Start using registry mirror

2025-03-26 22:23:54 +01:00 · 2025-03-26 22:23:54 +01:00 · 173af0f7f8
commit 173af0f7f8
parent 1184e6cd89
15 changed files with 297 additions and 66 deletions
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -8,9 +8,10 @@ repos:
    hooks:
      - id: yamlfmt
        exclude: |
-          (?x)^(
-            .*secrets.*yaml
-          )$
+          (?x)(
+            ^charts/|
+            ^.*secrets.*yaml|
+          )
          #  - repo: https://github.com/codespell-project/codespell
          #    rev: v2.2.4
          #    hooks:
--- a/charts/namespaces/chart/templates/namespaces.yaml
+++ b/charts/namespaces/chart/templates/namespaces.yaml
@ -15,5 +15,16 @@ metadata:
    {{- with $ns.annotations}}
    {{- toYaml . | nindent 4 }}
  {{- end }}
+{{- if $ns.defaultRegcred }}
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+metadata:
+  name: regcred
+  namespace: {{ $ns.name }}
+data:
+  .dockerconfigjson: {{ $.Values.defaultRegcred }}
+{{- end }}
 {{- end }}
 {{- end }}
--- a/installations/platform/helmfile.yaml
+++ b/installations/platform/helmfile.yaml
@ -1,4 +1,4 @@
-bases:
+1ybases:
  - ../../common/environments.yaml
  - ../../common/templates.yaml

--- a/installations/system/helmfile.yaml
+++ b/installations/system/helmfile.yaml
@ -25,7 +25,8 @@ repositories:
    url: git+https://github.com/rancher/local-path-provisioner@deploy/chart?ref=master
  - name: istio
    url: https://istio-release.storage.googleapis.com/charts
-
+  - name: zot
+    url: https://zotregistry.dev/helm-charts/
 releases:
  - name: namespaces
    chart: '{{ requiredEnv "PWD" }}/charts/namespaces/chart'
@ -33,6 +34,7 @@ releases:
    createNamespace: false
    inherit:
      - template: default-env-values
+      - template: default-env-secrets

  - name: roles
    chart: '{{ requiredEnv "PWD" }}/charts/roles'
@ -181,3 +183,13 @@ releases:
      - template: default-env-values
    needs:
      - istio-system/istio-base
+
+  - name: zot-mirror
+    chart: zot/zot
+    version: 0.1.67
+    createNamespace: false
+    installed: true
+    namespace: kube-system
+    inherit:
+      - template: default-env-values
+      - template: default-env-secrets
--- a/values/badhouseplants/secrets.gitea.yaml
+++ b/values/badhouseplants/secrets.gitea.yaml
@ -1,33 +1,33 @@
 gitea:
    admin:
-        username: ENC[AES256_GCM,data:XdPhs58Q9gw=,iv:OC1PBo59fDJoGapR5ddOJ3aP//lIp2O+IUFxZ7p8Y2U=,tag:xubvAEW/Fn+oyhxvsUfU+A==,type:str]
-        password: ENC[AES256_GCM,data:FLIa8F0y596vVOM6ih9sHl9r4VM=,iv:lXzCTCA0g2hjia4NSfrUhfXL6Pr7UkSQRcXxbnWg1do=,tag:a1iRT01JWuEH0B9N5U3DuQ==,type:str]
+        username: ENC[AES256_GCM,data:u1KcCwDNplU=,iv:s9mWKPTz+8rFKS2RmFPxCGOIPXFHLvLX3v0t+DemDEU=,tag:MmGR2LqDmHw10uJdPe/tSw==,type:str]
