fix: remove email from cert-manager, update ks namespace

[slipperypenguin]

No description provided.

[github-actions]

--- kubernetes/apps/cert-manager/cert-manager/issuers Kustomization: flux-system/cert-manager-issuers ClusterIssuer: cert-manager/letsencrypt-production

+++ kubernetes/apps/cert-manager/cert-manager/issuers Kustomization: flux-system/cert-manager-issuers ClusterIssuer: cert-manager/letsencrypt-production

@@ -7,13 +7,12 @@

     kustomize.toolkit.fluxcd.io/name: cert-manager-issuers
     kustomize.toolkit.fluxcd.io/namespace: flux-system
   name: letsencrypt-production
   namespace: cert-manager
 spec:
   acme:
-    email: ..PLACEHOLDER_SECRET_ACME_EMAIL..
     privateKeySecretRef:
       name: letsencrypt-production
     server: https://acme-v02.api.letsencrypt.org/directory
     solvers:
     - dns01:
         cloudflare:
--- kubernetes/apps/cert-manager/cert-manager/issuers Kustomization: flux-system/cert-manager-issuers ClusterIssuer: cert-manager/letsencrypt-staging

+++ kubernetes/apps/cert-manager/cert-manager/issuers Kustomization: flux-system/cert-manager-issuers ClusterIssuer: cert-manager/letsencrypt-staging

@@ -7,13 +7,12 @@

     kustomize.toolkit.fluxcd.io/name: cert-manager-issuers
     kustomize.toolkit.fluxcd.io/namespace: flux-system
   name: letsencrypt-staging
   namespace: cert-manager
 spec:
   acme:
-    email: ..PLACEHOLDER_SECRET_ACME_EMAIL..
     privateKeySecretRef:
       name: letsencrypt-staging
     server: https://acme-staging-v02.api.letsencrypt.org/directory
     solvers:
     - dns01:
         cloudflare:
--- kubernetes/apps/volsync-system/snapshot-controller/app Kustomization: volsync-system/snapshot-controller HelmRelease: volsync-system/snapshot-controller

+++ kubernetes/apps/volsync-system/snapshot-controller/app Kustomization: volsync-system/snapshot-controller HelmRelease: volsync-system/snapshot-controller

@@ -1,36 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: snapshot-controller
-    kustomize.toolkit.fluxcd.io/name: snapshot-controller
-    kustomize.toolkit.fluxcd.io/namespace: volsync-system
-  name: snapshot-controller
-  namespace: volsync-system
-spec:
-  chart:
-    spec:
-      chart: snapshot-controller
-      sourceRef:
-        kind: HelmRepository
-        name: piraeus
-        namespace: flux-system
-      version: 4.0.1
-  install:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  interval: 30m
-  upgrade:
-    cleanupOnFail: true
-    crds: CreateReplace
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    controller:
-      replicaCount: 1
-      serviceMonitor:
-        create: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/not-used

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/not-used

@@ -1,11 +0,0 @@

----
-apiVersion: v1
-kind: Namespace
-metadata:
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: not-used
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: rook-ceph/rook-ceph

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: rook-ceph/rook-ceph

@@ -1,39 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: rook-ceph
-  namespace: rook-ceph
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: rook-ceph
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-  - name: onepassword-store
-    namespace: flux-system
-  interval: 30m
-  path: ./kubernetes/apps/rook-ceph/rook-ceph/app
-  postBuild:
-    substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-      optional: true
-    - kind: Secret
-      name: cluster-secrets
-      optional: true
-  prune: false
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: rook-ceph
-  timeout: 5m
-  wait: false
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: rook-ceph/rook-ceph-cluster

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: rook-ceph/rook-ceph-cluster

@@ -1,41 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: rook-ceph-cluster
-  namespace: rook-ceph
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: rook-ceph-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-  - name: onepassword-store
-    namespace: flux-system
-  interval: 30m
-  path: ./kubernetes/apps/rook-ceph/rook-ceph/cluster
-  postBuild:
-    substitute:
-      APP: rook-ceph-cluster
-    substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-      optional: true
-    - kind: Secret
-      name: cluster-secrets
-      optional: true
-  prune: false
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: rook-ceph
-  timeout: 15m
-  wait: false
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: volsync-system/snapshot-controller

