fix: correct external-dns target IP to 198.18.200.4

fix(puppet): add traefik.io/instance label to puppetdb Gateway
feat(puppet): migrate puppetdb Ingress to Gateway API
2026-05-23 01:33:59 +10:00 · 2026-05-23 01:33:59 +10:00 · 2026-05-23 01:33:59 +10:00 · 2026-05-23 01:31:28 +10:00 · 2026-05-23 01:31:03 +10:00 · 2026-05-23 01:29:54 +10:00
22 changed files with 246 additions and 129 deletions
@@ -0,0 +1,29 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
  name: rancher
  namespace: cattle-system
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: rancher.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - kind: Secret
            name: rancher-tls
        mode: Terminate
@@ -0,0 +1,20 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: rancher
  namespace: cattle-system
 spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
    - name: rancher
      sectionName: https
  rules:
    - backendRefs:
        - name: rancher
          port: 80
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: rancher
  namespace: cattle-system
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
 spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - rancher.k8s.syd1.au.unkin.net
      secretName: rancher-tls
  rules:
    - host: rancher.k8s.syd1.au.unkin.net
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: rancher
                port:
                  number: 80
@@ -6,4 +6,5 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
@@ -0,0 +1,29 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: litellm
  namespace: litellm
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: litellm.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - kind: Secret
            name: litellm-tls
        mode: Terminate
@@ -0,0 +1,20 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: litellm
  namespace: litellm
 spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
    - name: litellm
      sectionName: https
  rules:
    - backendRefs:
        - name: litellm
          port: 4000
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: litellm
  namespace: litellm
 spec:
  rules:
    - host: litellm.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: litellm
                port:
                  number: 4000
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - litellm.k8s.syd1.au.unkin.net
      secretName: litellm-tls
@@ -7,7 +7,8 @@ resources:
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
@@ -0,0 +1,29 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: paperclip
  namespace: paperclip
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: paperclip.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - kind: Secret
            name: paperclip-tls
        mode: Terminate
@@ -0,0 +1,20 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: paperclip
  namespace: paperclip
 spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
    - name: paperclip
      sectionName: https
  rules:
    - backendRefs:
        - name: paperclip
          port: 3100
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: paperclip
  namespace: paperclip
 spec:
  rules:
    - host: paperclip.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: paperclip
                port:
                  number: 3100
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - paperclip.k8s.syd1.au.unkin.net
      secretName: paperclip-tls
@@ -6,7 +6,8 @@ resources:
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - services.yaml
  - vaultauth.yaml
@@ -0,0 +1,33 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: puppetboard.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - kind: Secret
            name: puppetboard-tls
        mode: Terminate
@@ -0,0 +1,25 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
    - name: puppetboard
      sectionName: https
  rules:
    - backendRefs:
        - name: puppetboard
          port: 80
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,34 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  labels:
    app.kubernetes.io/component: puppetboard
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetboard
  namespace: puppet
 spec:
  rules:
    - host: puppetboard.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: puppetboard
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - puppetboard.k8s.syd1.au.unkin.net
      secretName: puppetboard-tls
@@ -25,7 +25,8 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
+  - gateway_puppetboard.yaml
  - httproute_puppetboard.yaml
  - gateway_puppetdb.yaml
  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
@@ -2,6 +2,8 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
  labels:
    traefik.io/instance: external
  name: traefik-external
 spec:
  controllerName: traefik.io/gateway-controller
@@ -2,6 +2,8 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
  labels:
    traefik.io/instance: internal
  name: traefik-internal
 spec:
  controllerName: traefik.io/gateway-controller
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: external-dns
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.19.0"
+    version: "1.21.1"
    releaseName: externaldns
    namespace: externaldns
    valuesFile: values.yaml
@@ -25,10 +25,7 @@ sources:
  - service
  - ingress
  - gateway-httproute
  - gateway-tlsroute
  - gateway-grpcroute
  - gateway-tcproute
  - gateway-udproute
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -54,3 +51,5 @@ extraArgs:
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx
 logLevel: debug
@@ -82,4 +82,17 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
 ports:
  web:
    port: 80
  websecure:
    port: 443
 enabled: true
@@ -82,4 +82,17 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
 ports:
  web:
    port: 80
  websecure:
    port: 443
 enabled: true
Author	SHA1	Message	Date
unkinben	12b6b5e038	fix: correct external-dns target IP to 198.18.200.4 ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-05-23 01:33:59 +10:00
unkinben	e87f56d597	fix(puppet): add traefik.io/instance label to puppetdb Gateway	2026-05-23 01:33:59 +10:00
