feat(gitops): populate declarative manifests for all 10 workloads and correct destination namespaces

manifests/spaceport/coder/coder.yaml

@@ -0,0 +1,173 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: coder
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: coder
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 2.34.3
+    helm.sh/chart: coder-2.34.3
+  name: coder
+  namespace: infrastructure
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: coder
+      app.kubernetes.io/name: coder
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        app.kubernetes.io/component: coderd
+        kubectl.kubernetes.io/restartedAt: '2026-10-28T17:41:30.902229+00:00'
+      labels:
+        app.kubernetes.io/instance: coder
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 2.34.3
+        helm.sh/chart: coder-2.34.3
+      namespace: infrastructure
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PPROF_ADDRESS
+          value: 0.0.0.0:6060
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: CODER_ACCESS_URL
+          value: https://coder.snarfnet.net
+        - name: CODER_OIDC_ISSUER_URL
+          value: https://authentik.snarfnet.net/application/o/coder/
+        - name: CODER_OIDC_CLIENT_ID
+          value: coder-86c7516d
+        - name: CODER_OIDC_CLIENT_SECRET
+          value: GWYwV816HcUZpl_qqG9lTmI-85QihNJexaoS8tL8AoDGqQ4opwwWbw
+        - name: CODER_OIDC_SCOPES
+          value: openid,profile,email,groups
+        - name: CODER_OIDC_SIGN_IN_TEXT
+          value: Sign in with Authentik
+        - name: CODER_OIDC_ALLOW_SIGNUPS
+          value: 'true'
+        image: ghcr.io/coder/coder:v2.38.6
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: '2'
+            memory: 1028Mi
+          requests:
+            cpu: '2'
+            memory: 1028Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /home/coder
+          name: coder-data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: coder
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes:
+      - name: coder-data
+        persistentVolumeClaim:
+          claimName: coder-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: coder
+    meta.helm.sh/release-namespace: infrastructure
+    metallb.io/ip-allocated-from-pool: lan-pool
+    metallb.universe.tf/loadBalancerIP: 140.44.4.58
+  finalizers:
+  - service.kubernetes.io/load-balancer-cleanup
+  labels:
+    app.kubernetes.io/instance: coder
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 2.34.3
+    helm.sh/chart: coder-2.34.3
+  name: coder
+  namespace: infrastructure
+spec:
+  allocateLoadBalancerNodePorts: true
+  clusterIP: 10.43.128.151
+  clusterIPs:
+  - 10.43.128.151
+  externalTrafficPolicy: Cluster
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  loadBalancerIP: 140.44.4.58
+  ports:
+  - name: http
+    nodePort: 31775
+    port: 96
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: coder
+    app.kubernetes.io/name: coder
+  sessionAffinity: None
+  type: LoadBalancer

manifests/spaceport/homepage/homepage.yaml

@@ -0,0 +1,195 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: homepage-2-1744068158
+    meta.helm.sh/release-namespace: infrastructure
+    values-checksum: 49348e8f2cbd3272bd4954b0c4ff1480780ebd91277816507927bed3fbb0043a
+  labels:
+    app.kubernetes.io/instance: homepage-2-1744068158
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: homepage-2-1744068158
+    app.kubernetes.io/version: v1.2.0
+    helm.sh/chart: homepage-2.1.0
+  name: homepage-2-1744068158
+  namespace: infrastructure
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: homepage-2-1744068158
+      app.kubernetes.io/name: homepage-2-1744068158
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        cattle.io/timestamp: '2026-01-09T21:19:17Z'
+        values-checksum: 49348e8f2cbd3272bd4954b0c4ff1480780ebd91277816507927bed3fbb0043a
+      labels:
+        app.kubernetes.io/instance: homepage-2-1744068158
+        app.kubernetes.io/name: homepage-2-1744068158
+    spec:
+      automountServiceAccountToken: true
+      containers:
+      - env:
+        - name: HOMEPAGE_ALLOWED_HOSTS
+          value: homepage.snarfnet.net
+        image: ghcr.io/gethomepage/homepage:v1.4.5
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 3000
+          timeoutSeconds: 1
+        name: homepage-2-1744068158
+        ports:
+        - containerPort: 3000
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 3000
+          timeoutSeconds: 1
+        resources: {}
+        startupProbe:
+          failureThreshold: 30
+          periodSeconds: 5
+          successThreshold: 1
+          tcpSocket:
+            port: 3000
+          timeoutSeconds: 1
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /app/config
+          name: homepage-base-config
+        - mountPath: /app/config/bookmarks.yaml
+          name: homepage-config
+          subPath: bookmarks.yaml
+        - mountPath: /app/config/docker.yaml
+          name: homepage-config
+          subPath: docker.yaml
+        - mountPath: /app/config/kubernetes.yaml
+          name: homepage-config
+          subPath: kubernetes.yaml
+        - mountPath: /app/config/services.yaml
+          name: homepage-config
+          subPath: services.yaml
+        - mountPath: /app/config/settings.yaml
+          name: homepage-config
+          subPath: settings.yaml
+        - mountPath: /app/config/widgets.yaml
+          name: homepage-config
+          subPath: widgets.yaml
+        - mountPath: /app/config/logs
+          name: logs
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: default
+      serviceAccountName: default
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - emptyDir: {}
+        name: homepage-base-config
+      - configMap:
+          defaultMode: 420
+          name: homepage-2-1744068158
+        name: homepage-config
+      - emptyDir: {}
+        name: logs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: homepage-2-1744068158
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: homepage-2-1744068158
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: homepage-2-1744068158
+    app.kubernetes.io/service: homepage-2-1744068158
+    app.kubernetes.io/version: v1.2.0
+    helm.sh/chart: homepage-2.1.0
+  name: homepage-2-1744068158
+  namespace: infrastructure
+spec:
+  clusterIP: 10.43.36.247
+  clusterIPs:
+  - 10.43.36.247
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 3000
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: homepage-2-1744068158
+    app.kubernetes.io/name: homepage-2-1744068158
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  bookmarks.yaml: "- Developer:\n  - Github:\n    - abbr: GH\n      href: https://github.com/\n"
+  docker.yaml: ''
+  kubernetes.yaml: 'mode: disable
+
+    '
+  services.yaml: "- Critical Services:\n  - Authentik:\n      icon: authentik.png\n\
+    \      href: https://authentik.snarfnet.net\n      widget:\n       type: authentik\n\
+    \       url: https://authentik.snarfnet.net\n       fields: [\"users\", \"loginsLast24H\"\
+    , \"failedLoginsLast24H\"]\n       key: 7HamapUhYizcNudHDIT5IFy3XEpRgeKgqr1Pw4ub9eTpAjMAzB8Aur1Z6dUU\n\
+    \  - PeaNUT UPS:\n      icon: peanut.png\n      href: https://portal.snarfnet.net\n\
+    \      widget:\n       type: peanut\n       url: https://peanut.snarfnet.net\n\
+    \       fields: [\"battery_charge\", \"ups_load\", \"ups_status\"]\n       key:\
+    \ server-closet\n  - Unifi Controller:\n      icon: unifi.png\n      href: https://unifi.ui.com\n\
+    \      widget:\n       type: unifi\n       url: https://140.44.44.1\n       username:\
+    \ Snarf\n       password: Katzir476!!!\n- Git Ops:\n  - Gitea:\n      icon: gitea.png\n\
+    \      href: https://git.snarfnet.net\n      widget:\n       type: gitea\n   \
+    \    url: https://git.snarfnet.net\n       fields: [\"repositories\", \"notifications\"\
+    , \"issues\", \"pulls\"]\n       key: 47c10c54574131c007302b246352f653facb5062\n\
+    - Infrastructure:\n  - NGINX proxy manager:\n      icon: nginx-proxy-manager\n\
+    \      href: https://nginx.snarfnet.net\n      widget:\n        type: npm\n  \
+    \      url: https://nginx.snarfnet.net\n        fields: [\"enabled\", \"disabled\"\
+    , \"total\"]\n        username: snarf@snarfnet.net\n        password: Katzir476!\n\
+    \  - Uptime Kuma:\n      icon: uptime-kuma\n      href: https://uptime.snarfnet.net\n\
+    \      widget:\n        type: uptimekuma\n        url: https://uptime.snarfnet.net\n\
+    \        fields: [\"up\", \"down\", \"uptime\", \"incident\"]\n        slug: public\n"
+  settings.yaml: "title: SnarfNet Landing Zone\nheaderStyle: boxedWidgets\ncolor:\
+    \ green\ntheme: dark\nlayout:\n  Critical Services:\n  Git Ops:\n  Infrastructure:\n\
+    showStats: true\nproviders:\n  longhorn:\n    url: https://longhorn.aerodrome.snarfnet.net\n"
+  widgets.yaml: "- resources:\n    backend: resources\n    cpu: true\n    expanded:\
+    \ true\n    memory: true\n- search:\n    provider: duckduckgo\n    target: _blank\n\
+    - longhorn:\n    expanded: true\n    total: true\n    labels: true\n    nodes:\
+    \ true\n"
+kind: ConfigMap
+metadata:
+  annotations:
+    meta.helm.sh/release-name: homepage-2-1744068158
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: homepage-2-1744068158
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: homepage-2-1744068158
+    app.kubernetes.io/version: v1.2.0
+    helm.sh/chart: homepage-2.1.0
+  name: homepage-2-1744068158
+  namespace: infrastructure

manifests/spaceport/jenkins/jenkins.yaml

@@ -0,0 +1,336 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  annotations:
+    meta.helm.sh/release-name: jenkins
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/component: jenkins-controller
+    app.kubernetes.io/instance: jenkins
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: jenkins
+    helm.sh/chart: jenkins-5.9.18
+  name: jenkins
+  namespace: infrastructure
+spec:
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  podManagementPolicy: OrderedReady
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: jenkins-controller
+      app.kubernetes.io/instance: jenkins
+  serviceName: jenkins
+  template:
+    metadata:
+      annotations:
+        checksum/config: ad12688985f56d830ccee6722b20739f268bf95f97d84591925bb0a0d9b871f0
+      labels:
+        app.kubernetes.io/component: jenkins-controller
+        app.kubernetes.io/instance: jenkins
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: jenkins
+        helm.sh/chart: jenkins-5.9.18
+    spec:
+      automountServiceAccountToken: true
+      containers:
+      - args:
+        - --httpPort=8080
+        env:
+        - name: SECRETS
+          value: /run/secrets/additional
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: JAVA_OPTS
+          value: '-Dcasc.reload.token=$(POD_NAME) '
+        - name: JENKINS_OPTS
+          value: '--webroot=/var/jenkins_cache/war '
+        - name: JENKINS_SLAVE_AGENT_PORT
+          value: '50000'
+        - name: CASC_JENKINS_CONFIG
+          value: /var/jenkins_home/casc_configs
+        image: docker.io/jenkins/jenkins:2.589-jdk21
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /login
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: jenkins
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        - containerPort: 50000
+          name: agent-listener
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /login
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        resources:
+          limits:
+            cpu: '2'
+            memory: 4Gi
+          requests:
+            cpu: 50m
+            memory: 256Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 1000
+          runAsUser: 1000
+        startupProbe:
+          failureThreshold: 12
+          httpGet:
+            path: /login
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/jenkins_home
+          name: jenkins-home
+        - mountPath: /var/jenkins_config
+          name: jenkins-config
+          readOnly: true
+        - mountPath: /usr/share/jenkins/ref/plugins/
+          name: plugin-dir
+        - mountPath: /var/jenkins_home/casc_configs
+          name: sc-config-volume
+        - mountPath: /run/secrets/additional
+          name: jenkins-secrets
+          readOnly: true
+        - mountPath: /var/jenkins_cache
+          name: jenkins-cache
+        - mountPath: /tmp
+          name: tmp-volume
+      - env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: LABEL
+          value: jenkins-jenkins-config
+        - name: HEALTH_PORT
+          value: '8060'
+        - name: FOLDER
+          value: /var/jenkins_home/casc_configs
+        - name: NAMESPACE
+          value: infrastructure
+        - name: REQ_URL
+          value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)
+        - name: REQ_METHOD
+          value: POST
+        - name: REQ_RETRY_CONNECT
+          value: '10'
+        image: docker.io/kiwigrid/k8s-sidecar:2.6.0
+        imagePullPolicy: IfNotPresent
+        name: config-reload
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/jenkins_home/casc_configs
+          name: sc-config-volume
+        - mountPath: /var/jenkins_home
+          name: jenkins-home
+        - mountPath: /tmp
+          name: tmp-volume
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: false
+      initContainers:
+      - env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: LABEL
+          value: jenkins-jenkins-config
+        - name: HEALTH_PORT
+          value: '8060'
+        - name: FOLDER
+          value: /var/jenkins_home/casc_configs
+        - name: NAMESPACE