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: volsync-system/snapshot-controller

@@ -1,36 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: snapshot-controller
-  namespace: volsync-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: snapshot-controller
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  interval: 30m
-  path: ./kubernetes/apps/volsync-system/snapshot-controller/app
-  postBuild:
-    substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-      optional: true
-    - kind: Secret
-      name: cluster-secrets
-      optional: true
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: volsync-system
-  timeout: 5m
-  wait: false
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/actions-runner-system

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/actions-runner-system

@@ -0,0 +1,11 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: actions-runner-system
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/rook-ceph

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/rook-ceph

@@ -0,0 +1,39 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: rook-ceph
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: rook-ceph
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: onepassword-store
+    namespace: flux-system
+  interval: 30m
+  path: ./kubernetes/apps/rook-ceph/rook-ceph/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+      optional: true
+    - kind: Secret
+      name: cluster-secrets
+      optional: true
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: rook-ceph
+  timeout: 5m
+  wait: false
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/rook-ceph-cluster

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/rook-ceph-cluster

@@ -0,0 +1,41 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: rook-ceph-cluster
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: rook-ceph-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: onepassword-store
+    namespace: flux-system
+  interval: 30m
+  path: ./kubernetes/apps/rook-ceph/rook-ceph/cluster
+  postBuild:
+    substitute:
+      APP: rook-ceph-cluster
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+      optional: true
+    - kind: Secret
+      name: cluster-secrets
+      optional: true
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: rook-ceph
+  timeout: 15m
+  wait: false
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/snapshot-controller

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/snapshot-controller

@@ -0,0 +1,36 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: snapshot-controller
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: snapshot-controller
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 30m
+  path: ./kubernetes/apps/volsync-system/snapshot-controller/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+      optional: true
+    - kind: Secret
+      name: cluster-secrets
+      optional: true
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: volsync-system
+  timeout: 5m
+  wait: false
+
--- kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: rook-ceph/rook-ceph ExternalSecret: rook-ceph/rook-ceph-dashboard

+++ kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: rook-ceph/rook-ceph ExternalSecret: rook-ceph/rook-ceph-dashboard

@@ -1,23 +0,0 @@

----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: rook-ceph
-    kustomize.toolkit.fluxcd.io/name: rook-ceph
-    kustomize.toolkit.fluxcd.io/namespace: rook-ceph
-  name: rook-ceph-dashboard
-  namespace: rook-ceph
-spec:
-  dataFrom:
-  - extract:
-      key: rook-ceph
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword
-  target:
-    name: rook-ceph-dashboard-password
-    template:
-      data:
-        password: '{{ .ROOK_DASHBOARD_PASSWORD }}'
-
--- kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: rook-ceph/rook-ceph HelmRelease: rook-ceph/rook-ceph-operator

+++ kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: rook-ceph/rook-ceph HelmRelease: rook-ceph/rook-ceph-operator

@@ -1,47 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: rook-ceph
-    kustomize.toolkit.fluxcd.io/name: rook-ceph
-    kustomize.toolkit.fluxcd.io/namespace: rook-ceph
-  name: rook-ceph-operator
-  namespace: rook-ceph
-spec:
-  chart:
-    spec:
-      chart: rook-ceph
-      sourceRef:
-        kind: HelmRepository
-        name: rook-ceph
-        namespace: flux-system
-      version: v1.16.2
-  dependsOn:
-  - name: snapshot-controller
-    namespace: volsync-system
-  install:
-    remediation:
-      retries: 3
-  interval: 30m
-  timeout: 15m
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    csi:
-      cephFSKernelMountOptions: ms_mode=prefer-crc
-      enableLiveness: true
-      serviceMonitor:
-        enabled: true
-    enableDiscoveryDaemon: true
-    monitoring:
-      enabled: true
-    resources:
-      limits: {}
-      requests:
-        cpu: 100m
-        memory: 128Mi
-
--- kubernetes/apps/rook-ceph/rook-ceph/cluster Kustomization: rook-ceph/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

+++ kubernetes/apps/rook-ceph/rook-ceph/cluster Kustomization: rook-ceph/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

@@ -1,176 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: rook-ceph-cluster
-    kustomize.toolkit.fluxcd.io/name: rook-ceph-cluster
-    kustomize.toolkit.fluxcd.io/namespace: rook-ceph
-  name: rook-ceph-cluster
-  namespace: rook-ceph
-spec:
-  chart:
-    spec:
-      chart: rook-ceph-cluster
-      sourceRef:
-        kind: HelmRepository
-        name: rook-ceph
-        namespace: flux-system
-      version: v1.16.2
-  dependsOn:
-  - name: rook-ceph-operator
-    namespace: rook-ceph
-  - name: snapshot-controller
-    namespace: volsync-system
-  install:
-    remediation:
-      retries: 3
-  interval: 30m
-  timeout: 15m
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    cephBlockPools:
-    - name: ceph-blockpool
-      spec:
-        failureDomain: host
-        replicated:
-          size: 3
-      storageClass:
-        allowVolumeExpansion: true
-        enabled: true
-        isDefault: true
-        mountOptions:
-        - discard
-        name: ceph-block
-        parameters:
-          csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
-          csi.storage.k8s.io/controller-expand-secret-namespace: '{{ .Release.Namespace
-            }}'
-          csi.storage.k8s.io/fstype: ext4
-          csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
-          csi.storage.k8s.io/node-stage-secret-namespace: '{{ .Release.Namespace }}'
-          csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
-          csi.storage.k8s.io/provisioner-secret-namespace: '{{ .Release.Namespace
-            }}'
-          imageFeatures: layering,fast-diff,object-map,deep-flatten,exclusive-lock
-          imageFormat: '2'
-        reclaimPolicy: Delete
-        volumeBindingMode: Immediate
-    cephBlockPoolsVolumeSnapshotClass:
-      deletionPolicy: Delete
-      enabled: true
-      isDefault: false
-      name: csi-ceph-blockpool
-    cephClusterSpec:
-      crashCollector:
-        disable: false
-      csi:
-        readAffinity:
-          enabled: true
-      dashboard:
-        enabled: true
-        prometheusEndpoint: http://prometheus-operated.observability.svc.cluster.local:9090
-        ssl: false
-        urlPrefix: /
-      mgr:
-        modules:
-        - enabled: true
-          name: insights
-        - enabled: true
-          name: pg_autoscaler
-        - enabled: true
-          name: rook
-      network:
-        connections:
-          requireMsgr2: true
-        provider: host
-      storage:
-        config:
-          osdsPerDevice: '1'
-        nodes:
-        - devices:
-          - name: /dev/sdb
-          - name: /dev/sdc
-          - name: /dev/sdd
-          name: mbp-node-01
-        - devices:
-          - name: /dev/sdc
-          - name: /dev/sdd
-          name: mba-node-01
-        useAllDevices: false
-        useAllNodes: false
-    cephFileSystemVolumeSnapshotClass:
-      deletionPolicy: Delete
-      enabled: true
-      isDefault: false
-      name: csi-ceph-filesystem
-    cephFileSystems:
-    - name: ceph-filesystem
-      spec:
-        dataPools:
-        - failureDomain: host
-          name: data0
-          replicated:
-            size: 3
-        metadataPool:
-          replicated:
-            size: 3
-        metadataServer:
-          activeCount: 1
-          activeStandby: true
-          placement:
-            topologySpreadConstraints:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: ceph-mds
-                  app.kubernetes.io/part-of: ceph-filesystem
-              maxSkew: 1
-              topologyKey: kubernetes.io/hostname
-              whenUnsatisfiable: DoNotSchedule
-          priorityClassName: system-cluster-critical
-          resources:
-            limits:
-              memory: 4Gi
-            requests:
-              cpu: 100m
-              memory: 1Gi
-      storageClass:
-        allowVolumeExpansion: true
-        enabled: true
-        isDefault: false
-        name: ceph-filesystem
-        parameters:
-          csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
-          csi.storage.k8s.io/controller-expand-secret-namespace: '{{ .Release.Namespace
-            }}'
-          csi.storage.k8s.io/fstype: ext4
-          csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
-          csi.storage.k8s.io/node-stage-secret-namespace: '{{ .Release.Namespace }}'
-          csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
-          csi.storage.k8s.io/provisioner-secret-namespace: '{{ .Release.Namespace
-            }}'
-        pool: data0
-        reclaimPolicy: Delete
-        volumeBindingMode: Immediate
-    cephObjectStores: []
-    configOverride: |
-      [global]
-      bdev_enable_discard = true
-      bdev_async_discard = true
-      osd_class_update_on_start = false
-    ingress:
-      dashboard:
-        host:
-          name: rook.igloo.sh
-          path: /
-        ingressClassName: internal
-    monitoring:
-      createPrometheusRules: true
-      enabled: true
-    toolbox:
-      enabled: true
-
--- kubernetes/apps/volsync-system/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: volsync-system/snapshot-controller