unkinben	be7a195d3e	feat(puppet): migrate puppetdb Ingress to Gateway API Replace nginx Ingress with Gateway + HTTPRoute using the traefik-internal GatewayClass. TLS is terminated at the Gateway listener via cert-manager.	2026-05-23 01:33:59 +10:00
unkinben	2c6d88aa6b	feat(puppet): migrate puppetboard Ingress to Gateway API (#130 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetdb.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetboard-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #130	2026-05-23 01:31:28 +10:00
unkinben	58368948d9	feat(paperclip): migrate Ingress to Gateway API (#133 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the paperclip app cleanly - [ ] cert-manager issues the `paperclip-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #133	2026-05-23 01:31:03 +10:00
unkinben	4f5c3f7ea0	feat(litellm): migrate Ingress to Gateway API (#134 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the litellm app cleanly - [ ] cert-manager issues the `litellm-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://litellm.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #134	2026-05-23 01:29:54 +10:00
unkinben	fd87cb96b5	feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs (#143 ) ## Changes - Upgrade external-dns chart from 1.19.0 → 1.21.1 (app v0.19.0 → v0.21.0) - Remove `gateway-tcproute` source — `TCPRoute` CRD is not installed, causing crash-loop - Add `gateway-tlsroute` source — `TLSRoute` CRD is installed (Gateway API 1.5.1) ## Why The pod was crash-looping every minute with `failed to list *v1alpha2.TCPRoute: the server could not find the requested resource` because the TCPRoute CRD doesn't exist in this cluster. TLSRoute was previously removed but its CRD does exist. Reviewed-on: #143	2026-05-23 01:28:20 +10:00
unkinben	d619f9195e	benvin/externaldns_compatability (#142 ) Reviewed-on: #142	2026-05-23 01:17:20 +10:00
unkinben	1944dbbfcd	temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout (#140 ) Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found. Reviewed-on: #140	2026-05-23 01:07:45 +10:00
unkinben	0940cc20f8	fix(traefik): listen on port 443 directly for Gateway API compatibility (#138 ) ## Problem Gateway listeners with `port: 443` were rejected with `PortUnavailable: Cannot find entryPoint for Gateway: no matching entryPoint for port 443 and protocol "HTTPS"`. Traefik matches Gateway listener ports against its internal entryPoint ports (pod-level), not the Service's `exposedPort`. The `websecure` entryPoint was configured on port `8443`, so port `443` listeners had no match. ## Fix - `ports.websecure.port: 443` — Traefik now binds directly on 443 - `securityContext.capabilities.add: [NET_BIND_SERVICE]` — allows a non-root process to bind to privileged ports (<1024) The Service `exposedPort` stays at `443`, so external connectivity is unchanged. All existing Gateway listeners (`port: 443`) are correct as-is. Applies to both internal and external Traefik instances. ## Test plan - [ ] Traefik pods restart cleanly - [ ] `kubectl get gateway -A` shows listeners as `Programmed: True` - [ ] `https://rancher.k8s.syd1.au.unkin.net` (already merged) is reachable Reviewed-on: #138	2026-05-23 00:44:13 +10:00
unkinben	20ce2b1b92	feat(cattle-system): migrate rancher Ingress to Gateway API (#132 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the cattle-system app cleanly - [ ] cert-manager issues the `rancher-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://rancher.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #132	2026-05-23 00:24:57 +10:00
unkinben	64dc5a0242	fix(traefik): add instance labels to GatewayClasses (#137 ) ## Problem GatewayClasses were `Unknown` even after controllerName was fixed. The `kubernetesGateway` `labelSelector` applies to all watched resources, including GatewayClasses themselves. Since neither GatewayClass had a `traefik.io/instance` label, both Traefik instances filtered them out and never accepted them. ## Fix - `gatewayclass-internal.yaml`: add `traefik.io/instance: internal` - `gatewayclass-external.yaml`: add `traefik.io/instance: external` ## Test plan - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #137	2026-05-23 00:23:18 +10:00
unkinben	57c14d32c0	fix(traefik): remove invalid controllerName flag causing CrashLoopBackOff (#136 ) ## URGENT — Traefik pods are CrashLoopBackOff The merged PR #135 added `--providers.kubernetesgateway.controllerName` as an `additionalArguments` entry. Traefik v3.7.0 does not support this flag and fails immediately on startup. Old replica sets are still running (one pod each) but new pods cannot come up. ## Fix - Remove `additionalArguments` from both `values-internal.yaml` and `values-external.yaml` - Revert GatewayClass `controllerName` back to `traefik.io/gateway-controller` (the hardcoded Traefik default — no override mechanism exists in v3.7.0) ## After merge GatewayClasses will remain `Unknown` until a separate solution for internal/external separation is implemented (the `labelSelector` approach needs further investigation). Reviewed-on: #136	2026-05-22 23:58:56 +10:00
unkinben	2df359c4a9	fix(traefik): set controllerName on GatewayClasses and Traefik providers (#135 ) ## Problem Both GatewayClasses (`traefik-internal`, `traefik-external`) were stuck as `Unknown`. Neither Traefik deployment had `controllerName` set in `kubernetesGateway`, so both defaulted to `traefik.io/gateway-controller` — which matched neither GatewayClass. ## Fix - `gatewayclass-internal.yaml`: `controllerName: traefik.io/gateway-controller-internal` - `gatewayclass-external.yaml`: `controllerName: traefik.io/gateway-controller-external` - `values-internal.yaml`: added `controllerName: traefik.io/gateway-controller-internal` - `values-external.yaml`: added `controllerName: traefik.io/gateway-controller-external` ## Test plan - [ ] ArgoCD syncs traefik-system cleanly - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #135	2026-05-22 23:44:06 +10:00