+          value: infrastructure
+        - name: METHOD
+          value: LIST
+        image: docker.io/kiwigrid/k8s-sidecar:2.6.0
+        imagePullPolicy: IfNotPresent
+        name: config-reload-init
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/jenkins_home/casc_configs
+          name: sc-config-volume
+        - mountPath: /var/jenkins_home
+          name: jenkins-home
+        - mountPath: /tmp
+          name: tmp-volume
+      - command:
+        - sh
+        - /var/jenkins_config/apply_config.sh
+        image: docker.io/jenkins/jenkins:2.555.1-jdk21
+        imagePullPolicy: Always
+        name: init
+        resources:
+          limits:
+            cpu: '2'
+            memory: 4Gi
+          requests:
+            cpu: 50m
+            memory: 256Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 1000
+          runAsUser: 1000
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/jenkins_home
+          name: jenkins-home
+        - mountPath: /var/jenkins_config
+          name: jenkins-config
+        - mountPath: /usr/share/jenkins/ref/plugins
+          name: plugins
+        - mountPath: /var/jenkins_plugins
+          name: plugin-dir
+        - mountPath: /tmp
+          name: tmp-volume
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        runAsNonRoot: true
+        runAsUser: 1000
+      serviceAccount: jenkins
+      serviceAccountName: jenkins
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - emptyDir: {}
+        name: plugins
+      - configMap:
+          defaultMode: 420
+          name: jenkins
+        name: jenkins-config
+      - emptyDir: {}
+        name: plugin-dir
+      - name: jenkins-secrets
+        projected:
+          defaultMode: 420
+          sources:
+          - secret:
+              items:
+              - key: jenkins-admin-user
+                path: chart-admin-username
+              - key: jenkins-admin-password
+                path: chart-admin-password
+              name: jenkins
+      - emptyDir: {}
+        name: jenkins-cache
+      - name: jenkins-home
+        persistentVolumeClaim:
+          claimName: jenkins
+      - emptyDir: {}
+        name: sc-config-volume
+      - emptyDir: {}
+        name: tmp-volume
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+    type: RollingUpdate
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: jenkins
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/component: jenkins-controller
+    app.kubernetes.io/instance: jenkins
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: jenkins
+    helm.sh/chart: jenkins-5.9.18
+  name: jenkins
+  namespace: infrastructure
+spec:
+  clusterIP: 10.43.106.157
+  clusterIPs:
+  - 10.43.106.157
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 101
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app.kubernetes.io/component: jenkins-controller
+    app.kubernetes.io/instance: jenkins
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: jenkins
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/component: jenkins-controller
+    app.kubernetes.io/instance: jenkins
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: jenkins
+    helm.sh/chart: jenkins-5.9.18
+  name: jenkins-agent
+  namespace: infrastructure
+spec:
+  clusterIP: 10.43.107.50
+  clusterIPs:
+  - 10.43.107.50
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: agent-listener
+    port: 50000
+    protocol: TCP
+    targetPort: 50000
+  selector:
+    app.kubernetes.io/component: jenkins-controller
+    app.kubernetes.io/instance: jenkins
+  sessionAffinity: None
+  type: ClusterIP

manifests/spaceport/semaphore/semaphore.yaml

@@ -0,0 +1,302 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: semaphore
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: semaphore
+    app.kubernetes.io/version: 2.17.34
+    helm.sh/chart: semaphore-16.1.2
+  name: semaphore
+  namespace: infrastructure
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: semaphore
+      app.kubernetes.io/name: semaphore
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        checksum/config: 6db2d80fdda45e7be278174345179b6ece77d6ca957902f08bb3ba861921e4a8
+        checksum/secret-admin: 3c0ad6cefcee43617216b7c1703bdd864766da7cee9e43f18724fe4a70c89545
+        checksum/secret-general: 91136cb91b1e8cc2540294d8ecd541338bffdb2127897e8bea112160e6a3705d
+        checksum/secret-runner: 8e3582b533083a64b4205c22d9b2d476f93d90b27276d88e74fe4c885f7db60a
+        kubectl.kubernetes.io/restartedAt: '2026-10-28T18:13:14.547755+00:00'
+      labels:
