Serve grafana.unkin.net from traefik-external (#522)
grafana.unkin.net still routes through the puppet haproxy edge to the old grafana VMs; the k8s grafana should serve it directly like identity and vlogs. - add grafana-external Gateway (traefik-external, *.unkin.net wildcard) with redirect + main HTTPRoutes - reflect wildcard-unkin-net-tls into grafana - set grafana root_url to https://grafana.unkin.net - add grafana A record -> 198.18.199.0 in the bind-operator unkin.net zone - drop grafana.unkin.net from the k8s haproxy routes and config Requires terraform-authentik grafana redirect URI PR applied first, and the puppet halb vrrp_cnames grafana.unkin.net CNAME removed. Reviewed-on: #522 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #522.
This commit is contained in:
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: DNSRecord
|
||||
metadata:
|
||||
name: grafana-dns-internal
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
zoneRef: unkin-net
|
||||
name: grafana
|
||||
type: A
|
||||
ttl: 600
|
||||
values:
|
||||
# traefik-EXTERNAL (DMZ) gateway VIP; the grafana-external Gateway serves
|
||||
# grafana.unkin.net there.
|
||||
- 198.18.199.0
|
||||
@@ -9,6 +9,7 @@ resources:
|
||||
# record itself.
|
||||
# - git.yaml
|
||||
- ghp.yaml
|
||||
- grafana.yaml
|
||||
- identity.yaml
|
||||
- lb1.yaml
|
||||
- logviewer.yaml
|
||||
|
||||
@@ -14,9 +14,9 @@ spec:
|
||||
secretTemplate:
|
||||
annotations:
|
||||
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
|
||||
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs"
|
||||
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs,grafana"
|
||||
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
|
||||
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs"
|
||||
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs,grafana"
|
||||
privateKey:
|
||||
size: 4096
|
||||
dnsNames:
|
||||
|
||||
@@ -37,3 +37,36 @@ spec:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: grafana-tls
|
||||
---
|
||||
# Public grafana.unkin.net via the external Traefik; TLS uses the reflected
|
||||
# Let's Encrypt *.unkin.net wildcard, DNS lives in the bind-operator zone.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: external
|
||||
name: grafana-external
|
||||
namespace: grafana
|
||||
spec:
|
||||
gatewayClassName: traefik-external
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: grafana.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: grafana.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: wildcard-unkin-net-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -43,7 +43,7 @@ spec:
|
||||
memory: 4Gi
|
||||
config:
|
||||
server:
|
||||
root_url: "https://grafana.k8s.syd1.au.unkin.net"
|
||||
root_url: "https://grafana.unkin.net"
|
||||
database:
|
||||
type: "postgres"
|
||||
host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
|
||||
|
||||
@@ -53,3 +53,58 @@ spec:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: grafana-external-http-redirect
|
||||
namespace: grafana
|
||||
labels:
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/instance: grafana
|
||||
spec:
|
||||
hostnames:
|
||||
- grafana.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: grafana-external
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: grafana-external
|
||||
namespace: grafana
|
||||
labels:
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/instance: grafana
|
||||
spec:
|
||||
hostnames:
|
||||
- grafana.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: grafana-external
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: grafana-service
|
||||
port: 3000
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
|
||||
@@ -21,7 +21,6 @@ data:
|
||||
jellyfin.main.unkin.net be_jellyfin
|
||||
fafflix.unkin.net be_jellyfin
|
||||
git.unkin.net be_gitea
|
||||
grafana.unkin.net be_grafana
|
||||
dashboard.ceph.unkin.net be_ceph_dashboard
|
||||
auth.unkin.net be_k8s_kanidm
|
||||
|
||||
@@ -124,23 +123,6 @@ data:
|
||||
server ausyd1nxvm2081 198.18.27.117:443 check cookie ausyd1nxvm2081 fall 2 inter 2s rise 3 ssl verify none
|
||||
server ausyd1nxvm2082 198.18.28.71:443 check cookie ausyd1nxvm2082 fall 2 inter 2s rise 3 ssl verify none
|
||||
|
||||
backend be_grafana
|
||||
description Backend for grafana nodes
|
||||
balance roundrobin
|
||||
cookie SRVNAME insert indirect nocache
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { dst_port 443 }
|
||||
http-reuse always
|
||||
option httpchk GET /
|
||||
option forwardfor
|
||||
option http-keep-alive
|
||||
option prefer-last-server
|
||||
redirect scheme https if !{ ssl_fc }
|
||||
stick on src
|
||||
stick-table type ip size 200k expire 30m
|
||||
server ausyd1nxvm2015 198.18.27.2:443 check cookie ausyd1nxvm2015 fall 2 inter 2s rise 3 ssl verify none
|
||||
server ausyd1nxvm2016 198.18.28.189:443 check cookie ausyd1nxvm2016 fall 2 inter 2s rise 3 ssl verify none
|
||||
|
||||
backend be_jellyfin
|
||||
description Backend for au-syd1 jellyfin
|
||||
balance roundrobin
|
||||
|
||||
@@ -17,7 +17,6 @@ spec:
|
||||
- jellyfin.main.unkin.net
|
||||
- fafflix.unkin.net
|
||||
- git.unkin.net
|
||||
- grafana.unkin.net
|
||||
- dashboard.ceph.unkin.net
|
||||
- auth.unkin.net
|
||||
parentRefs:
|
||||
|
||||
@@ -17,7 +17,6 @@ spec:
|
||||
- jellyfin.main.unkin.net
|
||||
- fafflix.unkin.net
|
||||
- git.unkin.net
|
||||
- grafana.unkin.net
|
||||
- dashboard.ceph.unkin.net
|
||||
- auth.unkin.net
|
||||
parentRefs:
|
||||
|
||||
Reference in New Issue
Block a user