+        password: ENC[AES256_GCM,data:mBhL52UJwOwWpRGRfc5WNAvYwHo=,iv:hGt1kGA2miwzMidwD0AT62oXs1CAwAFpKk3XltqsCz8=,tag:bfhsQxef8cKEes1JkTQw/w==,type:str]
    config:
        storage:
-            MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:PF4yojmx0lgNT2dKVyCXwY5HTScbiIN5Zg==,iv:6LQ7S5DHmk9yo4GkhvWt7uDkGrCfPdI7K/VuGtWmX+w=,tag:YiFcVaAwSw7ymw430IAjgQ==,type:str]
+            MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:5VjeSHLIDvZB/VE7OJ1eqWOnT5NU64om0g==,iv:OFK7MYlb9QfV4ZHIECa3vHG9pBp1TCGSqqUJX3D7uGE=,tag:Ibmihyp3TXarFtr/tDtEEQ==,type:str]
        mailer:
-            PASSWD: ENC[AES256_GCM,data:3IHYRUj0jgojliVqfZAHXHnL0jqX4zz/gQ==,iv:jnJhJVQKDdpf/2zkJBOh+J5KPfQ8HMNqcdegzw4wsos=,tag:iV4FCaR7yv4/2o30Bk0mOg==,type:str]
+            PASSWD: ENC[AES256_GCM,data:lIv1/BEEkouDVqNy4u+u7WCY4zz3ow7fWg==,iv:we77bHyHyAYCMxFGG13sE/M+5Tv2VeYfrg9bsa3leec=,tag:TOltFQbhrXMJW5w5x27YjQ==,type:str]
        database:
-            PASSWD: ENC[AES256_GCM,data:hRcButljKxyK2kpkHEOOVVcc+/o=,iv:2gXfHlveKVZJivb+x52Ntqx2io679rSTOddb+N0lSFc=,tag:QAV1d/NhYpdcueyEO8/Zmg==,type:str]
+            PASSWD: ENC[AES256_GCM,data:a3AV8QMYOxlWiU7G1DRCaOSdHKA=,iv:3ZCwEMo3/3rmGJXgDr/Pw+rNQBU14rUKQ7330otX1qQ=,tag:KjwexsLkYaHsTdXoHwXBJA==,type:str]
        session:
-            PROVIDER_CONFIG: ENC[AES256_GCM,data:UFPgJIBlAiiWvE+kxb3zSqkqLONQoWbgyiORYnQUPhH/CICGmI/zuxxlkSKTHk3EPhV0Zd3zaG1chI8jpYX1d0y8pBdHg9IncsolGncj4P4jgiS0p7yup1e0yWHBmbyCwEErFr7h//TDC1zojcdoCuViZSMEfg89,iv:gSiTMscOca0mIC7JJx4SQIaMFvoTZkHHJUynHubgr7w=,tag:JFTdwuqtkvBiHLMXC0PsBA==,type:str]
+            PROVIDER_CONFIG: ENC[AES256_GCM,data:nPtmi3wG3+wVkyb+IV832he9rUo2TRRx6cTqvGdVSIZMfcfUvS4rmSH7CQ28OYK6f+WEKs8PkjfrBzEP1mPFHC5eRQfg4ryaqM7eWmHaJipcg4h2nzH9ii6FXyYtmm2zFsTnodOJryEo0T/nMaGhEt7+eylCL+L4,iv:8UFjsAEtMjMqyC9Ib3ipoqpshFrsdE9d3dg7Cewv7dU=,tag:gGVNGk66/Kr/dZ6B3wbD4A==,type:str]
        cache:
-            HOST: ENC[AES256_GCM,data:JVIJ/OUU+mxzHVdHhtiOgs4kq5xkpdy8xSedpVjw+L7PkhPjVtGyQ6KNhM04Yqe2CbdLJJQWks2gcYnVp3l7Lmf1OXND5IOhfzzuO2tcZkClqww4KSEGuOoUz2nb3U3TEt5sFQtsPMruEnEqD+qhtz5P+TQrSsxX,iv:6ACIES1T71UH9nW5bCnvL2V8kVr+rxPs3uy/7fh0g94=,tag:bjJVglzPvDAeEdZ5lafU9g==,type:str]
+            HOST: ENC[AES256_GCM,data:tXEIBKqGyeuAc/adO6DjcyAAGgcIuwxJ8T0Zsi1xMy3I3gXbzeTG6XwyAesiUoHifoYTpn3wWbf+pIh8KtGFXb58UcEOgHmnADPWALiXKFoZmvtHDL+JEjOjd0tyoskJNf4Oi4BckJDnfpYuMqJW9qcQbsxlB1My,iv:kJ7XRqvUVEGUC9aAPYO+1oZA3QPc/SE9apaeTgLf3wA=,tag:525IBTPiuZIkAxAIiRE35w==,type:str]
        queue:
-            CONN_STR: ENC[AES256_GCM,data:a3Ye/OgqUxGhysskzfSwP2IVCpt1oMegema+oW0s6OaD5POXho+vTUiutEV33ruk07PtBi6zYnukoAXVlT5l2xVfvWLKebDT56Jc0K+k0fmzO5R0tcvyg6c3DaoEdfcs7ih4OXGfgD8bCmMCGHUtYZnHYqACMLUQ,iv:1xryG/UYu7zm3zhx/bvtYf23E8xNDHmi8Us0FCKgZg8=,tag:FwLJvK+uWQvmIYmmp4IjQQ==,type:str]
+            CONN_STR: ENC[AES256_GCM,data:Z1+u7JAcgNXkrO80YC2bMDk5VMyTFRAxDPc75ZPKbaD5+nsWQusvnHTS68rAu/WT21xAFpny7geERIOEZIewpucNoCTlqHVfJu/tsl40qMoBfjEWuwfaRM+AlNaXm5USTXkk+alQ3eJ2KIIhfhY1cd1yohRoKvAd,iv:bmLkzWqR8SwHLgWG6SWdeNr1w0fcZP8qNRlhfQfvJqs=,tag:QY5A8YGy0+3BnWSLBcsK5w==,type:str]
    oauth:
-        - name: ENC[AES256_GCM,data:1HbV3MFK,iv:87vcJ57cwyfXIvfTG5lbn8NXl2OxwzXTwJuja8N8ozs=,tag:CTsu4f+GE3d8H4Mu+G1ZvA==,type:str]
-          provider: ENC[AES256_GCM,data:bB0yq9oJ,iv:icFjcFRPU6yLoToqz+L2dsC61tClM3y9RuWt1ORjAio=,tag:gCiMVVT1gA6UfyrMkYrPMw==,type:str]
-          key: ENC[AES256_GCM,data:Yr9hJMRpeFa8CvbELFy7PhS5E7A=,iv:lwRygPesEp50MWM04RpRP7ARIiuoLXlIfxjx6R7X5y4=,tag:Zl7mivC9/BvyUCl/UGqw6g==,type:str]
-          secret: ENC[AES256_GCM,data:hShUsbiZjHcYkPHx3YG0UekTM+HsrmT30R0Qa0/6WWIXjn0PoZqBWQ==,iv:CfbPvj+H0VpmhRPoPsHus1eUmPC06u313PqJ/cO7QtM=,tag:5EhZbN6ylXhmCjWaHIq70A==,type:str]
-        - name: ENC[AES256_GCM,data:dkrcYEhE/0qh,iv:rmRZLqFJ6IJ2D4cXhe0VfKE/Fn33aJ+0JzccT23Uayc=,tag:vF82viM5iPIuXVkVDofcGg==,type:str]
-          provider: ENC[AES256_GCM,data:z4By7Eq1cS1z4f3l9g==,iv:WBAvO3PutqxzhSrkFVPVTexf1FhTLYA3ej55uis/7sQ=,tag:oo2Mxh2h66Fny2r3tY2rdQ==,type:str]
-          skip_local_2fa: ENC[AES256_GCM,data:K0Zwsw==,iv:h9u4eCWadGKzXQzdCGLhmVQUub77YbVCujYEVGUIa90=,tag:oFOxu6VQnOOorB77MlmnkQ==,type:str]
-          key: ENC[AES256_GCM,data:kV0u7XE=,iv:KUOrvGVCB9R2OaPPy1N2fMNXneuSdnyl3a+JHlxN7Cw=,tag:XH/v7NFfkjGIkffICmHVhQ==,type:str]
-          secret: ENC[AES256_GCM,data:mOfvg3DO+/hjsvyzugeEfQejYPA2Yy89dlMvgrzMBeeTKkx8btB9wpMzKiSCMr3tAyIyqrxpdhJ0OxCMhH8gQJcC/FeE8SkYtRW3/gGqgodDjDyWAFOMufnvlsxM8z9zKEroH85GU+RLvzXp3Ylj3GMb1mooNutz6NDle1OHFTM=,iv:fUrf8JHUS+44mp+mtpw0jpZrNA+8YmsTU5NgmWOBT7g=,tag:1S2gNFUf0VheDta7pNgnzA==,type:str]
-          autoDiscoverUrl: ENC[AES256_GCM,data:XhZD57N1lMKvWUJtE1mMAw8TiECqGKHc6V7a4GjlG9hI51AeVPMeUtn5NhPj15ChjazDRWooZUQIYwNhaOMMtZ0OB+vW2eELo84y+islxPtzTm3gPdX2wtw=,iv:PTcNXkBCqh2F2fAzvxKZt++Yi3lnwetNWrfSgrrpeNE=,tag:OBRmdS+/rGViObEZozl2bg==,type:str]
-          iconUrl: ENC[AES256_GCM,data:VKrfFl5XZTPHGX+05Byw+h8tEb25NWoHSnws5dylc8XMlARq30LIFPMftuCAJ9Ig3oLqH5LIyDH59Bcy/pEBw3osw8jaow==,iv:iZGR4UvZv+YrjURsax7SDXx4HwtDXbn+G6oUVRWV9xA=,tag:x2mxauopN+vjuUjkZyAjBw==,type:str]
-          scopes: ENC[AES256_GCM,data:3TejcQxM0K60YVGJwA==,iv:R/E0Xfe9nI343TyOO/1FycvFXg6sP4j2DZrb05SuK8o=,tag:TAkoBe7LSRfdRz3UIlvZzQ==,type:str]
+        - name: ENC[AES256_GCM,data:7KhuIzC/,iv:nn4bNQ1/tBiqjnQxcyocZd0h/54mH+LlRtiAjWuPCOc=,tag:e+55SHN49Q6NzT7KSsh52A==,type:str]
+          provider: ENC[AES256_GCM,data:+TrDQq3Z,iv:AAwjnHG40IKAkSPO5gzwEC745NH+Y5BgZIiJJ5Z2+AE=,tag:DENE8aAHAG9DZhkPmZWYVQ==,type:str]
+          key: ENC[AES256_GCM,data:uOY9iM/dAkhGbWSsUbmN5rnbqUY=,iv:BQ3KjcHN1jJG28RkjjhsTgWm+lHmHzYS4/P4Vlp89hs=,tag:HY3fZysu7sCdyoR0TuRd6A==,type:str]
+          secret: ENC[AES256_GCM,data:5s12mFDJJLPRg/IsypTx/BpvobX0hluTSddTaCQ0SgYjt4lthZDGGg==,iv:ojiXiVQ7BFUNO2ukAK0ygUTu6KVDKu8AMVmHfBw8Ii0=,tag:0zcD8iNT8iutij1C+Hk7Hg==,type:str]
+        - name: ENC[AES256_GCM,data:S/RV60Bc3/lH,iv:xIG+UJnmkEvuo2mgu904Hdn18BhsOCtWVl/eL6ybcZs=,tag:nFKPEisO3U3hPJZASrytiw==,type:str]
+          provider: ENC[AES256_GCM,data:eZOq2jNeqLM7BzePXA==,iv:vHhMOtF/mqUorcKSe2djtWKcyc5F2c+udWclcOkxK/A=,tag:6yKwQj/9oDDIdHcRtIgW3A==,type:str]
+          skip_local_2fa: ENC[AES256_GCM,data:B8ObUg==,iv:mmfGkA+8HK6H3DS+Hl5Hz3s/pwGBoYcXQfJiPiBKYFs=,tag:ErmgC/mcQZJ5sI5eEtLHzg==,type:str]
+          key: ENC[AES256_GCM,data:+w1/goQ=,iv:cIOxkdP38IaiNZ3dig5xo2kYrXdAwqerojCXcBifYds=,tag:5/+QimbfqpfnaFgFT3gfLg==,type:str]
+          secret: ENC[AES256_GCM,data:Rg4rEk9j8zZcUCWbm6xmuEbRb107f5HaU8ClbUkXWKnnERkN91QYtSNlAEWfHBk30xmBObm/O2LlypYJWT5wO7LNw4G6q9yv5JaIc7vS1pjicDi2QNxAW89euELdlthFa2fXj4lNlKLgQr8TbC5wpX0oysC261MM9kgjLuTQnw8=,iv:ft8IMPIu2JuzeWdM53qN5kJQQR5Oq9d2yyNbAQdtdY4=,tag:cBMEqmoP3KAuOhuX364hew==,type:str]
+          autoDiscoverUrl: ENC[AES256_GCM,data:IlykewahSerO46QAqJrvryzHkZONrEDHYBgwq9Nkg1pja9X1l3YaMbsg9DYWUkod/ZlzrGUA8Qyi58WW07chkFDPvy/Cfbp7GZSosr9ZVv7LI7TlpZHxeaA=,iv:rp05dCHRMnysz98G3EbKBZWsBzHrGzSuC6FCr/S8evw=,tag:6UtCbpVoWLbv5W/cB1+qBg==,type:str]
+          iconUrl: ENC[AES256_GCM,data:Tp16796JFzlYfOSfI+ld+Lf7hCeS74ZDz0kA/I9P3v6G+3LQAUGOtfFTzx5mTsfpP1eQN4HgD2uU3lfLhSozril1qq3AZA==,iv:dQSq+IiRcepUZqLipRr6DOHH7Hg6h45gnr9LH9dWYdU=,tag:zeq3tVobXsOasCkIAw/riw==,type:str]
+          scopes: ENC[AES256_GCM,data:3qwG8sYZER/p9GgnuA==,iv:hvJvc1pwUgeatq9R8GBde1EQDJunwZBl+cmsqJr1PBY=,tag:ov+WHCFaNaA40PPvOzVPqQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -37,14 +37,14 @@ sops:
        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Y01NOU5WWnZ6S1VaTm5G
-            KzhBSGhSQXZCbWEzckhIN2dEUUFISUN4NWpjCnBMMDhaS3Z3NTB6ZVJoak9nWTgv
-            WmhqSlh0Nmlna3NoMlQ3VjdZQ21IczAKLS0tIG5JVVJ1dmloYXVxZWhrVGFKMFcx
-            MXI3NnozVURjTzEwTk1vNjBZRDlmbkEKsBHUyaVMtl8lxKo6tRP2++WRf0RnwW6Z
-            EFhh4sywF/w2W7lSz1PAGUItp7YI55L6v6F3z4hsJjqSpxL/1F17QA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ0IxQnpLSmJjTm1jTkI4
+            NkhuMUN3RVp0TEFSNHhtTkFvWDFaUXVpUlIwCkxWbkxnQkY2R3g0cUY5VG1Kb251
+            VUhYZlNCWC82Z0h3SHpaSnVST2h0WTAKLS0tIHJWR2FuT1ArRFhMWnV4cW9EcnZw
+            UHpBeWgyN21CUThydi9XdFc2V2c0TTQK38CQDRnFpUmWjyvDGGQ3vQxhBvy2Xva+
+            SCd8sJZc/bnVDOEidvV9oxJz4y0nj6RvgzcsU+M99YBJcuV12xPqag==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-25T18:38:21Z"
-    mac: ENC[AES256_GCM,data:iogjVYVKmj11IELxm7fAhUGpbp7upBAXQMu3bgWTL7LVe+624Nb//1sDAMUQAHsQEVq5R98gBsPZc5STVGvbxNrAQaElivhtxGCyHi9B1imFGmfHzaqu9j2VUC5IdF18gyizPHdJt+SLUfhg//3dsO3Emv/GfunzzXLDGkRQC60=,iv:bxgPg4HioG31P/0IhBPyZCkVkXeaTXoA4N5josDrWrE=,tag:xkQcIKszrG5iBNHyJdkP0g==,type:str]
+    lastmodified: "2025-03-26T11:56:44Z"
+    mac: ENC[AES256_GCM,data:cc0H+6P0uTl5kpMR0B9o5BP8l1KHjLHdMetPlmNEVQo3NCzm+0SBjGYOqNhr0EG2Gd6RKdsAADrZAwyH+pXA2pmNVdIehDBu4Xncwi8nrUY3gm3jBIG/01H5VLqtZCoLfbqQ4ANHrGhn7JE5bwrXbbmD4t/7E2i7qHLukPj4S8w=,iv:3+llbgLRU2tMr+S2nvyA8hGfCnnWnqprGSW9H3VSCH0=,tag:gzMc8wSjZfa4h0eN3V5Ylw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.4
--- a/values/badhouseplants/secrets.namespaces.yaml
+++ b/values/badhouseplants/secrets.namespaces.yaml
@ -0,0 +1,21 @@
+defaultRegcred: ENC[AES256_GCM,data:QpL9wlCjErkjp16vsOAcsDA539EguT48JPb24oi6VexbbRm3cBVz9KDlrVhhbt1Uk8hMkbHfN+SQT+OQL38EW6fJiQ2CJ6JbVuyNXeolErxbeV2V9dWegiSjcekgS+tqs0YmshdfUpMFXIpmHWAsW2hty40b6+WE1iAmSf0NgrdYTG+ctMtetCIpiLwy3vgiBc581h0kmAxC3QCDVXIxtw0p0mtF3iHZmQv78FEd9CseTPH0jVlaoucM3mRPKNFi5j7sGQtrevYfPZpynpufTRLSkW84NddXbpk1gzFn5fbENjS1b0vrInqVkS0KMmewOGwf6coL0uELFclRQua1YO7hW5uVKZyUCn9UpCMFHWI=,iv:Vr6x3YFd7UGqId1PQOJqJmpSWxlalIcQdsfwCmQkdQo=,tag:rtFEPOYSzf7M8vTwe3hxtA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPTSs0WkNIdlhxVURXcU5u
+            WDMzb000cUE5TnpPajRHZnZLblpKY0RUZmlnCnNpbno2VUVHb1g2cy9XUEV2eHdz
+            QWI0VVVJSllIRHdRZFdlRmFOckVmV2MKLS0tIDJER2UrTXArblBnckxJY3hSaXZk
+            Tk5SK3Y2YVBPem1HVjI1ejhaK2tmTVkKgfdOUiERRABkvvYLe3P7hAOoc97dNmnF
+            rAwK+FrRrAnfeG2R9RegocbDv64ieB1vwJpW2LeainGchn9opNjeeQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-26T19:22:13Z"
+    mac: ENC[AES256_GCM,data:JYkxfsrFgYHrxQTPh4uZ1RIqexJnaYefRWzYFzpE6Or2in/UBDG+UghYtbld8+wI6xSMMwfh8BgmOwUWWhqzCwzHEVaiNjRUNisw/epdbKwCuou1h6m4e8vid8NG8+FttWK2QvIzEKM9ONTJPcoCRjiKIBH7dGBAeCjAOJy6PlA=,iv:n26YeGhiZ80SQYfFUA5Lv0THDTPYvOvWoU23nTut7Qw=,tag:C3ij7ClL2ra6hutcTtbP9g==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
--- a/values/badhouseplants/secrets.redis.yaml
+++ b/values/badhouseplants/secrets.redis.yaml
@ -1,26 +1,26 @@
 global:
-  redis:
-    #ENC[AES256_GCM,data:d/vtscwAkAPFyRz6Ap29M/oZGEcX3POnzAd6GCkHIiTLFinXzOAn/ruMSiMsnL9lJxj50foVeLIXnmtFDGxUPsxNU9jePD037t6vbtja,iv:ALXE7IPi2d79rOpBMwlfi9IPtcvfoSAxsDHwiVItk8U=,tag:cMoKK0zkagLc3uC8Ry5hBw==,type:comment]
-    #ENC[AES256_GCM,data:XQ6nK+hlKfFOBDye9a2a,iv:ptA0TWsjVjOQGOCe8leC7ZjRX8gSnbjb94NWZMccxSs=,tag:9vw4k4N1wI/C7jf7ZPxi7w==,type:comment]
-    #ENC[AES256_GCM,data:eTsTA07O2Y/468A=,iv:ZWOZO3GAYbU/Bq5ejdzDUsrYpkfwNtK23zH+XS5PUsk=,tag:KL1Z0a+BxBW4Y+aeJb78lA==,type:comment]
-    password: ENC[AES256_GCM,data:kFbVUyKL0B9GhOapmqOS/FyTaXZEGUmSFFLxYIzX,iv:sLue4AmkT12DoPrWH3VxpvXFBHYhYRUTWcNoC+ojhGY=,tag:ikQsyximPvONoANv/61GXA==,type:str]
