feat(gitops): populate declarative manifests for all 10 workloads and correct destination namespaces

manifests/aerodrome/authentik/authentik.yaml

@@ -0,0 +1,566 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: authentik
+    meta.helm.sh/release-namespace: infra
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/part-of: authentik
+    app.kubernetes.io/version: 2026.2.2
+    helm.sh/chart: authentik-2026.2.2
+  name: authentik-server
+  namespace: infra
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: server
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/name: authentik
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        checksum/secret: dd7f348e3b2f89fc2c10dd192b2fa5e17fcda500ee513b9f5f66cd33b97e268d
+        kubectl.kubernetes.io/restartedAt: 2026-10-28 22:52:19.572345
+      labels:
+        app.kubernetes.io/component: server
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/part-of: authentik
+        app.kubernetes.io/version: 2026.2.2
+        helm.sh/chart: authentik-2026.2.2
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: server
+                  app.kubernetes.io/instance: authentik
+                  app.kubernetes.io/name: authentik
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - server
+        env:
+        - name: AUTHENTIK_LISTEN__HTTP
+          value: 0.0.0.0:9000
+        - name: AUTHENTIK_LISTEN__HTTPS
+          value: 0.0.0.0:9443
+        - name: AUTHENTIK_LISTEN__METRICS
+          value: 0.0.0.0:9300
+        envFrom:
+        - secretRef:
+            name: authentik
+        image: ghcr.io/goauthentik/server:2026.2.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /-/health/live/
+            port: http
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        name: server
+        ports:
+        - containerPort: 9000
+          name: http
+          protocol: TCP
+        - containerPort: 9443
+          name: https
+          protocol: TCP
+        - containerPort: 9300
+          name: metrics
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /-/health/ready/
+            port: http
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        resources: {}
+        startupProbe:
+          failureThreshold: 60
+          httpGet:
+            path: /-/health/live/
+            port: http
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: authentik
+    meta.helm.sh/release-namespace: infra
+  labels:
+    app.kubernetes.io/component: worker
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/part-of: authentik
+    app.kubernetes.io/version: 2026.2.2
+    helm.sh/chart: authentik-2026.2.2
+  name: authentik-worker
+  namespace: infra
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: worker
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/name: authentik
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        checksum/secret: dd7f348e3b2f89fc2c10dd192b2fa5e17fcda500ee513b9f5f66cd33b97e268d
+      labels:
+        app.kubernetes.io/component: worker
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/part-of: authentik
+        app.kubernetes.io/version: 2026.2.2
+        helm.sh/chart: authentik-2026.2.2
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: worker
+                  app.kubernetes.io/instance: authentik
+                  app.kubernetes.io/name: authentik
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - worker
+        env:
+        - name: AUTHENTIK_LISTEN__HTTP
+          value: 0.0.0.0:9000
+        - name: AUTHENTIK_LISTEN__METRICS
+          value: 0.0.0.0:9300
+        envFrom:
+        - secretRef:
+            name: authentik
+        image: ghcr.io/goauthentik/server:2026.2.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command:
+            - ak
+            - healthcheck
+          failureThreshold: 3
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        name: worker
+        ports:
+        - containerPort: 9000
+          name: http
+          protocol: TCP
+        - containerPort: 9300
+          name: metrics
+          protocol: TCP
+        readinessProbe:
+          exec:
+            command:
+            - ak
+            - healthcheck
+          failureThreshold: 3
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        resources: {}
+        startupProbe:
+          exec:
+            command:
+            - ak
+            - healthcheck
+          failureThreshold: 60
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: authentik
+      serviceAccountName: authentik
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  annotations:
+    meta.helm.sh/release-name: authentik
+    meta.helm.sh/release-namespace: infra
+  labels:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 17.6.0
+    helm.sh/chart: postgresql-16.7.27
+  name: authentik-postgresql
+  namespace: infra
+spec:
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  podManagementPolicy: OrderedReady
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: primary
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/name: postgresql
+  serviceName: authentik-postgresql-hl
+  template:
+    metadata:
+      annotations:
+        checksum/configuration: c7768a9df482d4c1de21ac88a598f24ff260dad3ff5925385ab5225b3ef8be39
+        checksum/extended-configuration: f231c584ead90a4176b09eb6d6073240ab2939b8bd09b20013265962083b3208
+      labels:
+        app.kubernetes.io/component: primary
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: postgresql
+        app.kubernetes.io/version: 17.6.0
+        helm.sh/chart: postgresql-16.7.27
+      name: authentik-postgresql
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: primary
+                  app.kubernetes.io/instance: authentik
+                  app.kubernetes.io/name: postgresql
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - -c
+        - config_file=/bitnami/postgresql/conf/postgresql.conf
+        - -c
+        - hba_file=/bitnami/postgresql/conf/pg_hba.conf
+        env:
+        - name: BITNAMI_DEBUG
+          value: 'false'
+        - name: POSTGRESQL_PORT_NUMBER
+          value: '5432'
+        - name: POSTGRESQL_VOLUME_DIR
+          value: /bitnami/postgresql
+        - name: PGDATA
+          value: /bitnami/postgresql/data
+        - name: POSTGRES_USER
+          value: authentik
+        - name: POSTGRES_PASSWORD_FILE
+          value: /opt/bitnami/postgresql/secrets/password
+        - name: POSTGRES_POSTGRES_PASSWORD_FILE
+          value: /opt/bitnami/postgresql/secrets/postgres-password
+        - name: POSTGRES_DATABASE
+          value: authentik
+        - name: POSTGRESQL_ENABLE_LDAP
+          value: 'no'
+        - name: POSTGRESQL_ENABLE_TLS
+          value: 'no'
+        - name: POSTGRESQL_LOG_HOSTNAME
+          value: 'false'
+        - name: POSTGRESQL_LOG_CONNECTIONS
+          value: 'false'
+        - name: POSTGRESQL_LOG_DISCONNECTIONS
+          value: 'false'
+        - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
+          value: 'off'
+        - name: POSTGRESQL_CLIENT_MIN_MESSAGES
+          value: error
+        - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
+          value: pgaudit
+        - name: POSTGRES_DB
+          value: authentik
+        image: docker.io/library/postgres:17.9-bookworm
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "authentik" -d "dbname=authentik" -h 127.0.0.1 -p
+              5432
+          failureThreshold: 6
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: postgresql
+        ports:
+        - containerPort: 5432
+          name: tcp-postgresql
+          protocol: TCP
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - -e
+            - 'exec pg_isready -U "authentik" -d "dbname=authentik" -h 127.0.0.1 -p
+              5432
+
+              [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized
+              ]
+
+              '
+          failureThreshold: 6
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 1001
+          runAsNonRoot: true
+          runAsUser: 1001
+          seLinuxOptions: {}
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /tmp
+          name: empty-dir
+          subPath: tmp-dir
+        - mountPath: /opt/bitnami/postgresql/conf
+          name: empty-dir
+          subPath: app-conf-dir
+        - mountPath: /opt/bitnami/postgresql/tmp
+          name: empty-dir
+          subPath: app-tmp-dir
+        - mountPath: /bitnami/postgresql/conf/conf.d/
+          name: postgresql-extended-config
+        - mountPath: /opt/bitnami/postgresql/secrets/
+          name: postgresql-password
+        - mountPath: /dev/shm
+          name: dshm
+        - mountPath: /bitnami/postgresql
+          name: data
+        - mountPath: /bitnami/postgresql/conf
+          name: postgresql-config
+        - mountPath: /var/run/postgresql
+          name: postgresql-socket
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 1001
+        fsGroupChangePolicy: Always
+      serviceAccount: authentik-postgresql
+      serviceAccountName: authentik-postgresql
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - emptyDir: {}
+        name: empty-dir
+      - configMap:
+          defaultMode: 420
+          name: authentik-postgresql-configuration
+        name: postgresql-config
+      - configMap:
+          defaultMode: 420
+          name: authentik-postgresql-extended-configuration
+        name: postgresql-extended-config
+      - name: postgresql-password
+        secret:
+          defaultMode: 420
+          secretName: authentik-postgresql
+      - emptyDir: {}
+        name: postgresql-socket
+      - emptyDir:
+          medium: Memory
+        name: dshm
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+    type: RollingUpdate
+  volumeClaimTemplates:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 8Gi
+      volumeMode: Filesystem
+    status:
+      phase: Pending
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: authentik
+    meta.helm.sh/release-namespace: infra
+  labels:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 17.6.0
+    helm.sh/chart: postgresql-16.7.27
+  name: authentik-postgresql
+  namespace: infra
+spec:
+  clusterIP: 10.43.189.60
+  clusterIPs:
+  - 10.43.189.60
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: tcp-postgresql
+    port: 5432
+    protocol: TCP
+    targetPort: tcp-postgresql
+  selector:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/name: postgresql
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: authentik
+    meta.helm.sh/release-namespace: infra
+  labels:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 17.6.0
+    helm.sh/chart: postgresql-16.7.27
+  name: authentik-postgresql-hl
+  namespace: infra
+spec:
+  clusterIP: None
+  clusterIPs:
+  - None
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: tcp-postgresql
+    port: 5432
+    protocol: TCP
+    targetPort: tcp-postgresql
+  publishNotReadyAddresses: true
+  selector:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/name: postgresql
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: authentik
+    meta.helm.sh/release-namespace: infra
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/part-of: authentik
+    app.kubernetes.io/version: 2026.2.2
+    helm.sh/chart: authentik-2026.2.2
+  name: authentik-server
+  namespace: infra
+spec:
+  clusterIP: 10.43.250.197
+  clusterIPs:
+  - 10.43.250.197
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 9000
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 9443
+  selector:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/name: authentik
+  sessionAffinity: None
+  type: ClusterIP

manifests/aerodrome/awx/awx.yaml

@@ -0,0 +1,992 @@
+apiVersion: awx.ansible.com/v1beta1
+kind: AWX
+metadata:
+  annotations:
+    meta.helm.sh/release-name: awx
+    meta.helm.sh/release-namespace: awx
+    restartedAt: now
+  labels:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/operator-version: 2.19.1
+    app.kubernetes.io/part-of: awx
+  name: awx
+  namespace: awx
+spec:
+  admin_user: snarf
+  auto_upgrade: true
+  create_preload_data: true
+  extra_settings:
+  - setting: CSRF_TRUSTED_ORIGINS
+    value:
+    - https://awx.snarfnet.net
+  - setting: SECURE_PROXY_SSL_HEADER
+    value:
+    - HTTP_X_FORWARDED_PROTO
+    - https
+  - setting: SOCIAL_AUTH_REDIRECT_IS_HTTPS
+    value: true
+  garbage_collect_secrets: false
+  image_pull_policy: IfNotPresent
+  ipv6_disabled: false
+  loadbalancer_ip: ''
+  loadbalancer_port: 80
+  loadbalancer_protocol: http
+  no_log: true
+  postgres_configuration_secret: awx-postgres-configuration
+  postgres_keepalives: true
+  postgres_keepalives_count: 5
+  postgres_keepalives_idle: 5
+  postgres_keepalives_interval: 5
+  postgres_storage_class: longhorn
+  projects_persistence: false
+  projects_storage_access_mode: ReadWriteMany
+  projects_storage_size: 8Gi
+  replicas: 1
+  route_tls_termination_mechanism: Edge
+  security_context_settings:
+    fsGroup: 0
+    fsGroupChangePolicy: OnRootMismatch
+    runAsGroup: 0
+    runAsUser: 0
+  set_self_labels: true
+  task_privileged: false
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: awx
+    meta.helm.sh/release-namespace: awx
+  labels:
+    app.kubernetes.io/managed-by: Helm
+    control-plane: controller-manager
+    helm.sh/chart: awx-operator
+  name: awx-operator-controller-manager
+  namespace: awx
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+      helm.sh/chart: awx-operator
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        cattle.io/timestamp: '2026-05-15T20:05:15Z'
+        kubectl.kubernetes.io/default-container: awx-manager
+        kubectl.kubernetes.io/restartedAt: '2026-05-15T20:01:42Z'
+      labels:
+        control-plane: controller-manager
+        helm.sh/chart: awx-operator
+    spec:
+      containers:
+      - args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --v=0
+        image: quay.io/brancz/kube-rbac-proxy:v0.15.0
+        imagePullPolicy: IfNotPresent
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https
+          protocol: TCP
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 5m
+            memory: 64Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - args:
+        - --health-probe-bind-address=:6789
+        - --metrics-bind-address=127.0.0.1:8080
+        - --leader-elect
+        - --leader-election-id=awx-operator
+        env:
+        - name: ANSIBLE_GATHERING
+          value: explicit
+        - name: ANSIBLE_DEBUG_LOGS
+          value: 'false'
+        - name: WATCH_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        image: quay.io/ansible/awx-operator:2.19.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 6789
+            scheme: HTTP
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: awx-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /readyz
+            port: 6789
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 1500m
+            memory: 960Mi
+          requests:
+            cpu: 50m
+            memory: 32Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /opt/ansible/roles/installer/defaults
+          name: installer-defaults-override
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: redhat-operators-pull-secret
+      initContainers:
+      - command:
+        - sh
+        - -c
+        - 'cp /opt/ansible/roles/installer/defaults/main.yml /mnt/defaults/main.yml
+
+          echo "" >> /mnt/defaults/main.yml
+
+          echo "web_manage_replicas: true" >> /mnt/defaults/main.yml
+
+          echo "task_manage_replicas: true" >> /mnt/defaults/main.yml
+
+          '
+        image: quay.io/ansible/awx-operator:2.19.1
+        imagePullPolicy: IfNotPresent
+        name: patch-defaults
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /mnt/defaults
+          name: installer-defaults-override
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsNonRoot: true
+      serviceAccount: awx-operator-controller-manager
+      serviceAccountName: awx-operator-controller-manager
+      terminationGracePeriodSeconds: 10
+      volumes:
+      - emptyDir: {}
+        name: installer-defaults-override
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/operator-version: 2.19.1
+    app.kubernetes.io/part-of: awx
+    app.kubernetes.io/version: 24.6.1
+  name: awx-task
+  namespace: awx
+  ownerReferences:
+  - apiVersion: awx.ansible.com/v1beta1
+    kind: AWX
+    name: awx
+    uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: awx
+      app.kubernetes.io/managed-by: awx-operator
+      app.kubernetes.io/name: awx-task
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
+        checksum-configmaps-pre_stop_scripts: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+        checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
+        checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
+        checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
+        checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
+        checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
+        checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
+        checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
+        checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+        kubectl.kubernetes.io/default-container: awx-task
+      labels:
+        app.kubernetes.io/component: awx
+        app.kubernetes.io/managed-by: awx-operator
+        app.kubernetes.io/name: awx-task
+        app.kubernetes.io/operator-version: 2.19.1
+        app.kubernetes.io/part-of: awx
+        app.kubernetes.io/version: 24.6.1
+    spec:
+      containers:
+      - args:
+        - redis-server
+        - /etc/redis.conf
+        image: docker.io/redis:7
+        imagePullPolicy: IfNotPresent
+        name: redis
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/redis.conf
+          name: awx-redis-config
+          readOnly: true
+          subPath: redis.conf
+        - mountPath: /var/run/redis
+          name: awx-redis-socket
+        - mountPath: /data
+          name: awx-redis-data
+      - args:
+        - /usr/bin/launch_awx_task.sh
+        env:
+        - name: AWX_COMPONENT
+          value: task
+        - name: SUPERVISOR_CONFIG_PATH
+          value: /etc/supervisord_task.conf
+        - name: AWX_SKIP_MIGRATIONS
+          value: '1'
+        - name: MY_POD_UID
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.uid
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: MY_POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        image: quay.io/ansible/awx:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: awx-task
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/tower/conf.d/execution_environments.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: execution_environments.py
+        - mountPath: /etc/tower/conf.d/credentials.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: credentials.py
+        - mountPath: /etc/tower/conf.d/ldap.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: ldap.py
+        - mountPath: /etc/tower/SECRET_KEY
+          name: awx-secret-key
+          readOnly: true
+          subPath: SECRET_KEY
+        - mountPath: /etc/tower/settings.py
+          name: awx-settings
+          readOnly: true
+          subPath: settings.py
+        - mountPath: /var/run/redis
+          name: awx-redis-socket
+        - mountPath: /var/run/awx-rsyslog
+          name: rsyslog-socket
+        - mountPath: /etc/receptor/
+          name: awx-receptor-config
+        - mountPath: /etc/receptor/work_private_key.pem
+          name: awx-receptor-work-signing
+          readOnly: true
+          subPath: work-private-key.pem
+        - mountPath: /var/run/receptor
+          name: receptor-socket
+        - mountPath: /var/lib/awx/projects
+          name: awx-projects
+      - args:
+        - /bin/sh
+        - -c
+        - "if [ ! -f /etc/receptor/receptor.conf ]; then\n  cp /etc/receptor/receptor-default.conf\
+          \ /etc/receptor/receptor.conf\n  sed -i \"s/HOSTNAME/$HOSTNAME/g\" /etc/receptor/receptor.conf\n\
+          fi\nexec receptor --config /etc/receptor/receptor.conf\n"
+        image: quay.io/ansible/awx-ee:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: awx-ee
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/receptor/receptor-default.conf
+          name: awx-default-receptor-config
+          subPath: receptor.conf
+        - mountPath: /etc/receptor/
+          name: awx-receptor-config
+        - mountPath: /etc/receptor/tls/ca/mesh-CA.crt
+          name: awx-receptor-ca
+          readOnly: true
+          subPath: tls.crt
+        - mountPath: /etc/receptor/work_private_key.pem
+          name: awx-receptor-work-signing
+          readOnly: true
+          subPath: work-private-key.pem
+        - mountPath: /etc/receptor/tls/
+          name: awx-receptor-tls
+        - mountPath: /var/run/receptor
+          name: receptor-socket
+        - mountPath: /var/lib/awx/projects
+          name: awx-projects
+      - args:
+        - /usr/bin/launch_awx_rsyslog.sh
+        env:
+        - name: SUPERVISOR_CONFIG_PATH
+          value: /etc/supervisord_rsyslog.conf
+        image: quay.io/ansible/awx:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: awx-rsyslog
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/tower/conf.d/credentials.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: credentials.py
+        - mountPath: /etc/tower/SECRET_KEY
+          name: awx-secret-key
+          readOnly: true
+          subPath: SECRET_KEY
+        - mountPath: /etc/tower/settings.py
+          name: awx-settings
+          readOnly: true
+          subPath: settings.py
+        - mountPath: /var/run/redis
+          name: awx-redis-socket
+        - mountPath: /var/run/awx-rsyslog
+          name: rsyslog-socket
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - command:
+        - /bin/sh
+        - -c
+        - wait-for-migrations
+        image: quay.io/ansible/awx:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: init-database