+        app.kubernetes.io/instance: semaphore
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: semaphore
+        app.kubernetes.io/version: 2.17.34
+        helm.sh/chart: semaphore-16.1.2
+    spec:
+      containers:
+      - env:
+        - name: SEMAPHORE_PORT
+          value: '3000'
+        - name: SEMAPHORE_GIT_CLIENT
+          value: cmd_git
+        - name: SEMAPHORE_TMP_PATH
+          value: /tmp/semaphore
+        - name: SEMAPHORE_MAX_PARALLEL_TASKS
+          value: '0'
+        - name: SEMAPHORE_PASSWORD_LOGIN_DISABLED
+          value: 'false'
+        - name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT
+          value: 'false'
+        - name: SEMAPHORE_USE_REMOTE_RUNNER
+          value: 'false'
+        - name: SEMAPHORE_DB_DIALECT
+          value: bolt
+        - name: SEMAPHORE_DB_HOST
+          value: /var/lib/semaphore/database.boltdb
+        - name: SEMAPHORE_LDAP_ENABLE
+          value: 'false'
+        - name: SEMAPHORE_EMAIL_ALERT
+          value: 'false'
+        - name: SEMAPHORE_TELEGRAM_ALERT
+          value: 'false'
+        - name: SEMAPHORE_SLACK_ALERT
+          value: 'false'
+        - name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: semaphore-runner
+        - name: SEMAPHORE_COOKIE_HASH
+          valueFrom:
+            secretKeyRef:
+              key: cookieHash
+              name: semaphore-general
+        - name: SEMAPHORE_COOKIE_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: cookieEncryption
+              name: semaphore-general
+        - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: accesskeyEncryption
+              name: semaphore-general
+        - name: SEMAPHORE_OIDC_PROVIDERS
+          value: '{"authentik": {"display_name": "Sign in with Authentik", "provider_url":
+            "https://authentik.snarfnet.net/application/o/semaphore/", "client_id":
+            "semaphore-2e50dbdf", "client_secret": "V4uazPXN9toUn5Jf2DfsRIFrygf1T0Vcltga-APrzTRjWFN0DIIqNw",
+            "redirect_url": "https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect/",
+            "username_claim": "preferred_username", "name_claim": "name", "email_claim":
+            "email", "scopes": ["openid", "profile", "email", "groups"]}}'
+        - name: SEMAPHORE_WEB_HOST
+          value: https://semaphore.snarfnet.net
+        image: semaphoreui/semaphore:v2.17.34
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: semaphore
+        ports:
+        - containerPort: 3000
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/semaphore/config.json
+          name: config
+          subPath: config.json
+        - mountPath: /tmp/semaphore
+          name: workdir
+        - mountPath: /var/lib/semaphore
+          name: boltdb
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - command:
+        - sh
+        - -c
+        - "if ! semaphore user get --config=/etc/semaphore/config.json --login $(SEMAPHORE_ADMIN_USERNAME)\
+          \ >/dev/null; then\n  semaphore user add \\\n    --config=/etc/semaphore/config.json\
+          \ \\\n    --admin \\\n    --name=$(SEMAPHORE_ADMIN_FULLNAME) \\\n    --login=$(SEMAPHORE_ADMIN_USERNAME)\
+          \ \\\n    --password=$(SEMAPHORE_ADMIN_PASSWORD) \\\n    --email=$(SEMAPHORE_ADMIN_EMAIL)\n\
+          else\n  echo \"Admin already extists\"\nfi\n"
+        env:
+        - name: SEMAPHORE_ADMIN_FULLNAME
+          valueFrom:
+            secretKeyRef:
+              key: fullname
+              name: semaphore-admin
+        - name: SEMAPHORE_ADMIN_USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: semaphore-admin
+        - name: SEMAPHORE_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: semaphore-admin
+        - name: SEMAPHORE_ADMIN_EMAIL
+          valueFrom:
+            secretKeyRef:
+              key: email
+              name: semaphore-admin
+        - name: SEMAPHORE_PORT
+          value: '3000'
+        - name: SEMAPHORE_GIT_CLIENT
+          value: cmd_git
+        - name: SEMAPHORE_TMP_PATH
+          value: /tmp/semaphore
+        - name: SEMAPHORE_SSH_PATH
+        - name: SEMAPHORE_MAX_PARALLEL_TASKS
+          value: '0'
+        - name: SEMAPHORE_PASSWORD_LOGIN_DISABLED
+          value: 'false'
+        - name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT
+          value: 'false'
+        - name: SEMAPHORE_USE_REMOTE_RUNNER
+          value: 'false'
+        - name: SEMAPHORE_DB_DIALECT
+          value: bolt
+        - name: SEMAPHORE_DB_HOST
+          value: /var/lib/semaphore/database.boltdb
+        - name: SEMAPHORE_LDAP_ENABLE
+          value: 'false'
+        - name: SEMAPHORE_EMAIL_ALERT
+          value: 'false'
+        - name: SEMAPHORE_TELEGRAM_ALERT
+          value: 'false'
+        - name: SEMAPHORE_SLACK_ALERT
+          value: 'false'
+        - name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: semaphore-runner
+        - name: SEMAPHORE_COOKIE_HASH
+          valueFrom:
+            secretKeyRef:
+              key: cookieHash
+              name: semaphore-general
+        - name: SEMAPHORE_COOKIE_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: cookieEncryption
+              name: semaphore-general
+        - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: accesskeyEncryption
+              name: semaphore-general
+        image: semaphoreui/semaphore:v2.17.34
+        imagePullPolicy: IfNotPresent
+        name: admin
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/semaphore/config.json
+          name: config
+          subPath: config.json
+        - mountPath: /tmp/semaphore
+          name: workdir
+        - mountPath: /var/lib/semaphore
+          name: boltdb
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 1001
+      serviceAccount: semaphore
+      serviceAccountName: semaphore
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: semaphore-config
+        name: config
+      - name: workdir
+        persistentVolumeClaim:
+          claimName: semaphore-workdir
+      - name: boltdb
+        persistentVolumeClaim:
+          claimName: semaphore-boltdb
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: semaphore
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: semaphore
+    app.kubernetes.io/version: 2.17.34
+    helm.sh/chart: semaphore-16.1.2
+  name: semaphore
+  namespace: infrastructure
+spec:
+  clusterIP: 10.43.119.206
+  clusterIPs:
+  - 10.43.119.206
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 3000
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/name: semaphore
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  config.json: '{
+
+    }
+
+    '
+kind: ConfigMap
+metadata:
+  annotations:
+    meta.helm.sh/release-name: semaphore
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: semaphore
+    app.kubernetes.io/version: 2.17.34
+    helm.sh/chart: semaphore-16.1.2
+  name: semaphore-config
+  namespace: infrastructure

manifests/spaceport/zabbix/zabbix.yaml

@@ -0,0 +1,599 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-zabbix-server
+  namespace: monitoring
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: server
+      app.kubernetes.io/instance: zabbix
+      app.kubernetes.io/name: zabbix
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: server
+        app.kubernetes.io/instance: zabbix
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: zabbix
+        app.kubernetes.io/version: 7.0.16
+        helm.sh/chart: zabbix-7.0.12
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: server
+                  app.kubernetes.io/instance: zabbix
+                  app.kubernetes.io/name: zabbix
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - env:
+        - name: DB_SERVER_HOST
+          value: zabbix-postgresql
+        - name: DB_SERVER_PORT
+          value: '5432'
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: zabbix-db-access
+              optional: true
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: zabbix-db-access
+        - name: POSTGRES_DB
+          value: zabbix
+        - name: ZBX_NODEADDRESS
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: ZBX_WEBSERVICEURL
+          value: http://zabbix-zabbix-webservice:10053/report
+        - name: ZBX_STARTREPORTWRITERS
+          value: '1'
+        - name: ZBX_JAVAGATEWAY_ENABLE
+          value: 'false'
+        - name: ZBX_WEBDRIVERURL
+          value: http://zabbix-chrome:4444
+        image: zabbix/zabbix-server-pgsql:ubuntu-7.0.32
+        imagePullPolicy: IfNotPresent
+        name: zabbix-server
+        ports:
+        - containerPort: 10051
+          name: zabbix-server
+          protocol: TCP
+        - containerPort: 10052
+          name: zabbix-jmx
+          protocol: TCP
+        resources: {}
+        securityContext: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - env:
+        - name: ZBX_HOSTNAME
+          value: Zabbix server
+        - name: ZBX_SERVER_HOST
+          value: 0.0.0.0/0
+        - name: ZBX_SERVER_PORT
+          value: '10051'
+        - name: ZBX_PASSIVE_ALLOW
+          value: 'true'
+        - name: ZBX_PASSIVESERVERS
+        - name: ZBX_ACTIVE_ALLOW