+    redis:
+        #ENC[AES256_GCM,data:INOZ17f72Qf6D+drbcvmnZRBRIeXLSAV9RmfOLZFp45qt8GWSHMnevqq9ge4Zlydtsd3BDek/JLUNl6YHPPq9qM1EFujY2htbOHyf0Cn,iv:zZDMizNKFllCyNH/bUF+vuB9YOikjo3q5ebzu3LYvCc=,tag:H0XX/D9xh0HS0Xnqgs/aag==,type:comment]
+        #ENC[AES256_GCM,data:JiLOpJanuZnMpN5dMvw2,iv:YEVZSdRHez1lCb61hWLvalLq8F67l7KF0WXmmuj9bck=,tag:KnpfgwUYBQLZsj4Jk13RtQ==,type:comment]
+        #ENC[AES256_GCM,data:mzDGjHlXUunu1yA=,iv:LOOU/QGaHKeDrssbk1haYd0lPclbFak9GygEbbN0gFs=,tag:4cUubeiY6aJj5KVKVkdFUA==,type:comment]
+        password: ENC[AES256_GCM,data:kN93kIMiVTGWbaYgMC1n1MWqdl8s3cbZS5vvYTa2,iv:Qy+GQchC6s2PoarPWtquipF9gAVYZR6mn0GeHABRogE=,tag:V/xbfm9u51UUG+we/3nNLQ==,type:str]
 sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBORUEvSlFCTzh4N2NGVkhO
-        SlJXQlNvYjdCQmVjQWVpZ2YyUjlmWkZrWVdVCk1FK1VjVmpCWEVScVo0YldZQWxE
-        L2I1RnNsVWJGRll5MXNjam1zMzU5OWcKLS0tIFI0eUFEYTdyWkFEb0xQeTBaZi9J
-        aUJ0Umg5T1BFN1lEbThJTXErUkxKaGsK1Vvk45dshvEGF3OZfrLJPabHgvWFT8ps
-        f7Ygd+3XhZUBUBi50Em/xzmKQXL0I0Ps9JetSbQ/Amlmp9gU8VqRGw==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-14T08:08:22Z"
-  mac: ENC[AES256_GCM,data:9dykGJs5NFjahNZ+4orzMh2u7UBRHMVCv5J9QxRqAzE2aT556W6bZoV9n0V5b7Z6jhVGHFxA4do9RoFT2lq7aMVpQ4nl4iSXuavPiuoBeq8aIwykpCF0cs5dHxQP7R5US2A8rzsSScIBbB2i1LhRtpiVVGmekVp1YSZJWcNhMNk=,iv:tWf4DjEcAff4LupkpFiR/Ss3iYBqtvcQGW/xAeCDIvw=,tag:nbWpyxzNKKrbo8HjMBbeMg==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOHRuN1J1ODYvc0Z3OW5H
+            NFhVM0dWWGZETU0vTzVkeUk1NFVWc2FSaGprCm5NalJKUWxtLzA5VTU3YjR5VWtx
+            NExtbTZZZUZteVBTYnNWTVZvbnF5VFUKLS0tIEpBTDhPbkVLVytaY29aUktmZGF2
+            bnVKWmI4RWpLaGU5WTIwblJRcDFDMlUK2BHkUNbpRMo0jm2Sk+Qcf4giufJtaJyM
+            xuoG41AqGs4+KEDS8/rF9HK7z+2Wk9H5b8L+/W0n+J5EPOvwvFePTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-26T12:23:02Z"
+    mac: ENC[AES256_GCM,data:xrA6hCFIH/R/j/V1T60xx5Eix5Z5ETREQP4zYriLkZQ4hEzL2WdJFExK1VXSfX4KmIR8215XHmHnWu70eIoAnFUaozBosIFtJz0YNrNNok6MeDGD5fy5mcBQfCqLw+rwbW/uxY7DQrchgVT9iFAkpRSoVPUzn6ku/xCmTmSlv3E=,iv:lNLR5QHKPUWb1Mz8mIFCHnjpuQVF7ttNTOy9+jEzLyo=,tag:G4iZ/9nWKh97JLGOxbgSQg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
--- a/values/badhouseplants/secrets.zot-mirror.yaml
+++ b/values/badhouseplants/secrets.zot-mirror.yaml
@ -0,0 +1,22 @@
+authHeader: ENC[AES256_GCM,data:nmlP0vRoKJRivvwJArnEO26sqIwFtnK5MYVPJBBCmAGCPpe/U00gYu6JET0gPqGV,iv:+GZwWrxoWw0mAZxZdITBLtHgRKYIyaj/NQwHbD8KppA=,tag:MAer3FiaBxyNwJr0BbDtow==,type:str]
+_mirror_password: ENC[AES256_GCM,data:W2xy2RMmD4d6N+DNceIgtDGUpygOGEbWgGa9Icsy,iv:YsQfm/EmBYY35q2irlZ2rmzkbJzlFnfgMSEKq0G1I5o=,tag:7rNG02Wm9g8GUXeM4nTHqA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPVUlyVFZWcWFuWnEyS2Nv
