v11.0.0 introduces the concept of environments and also drops support for the now deprecated Ingress Nginx and starts using Traefik with Gateway API. This is important for people running smol-k8s-lab for their home labs or running it as a production system for small orgs.

A major difference is that your config directory $XDG_CONFIG_HOME/smol-k8s-lab/ is now split up into a couple different directories. For simplicity's sake, we'll refer to $XDG_CONFIG_HOME/smol-k8s-lab/ as your config directory, but note that this defaults to ~/.config/smol-k8s-lab unless you have set the $XDG_CONFIG_HOME env var to be something else.

Your name config directory $XDG_CONFIG_HOME/smol-k8s-lab/apps file no longer contains your apps. Instead, all of your apps now live in $XDG_CONFIG_HOME/smol-k8s-lab/apps/$ENV with files for each app in that environment.

The following apps are considered core apps and should live in $XDG_CONFIG_HOME/smol-k8s-lab/apps/core as files of that name:

• alloy
• argocd
• autoscaler
• certmanager
• cilium
• cnpg_operator
• external_secrets_operator
• k8tz
• k8up
• kyverno
• longhorn
• openbao
• pxc_operator
• snapshot_controller
• traefik
• velero

These files are optionally included in core and can also live in other envs as well:

• grafana_stack
• zitadel

Zitadel is a special app, in that where ever it is deployed, it will be used for OIDC apps in that environment only. Everything in the core apps, should behave as they did before with no major changes. If you were only using smol-k8s-lab to boostrap a cluster and nothing else, then from here, all you need to do is remove ingress nginx, and rerun smol-k8s-lab with traefik enabled (and set apps_global_config.ingressClass and apps_global_config.gatewayClassName to traefik in your config.yaml file).

Everything else should live in a directory of that environment name, so for instance, if you'd like an environment called dev-my-org, you'd create a directory called $XDG_CONFIG_HOME/smol-k8s-lab/apps/dev-my-org.

To create a new environment, you can run smol-k8s-lab -n and we'll walk you through setting up a new environment. You can also launch the TUI and on the apps config screen, check the Add New Env check box and we'll walk you through that as well.

This release also introduces OpenBao, a fork of Vault, as the default External Secrets provider, rather than using the Argo CD ApplicationSet Secrets Plugin or Bitwarden. The ApplicationSet Secrets plugin was never encrypted and not intended to be used for sensitive values, while Bitwarden's company may not remain open source forever, so we're making the decision to quickly adopt OpenBao instead which can do both sensitive and insensitive values as well as much much more when it comes to security.

Because of this, while the smol-k8s-lab out of the box experience will be streamlined and straight forward, upgrading to 11.x from 10.x is going to be a bit of a chore. If you don't care about anything currently managed by smol-k8s-lab, you can just delete your cluster and wipe your $XDG_CONFIG_HOME/smol-k8s-lab to start fresh. Then you can use the TUI to setup your new values, or you can just run smol-k8s-lab and we'll install all our default apps.

If you do care about your current deployed apps:

1. We recommend backing up EVERYTHING, including both all your config files, but also, take restic backups using k8up of all your current PVCs and verify they are working and available in your remote S3 buckets.

2. You'll need to also schedule down time so that any users know that you'll be offline during the migration as you'll need to take down all your non-core apps. When you're good to take them all down AFTER you've verified your backups are working, you can proceed to the next step.

3. Create a directory for your new environment, so let's say that's called prod, you'd create a directory called $XDG_CONFIG_HOME/smol-k8s-lab/apps/prod and move all your non-core apps into it (e.g. home assistant, mastodon, peertube, etc). At this time, you can take down your existing apps (completely delete them from Kubernetes).

4. Set apps_global_config.external_secrets to openbao and apps_global_config.migrate_to_openbao to true in your config.yaml file, and then set the following in each of your apps: restore.enabled: true. Then, you should be able to run smol-k8s-lab as normal and all should be well!

This update officially introduces the beginning of our smol-schema, meaning we stop using using the appset secret plugin officially, and start instead using targeted helm charts of Argo CD Applications. We also stop overloading the init.values of every app, and instead use targeted parameters. This means instead of e.g. for zitadel's admin and smtp section:

init:
  values:
    # admin info
    admin_user: ""
    admin_email: ""
    # smtp info
    smtp_host: ""
    smtp_user: ""
    smtp_port: ""
    smtp_protocol: "SMTP"
    # smtp from email (verified sender)
    smtp_from_address: example.com
    smtp_password:
      value_from:
        env: GHOST_SMTP_PASSWORD

You would provide the following in your $XDG_CONFIG_HOME/smol-k8s-lab/apps/zitadel.yaml:

# note that this is at the top level of the yaml
admin:
  username: ""
  email: ""

# note that this is at the top level of the yaml
smtp:
  # smtp info
  host: ""
  username: ""
  port: ""
  protocol: "SMTP"
  # smtp from email (verified sender)
  from_address: example.com
  password:
    value_from:
      env: GHOST_SMTP_PASSWORD

Likewise, for databases, you'd provide:

# note that this is at the top level of the yaml
db:
  # postgresql is the only supported app for most apps, but sometimes we support mysql like in the case of ghost and writefreely
  type: postgresql
  # this is your database pvc capacity
  capacity: 5Gi

For affinity and tolerations:

# note that these are at the top level of the yaml
affinity: {}
tolerations: []

PVCs now also get their own parameters like this:

# note this is a top level parameter
pvc:
  # this is for an example PVC named ghost
  ghost:
    # this enables it
    enabled: true
    # this is the ghost pvc capacity
    capacity: 10Gi

Valkey can be enabled or disabled with:

# note this is a top level parameter
valkey:
  # enable valkey
  enabled: true

for hostnames, those are also declared at the top level:

hostnames:
  zitadel: "iam.example.com"

Changes how we provide prometheus CRDs and alloy:

• alloy is now its own app and prometheus_crds are not their own app, instead you can set alloy's syncWaves to 1 to accomplish this
• alloy is no longer part of the grafana stack, so you can deploy it separately if needed

fix default config to call pvc_storage_class storage_class instead: 5c4f31eb3f

Your config should now read something like this:

# anything here gets set for all apps if you're using our default repos
apps_global_config:
  # setting this changes all the below domains to use the following cluster_issuer
  # change to letsencrypt-prod when you're ready to go live with your infra
  cluster_issuer: "letsencrypt-staging"
  # change to your tz: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
  time_zone: "Europe/Amsterdam"
  # always deploy extnernal secrets. *Must be a string of either:
  # ""           - don't use external secrets
  # "bitwarden"  - use bitwarden for external secrets
  # "openbao"    - (coming soon!) use openbao (a fork of vault) for external secrets
  external_secrets: "bitwarden"
  # the default storage class you want to use for the creation of all Persistent Volume claims
  # it defaults to local-path, but you can set it to longhorn or whatever you'd like :)
  # for storage classes see:
  storage_class: "local-path"

• changed how we determine if we should install the appset secret plugin: 04514b1066

You now need to pass the following into your argocd app's config:

  argocd:
    # set this to true if you want to use the appset secret plugin (defaults to false)
    enable_appset_secret_plugin: true

• This update begins removing ALL references to our previous GitHub repos. Please instead point to our new codeberg.org/open-engineering org for all Argo CD Applications and any helm charts of ours you used.
• We switched to the Grafana community helm chart repo. You'll want this for any future community grafana updates
• bumped Kubernetes and Ruamel lib versions major versions to latest.

• This is where we officially switch from Thanos to Mimir and start supporting Tempo for self hosted tracing.
  • we don't offer a migration path from thanos unfortunately. We recommend re-deploying the grafana_stack
• We also start supporting sensitive values for jellyfin.

A major difference is that your config directory $XDG_CONFIG_HOME/smol-k8s-lab/ is now split up into a couple different directories. For simplicity's sake, we'll refer to $XDG_CONFIG_HOME/smol-k8s-lab/ as your config directory, but note that this defaults to ~/.config/smol-k8s-lab unless you have set the $XDG_CONFIG_HOME env var to be something else.