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/tower/conf.d/credentials.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: credentials.py
+        - mountPath: /etc/tower/SECRET_KEY
+          name: awx-secret-key
+          readOnly: true
+          subPath: SECRET_KEY
+        - mountPath: /etc/tower/settings.py
+          name: awx-settings
+          readOnly: true
+          subPath: settings.py
+      - command:
+        - /bin/sh
+        - -c
+        - "hostname=$MY_POD_NAME\nreceptor --cert-makereq \\\n  bits=2048 \\\n  commonname=$hostname\
+          \ \\\n  dnsname=$hostname \\\n  nodeid=$hostname \\\n  outreq=/etc/receptor/tls/receptor.req\
+          \ \\\n  outkey=/etc/receptor/tls/receptor.key\nreceptor --cert-signreq \\\
+          \n  req=/etc/receptor/tls/receptor.req \\\n  cacert=/etc/receptor/tls/ca/mesh-CA.crt\
+          \ \\\n  cakey=/etc/receptor/tls/ca/mesh-CA.key \\\n  outcert=/etc/receptor/tls/receptor.crt\
+          \ \\\n  notafter=$(date --iso-8601=seconds --utc --date \"10 years\") \\\
+          \n  verify=yes\n"
+        env:
+        - name: MY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: quay.io/ansible/awx-ee:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: init-receptor
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/receptor/tls/ca/mesh-CA.crt
+          name: awx-receptor-ca
+          readOnly: true
+          subPath: tls.crt
+        - mountPath: /etc/receptor/tls/ca/mesh-CA.key
+          name: awx-receptor-ca
+          readOnly: true
+          subPath: tls.key
+        - mountPath: /etc/receptor/tls/
+          name: awx-receptor-tls
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsUser: 0
+      serviceAccount: awx
+      serviceAccountName: awx
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: awx-application-credentials
+        secret:
+          defaultMode: 420
+          items:
+          - key: credentials.py
+            path: credentials.py
+          - key: ldap.py
+            path: ldap.py
+          - key: execution_environments.py
+            path: execution_environments.py
+          secretName: awx-app-credentials
+      - emptyDir: {}
+        name: awx-receptor-tls
+      - name: awx-receptor-ca
+        secret:
+          defaultMode: 420
+          secretName: awx-receptor-ca
+      - name: awx-receptor-work-signing
+        secret:
+          defaultMode: 420
+          secretName: awx-receptor-work-signing
+      - name: awx-secret-key
+        secret:
+          defaultMode: 420
+          items:
+          - key: secret_key
+            path: SECRET_KEY
+          secretName: awx-secret-key
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: settings
+            path: settings.py
+          name: awx-awx-configmap
+        name: awx-settings
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: nginx_conf
+            path: nginx.conf
+          name: awx-awx-configmap
+        name: awx-nginx-conf
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: redis_conf
+            path: redis.conf
+          name: awx-awx-configmap
+        name: awx-redis-config
+      - emptyDir: {}
+        name: awx-redis-socket
+      - emptyDir: {}
+        name: awx-redis-data
+      - emptyDir: {}
+        name: rsyslog-socket
+      - emptyDir: {}
+        name: receptor-socket
+      - emptyDir: {}
+        name: awx-receptor-config
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: receptor_conf
+            path: receptor.conf
+          name: awx-awx-configmap
+        name: awx-default-receptor-config
+      - emptyDir: {}
+        name: awx-projects
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/name: awx-web
+    app.kubernetes.io/operator-version: 2.19.1
+    app.kubernetes.io/part-of: awx
+    app.kubernetes.io/version: 24.6.1
+  name: awx-web
+  namespace: awx
+  ownerReferences:
+  - apiVersion: awx.ansible.com/v1beta1
+    kind: AWX
+    name: awx
+    uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: awx
+      app.kubernetes.io/managed-by: awx-operator
+      app.kubernetes.io/name: awx-web
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
+        checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
+        checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
+        checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
+        checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
+        checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
+        checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
+        checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
+        checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+        kubectl.kubernetes.io/default-container: awx-web
+      labels:
+        app.kubernetes.io/component: awx
+        app.kubernetes.io/managed-by: awx-operator
+        app.kubernetes.io/name: awx-web
+        app.kubernetes.io/operator-version: 2.19.1
+        app.kubernetes.io/part-of: awx
+        app.kubernetes.io/version: 24.6.1
+    spec:
+      containers:
+      - args:
+        - redis-server
+        - /etc/redis.conf
+        image: docker.io/redis:7
+        imagePullPolicy: IfNotPresent
+        name: redis
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/redis.conf
+          name: awx-redis-config
+          readOnly: true
+          subPath: redis.conf
+        - mountPath: /var/run/redis
+          name: awx-redis-socket
+        - mountPath: /data
+          name: awx-redis-data
+      - args:
