Added monitoring with Prometheus Kube stack and instructions for setting it up with Helm; WIP - need to create targeted SOPS encrypt/decrypt scripts to prevent all files showing as modified in Git history when I decrypt/encrypt the entire directory

k3s/rpi/dev-stuff/portainer-ce/portainer-password-reset-pod.yaml

@@ -5,15 +5,15 @@ metadata:
     namespace: portainer
 spec:
     volumes:
-        - name: ENC[AES256_GCM,data:iZ3pLQ==,iv:WZy9LoNRXhxhWrSamhv/qVIglwmReOB9qVPOEWQQ+3Y=,tag:fMfyt1xtfuBk+dOymo0IkQ==,type:str]
+        - name: ENC[AES256_GCM,data:MvwQMA==,iv:QlDoLv9yNQDg+gckPLUt5XLSE+INuNr/7zsBnG0rzPw=,tag:JaqhAzftYkcoQ35yKeHzdA==,type:str]
           persistentVolumeClaim:
-            claimName: ENC[AES256_GCM,data:t/Qn/XyXo26Y,iv:KemBYop0KbJbp27c4Gi+U5d3EUi4Rgz826hBHWBGj/A=,tag:pb4SN99bhqs0iUfooTqbKA==,type:str]
+            claimName: ENC[AES256_GCM,data:/cRbddXcBHP4,iv:/kZ3syUaFLmMBKmjHgqcgkZunAZvvBSfhjzyKl1esQQ=,tag:8QX9w6tLMSU/dWF2NbfPtg==,type:str]
     containers:
-        - name: ENC[AES256_GCM,data:YrI9Z1t9h+S5,iv:jJFLChbCOWOArryDlrN8hdrv/VpQNsNZpY9FOM/rNlc=,tag:JGxjHKcCuldz6Cq1xkdbsw==,type:str]
-          image: ENC[AES256_GCM,data:EpcyH4RdcPR8Jojt6BzYfAdu1D5aUbBL/85thoSYFw==,iv:MbF9TGmyu8A17Hm3c1QaP555hVJrF2YdDlucHh75p+s=,tag:92cZ23WZMb0h5uI9QhJanA==,type:str]
+        - name: ENC[AES256_GCM,data:9MHS+pQGUPjW,iv:KHDKHLy2zLhdefwM8ajwHAjGDvLKj432NTCHr1sOlrA=,tag:QOB9+7Fq2ciXUbiimselVA==,type:str]
+          image: ENC[AES256_GCM,data:zfhne7N9k0FRUQghjxiOdeJ9LZVU0jrqhcxNE7r5lA==,iv:OTdwUaHKLjMcqoCg8Ql3R9Xst6+Xz6OghwT573DI29E=,tag:quHRPedcAOrxvxz4LG2sGg==,type:str]
           volumeMounts:
-            - mountPath: ENC[AES256_GCM,data:SUo0x1Y=,iv:XDRL/3K9Fto8DhiR4+3H5v124x59cykC4BHPh16oF6s=,tag:xgVKDXmmdpScYVZGAokllw==,type:str]
-              name: ENC[AES256_GCM,data:9x2V+g==,iv:EFhCYphUxXveGQExpOQ/PBmm0hxfGmCzW3ZFTIBhq6c=,tag:EanYfK4qXmjsnVqkW14UjQ==,type:str]
+            - mountPath: ENC[AES256_GCM,data:RhkYtrQ=,iv:ML0clC/twxgvueRgoBZBWuV2USvqu9ygZd3/FOZYf+4=,tag:a7w4qvALPUcG+itMSaeq7Q==,type:str]
+              name: ENC[AES256_GCM,data:DBuSEA==,iv:n9NZVOSp+7ylO5pk1ka4Cq3ha7jw6DLR8sJOK9wJC2g=,tag:hRI4aqPjfcxMBcS4i6K6Sw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -23,14 +23,14 @@ sops:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSHQ0cGpDZlNaVDZ3NFZB
-            blZEVnM0cFVVaDNmWTVkcyswMXlGWmI1L1NjCnlLNDdwYVUzMW1zc05xRmgrUlFR
-            Y2lsandCSDM5S2NkNVJ0ZVZyS1J1NjQKLS0tIDFzOTRnM2NjdjlwL2MwSVRPTGZP
-            dDRabTlHdkNBQ0VEMjdZYUhMby9yUXMKaSLB8adhd4YF/alrRt6+hHSn2Vhl+0NF
-            wivSp+cjjCTBF3dP0NEM/ctjNY724WicMyzYFmEDgWrDNiyfXf/tBg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqb1RrK0FSNDRjVkdxcDQw