Your name config file $XDG_CONFIG_HOME/smol-k8s-lab/config.yaml file no longer contains your apps at all. Instead, all of your apps now live in $XDG_CONFIG_HOME/smol-k8s-lab/apps and within that directory, you'll files for each app in that environment. The apps parameter in your $XDG_CONFIG_HOME/smol-k8s-lab/config.yaml will no longer be used. Instead, take each app's config parameters and move them to a file by that name in your apps directory, so for example, this is what your $XDG_CONFIG_HOME/smol-k8s-lab/apps/zitadel.yaml should look like, in order to deploy zitadel:

```yaml
enabled: true
description: |
  [link=https://zitadel.com/opensource]ZITADEL[/link] is an open source self hosted IAM platform for the cloud era

  smol-k8s-lab supports initialization of:
    - an admin service account
    - a human admin user (including an autogenerated password)
    - a project with a name of your chosing
    - 2 OIDC applications for Argo CD and Vouch
    - 2 Argo CD groups (admins and users), 1 vouch groups
    - groupsClaim action to enforce group roles on authentication
    - updates your appset_secret_plugin secret and refreshes the pod

  The default app will also deploy SeaweedFS to backup your database which in turn is backed up to a remote s3 provider of your choice.

  To provide sensitive values via environment variables to smol-k8s-lab use:
    - ZITADEL_S3_BACKUP_ACCESS_ID
    - ZITADEL_S3_BACKUP_SECRET_KEY
    - ZITADEL_RESTIC_REPO_PASSWORD
init:
  # Switch to false if you don't want to create intial secrets or use the
  # API via a service acocunt to create the above described resources
  enabled: true
  restore:
    # set to true to run a restic restore via a k8up job for seaweedfs PVCs,
    # and restoring your postgresql database
    enabled: false
    # for Cloudnative postgres operator cluster restores only
    cnpg_restore: true
    # the restic snapshot IDs of the PVC snapshots you want to restore
    restic_snapshot_ids:
      # seaweedFS volume pvc snapshot id. if not given, we use the latest
      seaweedfs_volume: ""
      # seaweedFS filer pvc snapshot id. if not given, we use the latest
      seaweedfs_filer: ""
  values:
    # initial human user's usename
    admin_user: ""
    # initial human user's email
    email: ""
    # initial human's first name
    first_name: ""
    # initial human's last name
    last_name: ""
    # options: GENDER_UNSPECIFIED, GENDER_MALE, GENDER_FEMALE, GENDER_DIVERSE
    # more coming soon, see: https://github.com/zitadel/zitadel/issues/6355
    gender: GENDER_UNSPECIFIED
    # name of the default project to create OIDC applications in
    project: core
    # mail server, must include port! e.g. mymailserver.com:587
    smtp_host:
      value_from:
        env: ZITADEL_SMTP_HOST
    # mail user
    smtp_user:
      value_from:
        env: ZITADEL_SMTP_USER
    # mail password
    smtp_password:
      value_from:
        env: ZITADEL_SMTP_PASSWORD
    # mail from address
    smtp_from_address:
      value_from:
        env: ZITADEL_SMTP_FROM_ADDRESS
    # mail from name
    smtp_from_name:
      value_from:
        env: ZITADEL_SMTP_FROM_NAME
    # mail reply to address
    smtp_reply_to_address:
      value_from:
        env: ZITADEL_SMTP_REPLY_TO_ADDRESS
backups:
  # cronjob syntax schedule to run zitadel seaweedfs pvc backups
  pvc_schedule: 10 0 * * *
  # cronjob syntax (with SECONDS field) for zitadel postgres backups
  # must happen at least 10 minutes before pvc backups, to avoid corruption
  # due to missing files. This is because the cnpg backup shows as completed
  # before it actually is, due to the wal archive it lists as it's end not
  # being in the backup yet
  postgres_schedule: 0 0 0 * * *
  s3:
    # these are for pushing remote backups of your local s3 storage, for speed and cost optimization
    endpoint: ""
    bucket: ""
    region: ""
    secret_access_key:
      value_from:
        env: ZITADEL_S3_BACKUP_SECRET_KEY
    access_key_id:
      value_from:
        env: ZITADEL_S3_BACKUP_ACCESS_ID
  restic_repo_password:
    value_from:
      env: ZITADEL_RESTIC_REPO_PASSWORD
argo:
  # secrets keys to make available to Argo CD ApplicationSets
  secret_keys:
    # FQDN to use for zitadel
    hostname: ""
    # set the local s3 provider for zitadel's database backups. can be minio or seaweedfs
    s3_provider: seaweedfs
    # local s3 endpoint for postgresql backups, backed up constantly
    s3_endpoint: ""
    # capacity for the PVC backing your local s3 instance
    s3_pvc_capacity: 2Gi
  # repo to install the Argo CD app from
  # git repo to install the Argo CD app from
  repo: https://codeberg.org/small-hack/argocd-apps
  # path in the argo repo to point to.
  path: "zitadel/app_of_apps/"
  # either the branch or tag to point at in the argo repo above
  revision: main
  # kubernetes cluster to install the k8s app into, defaults to Argo CD default
  cluster: https://kubernetes.default.svc
  # namespace to install the k8s app in
  namespace: "zitadel"
  # recurse directories in the provided git repo
  directory_recursion: false
  # source repos for Argo CD App Project (in addition to argo.repo)
  project:
    name: zitadel
    source_repos:
      - https://charts.zitadel.com
      - https://zitadel.github.io/zitadel-charts
      - https://small-hack.github.io/cloudnative-pg-cluster-chart
      - https://operator.min.io/
      - https://seaweedfs.github.io/seaweedfs/helm
      - https://git.smallhack.org/small-hack/argocd-apps
      - https://codeberg.org/small-hack/argocd-apps
    destination:
      # automatically includes the app's namespace and argocd's namespace
      namespaces: []
```