+        - /usr/bin/launch_awx_web.sh
+        env:
+        - name: AWX_COMPONENT
+          value: web
+        - name: SUPERVISOR_CONFIG_PATH
+          value: /etc/supervisord_web.conf
+        - name: MY_POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: UWSGI_MOUNT_PATH
+          value: /
+        image: quay.io/ansible/awx:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: awx-web
+        ports:
+        - containerPort: 8052
+          protocol: TCP
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/tower/uwsgi.ini
+          name: awx-uwsgi-config
+          readOnly: true
+          subPath: uwsgi.conf
+        - mountPath: /etc/tower/conf.d/execution_environments.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: execution_environments.py
+        - mountPath: /etc/tower/conf.d/credentials.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: credentials.py
+        - mountPath: /etc/tower/conf.d/ldap.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: ldap.py
+        - mountPath: /etc/tower/SECRET_KEY
+          name: awx-secret-key
+          readOnly: true
+          subPath: SECRET_KEY
+        - mountPath: /etc/tower/settings.py
+          name: awx-settings
+          readOnly: true
+          subPath: settings.py
+        - mountPath: /etc/nginx/nginx.conf
+          name: awx-nginx-conf
+          readOnly: true
+          subPath: nginx.conf
+        - mountPath: /var/run/redis
+          name: awx-redis-socket
+        - mountPath: /var/run/awx-rsyslog
+          name: rsyslog-socket
+        - mountPath: /etc/receptor/tls/ca/mesh-CA.crt
+          name: awx-receptor-ca
+          readOnly: true
+          subPath: tls.crt
+        - mountPath: /etc/receptor/tls/ca/mesh-CA.key
+          name: awx-receptor-ca
+          readOnly: true
+          subPath: tls.key
+        - mountPath: /etc/receptor/work_public_key.pem
+          name: awx-receptor-work-signing
+          readOnly: true
+          subPath: work-public-key.pem
+      - args:
+        - /usr/bin/launch_awx_rsyslog.sh
+        env:
+        - name: SUPERVISOR_CONFIG_PATH
+          value: /etc/supervisord_rsyslog.conf
+        image: quay.io/ansible/awx:24.6.1
+        imagePullPolicy: IfNotPresent
+        name: awx-rsyslog
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/tower/conf.d/credentials.py
+          name: awx-application-credentials
+          readOnly: true
+          subPath: credentials.py
+        - mountPath: /etc/tower/SECRET_KEY
+          name: awx-secret-key
+          readOnly: true
+          subPath: SECRET_KEY
+        - mountPath: /etc/tower/settings.py
+          name: awx-settings
+          readOnly: true
+          subPath: settings.py
+        - mountPath: /var/run/redis
+          name: awx-redis-socket
+        - mountPath: /var/run/awx-rsyslog
+          name: rsyslog-socket
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 0
+        runAsUser: 0
+      serviceAccount: awx
+      serviceAccountName: awx
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: awx-receptor-ca
+        secret:
+          defaultMode: 420
+          secretName: awx-receptor-ca
+      - name: awx-receptor-work-signing
+        secret:
+          defaultMode: 420
+          secretName: awx-receptor-work-signing
+      - name: awx-application-credentials
+        secret:
+          defaultMode: 420
+          items:
+          - key: credentials.py
+            path: credentials.py
+          - key: ldap.py
+            path: ldap.py
+          - key: execution_environments.py
+            path: execution_environments.py
+          secretName: awx-app-credentials
+      - name: awx-secret-key
+        secret:
+          defaultMode: 420
+          items:
+          - key: secret_key
+            path: SECRET_KEY
+          secretName: awx-secret-key
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: settings
+            path: settings.py
+          name: awx-awx-configmap
+        name: awx-settings
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: nginx_conf
+            path: nginx.conf
+          name: awx-awx-configmap
+        name: awx-nginx-conf
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: redis_conf
+            path: redis.conf
+          name: awx-awx-configmap
+        name: awx-redis-config
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: uwsgi_conf
+            path: uwsgi.conf
+          name: awx-awx-configmap
+        name: awx-uwsgi-config
+      - emptyDir: {}
+        name: awx-redis-socket
+      - emptyDir: {}
+        name: awx-redis-data
+      - emptyDir: {}
+        name: rsyslog-socket
+      - emptyDir: {}
+        name: receptor-socket
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: receptor_conf
+            path: receptor.conf
+          name: awx-awx-configmap
+        name: awx-receptor-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    metallb.io/ip-allocated-from-pool: lan-pool
+    metallb.universe.tf/ip-allocated-from-pool: default-pool
+    metallb.universe.tf/loadBalancerIP: 140.44.4.30
+  finalizers:
+  - service.kubernetes.io/load-balancer-cleanup
+  name: awx-lb
+  namespace: awx
+spec:
+  allocateLoadBalancerNodePorts: true
+  clusterIP: 10.43.229.215
+  clusterIPs:
+  - 10.43.229.215
+  externalTrafficPolicy: Cluster
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  loadBalancerIP: 140.44.4.30
+  ports:
+  - name: webport
+    nodePort: 30015
+    port: 87
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/name: awx-web
+  sessionAffinity: None