+          value: 'false'
+        - name: ZBX_ACTIVESERVERS
+        - name: ZBX_DEBUGLEVEL
+          value: '3'
+        - name: ZBX_TIMEOUT
+          value: '4'
+        - name: ZBX_LOADMODULE
+        image: zabbix/zabbix-agent2:ubuntu-7.0.32
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: zabbix-agent
+          timeoutSeconds: 3
+        name: zabbix-agent
+        ports:
+        - containerPort: 10050
+          name: zabbix-agent
+          protocol: TCP
+        resources: {}
+        securityContext: {}
+        startupProbe:
+          failureThreshold: 5
+          initialDelaySeconds: 15
+          periodSeconds: 5
+          successThreshold: 1
+          tcpSocket:
+            port: zabbix-agent
+          timeoutSeconds: 3
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: zabbix
+      serviceAccountName: zabbix
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/component: web
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-zabbix-web
+  namespace: monitoring
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: web
+      app.kubernetes.io/instance: zabbix
+      app.kubernetes.io/name: zabbix
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/restartedAt: '1793197639.2173924'
+      labels:
+        app.kubernetes.io/component: web
+        app.kubernetes.io/instance: zabbix
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: zabbix
+        app.kubernetes.io/version: 7.0.16
+        helm.sh/chart: zabbix-7.0.12
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: zabbix-zabbix-web
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - env:
+        - name: DB_SERVER_HOST
+          value: zabbix-postgresql
+        - name: DB_SERVER_PORT
+          value: '5432'
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: zabbix-db-access
+              optional: true
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: zabbix-db-access
+        - name: POSTGRES_DB
+          value: zabbix
+        image: zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.32
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 6
+          httpGet:
+            path: /ping
+            port: zabbix-web
+            scheme: HTTP
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: zabbix-web
+        ports:
+        - containerPort: 8080
+          name: zabbix-web
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 6
+          httpGet:
+            path: /ping
+            port: zabbix-web
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        resources: {}
+        securityContext: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /usr/share/zabbix/conf/certs
+          name: saml-certs
+        - mountPath: /etc/zabbix/web/certs
+          name: saml-certs
+        - mountPath: /etc/nginx/fastcgi_params
+          name: saml-certs
+          subPath: fastcgi_params
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: zabbix
+      serviceAccountName: zabbix
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: zabbix-saml-certs
+        name: saml-certs
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/component: webservice
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-zabbix-webservice
+  namespace: monitoring
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: webservice
+      app.kubernetes.io/instance: zabbix
+      app.kubernetes.io/name: zabbix
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: webservice
+        app.kubernetes.io/instance: zabbix
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: zabbix
+        app.kubernetes.io/version: 7.0.16
+        helm.sh/chart: zabbix-7.0.12
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: zabbix-zabbix-webservice
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - env:
+        - name: ZBX_ALLOWEDIP
+          value: ::/0
+        image: zabbix/zabbix-web-service:ubuntu-7.0.32
+        imagePullPolicy: IfNotPresent
+        name: zabbix-webservice
+        ports:
+        - containerPort: 10053
+          name: webservice
+          protocol: TCP
+        resources: {}
+        securityContext: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: zabbix
+      serviceAccountName: zabbix
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/component: postgresql
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-postgresql
+  namespace: monitoring
+spec:
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  podManagementPolicy: OrderedReady
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: postgresql
+      app.kubernetes.io/instance: zabbix