+            eG45RjViSStsbVFwTTVaY0NvdTYxaSt1SW53CkVRdmlSanBxQS9jMTF3RDNKUlI5
+            ZndIMUFWMGRwN3hNckI5ZUE2N3U4TTQKLS0tIE9OVkRXVHIwNFVCS2ZDRHZiLysv
+            bkk2bm5CQkk2RDloZ1VjanQ2Y2RKRTgKL0Si6hyxDkZB1XlxubbdbvwZAxIf7dT8
+            Fs+ZGrW3GIGBUgOi9m7V452kkXse/NPlks6f9HDKYXeWT2lx2Fm5AA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:11Z"
-    mac: ENC[AES256_GCM,data:GCznc9EoSB6dWTGCxvLsCuVy4I9BKynagh7XJ5aHMOtz8sE6fCZbb1hq8xB4ypCw+yD+ehHq9g4di78nB6xl7z5vou9CzNvZMmdAIRNNR6PResIro0F3Ae3s61b1o62XoGx46D7hUy0J6h/+D4zxdYmqMNRyNoB1QxhsOCA8mF8=,iv:IqK4uq3ENeDxcSNDfMxOakYBX9KrBJGjjuHNRx1sRTQ=,tag:pXJCc2xfbxXrXD3SHX/Qqw==,type:str]
+    lastmodified: "2025-06-29T21:31:00Z"
+    mac: ENC[AES256_GCM,data:e0CSXVCcGyjcP0ekagvbi6eGqUeK/3RxbM4KYKCmcHB+n6Q4pQR4nDm1Wl33Js+61KpxAyI0Ongagtc4qw4wvFfO0p3TFpcqD7RAAIvBuWHerSlaTXqwiWfMnMarvIS2n6aCHJ1EI7XsjLah6zJYvYtCU4nzqoB6qAmyi7ldJ/A=,iv:RVRT0hewHGD4aH0uxRRu/weCDoTA4vbS5vt4SJ9eJog=,tag:2btYSdCbdqfjhNTGtuqd9Q==,type:str]
     pgp: []
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.9.1

k3s/rpi/dev-stuff/portainer-ce/portainer-service.yaml

@@ -7,14 +7,14 @@ metadata:
         metallb.universe.tf/allow-shared-ip: internal
 spec:
     selector:
-        app.kubernetes.io/name: ENC[AES256_GCM,data:FXIcD0k+sxK6,iv:0+jaErf7Jz0Epjl9aCDO2wbmhu0ldG9pjUDmwqLOI5Y=,tag:PYorIJhlWdsNSAwuEWY9Vw==,type:str]
-        app.kubernetes.io/instance: ENC[AES256_GCM,data:Ma1wqKdVv5en,iv:NaLoPa2jdNHKN1Wj+LYvLwq4c8A5sarQ5RgTX3i6Obw=,tag:uuvN4ffbiwwZkjfjpU0W5w==,type:str]
+        app.kubernetes.io/name: ENC[AES256_GCM,data:WYIuHsC1IhkJ,iv:QOrAkUNVgpKuVVnoAG7GE1vvLzjcjq4BMS9OPLHwM4A=,tag:SX+yMHe9tetEqTOKEb7A/w==,type:str]
+        app.kubernetes.io/instance: ENC[AES256_GCM,data:y9HW4wU1oLYl,iv:q0hyc3/bvn4iwTXgkIcPtNjPK1oWjmv4AFi7xLaFBWE=,tag:M0BcjM0/UTpHvZhiHiRwwQ==,type:str]
     type: LoadBalancer
     ports:
-        - protocol: ENC[AES256_GCM,data:9PnI,iv:th+YP1kkfBh7AaYyRsizUOptejqJUgaqmL51QRYFQwg=,tag:p7g//IopfRHFeQAgZ4L8fg==,type:str]
-          port: ENC[AES256_GCM,data:958LQA==,iv:sALn3NkGNiJLhP99EZ4/Z8TAF9xdOVNUAf7Wvritz5k=,tag:65Mu2g14Eji7/lpfie4QNA==,type:int]
-          targetPort: ENC[AES256_GCM,data:VV+rhQ==,iv:tzBjVcPxjWmnM6dSxdRrNAHH7Nj951j3Bv/mGRAb8o4=,tag:uuhDW1d5IwwC4UInHonNpw==,type:int]
-    loadBalancerIP: ENC[AES256_GCM,data:yWGBqCMDlfXxLmQG,iv:ynLGZxAy6fnpbDkOaoY5+/9n4iGKH0xik3taUq08b4c=,tag:GeZu1SGv04RKHx/UNWWDsQ==,type:str]
+        - protocol: ENC[AES256_GCM,data:kTwM,iv:xY4x09v1NZRnStDKKgBptsL0NB80fKEYR05B58ShiQI=,tag:aGrq6bBy5Akjlu46k8x/cA==,type:str]
+          port: ENC[AES256_GCM,data:4NmTnw==,iv:ATGM31FCwh5iXlEhAwBuqauxmM19Y1hKAawzd5iPgas=,tag:/ghUpG8p5VLh3ksOyqF0vQ==,type:int]
+          targetPort: ENC[AES256_GCM,data:SJYDpQ==,iv:c7SbEfHGUWMLHFac8FUWIQDyfaO+ldpgHSE0P6B3ARw=,tag:OIlqxpquc1tPNt3ngBlF7w==,type:int]
+    loadBalancerIP: ENC[AES256_GCM,data:ao+lzPVhbaAFAz/m,iv:yDjbLor6sq+2Xbe39N8ZJtFjHTVJVUjuPj1BN3GfZm0=,tag:eoWonEr5+y/buAD1s3v50w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -24,14 +24,14 @@ sops:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsYWFqUm1icFlmY1ViUVFG
-            NUlVQ1hWeWp1TFBFYzBCWWNvQ3NXckJCR2gwCmFibldIRnlnaGpkMmpPSUhDeXJS
-            ZHRWbGtuZzJPZy9VRDdaaUttZWZxY0EKLS0tIExreGljWnBmV1lWWmVhM0hLRXgr
-            b25EY0tuL2c1bk5sbCs1RFFQaFJreUkKeclwMeRs5DJtxAB5zfEiPpMiHxYlljJr
-            intkycf5x+P7ND4FNKJNsR/H68sQVsrpQxDrAu4g4XtgCGt3TiJBNw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZc0lPOUp3aCtvYTRpK29S
+            UGRBS1F6V21GSlNob0dYNnVvZUdwaGEzYUdNCjFWd202ZytqQm5PODZwMmRjbm9w
+            QTVKdXVteWFUd2NrRUthdU54VVZOekkKLS0tIFVqS094MmJac1hUb1RhakE4WnYv
+            MkRrNkNiMUFjVHRjK05EWmNZR2RiU2MK5wNmE7KZRyqkOrvWWVqyepv2byBJVhR3
+            HhRiATrxT/5YrA9rkLgLwKh0qJveCTI54jqeNi9ERQ1efNNflRU7Zg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:11Z"
-    mac: ENC[AES256_GCM,data:bgy3ZP5uYQv7uTdZALJU0DyusLCuAK5Pe8BnzE0YUjN869YvatJ+syH/taMA4uHHnOr2E3MITwQjIlcV6Z2oBVYqcsmcHJ96NH3Wdz25Ep8bH2GNYqz0KZKht5IiayQCj/DgCuFAuTae7yV9bNye9IcVyQkBCLHkzIdDAQ86H94=,iv:oECX60m6LcXRMofcmVtzcDICZHNfxta5lSjINCzQThQ=,tag:BvN9HS6nND2RE9mivz0NwA==,type:str]
+    lastmodified: "2025-06-29T21:31:00Z"
+    mac: ENC[AES256_GCM,data:XXM4zJkp2EKkNLRRh/r1leaB11OxGsc8JxbyDxPp40yzykOzNPE4tROydwp3MhPcbj8pTP9tVEiQPN0MbNY9pEFzOiMWP2qxOAd2lMEp0hytuy7Jypo+4a4dM3ALUSrCx9kfBmqVRSC4YuqDDhKDh+wdKdxe7gKdw+0VaE7ABWE=,iv:rGew/ufRmwukQy06szPvI6eEuyGl1BxnzsFDbRpLDQY=,tag:RFBxXvRJ/KwtMUHjhtbuuQ==,type:str]
     pgp: []
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.9.1

k3s/rpi/dev-stuff/portainer-ce/portainer.ingress.yml

@@ -8,16 +8,16 @@ metadata:
         nginx.ingress.kubernetes.io/backend-protocol: HTTPS
 spec:
     rules:
-        - host: ENC[AES256_GCM,data:JlWZROqVmSbS32V+hAmaU2U1ug==,iv:4Rs3e9llE7LgGwovDD7tnnIIQi3YT6m/UAeXPtqIwu4=,tag:H9+v141qEirsbNleCUqP+A==,type:str]
+        - host: ENC[AES256_GCM,data:k+51RXTRI10RN/TCGsdv9/nt9w==,iv:wwD3MAm1CFon3cT/tMpFjhlflGFQCFbPJVUWI9iYbmM=,tag:j1EcAo+pWrdJVeuFaG5i+w==,type:str]
           http:
             paths:
-                - path: ENC[AES256_GCM,data:ow==,iv:fyqJV5GdIHno9QGpz550ryF0CH7wIdIvniMMyNTdavs=,tag:kVAqXcgquBP58ycutfZgZw==,type:str]