+            Tkx6aTZKY1czQ25RTHhKNWNNQ0xIaWJLb1VFCkdoT0RBTW9EWG8zbzYxekdsUEY2
+            bE9nQUthV3NCa0kzRnBwZ2U2MWlVNzAKLS0tIFY4RVJDM05ZVmR3NEt5YUlpOWZa
+            ZVc1bmJnU1o4U3NGaGN0Sk90YTR0ckkK8gmkHty4Gwt4vuVK3xhWWg4h/EgvJULh
+            Trgn0lzx2pCThg/+82u5J1T/QLXdbbDFFFwGldiMwNjZQfpOmrZpVw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-26T21:04:45Z"
+    mac: ENC[AES256_GCM,data:cTN6wq1m1XtsfNujCfQ4nKtX1Pkc8MFCipUeScDLJUuZZwg4St0h1OkYtYJBWeVSt3CSjjexQpb7Oi9K8wukboIVevaIj0BTT1hkf2ZUFeIV8W62mtftfdRex0yJ/4h1gTZaYBhHEw+qD6r+XvavDs1m22FF5RuF+5qfGUEWA4I=,iv:RsVuXbLVfZSJ7AkIvEdf7H2auFTiqXgpXLe/LbATAo8=,tag:1V5eIiJzjzv4C1JNNf5Quw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
--- a/values/badhouseplants/secrets.zot.yaml
+++ b/values/badhouseplants/secrets.zot.yaml
--- a/values/badhouseplants/values.namespaces.yaml
+++ b/values/badhouseplants/values.namespaces.yaml
@ -16,3 +16,5 @@ namespaces:
      istio-injection: disabled
  - name: org-badhouseplants
  - name: org-allanger
+  - name: kube-system
+    defaultRegcred: true
--- a/values/badhouseplants/values.zot-mirror.yaml
+++ b/values/badhouseplants/values.zot-mirror.yaml
@ -0,0 +1,148 @@
+image:
+  repository: ghcr.io/project-zot/zot
+  tag: v2.1.3-rc4
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  pathtype: Prefix
+  hosts:
+    - host: registry.badhouseplants.net
+      paths:
+        - path: /
+  tls:
+    - secretName: registry.badhouseplants.net
+      hosts:
+        - registry.badhouseplants.net
+service:
+  type: ClusterIP
+persistence: false
+pvc:
+  create: true
+  lavels:
+    velero.io/exclude-from-backup: true
+mountConfig: true
+mountSecret: true
+configFiles:
+  config.json: |-
+    {
+      "distSpecVersion": "1.1.1",
+      "storage": {
+        "dedupe": true,
+        "gc": true,
+        "rootDirectory": "/var/lib/registry",
+        "retention": {
+          "dryRun": false,
+          "delay": "24h",
+          "policies": [
+            {
+              "repositories": [
+                "**"
+              ],
+              "deleteReferrers": false,
+              "deleteUntagged": true,
+              "keepTags": [
+                {
+                  "mostRecentlyPulledCount": 2
+                }
+              ]
+            }
+          ]
+        }
+      },
+      "http": {
+        "address": "0.0.0.0",
+        "port": "5000",
+        "externalUrl": "https://registry.badhouseplants.net",
+        "auth": {
+          "htpasswd": {
+            "path": "/secret/htpasswd"
+          }
+        },
+        "accessControl": {
+          "metrics": {
+            "users": [
+              "admin"
+            ]
+          },
+          "repositories": {
+            "**": {
+              "anonymousPolicy": [],
+              "policies": [
+                {
+                  "users": [
+                    "mirror_user",
+                    "overlord"
+                  ],
+                  "actions": [
+                    "read",
+                    "create",
+                    "update",
+                    "delete"
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "log": {
+        "level": "info"
+      },
+      "extensions": {
+        "scrub": {
+          "enable": true
+        },
+        "metrics": {
+          "enable": true,
+          "prometheus": {
+            "path": "/metrics"
+          }
+        },
+        "mgmt": {
+          "enable": false
+        },
+        "sync": {
+          "enable": true,
+          "registries": [
+            {
+              "urls": [
+                "https://docker.io/library",
+                "https://docker.io"
+              ],
+              "content": [
+                {
+                  "prefix": "**",
+                  "destination": "/dockerhub"
+                }
+              ],
+              "onDemand": true,
+              "tlsVerify": true
+            },
+            {
+              "urls": [
+                "https://registry.k8s.io"
+              ],
+              "content": [
+                {
+                  "prefix": "**",
+                  "destination": "/k8s"
+                }
+              ],
+              "onDemand": true,
+              "tlsVerify": true
+            }
+          ]
+        }
+      }
+    }
+
+secretFiles:
+  htpasswd: |-
+    overlord:$2y$05$RhAeAsFY32y8h0japhT72.SQTPXgHc54RCp4CZ4Udsg2.iQxJVeZ.
+    mirror_user:$2y$05$PkvVMY04ZGvuGUXkrez7peyXevl63ugFbdxZ.ON1G/Tof/0Uf5vZi
+
--- a/values/badhouseplants/values.zot.yaml
+++ b/values/badhouseplants/values.zot.yaml
@ -1,5 +1,6 @@
 image:
  repository: ghcr.io/project-zot/zot
+  tag: v2.1.3-rc4
 ingress:
  enabled: true
  className: traefik
--- a/values/common/values.coredns.yaml
+++ b/values/common/values.coredns.yaml
@ -1,3 +1,7 @@
+image:
+  repository: registry.badhouseplants.net/dockerhub/coredns/coredns
+  pullSecrets:
+    - name: regcred
 service:
  clusterIP: 10.43.0.10
 replicaCount: 2
--- a/values/common/values.metrics-server.yaml
+++ b/values/common/values.metrics-server.yaml
@ -1,3 +1,7 @@
+image:
+  repository: registry.badhouseplants.net/k8s/metrics-server/metrics-server
+imagePullSecrets:
+  - name: regcred
 apiService:
  insecureSkipTLSVerify: true
 nodeSelector:
--- a/values/common/values.traefik.yaml
+++ b/values/common/values.traefik.yaml
@ -7,3 +7,7 @@ ports:
      port: websecure
 deployment:
  replicas: 2
+  imagePullSecrets:
+    - name: regcred
+image:
+  registry: registry.badhouseplants.net/dockerhub/library