+      app.kubernetes.io/name: zabbix
+  serviceName: zabbix
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: postgresql
+        app.kubernetes.io/instance: zabbix
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: zabbix
+        app.kubernetes.io/version: 7.0.16
+        helm.sh/chart: zabbix-7.0.12
+    spec:
+      containers:
+      - args:
+        - -c
+        - max_connections=100
+        env:
+        - name: DB_SERVER_HOST
+          value: zabbix-postgresql
+        - name: DB_SERVER_PORT
+          value: '5432'
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: zabbix-db-access
+              optional: true
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: zabbix-db-access
+        - name: POSTGRES_DB
+          value: zabbix
+        - name: PGDATA
+          value: /var/lib/postgresql/data/pgdata
+        image: postgres:16
+        imagePullPolicy: IfNotPresent
+        name: postgresql
+        ports:
+        - containerPort: 5432
+          name: db
+          protocol: TCP
+        resources: {}
+        securityContext: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/lib/postgresql/data
+          name: postgresql-data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: zabbix
+      serviceAccountName: zabbix
+      terminationGracePeriodSeconds: 30
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+    type: RollingUpdate
+  volumeClaimTemplates:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: postgresql-data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 50Gi
+      volumeMode: Filesystem
+    status:
+      phase: Pending
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/component: postgresql
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-postgresql
+  namespace: monitoring
+spec:
+  clusterIP: 10.43.246.111
+  clusterIPs:
+  - 10.43.246.111
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: db
+    port: 5432
+    protocol: TCP
+    targetPort: 5432
+  selector:
+    app.kubernetes.io/component: postgresql
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/name: zabbix
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+    metallb.io/ip-allocated-from-pool: lan-pool
+    metallb.universe.tf/loadBalancerIP: 140.44.4.64
+  finalizers:
+  - service.kubernetes.io/load-balancer-cleanup
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-zabbix-server
+  namespace: monitoring
+spec:
+  allocateLoadBalancerNodePorts: true
+  clusterIP: 10.43.14.128
+  clusterIPs:
+  - 10.43.14.128
+  externalTrafficPolicy: Cluster
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  loadBalancerIP: 140.44.4.64
+  ports:
+  - name: zabbix-server
+    nodePort: 32156
+    port: 10051
+    protocol: TCP
+    targetPort: 10051
+  - name: zabbix-jmx
+    nodePort: 31105
+    port: 10052
+    protocol: TCP
+    targetPort: 10052
+  selector:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/name: zabbix
+  sessionAffinity: None
+  type: LoadBalancer
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+    metallb.io/ip-allocated-from-pool: lan-pool
+    metallb.universe.tf/loadBalancerIP: 140.44.4.60
+  finalizers:
+  - service.kubernetes.io/load-balancer-cleanup
+  labels:
+    app.kubernetes.io/component: web
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-zabbix-web
+  namespace: monitoring
+spec:
+  allocateLoadBalancerNodePorts: true
+  clusterIP: 10.43.156.214
+  clusterIPs:
+  - 10.43.156.214
+  externalTrafficPolicy: Cluster
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  loadBalancerIP: 140.44.4.60
+  ports:
+  - name: zabbix-web
+    nodePort: 31080
+    port: 8888
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app.kubernetes.io/component: web
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/name: zabbix
+  sessionAffinity: None
+  type: LoadBalancer
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: zabbix
+    meta.helm.sh/release-namespace: monitoring
+  labels:
+    app.kubernetes.io/component: webservice
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: zabbix
+    app.kubernetes.io/version: 7.0.16
+    helm.sh/chart: zabbix-7.0.12
+  name: zabbix-zabbix-webservice
+  namespace: monitoring
+spec:
+  clusterIP: 10.43.76.219
+  clusterIPs:
+  - 10.43.76.219
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: webservice
+    port: 10053
+    protocol: TCP
+    targetPort: 10053
+  selector:
+    app.kubernetes.io/component: webservice
+    app.kubernetes.io/instance: zabbix
+    app.kubernetes.io/name: zabbix
+  sessionAffinity: None
+  type: ClusterIP