There are no other major changes except that:

• we upgrade Textual to a new major version. This is not something you need to worry about unless you forked this repo.
• we drop support for collabora as a stand alone app (it's now part of nextcloud)
• we add gotosocial as a default app

If you've installed smol-k8s-lab prior to v5.0.0, please backup your old configuration, and then remove the ~/.config/smol-k8s-lab/config.yaml (or $XDG_CONFIG_HOME/smol-k8s-lab/config.yaml) file entirely, then run the following with either pip or pipx:

if using pip:

# this uninstalls the old smol-k8s-lab for python 3.11
pip3.11 uninstall smol-k8s-lab

# this installs smol-k8s-lab for python 3.12
pip3.12 install --upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

or if using pipx:

# this upgrades smol-k8s-lab
pipx upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

We have done a masive upgrade of the config file. You'll need to update your configs based on the details in https://github.com/open-engineering-nl/smol-k8s-lab/pull/210 . The main changes are to the following (check each doc link for details):

• accessibility features
• k3s nodes section
• backups and restores
• sensitive values
• k9s has been removed in favor of run command (hint: you can still use k9s via run command)

If you've installed smol-k8s-lab prior to v4.0.0, please backup your old configuration, and then remove the ~/.config/smol-k8s-lab/config.yaml (or $XDG_CONFIG_HOME/smol-k8s-lab/config.yaml) file entirely, then run the following with either pip or pipx:

if using pip:

# this upgrades smol-k8s-lab
pip3.11 install --upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

or if using pipx:

# this upgrades smol-k8s-lab
pipx upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

The main breaking changes between v3.7.1 and v4.0.0 are that we now default enable metrics on most apps. Because of this, you need to have the Prometheus ServiceMonitor CRD installed ahead of time. Luckily, we now provide that as an app as well :) If you deleted your config and created a new one, it will already be there, but if you want to reuse your old config, you can add the app like this:

apps:
  prometheus_crds:
    description: |
      [link=https://prometheus.io/docs/introduction/overview/]Prometheus[/link] CRDs to start with.
      You can optionally disable this if you don't want to deploy apps with metrics.

    enabled: true
    argo:
      # secrets keys to make available to Argo CD ApplicationSets
      secret_keys: {}
      # git repo to install the Argo CD app from
      repo: https://codeberrg.org/open-engineering/argocd-apps
      # path in the argo repo to point to. Trailing slash very important!
      path: prometheus/crds/
      # either the branch or tag to point at in the argo repo above
      revision: main
      # namespace to install the k8s app in
      namespace: prometheus
      # recurse directories in the provided git repo
      directory_recursion: false
      # source repos for Argo CD App Project (in addition to argo.repo)
      project:
        name: prometheus
        source_repos:
        - https://github.com/prometheus-community/helm-charts.git
        destination:
          # automatically includes the app's namespace and argocd's namespace
          namespaces:
          - kube-system
          - prometheus

If using the default repos, please also disable directory directory_recursion for:

• your prometheus stack app
• zitadel

For all changes, please check out PR #206.

If you've installed smol-k8s-lab prior to v3.0.0, please backup your old configuration, and then remove the ~/.config/smol-k8s-lab/config.yaml (or $XDG_CONFIG_HOME/smol-k8s-lab/config.yaml) file entirely, then run the following with either pip or pipx:

if using pip:

# this upgrades smol-k8s-lab
pip3.11 install --upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

or if using pipx:

# this upgrades smol-k8s-lab
pipx upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

The main breaking changes between v2.2.4 and v3.0 are as follows:

• home assistant has graduated from demo app to live app

You'll need to change apps.home_assistant.argo.path to either home-assistant/toleration_and_affinity/ if you're using node labels and taints, or home-assistant/ if you're deploying to a single node cluster. Here's an example with no tolerations or node affinity:

apps:
  home_assistant:
    enabled: false
    description: |
      [link=https://home-assistant.io]Home Assistant[/link] is a home IOT management solution.

      By default, we assume you want to use node affinity and tolerations to keep home assistant pods on certain nodes and keep other pods off said nodes. If you don't want to use either of these features but still want to use the argocd-apps repo, first change the argo path to /home-assistant/ and then remove the 'toleration_' and 'affinity' secret_keys from the yaml file under apps.home_assistant.description.
    argo:
      secret_keys:
        hostname: "home-assistant.coolestdogintheworld.dog"
      repo: https://github.com/open-engineering/argocd-apps
      path: home-assistant/
      revision: main
      namespace: home-assistant
      directory_recursion: false
      project:
        source_repos:
        - http://jessebot.github.io/home-assistant-helm
        destination:
          namespaces:
          - argocd

And here's an example for labeled and tainted nodes, where your pod can use tolerations and node affinity:

apps:
  home_assistant:
    enabled: false
    description: |
      [link=https://home-assistant.io]Home Assistant[/link] is a home IOT management solution.

      By default, we assume you want to use node affinity and tolerations to keep home assistant pods on certain nodes and keep other pods off said nodes. If you don't want to use either of these features but still want to use the argocd-apps repo, first change the argo path to /home-assistant/ and then remove the 'toleration_' and 'affinity' secret_keys from the yaml file under apps.home_assistant.description.
    argo:
      secret_keys:
        hostname: "home-assistant.coolestdogintheworld.dog"
        toleration_key: "blutooth"
        toleration_operator: "Equals"
        toleration_value: "True"
        toleration_effect: "NoSchedule"
        affinity_key: "blutooth"
        affinity_value: "True"
      repo: https://github.com/open-engineering/argocd-apps
      path: home-assistant/toleration_and_affinity/
      revision: main
      namespace: home-assistant
      directory_recursion: false
      project:
        source_repos:
        - http://jessebot.github.io/home-assistant-helm
        destination:
          namespaces:
          - argocd

• new k3s feature for adding additional nodes

This feature changes k8s_distros.k3s.nodes to be a dictionary so that you can include additional nodes for us to join to the cluster after we create it, but before we install apps. Here's an example of how you can add a new node to k3s on installation:

k8s_distros:
  k3s:
    enabled: false
    k3s_yaml:
      # if you enable MetalLB, we automatically add servicelb to the disable list
      # enables encryption at rest for Kubernetes secrets
      secrets-encryption: true
      # disables traefik so we can enable ingress-nginx, remove if you're using traefik
      disable:
      - "traefik"
      node-label:
      - "ingress-ready=true"
      kubelet-arg:
      - "max-pods=150"
    # nodes to SSH to and join to cluster. example:
    nodes:
      # name can be a hostname or ip address
      serverfriend1.lan:
        # change ssh_key to the name of a local private key to use
        ssh_key: id_rsa
        # must be node type of "worker" or "control_plane"
        node_type: worker
        # labels are optional, but may be useful for pod node affinity
        node_labels:
          - iot=true
        # taints are optional, but may be useful for pod tolerations
        node_taints:
          - iot=true:NoSchedule

if you don't want to add any nodes, this is what you should change your nodes section to be:

k8s_distros:
  k3s:
    enabled: false
    k3s_yaml:
      # if you enable MetalLB, we automatically add servicelb to the disable list
      # enables encryption at rest for Kubernetes secrets
      secrets-encryption: true
      # disables traefik so we can enable ingress-nginx, remove if you're using traefik
      disable:
      - "traefik"
      node-label:
      - "ingress-ready=true"
      kubelet-arg:
      - "max-pods=150"
    # nodes to SSH to and join to cluster. example:
    nodes: {}

• cert-manager now supports DNS01 challenge solver using the Cloudflare provider

This feature reworks the apps.cert_manager.init and apps.cert_manager.argo.secret_keys sections.

