   path: ingress-patch.yaml

components/storage/controllers/base/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: storage
+resources: 
+  - namespace.yaml
+  - rbac.yaml
+

components/storage/controllers/base/longhorn/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: storage
+resources: 
+  - longhorn.yaml

components/storage/controllers/base/longhorn/longhorn.yaml

@@ -0,0 +1,37 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: storage
+spec:
+  interval: 1h
+  url: https://charts.longhorn.io
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: storage
+spec:
+  serviceAccountName: flux
+  interval: 15m
+  timeout: 1h
+  chart:
+    spec:
+      chart: longhorn
+      version: "v1.10.1 " # {"$imagepolicy": "flux-system:longhorn:tag"}
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+      interval: 5m
+  install:
+    crds: Create
+    timeout: 9m
+    remediation:
+      retries: 3
+  upgrade:
+    crds: CreateReplace
+    timeout: 9m
+    remediation:
+      retries: 3
+

components/storage/controllers/base/namespace.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: storage
+  labels:
+    app.kubernetes.io/component: storage
+    toolkit.fluxcd.io/tenant: platform-team
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

components/storage/controllers/base/nfs/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: storage
+resources: 
+  - nfs-subdir-external-provisioner.yaml

components/storage/controllers/base/nfs/nfs-subdir-external-provisioner.yaml

@@ -0,0 +1,40 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: nfs-subdir-external-provisioner
+  namespace: storage
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-subdir-external-provisioner
+  namespace: storage
+spec:
+  serviceAccountName: flux
+  interval: 15m
+  timeout: 1h
+  chart:
+    spec:
+      chart: nfs-subdir-external-provisioner
+      version: "v4.0.2" # {"$imagepolicy": "flux-system:nfs-subdir-external-provisioner:tag"}
+      sourceRef:
+        kind: HelmRepository
+        name: nfs-subdir-external-provisioner
+      interval: 5m
+  install:
+    crds: Create
+    timeout: 9m
+    remediation:
+      retries: 3
+  upgrade:
+    crds: CreateReplace
+    timeout: 9m
+    remediation:
+      retries: 3
+  valuesFrom:
+    - kind: Secret
+      name: nfs-provisioner-config
+      valuesKey: values.yaml

components/storage/controllers/base/rbac.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: storage
+    toolkit.fluxcd.io/tenant: platform-team
+  name: flux-storage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: flux
+    namespace: storage
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flux
+  namespace: storage
+  labels:
+    app.kubernetes.io/component: storage
+    toolkit.fluxcd.io/tenant: platform-team

components/storage/controllers/dev-amd64/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - ../base
+  - ../base/nfs
+  - ../base/longhorn
+secretGenerator:
+  - name: nfs-provisioner-config
+    namespace: storage
+    files:
+      - values.yaml=./nfs/nfs-config.yaml
+generatorOptions:
+  disableNameSuffixHash: true

components/storage/controllers/dev-amd64/nfs/.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: nfs-config.yaml$
+    encrypted_regex: "^(nfs)$"
+    age: 
+      - age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq

components/storage/controllers/dev-amd64/nfs/nfs-config.yaml

@@ -0,0 +1,18 @@
+nfs:
+    path: ENC[AES256_GCM,data:/S0Ftz6vCdks3/F+rWuXUZDvFiTLRK1TmyFENAHbeA==,iv:meEuItTApBJkySX5kF+huTn/4Xq5Z7XyW23WWysXoKY=,tag:o1tMrcOQQVIahDzHiWcp0A==,type:str]
+    server: ENC[AES256_GCM,data:p7TOX8WZ6hBPaKw=,iv:BlcJgNSs+O5hg98pyF6xKql5/NzzYfxK2dIF0PkUItk=,tag:Vk9zzf68+1OWSm0XYngBDQ==,type:str]
+sops:
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3aklEYXg4VTFLb2xMaC9Y
+            MFRXdzR3b3ErNW9XWjF3azM0QnBVVjRJQkJBCmFsMC9DSnZoZDFWQ0JCd1ZyVDVH
+            UVFCMStSYzNiOGl5NjAyb0s5Y000cDgKLS0tIGFSRDRxcFVTdGFOOW95SXNmUDVH
+            bnRJbEVQa3JhdGx2Qk4xUHlSWGVwREEKCjmPc7nlKLdp0EDYPm6N7ICqf+Cg7Ymx
+            Y20aAzqMdBIucNhMxUFeh4XJVwZTi4JcP2Aylhn2LLb1wz6JZiGpMg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-06T15:24:24Z"
+    mac: ENC[AES256_GCM,data:8U6W37XVWjTfYdHVVk6Xd7XxKUIgsCyWBNmM5r4ICA/a4nYFP6P8IfAgT9WysrTWHQHdfHqAx8pYp4kpJ6RS25t4WVj8/828FeguyjaJNJnBpxJYy0piAFGKwghwD5Ba11L0znaaA4FY7/2nEeWQZEaJmX0RG2UIxC25ZIGV2Fk=,iv:TTJXiJkmUW7ddbv8lUUljDALG6nuwBayavDo76myVlI=,tag:lTg1yaQa6VbV5pq6E9CB+w==,type:str]
+    encrypted_regex: ^(nfs)$
+    version: 3.11.0

components/storage/controllers/dev-arm64/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - ../base
+  - ../base/nfs
+  - ../base/longhorn
+secretGenerator:
+  - name: nfs-provisioner-config
+    namespace: storage
+    files:
+      - values.yaml=./nfs/nfs-config.yaml
+generatorOptions:
+  disableNameSuffixHash: true

components/storage/controllers/dev-arm64/nfs/.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: nfs-config.yaml$
+    encrypted_regex: "^(nfs)$"
+    age: 
+      - age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq

components/storage/controllers/dev-arm64/nfs/nfs-config.yaml

@@ -0,0 +1,3 @@
+nfs:
+    path: /mnt/kingston-ssd-nfs/dev-arm64
+    server: 192.168.0.4

update/kube-prometheus-stack.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: kube-prometheus-stack
+spec:
+  image: "ghcr.io/prometheus-community/charts/kube-prometheus-stack"
+  interval: 1h
+  provider: generic
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: kube-prometheus-stack
+spec:
+  imageRepositoryRef:
+    name: kube-prometheus-stack
+  policy:
+    semver:
+      range: ">=79.4.0"

update/kustomization.yaml

@@ -3,3 +3,6 @@ kind: Kustomization
 namespace: flux-system
 resources:
   - kyverno.yaml
+  - metrics-server.yaml
+  - kube-prometheus-stack.yaml
+  - nfs-subdir-external-provisioner.yaml

update/nfs-subdir-external-provisioner.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: nfs-subdir-external-provisioner
+spec:
+  image: "gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner"
+  interval: 1h
+  provider: generic
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: nfs-subdir-external-provisioner
+spec:
+  imageRepositoryRef:
+    name: nfs-subdir-external-provisioner
+  policy:
+    semver:
+      range: ">=4.0.2"