+  type: LoadBalancer
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: awx
+    meta.helm.sh/release-namespace: awx
+  labels:
+    app.kubernetes.io/managed-by: Helm
+    control-plane: controller-manager
+    helm.sh/chart: awx-operator
+  name: awx-operator-controller-manager-metrics-service
+  namespace: awx
+spec:
+  clusterIP: 10.43.164.198
+  clusterIPs:
+  - 10.43.164.198
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: https
+    port: 8443
+    protocol: TCP
+    targetPort: https
+  selector:
+    control-plane: controller-manager
+    helm.sh/chart: awx-operator
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database
+    app.kubernetes.io/instance: postgres-15-awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/name: postgres-15
+    app.kubernetes.io/operator-version: 2.19.1
+    app.kubernetes.io/part-of: awx
+  name: awx-postgres-15
+  namespace: awx
+  ownerReferences:
+  - apiVersion: awx.ansible.com/v1beta1
+    kind: AWX
+    name: awx
+    uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
+spec:
+  clusterIP: None
+  clusterIPs:
+  - None
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - port: 5432
+    protocol: TCP
+    targetPort: 5432
+  selector:
+    app.kubernetes.io/component: database
+    app.kubernetes.io/instance: postgres-15-awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/name: postgres-15
+    app.kubernetes.io/part-of: awx
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/operator-version: 2.19.1
+    app.kubernetes.io/part-of: awx
+  name: awx-service
+  namespace: awx
+  ownerReferences:
+  - apiVersion: awx.ansible.com/v1beta1
+    kind: AWX
+    name: awx
+    uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
+spec:
+  clusterIP: 10.43.161.26
+  clusterIPs:
+  - 10.43.161.26
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8052
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8052
+  selector:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/managed-by: awx-operator
+    app.kubernetes.io/name: awx-web
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    traefik.ingress.kubernetes.io/service.serversscheme: http
+  labels:
+    app.kubernetes.io/component: awx
+    app.kubernetes.io/name: awx-web
+  name: awx-ingress
+  namespace: awx
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: awx.snarfnet.net
+    http:
+      paths:
+      - backend:
+          service:
+            name: awx-service
+            port:
+              number: 80
+        path: /
+        pathType: ImplementationSpecific
+  tls:
+  - hosts:
+    - awx.snarfnet.net
+    secretName: tls-awx-cert2

manifests/aerodrome/grafana/grafana.yaml

@@ -0,0 +1,252 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: grafana
+    meta.helm.sh/release-namespace: default
+  labels:
+    app.kubernetes.io/instance: grafana
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/version: 11.3.1
+    helm.sh/chart: grafana-8.6.4
+  name: grafana
+  namespace: default
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: grafana
+      app.kubernetes.io/name: grafana
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        cattle.io/timestamp: '2025-10-04T04:05:51Z'
+        checksum/config: f6e2070ec7fff0d4bb82d9a8fabedb9934e42e64a00d72e25402d46520734840
+        checksum/sc-dashboard-provider-config: e70bf6a851099d385178a76de9757bb0bef8299da6d8443602590e44f05fdf24
+        checksum/secret: 4eccb44a21c8117c1dbfbfe43f2ac844b240cd2482bc9fba8e4047442d121dc2
+        kubectl.kubernetes.io/default-container: grafana
+        kubectl.kubernetes.io/restartedAt: '2026-10-28T17:14:50.583825+00:00'
+      labels:
+        app.kubernetes.io/instance: grafana
+        app.kubernetes.io/name: grafana
+        app.kubernetes.io/version: 11.3.1
+        helm.sh/chart: grafana-8.6.4
+    spec:
+      automountServiceAccountToken: true
+      containers:
+      - env:
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: GF_SECURITY_ADMIN_USER
+          valueFrom:
+            secretKeyRef:
+              key: admin-user
+              name: grafana
+        - name: GF_SECURITY_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: admin-password
+              name: grafana
+        - name: GF_PATHS_DATA
+          value: /var/lib/grafana/
+        - name: GF_PATHS_LOGS
+          value: /var/log/grafana
+        - name: GF_PATHS_PLUGINS
+          value: /var/lib/grafana/plugins
+        - name: GF_PATHS_PROVISIONING
+          value: /etc/grafana/provisioning
+        image: docker.io/grafana/grafana:11.6.16
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /api/health
+            port: 3000
+            scheme: HTTP
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 30
+        name: grafana
+        ports:
+        - containerPort: 3000
+          name: grafana
+          protocol: TCP
+        - containerPort: 9094
+          name: gossip-tcp
+          protocol: TCP
+        - containerPort: 9094
+          name: gossip-udp
+          protocol: UDP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /api/health
+            port: 3000
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/grafana/grafana.ini
+          name: config
+          subPath: grafana.ini
+        - mountPath: /var/lib/grafana
+          name: storage
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: true
+      initContainers:
+      - command:
+        - chown
+        - -R
+        - 472:472
+        - /var/lib/grafana
+        image: docker.io/library/busybox:1.31.1
