Added monitoring with Prometheus Kube stack and instructions for setting it up with Helm; WIP - need to create targeted SOPS encrypt/decrypt scripts to prevent all files showing as modified in Git history when I decrypt/encrypt the entire directory

k3s/rpi/kube-system/cert-manager/lets_encrypt_production.yml

@@ -4,14 +4,14 @@ metadata:
     name: letsencrypt-prod
 spec:
     acme:
-        email: ENC[AES256_GCM,data:CrZo3dGvCQLpJXvy,iv:QoNm8du+SE1b9LJu1c+K1JmsiXoSzhsavjJC51/zXwo=,tag:0Og1CvUck2T5nnpb0N3fOw==,type:str]
-        server: ENC[AES256_GCM,data:DByJK2Z14pwAvNb5sZm1XNhd/Okk0DH25990+x+v8kEYbH/dvaofT2CqhH8l7A==,iv:9RZsmeb2wGELNB9QaJZgcEDQnHsmQJGwi/yCOZYHCLM=,tag:nT3eBQ58+h5+kVq29h+1SA==,type:str]
+        email: ENC[AES256_GCM,data:thYlmAYLIuKHiVWb,iv:NlRmZHGlVuxxGZV8D/K6KksGLyQ/XSqE6ex+4zCiH18=,tag:TX/hmj3U4Sn5vAYyZSUi7g==,type:str]
+        server: ENC[AES256_GCM,data:bV5KGCweIh5Rm6/fyCszB7GWo9eg/HQ+6GOwNntJ+nDJo1iIimckJUCswKUj9A==,iv:y09UBJjlavQ4HpZvNA/Fhc0Ofy3S1z2gkku9au1YGkc=,tag:8nY9EVFZDTLkHTyc09LlNw==,type:str]
         privateKeySecretRef:
-            name: ENC[AES256_GCM,data:PILSt075yDKElJoBuromdw==,iv:8tzvxx7ZAp+55tIX+Mvb88Xpkrlnx5Y0WPbNs/patZ0=,tag:wG7QUxx5jpK1Xp8iA+4rBA==,type:str]
+            name: ENC[AES256_GCM,data:0cSceKB3wCW4MNwwFvPR1w==,iv:An+JKnP5oKHbciW3YnC/POgxMk7OJUL2gx00wJ0rADw=,tag:dBDSNGbxqPFKBPu6nFBrdA==,type:str]
         solvers:
             - http01:
                 ingress:
-                    class: ENC[AES256_GCM,data:Id3YCpE=,iv:QwFhvDitp/hTfp5ZiKDHzDCT7kd675s48SxwD6zbvAo=,tag:t3oQenPSz20sbTB7z/2GNA==,type:str]
+                    class: ENC[AES256_GCM,data:IjSCVb0=,iv:6FYUHPPeJmOIThx1rDQJMjp5XoBNOavad6ejjIl1qSc=,tag:4ImpJzsihe4IrZCzGLzxvw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -21,14 +21,14 @@ sops:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwc0RxTFhsNlZqN1FGT1FN
-            WThOSXVkdHJHb0tkVlNWSzBJbDJwd1FjYkJNCkhKcVhRVit5TThGMjcrRk1vSE5i
-            d3ZDblJNNU5DK2NzTEIwL3FJOWo2SkkKLS0tIDh0WSt2bmJjWkg0ZE93SWNYeXJQ
-            cEREOHNmNUdTTCtaMzR0d1M3R0lmdm8KPzNSmxcUA2ORaPq2oy0sspflecpTVHs1
-            dmz5WTa7gGc+EzfxabZd3zm5AtSXcymlWrhRAST5gDKEiiLnb7ZtiA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZRGpicStmdDQvSzQxR0NR
+            VzJ2K21XcGxYZW5zd1FnTnk0SXZYQWFNTm1jCi8yNHUwWDB4TjU0Q2RJN0FobzZs
+            Tm1STWRUWnRvdjdsaEtnQ1BVd0dYbncKLS0tIFd4ajRjb2FyZ0YzbGRJK0Q0ZDVT
+            Rit4ZGdSYm41RDgzb3g5Wmc0RWRJK2sKo9787WPFTTSg3DYOQjcC4H9WnASewwFY
+            h0VkGc2oVXcpBdfAcn4+f5pfN/jY7er2Ph3yiDo97ia+nER2TLb+OA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:13Z"
-    mac: ENC[AES256_GCM,data:aXN14lEJ/BmOwcEwjMX3/eH8PClQB2S+5scHxwojOQAY9IqLJ6RuMmkwOuhdFGXnyTHSwrzCHcSJJMR+/04QPFYCtcGepUaLkcJ54crBQVEW/QSU8/I70JO+CdC+nWuUG3fcVHMPkc84qu7m6K+6QGfGQqLobanmvIQ9OaoH990=,iv:HiZoabEBxzUI1fYpvVVBxhZECpa3DXtnFajEevFFbqw=,tag:2uetHUV5UQ7zJZ/jPxIuzA==,type:str]
+    lastmodified: "2025-06-29T21:31:03Z"
+    mac: ENC[AES256_GCM,data:CQdJDlIx2n+Wz3R/RQ/994psS0Rils87CNbIliyPCxCA65RSzV09Bm+b3QpsqvcMqR77GJbuWs/hb5VwPGDAz0Uncc3KQnIt1Xwv0vFpxFMv4Wxllpgh9REXN0zQnIVehgZ2/uD/5znSlC35mVE3QCidvusewkHDKwD2etQM73s=,iv:wgoBBVsArsfSmTRCAeTMeAjhxnaz5p9ePVFya+sLYpo=,tag:P/zeCgxyg+/kGXh27yp0VQ==,type:str]
     pgp: []
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.9.1

k3s/rpi/kube-system/cert-manager/lets_encrypt_staging.yml

@@ -4,14 +4,14 @@ metadata:
     name: letsencrypt-staging
 spec:
     acme:
-        email: ENC[AES256_GCM,data:J8DC+/h17kupCA0X,iv:Z15nkYaChXer5krxPWvTwU+WugyDzQRb4/UnXc9l0cQ=,tag:QMpVTXIHczEDTWVlkbXRgg==,type:str]
-        server: ENC[AES256_GCM,data:dQPDPek/+7JXGXFdYbWW7Hp57T+PAe3qj66rFWFWeLOV7Eg0Pn2BQ7YfrQiMEbmMmEQ6T12i,iv:SYbkBCXSpdcqaAqjY6oi5lDb2IKz8R2LwOM23Izx2tY=,tag:KctQ0oLriNSLDrpeeYTzpg==,type:str]
+        email: ENC[AES256_GCM,data:wurJaargPfxU5BYl,iv:bmx3Gjq/wf/Guwj84d/qVOdQr1mOElV+JUUrmyOvgfg=,tag:c327T57voRH5J2YaRRGVrA==,type:str]
+        server: ENC[AES256_GCM,data:TXJac5RcXc63gi1Jylw7rdC0EgEIQK96BQ5FNRFMHAarbHbW/sUezwR/Ywi8/GHi6gzWysDa,iv:GFurNVZXBSlY4BKyHPa+zQkoXQif2oHabk12WlJMRY0=,tag:La9/B5W+Jdgvu95SKGnniw==,type:str]
         privateKeySecretRef:
-            name: ENC[AES256_GCM,data:sc235oq6O9BolS1tB823sVpxsg==,iv:F07MyXMLZAP5EYTZBU9k/V9dK8/hxVr8P26AeoyOooc=,tag:Asa224pIFnJcIiPKw1FQ4w==,type:str]
+            name: ENC[AES256_GCM,data:uQ/rfaYn5dfyTg7ywJjETgbuDw==,iv:skeZKWete6VTJAlfRXtWpbugiqC2DQA/LxwE47IgqWw=,tag:ORYThcagO4aJi+LnGoSsLg==,type:str]
         solvers:
             - http01:
                 ingress:
-                    class: ENC[AES256_GCM,data:xnZIAXM=,iv:tk65ggryt/ijexRz4fk5ow4EkJGTJPvuS0AW1/CbgaE=,tag:tZUEdS00bNfdkCBaEfOghw==,type:str]
+                    class: ENC[AES256_GCM,data:e02DHfI=,iv:q6gVEjpWHAkma38yIgwFKyUKI7HZcW7++iWJB0XyA1A=,tag:9v2+Gm+KmyPaxP5NhAPJ+A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -21,14 +21,14 @@ sops:
         - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZODhBaE9FVzAvTTd0YXZj
-            eEM5bWQ0UHJpa0JFNWhVK2RHV3NITHZBNHpvClJEaWxBaGtwUnJ5YTN6dk05L21M
-            Z3Z3L1RTYkZteURhait0d3JWcGgzdjgKLS0tIFVEZWx6di80QjdSa0NxUk9YUGx1
-            R1NzbS95b0tYYkFucjRGbm5XRldZTVEKCxcIdaShlU9sC+g9RYhbpylj0RLqHsbF
-            FWFls37I4qykCxXqgtYFDT+RvyJ4ZmSrNzhRTgLIW1efyLT7vzpDyQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaWVRmV3dodklmRkFyUkVY
+            M3l6MjZFdWdXNkpUYUpCQUY1M1ZMSmU4T0hFCnNrZUlpZEFobFdXSzVIZXV6Z1Mw
+            dmtQTXBQd1c0NkdpSy9ndFVEcm5Cc3MKLS0tIDNpTHRmUlFrVFUrZGpsU1E4K0hV
+            QWVmTnp4RFdNb2VkbnpSMi9QdXVwQWsK0U/1SRQjd9/16Vl6ctZVzhtv/nkou5oh
+            GzALWQsBOqqB6uzLqMk2tw6jTfgy5WAvT4TPxXbW1un3e/LvxKAYnA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:13Z"
-    mac: ENC[AES256_GCM,data:nV9q1TLwHuoqdoA+jagAnCIq+4B0E5IIRjVAG1KJM13rTenMw9pyPbb+cobIH9CcLM5XPHB3CcNwzObGb+6lubthVBEk/ymtp4/yqirFC6jnWoaioPaRxzB614Ie0llu2Bkj1lgfwl3cJfl38SJekiDgjTaDIVlnXhkCsJUBMas=,iv:2/nlMgeyuYwfRRDYnfYAVgHWVdy7rSzHDrCrbU38Ka8=,tag:dikrT5u776YViDxQ5VC0Ww==,type:str]
+    lastmodified: "2025-06-29T21:31:03Z"
+    mac: ENC[AES256_GCM,data:qgJR7FAYY80C+3/2gInfM3L5TlIxqcRkzzouLzocS7eQ/JQbJRNgBAyVH0JJTWW+ePli4rpPQpLaqhoKoeUNN6jcUnVaKciC1+KFnNPRog5UX9LN6R9T0iM5I31Znk2snFT+2xSfuphEF2YCURPOprw1kSRKPVXmoSFaDjz651w=,iv:2/9mFIW7yKK1OuI8KLe7TdkEIjBhrRDeY5vVQTsVjvk=,tag:jymAmSlyN0yFTbATsa9BtA==,type:str]
     pgp: []
     unencrypted_regex: ^(apiVersion|metadata|kind|type)$
     version: 3.9.1