fix(externaldns): remove experimental Gateway API route sources

TLSRoute, GRPCRoute, TCPRoute, UDPRoute CRDs are not installed (Traefik experimentalChannel: false), causing external-dns to crash with a context deadline timeout on every sync cycle. Keep only gateway-httproute which is the only route type in use.
fix(traefik): listen on port 443 directly for Gateway API compatibility (#138 )
2026-05-23 00:52:55 +10:00 · 2026-05-23 00:44:13 +10:00 · 2026-05-23 00:24:57 +10:00 · 2026-05-23 00:23:18 +10:00 · 2026-05-22 23:58:56 +10:00 · 2026-05-22 23:44:06 +10:00
12 changed files with 97 additions and 75 deletions
@@ -2,32 +2,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  labels:
    traefik.io/instance: internal
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
+  name: rancher
+  namespace: cattle-system
 spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
-      hostname: puppetdb.k8s.syd1.au.unkin.net
+      hostname: rancher.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - kind: Secret
-            name: puppetdb-tls
+            name: rancher-tls
        mode: Terminate
@@ -0,0 +1,20 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: rancher
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80
@@ -6,4 +6,5 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -1,25 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  hostnames:
-    - puppetdb.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: puppetdb
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: puppetdb
-          port: 8080
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -0,0 +1,34 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetdb.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetdb
+                port:
+                  number: 8080
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - puppetdb.k8s.syd1.au.unkin.net
+      secretName: puppetdb-tls
@@ -26,8 +26,7 @@ resources:
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
  - ingress_puppetboard.yaml
-  - gateway_puppetdb.yaml
-  - httproute_puppetdb.yaml
+  - ingress_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -2,6 +2,8 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
+  labels:
+    traefik.io/instance: external
  name: traefik-external
 spec:
  controllerName: traefik.io/gateway-controller
@@ -2,6 +2,8 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
+  labels:
+    traefik.io/instance: internal
  name: traefik-internal
 spec:
  controllerName: traefik.io/gateway-controller
@@ -25,10 +25,6 @@ sources:
  - service
  - ingress
  - gateway-httproute
-  - gateway-tlsroute
-  - gateway-grpcroute
-  - gateway-tcproute
-  - gateway-udproute

 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -82,4 +82,17 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault

+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
 enabled: true
@@ -82,4 +82,17 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault

+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
 enabled: true
Author	SHA1	Message	Date
unkinben	7a9ed39f97	fix(externaldns): remove experimental Gateway API route sources ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details TLSRoute, GRPCRoute, TCPRoute, UDPRoute CRDs are not installed (Traefik experimentalChannel: false), causing external-dns to crash with a context deadline timeout on every sync cycle. Keep only gateway-httproute which is the only route type in use.	2026-05-23 00:52:55 +10:00
unkinben	0940cc20f8	fix(traefik): listen on port 443 directly for Gateway API compatibility (#138 ) ## Problem Gateway listeners with `port: 443` were rejected with `PortUnavailable: Cannot find entryPoint for Gateway: no matching entryPoint for port 443 and protocol "HTTPS"`. Traefik matches Gateway listener ports against its internal entryPoint ports (pod-level), not the Service's `exposedPort`. The `websecure` entryPoint was configured on port `8443`, so port `443` listeners had no match. ## Fix - `ports.websecure.port: 443` — Traefik now binds directly on 443 - `securityContext.capabilities.add: [NET_BIND_SERVICE]` — allows a non-root process to bind to privileged ports (<1024) The Service `exposedPort` stays at `443`, so external connectivity is unchanged. All existing Gateway listeners (`port: 443`) are correct as-is. Applies to both internal and external Traefik instances. ## Test plan - [ ] Traefik pods restart cleanly - [ ] `kubectl get gateway -A` shows listeners as `Programmed: True` - [ ] `https://rancher.k8s.syd1.au.unkin.net` (already merged) is reachable Reviewed-on: #138	2026-05-23 00:44:13 +10:00
unkinben	20ce2b1b92	feat(cattle-system): migrate rancher Ingress to Gateway API (#132 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the cattle-system app cleanly - [ ] cert-manager issues the `rancher-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://rancher.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #132	2026-05-23 00:24:57 +10:00
unkinben	64dc5a0242	fix(traefik): add instance labels to GatewayClasses (#137 ) ## Problem GatewayClasses were `Unknown` even after controllerName was fixed. The `kubernetesGateway` `labelSelector` applies to all watched resources, including GatewayClasses themselves. Since neither GatewayClass had a `traefik.io/instance` label, both Traefik instances filtered them out and never accepted them. ## Fix - `gatewayclass-internal.yaml`: add `traefik.io/instance: internal` - `gatewayclass-external.yaml`: add `traefik.io/instance: external` ## Test plan - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #137	2026-05-23 00:23:18 +10:00
unkinben	57c14d32c0	fix(traefik): remove invalid controllerName flag causing CrashLoopBackOff (#136 ) ## URGENT — Traefik pods are CrashLoopBackOff The merged PR #135 added `--providers.kubernetesgateway.controllerName` as an `additionalArguments` entry. Traefik v3.7.0 does not support this flag and fails immediately on startup. Old replica sets are still running (one pod each) but new pods cannot come up. ## Fix - Remove `additionalArguments` from both `values-internal.yaml` and `values-external.yaml` - Revert GatewayClass `controllerName` back to `traefik.io/gateway-controller` (the hardcoded Traefik default — no override mechanism exists in v3.7.0) ## After merge GatewayClasses will remain `Unknown` until a separate solution for internal/external separation is implemented (the `labelSelector` approach needs further investigation). Reviewed-on: #136	2026-05-22 23:58:56 +10:00
unkinben	2df359c4a9	fix(traefik): set controllerName on GatewayClasses and Traefik providers (#135 ) ## Problem Both GatewayClasses (`traefik-internal`, `traefik-external`) were stuck as `Unknown`. Neither Traefik deployment had `controllerName` set in `kubernetesGateway`, so both defaulted to `traefik.io/gateway-controller` — which matched neither GatewayClass. ## Fix - `gatewayclass-internal.yaml`: `controllerName: traefik.io/gateway-controller-internal` - `gatewayclass-external.yaml`: `controllerName: traefik.io/gateway-controller-external` - `values-internal.yaml`: added `controllerName: traefik.io/gateway-controller-internal` - `values-external.yaml`: added `controllerName: traefik.io/gateway-controller-external` ## Test plan - [ ] ArgoCD syncs traefik-system cleanly - [ ] `kubectl get gatewayclass` shows both as `Accepted: True` Reviewed-on: #135	2026-05-22 23:44:06 +10:00