+        imagePullPolicy: IfNotPresent
+        name: init-chown-data
+        resources: {}
+        securityContext:
+          capabilities:
+            add:
+            - CHOWN
+          runAsNonRoot: false
+          runAsUser: 0
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/lib/grafana
+          name: storage
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 472
+        runAsGroup: 472
+        runAsNonRoot: true
+        runAsUser: 472
+      serviceAccount: grafana
+      serviceAccountName: grafana
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: grafana
+        name: config
+      - name: storage
+        persistentVolumeClaim:
+          claimName: grafana
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: grafana
+    meta.helm.sh/release-namespace: default
+  labels:
+    app.kubernetes.io/instance: grafana
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/version: 11.3.1
+    helm.sh/chart: grafana-8.6.4
+  name: grafana
+  namespace: default
+spec:
+  clusterIP: 10.43.216.183
+  clusterIPs:
+  - 10.43.216.183
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: service
+    port: 8080
+    protocol: TCP
+    targetPort: 3000
+  selector:
+    app.kubernetes.io/instance: grafana
+    app.kubernetes.io/name: grafana
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    metallb.io/ip-allocated-from-pool: lan-pool
+    metallb.universe.tf/ip-allocated-from-pool: default-pool
+    metallb.universe.tf/loadBalancerIP: 140.44.4.32
+  finalizers:
+  - service.kubernetes.io/load-balancer-cleanup
+  labels:
+    app.kubernetes.io/instance: grafana
+    app.kubernetes.io/name: grafana
+  name: grafana-lb
+  namespace: default
+spec:
+  allocateLoadBalancerNodePorts: true
+  clusterIP: 10.43.240.82
+  clusterIPs:
+  - 10.43.240.82
+  externalTrafficPolicy: Cluster
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  loadBalancerIP: 140.44.4.32
+  ports:
+  - name: grafana-lb
+    nodePort: 32758
+    port: 88
+    protocol: TCP
+    targetPort: 3000
+  selector:
+    app.kubernetes.io/instance: grafana
+    app.kubernetes.io/name: grafana
+  sessionAffinity: None
+  type: LoadBalancer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  labels:
+    app.kubernetes.io/instance: grafana
+    app.kubernetes.io/name: grafana
+  name: grafana
+  namespace: default
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: grafana.snarfnet.net
+    http:
+      paths:
+      - backend:
+          service:
+            name: grafana-lb
+            port:
+              number: 80
+        path: /
+        pathType: ImplementationSpecific
+  tls:
+  - hosts:
+    - grafana.snarfnet.net
+    secretName: firefly-tls-cert

manifests/aerodrome/uptime-kuma/uptime-kuma.yaml

@@ -0,0 +1,138 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: uptime-kuma-2-1756668961
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/instance: uptime-kuma-2-1756668961
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: uptime-kuma
+    app.kubernetes.io/version: 2.3.0
+    helm.sh/chart: uptime-kuma-4.1.0
+  name: uptime-kuma-2-1756668961
+  namespace: monitoring
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: uptime-kuma-2-1756668961
+      app.kubernetes.io/name: uptime-kuma
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        cattle.io/timestamp: '2026-09-30T03:22:55Z'
+      labels:
+        app.kubernetes.io/instance: uptime-kuma-2-1756668961
+        app.kubernetes.io/name: uptime-kuma
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - image: louislam/uptime-kuma:2.5.9
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command:
+            - extra/healthcheck
+          failureThreshold: 3
+          initialDelaySeconds: 180
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 2
+        name: uptime-kuma
+        ports:
+        - containerPort: 3001
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /
+            port: 3001
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+        securityContext: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /app/data
+          name: storage
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: default
+      serviceAccountName: default
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: storage
+        persistentVolumeClaim:
+          claimName: uptime-kuma-2-1756668961-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: uptime-kuma-2-1756668961
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/instance: uptime-kuma-2-1756668961
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: uptime-kuma
+    app.kubernetes.io/version: 2.3.0
+    helm.sh/chart: uptime-kuma-4.1.0
+  name: uptime-kuma-2-1756668961
+  namespace: monitoring
+spec:
+  clusterIP: 10.43.107.2
+  clusterIPs:
+  - 10.43.107.2
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 3001
+    protocol: TCP
+    targetPort: 3001
+  selector:
+    app.kubernetes.io/instance: uptime-kuma-2-1756668961
+    app.kubernetes.io/name: uptime-kuma
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: monitoring-authentik-forwardauth@kubernetescrd
+  labels:
+    app.kubernetes.io/name: uptime-kuma
+  name: uptime-ing
+  namespace: monitoring
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: uptime.snarfnet.net
+    http:
+      paths:
+      - backend:
+          service:
+            name: uptime-lb
+            port:
+              number: 448
+        path: /
+        pathType: ImplementationSpecific
+  tls:
+  - hosts:
+    - uptime.snarfnet.net
+    secretName: tls-uptime-cert