+++ kubernetes/apps/volsync-system/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: volsync-system/snapshot-controller

@@ -0,0 +1,36 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    kustomize.toolkit.fluxcd.io/name: snapshot-controller
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: snapshot-controller
+  namespace: volsync-system
+spec:
+  chart:
+    spec:
+      chart: snapshot-controller
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus
+        namespace: flux-system
+      version: 4.0.1
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  interval: 30m
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controller:
+      replicaCount: 1
+      serviceMonitor:
+        create: true
+
--- kubernetes/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

+++ kubernetes/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

@@ -0,0 +1,176 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: rook-ceph-cluster
+    kustomize.toolkit.fluxcd.io/name: rook-ceph-cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: rook-ceph-cluster
+  namespace: rook-ceph
+spec:
+  chart:
+    spec:
+      chart: rook-ceph-cluster
+      sourceRef:
+        kind: HelmRepository
+        name: rook-ceph
+        namespace: flux-system
+      version: v1.16.2
+  dependsOn:
+  - name: rook-ceph-operator
+    namespace: rook-ceph
+  - name: snapshot-controller
+    namespace: volsync-system
+  install:
+    remediation:
+      retries: 3
+  interval: 30m
+  timeout: 15m
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    cephBlockPools:
+    - name: ceph-blockpool
+      spec:
+        failureDomain: host
+        replicated:
+          size: 3
+      storageClass:
+        allowVolumeExpansion: true
+        enabled: true
+        isDefault: true
+        mountOptions:
+        - discard
+        name: ceph-block
+        parameters:
+          csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
+          csi.storage.k8s.io/controller-expand-secret-namespace: '{{ .Release.Namespace
+            }}'
+          csi.storage.k8s.io/fstype: ext4
+          csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
+          csi.storage.k8s.io/node-stage-secret-namespace: '{{ .Release.Namespace }}'
+          csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
+          csi.storage.k8s.io/provisioner-secret-namespace: '{{ .Release.Namespace
+            }}'
+          imageFeatures: layering,fast-diff,object-map,deep-flatten,exclusive-lock
+          imageFormat: '2'
+        reclaimPolicy: Delete
+        volumeBindingMode: Immediate
+    cephBlockPoolsVolumeSnapshotClass:
+      deletionPolicy: Delete
+      enabled: true
+      isDefault: false
+      name: csi-ceph-blockpool
+    cephClusterSpec:
+      crashCollector:
+        disable: false
+      csi:
+        readAffinity:
+          enabled: true
+      dashboard:
+        enabled: true
+        prometheusEndpoint: http://prometheus-operated.observability.svc.cluster.local:9090
+        ssl: false
+        urlPrefix: /
+      mgr:
+        modules:
+        - enabled: true
+          name: insights
+        - enabled: true
+          name: pg_autoscaler
+        - enabled: true
+          name: rook
+      network:
+        connections:
+          requireMsgr2: true
+        provider: host
+      storage:
+        config:
+          osdsPerDevice: '1'
+        nodes:
+        - devices:
+          - name: /dev/sdb
+          - name: /dev/sdc
+          - name: /dev/sdd
+          name: mbp-node-01
+        - devices:
+          - name: /dev/sdc
+          - name: /dev/sdd
+          name: mba-node-01
+        useAllDevices: false
+        useAllNodes: false
+    cephFileSystemVolumeSnapshotClass:
+      deletionPolicy: Delete
+      enabled: true
+      isDefault: false
+      name: csi-ceph-filesystem
+    cephFileSystems:
+    - name: ceph-filesystem
+      spec:
+        dataPools:
+        - failureDomain: host
+          name: data0
+          replicated:
+            size: 3
+        metadataPool:
+          replicated:
+            size: 3
+        metadataServer:
+          activeCount: 1
+          activeStandby: true
+          placement:
+            topologySpreadConstraints:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: ceph-mds
+                  app.kubernetes.io/part-of: ceph-filesystem
+              maxSkew: 1
+              topologyKey: kubernetes.io/hostname
+              whenUnsatisfiable: DoNotSchedule
+          priorityClassName: system-cluster-critical
+          resources:
+            limits:
+              memory: 4Gi
+            requests:
+              cpu: 100m
+              memory: 1Gi
+      storageClass:
+        allowVolumeExpansion: true
+        enabled: true
+        isDefault: false
+        name: ceph-filesystem
+        parameters:
+          csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
+          csi.storage.k8s.io/controller-expand-secret-namespace: '{{ .Release.Namespace
+            }}'
+          csi.storage.k8s.io/fstype: ext4
+          csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
+          csi.storage.k8s.io/node-stage-secret-namespace: '{{ .Release.Namespace }}'
+          csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
+          csi.storage.k8s.io/provisioner-secret-namespace: '{{ .Release.Namespace
+            }}'
+        pool: data0
+        reclaimPolicy: Delete
+        volumeBindingMode: Immediate
+    cephObjectStores: []
+    configOverride: |
+      [global]
+      bdev_enable_discard = true
+      bdev_async_discard = true
+      osd_class_update_on_start = false
+    ingress:
+      dashboard:
+        host:
+          name: rook.igloo.sh
+          path: /
+        ingressClassName: internal
+    monitoring:
+      createPrometheusRules: true
+      enabled: true
+    toolbox:
+      enabled: true
+
--- kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: flux-system/rook-ceph ExternalSecret: rook-ceph/rook-ceph-dashboard