-                  pathType: ENC[AES256_GCM,data:h1W66Ofq,iv:dqCqaEGHwLx1+8joPj5Qd9f2vV6yhWqnEohpElEo0A8=,tag:ZuuWEzs0fl8CX0wtEstFwQ==,type:str]
+                - path: ENC[AES256_GCM,data:AA==,iv:OPJtMa19mhXPY88Y+6L+cKGuFAp7X+8+i3Tmla56Is0=,tag:foCmeidGOoerZqC6sgH7hA==,type:str]
+                  pathType: ENC[AES256_GCM,data:ObPM+bwn,iv:ByXypy15eDe16mnftIgKzdP8W9F3l2/UUeBoAcNakuU=,tag:TlkLVe0Q5h44djW/HTe5PA==,type:str]
                   backend:
                     service:
-                        name: ENC[AES256_GCM,data:r61rOOQSLfDS,iv:gr+2iEGNMXvOf0RamKfSnwWJu7xnADgMCplsG+RR5WI=,tag:9U/CI0jJS8GZ5jQHW4LR5w==,type:str]
+                        name: ENC[AES256_GCM,data:UXHrMJR/5/BX,iv:sFW+wTrbeG/aiNfLGJDY8oPFK5kff2aBjyAFBpPAumg=,tag:s7sVGQ/peV8xusilp0RrVg==,type:str]
                         port:
-                            number: ENC[AES256_GCM,data:q4dH/w==,iv:Zzqep4scxTgnGROrJSNEzd28i97t7WmOa1WA899jmxE=,tag:+HwErEl/dYbvx1pIxHaz/Q==,type:int]
+                            number: ENC[AES256_GCM,data:J9bpgg==,iv:PWJPS36KbYegUATR57lTOsJ0JOodrqaVC798uw/cvMo=,tag:jgmbIwJyvKe8RNgjn7Eq9Q==,type:int]
 sops:
     kms: []
     gcp_kms: []
@@ -27,14 +27,14 @@ sops:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbWlTRWdpVWppMzlmN2dj
-            L1VsQUpXVVlzTGFiTmdVdXp0bVFhNXFTRkEwCjdHR2ZMWTU1bEhBWGNNaTRkRVJO
-            RlR4YWNQMVdQNnJYZE4wd1BUbXYzZ1kKLS0tIEE5d0tlSjhmWVNZWHlsQkphU2d4
-            RWprZXlGY04zYk11d1FxL0MveUpXOVEKt8mIZNUrn64eKZRWJXj3OWoqjFIA9rTj
-            DLSXqJ54YL2HuueMdKd4s0dqmHsKvB/fPt/1hQhclhrsrJlE7/ws0g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwN1dwRGhJUWx5ZVBWYmhL
+            dTllSlVHYnZmWnJidUxTSTZrNGEwVjEvOVhFCnJvdUI0a2FpSWZneFdzeWZIcU9N
+            dGVQZnFTYjJmRGV2OFRuWXZiUTJzSzQKLS0tIFBMeHZ2U1g5d1B1VVRpQUJYUHRy
+            L0EzRmxBVEdyeEc0Q2d1Y1J1TmVvRkUKUEKPQFyStzR1O0h0a/yULKl6Uj7yi0yK
+            Tww7oDqiq+OFMMSe0mh38ypjDzV6ccT+5Ce7gg2ducCGAC4OknorBg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:11Z"
-    mac: ENC[AES256_GCM,data:nJRt/Ahb6aYg3WGUnDUz9E3YERX/j5unLZEftrK0g9Zf58UbNyabggpGCpCef2b8XnHFyEM8XZ/vmhzfJjwlvEBQuPtWiB9O8dr76+zmtMI1txQvp8ocJeZyf4fsZSgKsNXGnukmMPLqC+IytD5dsZTTQpGx2WlslC0MMuI+Tts=,iv:ZMPbQrJnfSSLLDfoCWN9IW4XIA8fenYq8oUDukA36+c=,tag:CUNWMFGlplnrsAb534iVqg==,type:str]
+    lastmodified: "2025-06-29T21:31:00Z"
+    mac: ENC[AES256_GCM,data:eg+S5lNzNikVWL+TugAS+Z+lN052TG6dPrU3Mhi3o19j9Mh7tWR/XYIpynHF3bk35t4Tt+fW87hRldO7qkTCkChdxhj3alio4Ckie5/mJNU/iyxG5sSYn/cEs6zrWJ9vAASbAl/Cm+amZrLBayDGlTmvqDvaBobJmSxWF4jmqoI=,iv:iZtvzhbsyIhPoqGjoWL3AbUHcOZD/dEkryWQll0NV7I=,tag:GWw07WTwMF9eAYhNPTzboA==,type:str]
     pgp: []
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.9.1