fix: use chart logLevel value instead of duplicate extraArg

temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout (#140 )
Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found. Reviewed-on: #140
2026-05-23 01:08:49 +10:00 · 2026-05-23 01:07:45 +10:00 · 2026-05-23 00:44:13 +10:00 · 2026-05-23 00:24:57 +10:00 · 2026-05-23 00:23:18 +10:00 · 2026-05-22 23:58:56 +10:00
12 changed files with 99 additions and 71 deletions
@@ -2,32 +2,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
-    app.kubernetes.io/component: puppetdb
+  annotations:
-    app.kubernetes.io/instance: puppetserver
+    cert-manager.io/cluster-issuer: vault-issuer
-    app.kubernetes.io/name: puppetserver
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    app.kubernetes.io/version: 8.8.0
+    cert-manager.io/private-key-size: "4096"
-  name: puppetdb
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-  namespace: puppet
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
  name: rancher
  namespace: cattle-system
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
-      hostname: puppetdb.k8s.syd1.au.unkin.net
+      hostname: rancher.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - kind: Secret
-            name: puppetdb-tls
+            name: rancher-tls
        mode: Terminate
@@ -0,0 +1,20 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: rancher
  namespace: cattle-system
 spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
    - name: rancher
      sectionName: https
  rules:
    - backendRefs:
        - name: rancher
          port: 80
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -1,29 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: rancher
  namespace: cattle-system
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
 spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - rancher.k8s.syd1.au.unkin.net
      secretName: rancher-tls
  rules:
    - host: rancher.k8s.syd1.au.unkin.net
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: rancher
                port:
                  number: 80
@@ -6,4 +6,5 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
  - httproute.yaml
@@ -1,25 +0,0 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  hostnames:
    - puppetdb.k8s.syd1.au.unkin.net
  parentRefs:
    - name: puppetdb
      sectionName: https
  rules:
    - backendRefs:
        - name: puppetdb
          port: 8080
      matches:
        - path:
            type: PathPrefix
            value: /
@@ -0,0 +1,34 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.0
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
 spec:
  rules:
    - host: puppetdb.k8s.syd1.au.unkin.net
      http:
        paths:
          - backend:
              service:
                name: puppetdb
                port:
                  number: 8080
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - puppetdb.k8s.syd1.au.unkin.net
      secretName: puppetdb-tls
@@ -26,8 +26,7 @@ resources:
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
  - ingress_puppetboard.yaml
-  - gateway_puppetdb.yaml
+  - ingress_puppetdb.yaml
  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -2,6 +2,8 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
  labels:
    traefik.io/instance: external
  name: traefik-external
 spec:
  controllerName: traefik.io/gateway-controller
@@ -2,6 +2,8 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
  labels:
    traefik.io/instance: internal
  name: traefik-internal
 spec:
  controllerName: traefik.io/gateway-controller
@@ -54,3 +54,5 @@ extraArgs:
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx
 logLevel: debug
@@ -82,4 +82,17 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
 ports:
  web:
    port: 80
  websecure:
    port: 443
 enabled: true
@@ -82,4 +82,17 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
 ports:
  web:
    port: 80
  websecure:
    port: 443
 enabled: true
Author	SHA1	Message	Date
unkinben	d4b66bb651	fix: use chart logLevel value instead of duplicate extraArg ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-05-23 01:08:49 +10:00
unkinben	1944dbbfcd	temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout (#140 ) Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found. Reviewed-on: #140	2026-05-23 01:07:45 +10:00
unkinben	0940cc20f8	fix(traefik): listen on port 443 directly for Gateway API compatibility (#138 ) ## Problem Gateway listeners with `port: 443` were rejected with `PortUnavailable: Cannot find entryPoint for Gateway: no matching entryPoint for port 443 and protocol "HTTPS"`. Traefik matches Gateway listener ports against its internal entryPoint ports (pod-level), not the Service's `exposedPort`. The `websecure` entryPoint was configured on port `8443`, so port `443` listeners had no match. ## Fix - `ports.websecure.port: 443` — Traefik now binds directly on 443 - `securityContext.capabilities.add: [NET_BIND_SERVICE]` — allows a non-root process to bind to privileged ports (<1024) The Service `exposedPort` stays at `443`, so external connectivity is unchanged. All existing Gateway listeners (`port: 443`) are correct as-is. Applies to both internal and external Traefik instances. ## Test plan - [ ] Traefik pods restart cleanly - [ ] `kubectl get gateway -A` shows listeners as `Programmed: True` - [ ] `https://rancher.k8s.syd1.au.unkin.net` (already merged) is reachable Reviewed-on: #138	2026-05-23 00:44:13 +10:00
unkinben	20ce2b1b92	feat(cattle-system): migrate rancher Ingress to Gateway API (#132 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the cattle-system app cleanly - [ ] cert-manager issues the `rancher-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://rancher.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #132	2026-05-23 00:24:57 +10:00
unkinben	64dc5a0242	fix(traefik): add instance labels to GatewayClasses (#137 ) ## Problem GatewayClasses were `Unknown` even after controllerName was fixed. The `kubernetesGateway` `labelSelector` applies to all watched resources, including GatewayClasses themselves. Since neither GatewayClass had a `traefik.io/instance` label, both Traefik instances filtered them out and never accepted them. ## Fix - `gatewayclass-internal.yaml`: add `traefik.io/instance: internal` - `gatewayclass-external.yaml`: add `traefik.io/instance: external` ## Test plan - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #137	2026-05-23 00:23:18 +10:00
unkinben	57c14d32c0	fix(traefik): remove invalid controllerName flag causing CrashLoopBackOff (#136 ) ## URGENT — Traefik pods are CrashLoopBackOff The merged PR #135 added `--providers.kubernetesgateway.controllerName` as an `additionalArguments` entry. Traefik v3.7.0 does not support this flag and fails immediately on startup. Old replica sets are still running (one pod each) but new pods cannot come up. ## Fix - Remove `additionalArguments` from both `values-internal.yaml` and `values-external.yaml` - Revert GatewayClass `controllerName` back to `traefik.io/gateway-controller` (the hardcoded Traefik default — no override mechanism exists in v3.7.0) ## After merge GatewayClasses will remain `Unknown` until a separate solution for internal/external separation is implemented (the `labelSelector` approach needs further investigation). Reviewed-on: #136	2026-05-22 23:58:56 +10:00
unkinben	2df359c4a9	fix(traefik): set controllerName on GatewayClasses and Traefik providers (#135 ) ## Problem Both GatewayClasses (`traefik-internal`, `traefik-external`) were stuck as `Unknown`. Neither Traefik deployment had `controllerName` set in `kubernetesGateway`, so both defaulted to `traefik.io/gateway-controller` — which matched neither GatewayClass. ## Fix - `gatewayclass-internal.yaml`: `controllerName: traefik.io/gateway-controller-internal` - `gatewayclass-external.yaml`: `controllerName: traefik.io/gateway-controller-external` - `values-internal.yaml`: added `controllerName: traefik.io/gateway-controller-internal` - `values-external.yaml`: added `controllerName: traefik.io/gateway-controller-external` ## Test plan - [ ] ArgoCD syncs traefik-system cleanly - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #135	2026-05-22 23:44:06 +10:00