Here's an example of using the HTTP01 challenge solver, which would be the only previously supported challenge solver, so if you want everything to just work how it did before your config file should look like this:

apps:
  cert_manager:
    enabled: true
    description: |
      [link=https://cert-manager.io/]cert-manager[/link] let's you use LetsEncrypt to generate TLS certs for all your apps with ingress.

      smol-k8s-lab supports optional initialization by creating [link=https://cert-manager.io/docs/configuration/acme/]ACME Issuer type[/link] [link=https://cert-manager.io/docs/concepts/issuer/]ClusterIssuers[/link] using either the HTTP01 or DNS01 challenge solvers. We create two ClusterIssuers: letsencrypt-staging and letsencrypt-staging.

      For the DNS01 challange solver, you will need to either export $CLOUDFLARE_API_TOKEN as an env var, or fill in the sensitive value for it each time you run smol-k8s-lab.

      Currently, Cloudflare is the only supported DNS provider for the DNS01 challenge solver. If you'd like to use a different DNS provider or use a different Issuer type all together, please either set one up outside of smol-k8s-lab. We also welcome [link=https://codeberg.org/open-engineering/smol-k8s-lab/pulls]PRs[/link] to add these features :)

    # Initialize of the app through smol-k8s-lab
    init:
      # Deploys staging and prod ClusterIssuers and prompts you for
      # values if they were not set. Switch to false if you don't want
      # to deploy any ClusterIssuers
      enabled: true
      values:
        # Used for to generate certs and alert you if they're going to expire
        email: "you@emailsforfriends.com"
        # choose between "http01" or "dns01"
        cluster_issuer_acme_challenge_solver: http01
        # only needed if cluster_issuer_challenge_solver set to dns01,
        # currently only cloudflare is supported
        cluster_issuer_acme_dns01_provider: cloudflare
      sensitive_values: []
    argo:
      secret_keys: {}
      # git repo to install the Argo CD app from
      repo: "https://codeberg.org/open-engineering/argocd-apps"
      # path in the argo repo to point to. Trailing slash very important!
      path: "cert-manager/"
      # either the branch or tag to point at in the argo repo above
      revision: main
      # namespace to install the k8s app in
      namespace: "cert-manager"
      # recurse directories in the provided git repo
      directory_recursion: false
      # source repos for cert-manager CD App Project (in addition to argo.repo)
      project:
        source_repos:
          - https://charts.jetstack.io
        destination:
          # automatically includes the app's namespace and argocd's namespace
          namespaces:
            - kube-system

And here's how you'd use the new DNS01 feature (keep in mind you need to either provide a sensitive value each time you run smol-k8s-lab, OR you need to export $CLOUDFLARE_API_TOKEN as an env var prior to running smol-k8s-lab):

apps:
  cert_manager:
    enabled: true
    description: |
      [link=https://cert-manager.io/]cert-manager[/link] let's you use LetsEncrypt to generate TLS certs for all your apps with ingress.

      smol-k8s-lab supports optional initialization by creating [link=https://cert-manager.io/docs/configuration/acme/]ACME Issuer type[/link] [link=https://cert-manager.io/docs/concepts/issuer/]ClusterIssuers[/link] using either the HTTP01 or DNS01 challenge solvers. We create two ClusterIssuers: letsencrypt-staging and letsencrypt-staging.

      For the DNS01 challange solver, you will need to either export $CLOUDFLARE_API_TOKEN as an env var, or fill in the sensitive value for it each time you run smol-k8s-lab.

