Use externalTrafficPolicy: Local on the DNS services

Preserves client source IPs so the authoritative/resolver source-IP ACLs
actually apply to external clients (Cluster SNATs them to node IPs).

- externalTrafficPolicy: Local on bind-authoritative/resolvers/externaldns
- bump operator to v0.1.5 (CRD link + image) for the new service field

apps/base/bind-internal/authoritative/cluster.yaml

@@ -18,6 +18,7 @@ spec:
     - "allow-query { auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
+    externalTrafficPolicy: Local
     annotations:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.6

apps/base/bind-internal/externaldns/cluster.yaml

@@ -14,6 +14,7 @@ spec:
   storageSize: 1Gi
   service:
     type: LoadBalancer
+    externalTrafficPolicy: Local
     annotations:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.8

apps/base/bind-internal/resolvers/cluster.yaml

@@ -13,6 +13,7 @@ spec:
   storageSize: 1Gi
   service:
     type: LoadBalancer
+    externalTrafficPolicy: Local
     annotations:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.7

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.1.4
+          image: git.unkin.net/unkin/bind-operator:v0.1.5
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/bind-system/kustomization.yaml

@@ -6,6 +6,6 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.3/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.5/config/crd/install.yaml
   - rbac.yaml
   - deployment.yaml

apps/base/encapi/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: encapi
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: encapi
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: encapi
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/encapi/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: postgres-pooler
-  namespace: encapi
-spec:
-  cluster:
-    name: postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/encapi/configmap.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: encapi-env
-  namespace: encapi
-data:
-  LISTEN_ADDR: ":8000"
-  DBHOST: postgres-pooler
-  DBNAME: encapi
-  DBPORT: "5432"
-  DBUSER: encapi
-  DBSSL: require

apps/base/encapi/deployment.yaml

@@ -1,64 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: encapi
-  namespace: encapi
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: encapi
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: encapi
-    spec:
-      automountServiceAccountToken: true
-      containers:
-        - name: encapi
-          image: git.unkin.net/unkin/encapi:v0.0.1
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8000
-              name: http
-              protocol: TCP
-          envFrom:
-            # DBHOST/DBNAME/DBPORT/DBUSER/DBSSL/LISTEN_ADDR
-            - configMapRef:
-                name: encapi-env
-                optional: false
-            # DBPASS + ENCAPI_WRITE_TOKEN (seeded in Vault, see cutover notes)
-            - secretRef:
-                name: environment
-                optional: false
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      restartPolicy: Always

apps/base/encapi/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: encapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: encapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: encapi
-  namespace: encapi
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: encapi.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: encapi.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: encapi-tls
-        mode: Terminate

apps/base/encapi/httproute.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: encapi-http-redirect
-  namespace: encapi
-spec:
-  hostnames:
-    - encapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: encapi
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: encapi
-  namespace: encapi
-spec:
-  hostnames:
-    - encapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: encapi
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: encapi
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/encapi/kustomization.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - configmap.yaml
-  - deployment.yaml
-  - service.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/encapi/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: encapi

apps/base/encapi/service.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: encapi
-  namespace: encapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: encapi
-  sessionAffinity: None
-  type: ClusterIP

apps/base/encapi/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: encapi
-spec:
-  allowedNamespaces:
-    - encapi
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/encapi/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: encapi
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/encapi/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: environment
-  namespace: encapi
-spec:
-  destination:
-    create: true
-    name: environment
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/encapi/default/environment
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/overlays/au-syd1/encapi/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/encapi

argocd/applicationsets/platform.yaml

@@ -21,7 +21,6 @@ spec:
       - path: apps/overlays/*/cnpg-system
       - path: apps/overlays/*/consul
       - path: apps/overlays/*/elastic-system
-      - path: apps/overlays/*/encapi
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog