Etcd revival

services/jellyfin/jellyfin-ingress.yaml

@@ -19,21 +19,21 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: default-jellyfin-proxy-headers@kubernetescrd
 spec:
-  tls:
-  - hosts:
-    - beak.mynest.love
-    secretName: jellyfin-tls
+  # tls:
+  # - hosts:
+  #   - beak.mynest.love
+  #   secretName: jellyfin-tls
   rules:
-  - host: beak.mynest.love
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: jellyfin
-            port:
-              name: http-web
+  # - host: beak.mynest.love
+  #   http:
+  #     paths:
+  #     - path: /
+  #       pathType: Prefix
+  #       backend:
+  #         service:
+  #           name: jellyfin
+  #           port:
+  #             name: http-web
   - host: jellyfin.k3s.home.nest
     http:
       paths:

services/vault/keykeeper/keykeeper-deployment.yaml

@@ -15,11 +15,14 @@ spec:
     spec:
       serviceAccountName: vault # Allows k8s auth for autounsealing
       nodeSelector:
-        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir
+        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir chowned by 100:100
       containers:
       - name: vault
         image: hashicorp/vault:latest
         args: ["server"]
+        securityContext:
+          capabilities:
+            add: ["IPC_LOCK"]
         env:
         - name: VAULT_LOCAL_CONFIG
           value: |
@@ -55,5 +58,5 @@ spec:
       volumes:
       - name: vault-data
         hostPath:
-          path: /vaultkeeper
+          path: /keykeeper
           type: DirectoryOrCreate

services/vault/vault-statefulset.yaml

@@ -53,6 +53,10 @@ spec:
               address=http://vault-keykeeper.vault.svc.cluster.local:80)
             
             sed "s/REPLACE_WITH_TOKEN/$TRANSIT_TOKEN/" /etc/vault/extraconfig-from-values.hcl > /vault/runtime/vault.hcl
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add: ["IPC_LOCK"]
         env:
           - name: VAULT_ADDR
             value: "http://vault-keykeeper.vault.svc.cluster.local:80"
@@ -67,6 +71,8 @@ spec:
         args: ["server", "-config=/vault/runtime/vault.hcl"]
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            add: ["IPC_LOCK"]
         env:
         - name: POD_NAME
           valueFrom: