pdbmux: deploy the merging PuppetDB proxy in-cluster

node-lookup (and pblastreport) need a single merged view over the two PuppetDBs
that coexist during the VM -> k8s Puppet migration. pdbmux provides that merged
PuppetDB v4 surface. Per the all-in-kubernetes direction it runs in-cluster
rather than as a per-VM systemd service.

- Add apps/base/pdbmux/ (namespace, configmap, deployment, service, gateway,
  httproute) modeled on the encapi app.
- Deployment: 2 replicas, image git.unkin.net/unkin/pdbmux:v0.6.0, port 8080,
  /healthz liveness+readiness, PDBMUX_* env from a configmap. Backends: old =
  http://puppetdbapi.service.consul:8080, new =
  http://puppetdb.puppet.svc.cluster.local:8080 (in-cluster, preferred); new is
  primary/prefer.
- Expose over HTTPS at pdbmux.k8s.syd1.au.unkin.net via a traefik-internal
  Gateway (cert-manager vault-issuer, external-dns), plain-HTTP backend, same
  shape as the puppetdb/encapi gateways, so VM/workstation node-lookup can reach
  it.
- Add apps/overlays/au-syd1/pdbmux/ and wire it into the platform
  ApplicationSet + AppProject (pdbmux namespace destination), as encapi is.

apps/base/pdbmux/configmap.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pdbmux-env
+  namespace: pdbmux
+data:
+  PDBMUX_LISTEN: ":8080"
+  # Two PuppetDB backends merged during the VM -> k8s migration:
+  #   old = legacy Consul-registered puppetdbapi (reachable from pods via the
+  #         Consul DNS the puppet workloads already use)
+  #   new = the in-cluster k8s PuppetDB (plain HTTP on 8080; in-cluster address
+  #         is preferred over the external gateway to avoid a hairpin).
+  PDBMUX_BACKENDS: "old=http://puppetdbapi.service.consul:8080,new=http://puppetdb.puppet.svc.cluster.local:8080"
+  # "new" (the k8s PuppetDB) is the primary for non-merged pass-through and the
+  # preferred backend for ties / static-merge fallback.
+  PDBMUX_PRIMARY: "new"
+  PDBMUX_PREFER: "new"
+  PDBMUX_MERGE: "freshness"

apps/base/pdbmux/deployment.yaml

@@ -0,0 +1,63 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdbmux
+  namespace: pdbmux
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: pdbmux
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pdbmux
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - name: pdbmux
+          # Image is published by node-lookup's .woodpecker/docker.yaml on a v*
+          # tag. It only exists after that tag is cut (see PR merge gates).
+          image: git.unkin.net/unkin/pdbmux:v0.6.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          envFrom:
+            # PDBMUX_LISTEN / PDBMUX_BACKENDS / PDBMUX_PRIMARY / PDBMUX_PREFER /
+            # PDBMUX_MERGE
+            - configMapRef:
+                name: pdbmux-env
+                optional: false
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      restartPolicy: Always

apps/base/pdbmux/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: pdbmux.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: pdbmux.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: pdbmux
+  namespace: pdbmux
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: pdbmux.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: pdbmux.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: pdbmux-tls
+        mode: Terminate

apps/base/pdbmux/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: pdbmux-http-redirect
+  namespace: pdbmux
+spec:
+  hostnames:
+    - pdbmux.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: pdbmux
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: pdbmux
+  namespace: pdbmux
+spec:
+  hostnames:
+    - pdbmux.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: pdbmux
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: pdbmux
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/pdbmux/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/pdbmux/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: pdbmux

apps/base/pdbmux/service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pdbmux
+  namespace: pdbmux
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: pdbmux
+  sessionAffinity: None
+  type: ClusterIP

apps/overlays/au-syd1/pdbmux/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/pdbmux

argocd/applicationsets/platform.yaml

@@ -29,6 +29,7 @@ spec:
       - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/node-feature-discovery
+      - path: apps/overlays/*/pdbmux
       - path: apps/overlays/*/priority-classes
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb

argocd/projects/platform.yaml

@@ -39,6 +39,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
+    - namespace: 'pdbmux'
+      server: https://kubernetes.default.svc
     - namespace: 'priority-classes'
       server: https://kubernetes.default.svc
     - namespace: 'purelb'