+++ kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: flux-system/rook-ceph ExternalSecret: rook-ceph/rook-ceph-dashboard

@@ -0,0 +1,23 @@

+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  labels:
+    app.kubernetes.io/name: rook-ceph
+    kustomize.toolkit.fluxcd.io/name: rook-ceph
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: rook-ceph-dashboard
+  namespace: rook-ceph
+spec:
+  dataFrom:
+  - extract:
+      key: rook-ceph
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+  target:
+    name: rook-ceph-dashboard-password
+    template:
+      data:
+        password: '{{ .ROOK_DASHBOARD_PASSWORD }}'
+
--- kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: flux-system/rook-ceph HelmRelease: rook-ceph/rook-ceph-operator

+++ kubernetes/apps/rook-ceph/rook-ceph/app Kustomization: flux-system/rook-ceph HelmRelease: rook-ceph/rook-ceph-operator

@@ -0,0 +1,47 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: rook-ceph
+    kustomize.toolkit.fluxcd.io/name: rook-ceph
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: rook-ceph-operator
+  namespace: rook-ceph
+spec:
+  chart:
+    spec:
+      chart: rook-ceph
+      sourceRef:
+        kind: HelmRepository
+        name: rook-ceph
+        namespace: flux-system
+      version: v1.16.2
+  dependsOn:
+  - name: snapshot-controller
+    namespace: volsync-system
+  install:
+    remediation:
+      retries: 3
+  interval: 30m
+  timeout: 15m
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    csi:
+      cephFSKernelMountOptions: ms_mode=prefer-crc
+      enableLiveness: true
+      serviceMonitor:
+        enabled: true
+    enableDiscoveryDaemon: true
+    monitoring:
+      enabled: true
+    resources:
+      limits: {}
+      requests:
+        cpu: 100m
+        memory: 128Mi
+