      Currently, Cloudflare is the only supported DNS provider for the DNS01 challenge solver. If you'd like to use a different DNS provider or use a different Issuer type all together, please either set one up outside of smol-k8s-lab. We also welcome [link=https://codeberg.org/open-engineering/smol-k8s-lab/pulls]PRs[/link] to add these features :)

    # Initialize of the app through smol-k8s-lab
    init:
      # Deploys staging and prod ClusterIssuers and prompts you for
      # values if they were not set. Switch to false if you don't want
      # to deploy any ClusterIssuers
      enabled: true
      values:
        # Used for to generate certs and alert you if they're going to expire
        email: "you@emailsforfriends.com"
        # choose between "http01" or "dns01"
        cluster_issuer_acme_challenge_solver: dns01
        # only needed if cluster_issuer_challenge_solver set to dns01
        # currently only cloudflare is supported
        cluster_issuer_acme_dns01_provider: cloudflare
      sensitive_values:
        # can be passed in as env vars if you pre-pend CERT_MANAGER_
        # e.g. CERT_MANAGER_CLOUDFLARE_API_TOKEN
      - CLOUDFLARE_API_TOKEN
    argo:
      secret_keys: {}
      # git repo to install the Argo CD app from
      repo: "https://codeberg.org/open-engineering/argocd-apps"
      # path in the argo repo to point to. Trailing slash very important!
      path: "cert-manager/"
      # either the branch or tag to point at in the argo repo above
      revision: main
      # namespace to install the k8s app in
      namespace: "cert-manager"
      # recurse directories in the provided git repo
      directory_recursion: false
      # source repos for cert-manager CD App Project (in addition to argo.repo)
      project:
        source_repos:
          - https://charts.jetstack.io
        destination:
          # automatically includes the app's namespace and argocd's namespace
          namespaces:
            - kube-system

If you've installed smol-k8s-lab prior to v2.0.0, please backup your old configuration, and then remove the ~/.config/smol-k8s-lab/config.yaml (or $XDG_CONFIG_HOME/smol-k8s-lab/config.yaml) file entirely, then run the following:

# this upgrades smol-k8s-lab
pip3.11 install --upgrade smol-k8s-lab

# this initializes a new configuration
smol-k8s-lab

The main difference between the old and new config files are for apps, we've added:

• apps.APPNAME.description - for adding a custom description, set it to whatever you like
• apps.APPNAME.argo.directory_recursion - so you can have bigger nested apps :)
• apps.APPNAME.argo.project.destination.namespaces - control what namespaces are allowed for a project

And we've changed:

• apps.APPNAME.argo.ref to apps.APPNAME.argo.revision
• apps.APPNAME.argo.project_source_repos to apps.APPNAME.argo.project.source_repos

And we've REMOVED:

• apps.APPNAME.argo.part_of_app_of_apps - this was mostly used internally, we think

Here's an example of an updated cert-manager app with the new config:

apps:
  cert_manager:
    # ! NOTE: you currently can't set this to false. It is necessary to deploy
    # most of our supported Argo CD apps since they often have TLS enabled either
    # for pod connectivity or ingress
    enabled: true
    description: |
      [link=https://cert-manager.io/]cert-manager[/link] let's you use LetsEncrypt to generate TLS certs for all your apps with ingress.

      smol-k8s-lab supports initialization by creating two [link=https://cert-manager.io/docs/concepts/issuer/]ClusterIssuers[/link] for both staging and production using a provided email address as the account ID for acme.

    # Initialize of the app through smol-k8s-lab
    init:
      # Deploys staging and prod ClusterIssuers and prompts you for
      # cert-manager.argo.secret_keys if they were not set. Switch to false if
      # you don't want to deploy any ClusterIssuers
      enabled: true
    argo:
      secret_keys:
        # Used for letsencrypt-staging, to generate certs
        email: ""
      # git repo to install the Argo CD app from
      repo: "https://codeberg.org/open-engineering/argocd-apps"
      # path in the argo repo to point to. Trailing slash very important!
      path: "cert-manager/"
      # either the branch or tag to point at in the argo repo above
      revision: main
      # namespace to install the k8s app in
      namespace: "cert-manager"
      # recurse directories in the provided git repo
      directory_recursion: false
      # source repos for cert-manager CD App Project (in addition to argo.repo)
      project:
        source_repos:
          - https://charts.jetstack.io
        destination:
          # automatically includes the app's namespace and argocd's namespace
          namespaces:
            - kube-system