fix: use chart logLevel value instead of duplicate extraArg

Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found.
Reviewed-on: #140

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -19,7 +19,10 @@ remotes:
     package: "docker"
     description: "Docker Hub registry"
     immutable_patterns:
+      - "^library/almalinux"
       - "^library/busybox"
+      - "^library/debian"
+      - "^library/fedora"
       - "^library/nginx"
       - "^library/postgres"
       - "^library/redis"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -26,7 +26,9 @@ remotes:
       - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
       - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
       - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
       - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
+      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
       - "lxc/incus/.*.tar.gz$"
       - "mikefarah/yq/.*/yq_linux_amd64$"
       - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -54,6 +56,7 @@ remotes:
       - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
       - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
       - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
+      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
     cache:
       immutable_ttl: 0
       mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-helm.yaml

@@ -130,3 +130,14 @@ remotes:
     cache:
       immutable_ttl: 0
       mutable_ttl: 3600
+
+  argo-helm:
+    base_url: "https://argoproj.github.io/argo-helm"
+    package: "helm"
+    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600

apps/base/artifactapi/resources/conf.d/virtual-helm.yaml

@@ -15,3 +15,4 @@ virtuals:
       - stakater
       - traefik
       - victoriametrics
+      - argo-helm

apps/base/cattle-system/gateway.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
+  name: rancher
+  namespace: cattle-system
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: rancher-tls
+        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: rancher
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/cattle-system/ingress.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml

apps/base/traefik-system/gatewayclass-external.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: traefik-external
+spec:
+  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/gatewayclass-internal.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: internal
+  name: traefik-internal
+spec:
+  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gatewayclass-internal.yaml
+  - gatewayclass-external.yaml

apps/base/traefik-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik-system

apps/base/woodpecker/kustomization.yaml

@@ -6,5 +6,6 @@ resources:
   - namespace.yaml
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
+  - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_vault.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: terraform-vault
+  namespace: woodpecker

apps/overlays/au-syd1/externaldns/values.yaml

@@ -24,6 +24,11 @@ policy: "sync"
 sources:
   - service
   - ingress
+  - gateway-httproute
+  - gateway-tlsroute
+  - gateway-grpcroute
+  - gateway-tcproute
+  - gateway-udproute
 
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -49,3 +54,5 @@ extraArgs:
   - --rfc2136-tsig-axfr
   - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
   - --ingress-class=nginx
+
+logLevel: debug

apps/overlays/au-syd1/traefik-system/kustomization.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/traefik-system
+
+helmCharts:
+  - name: traefik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "40.0.0"
+    releaseName: traefik-internal
+    namespace: traefik-system
+    valuesFile: values-internal.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
+  - name: traefik
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "40.0.0"
+    releaseName: traefik-external
+    namespace: traefik-system
+    valuesFile: values-external.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/traefik-system/values-external.yaml

@@ -0,0 +1,98 @@
+image:
+  tag: v3.7.0
+
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+gateway:
+  enabled: false
+
+gatewayClass:
+  enabled: false
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+providers:
+  kubernetesCRD:
+    enabled: false
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: true
+    experimentalChannel: false
+    namespaces: []
+    nativeLBByDefault: false
+    labelSelector: "traefik.io/instance=external"
+
+logs:
+  access:
+    enabled: true
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+  notAppendXForwardedFor: false
+
+service:
+  enabled: true
+  single: true
+  annotations:
+    purelb.io/service-group: "dmz"
+    purelb.io/addresses: 198.18.199.0
+  annotationsTCP: {}
+  annotationsUDP: {}
+  labels: {}
+  spec:
+    type: LoadBalancer
+    loadBalancerIP: "198.18.199.0"
+  additionalServices: {}
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 5
+  metrics: []
+  behavior: {}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: "{{ template \"traefik.fullname\" . }}"
+
+persistence:
+  enabled: false
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
+        topologyKey: kubernetes.io/hostname
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
+enabled: true

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -0,0 +1,98 @@
+image:
+  tag: v3.7.0
+
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+gateway:
+  enabled: false
+
+gatewayClass:
+  enabled: false
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+providers:
+  kubernetesCRD:
+    enabled: false
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: true
+    experimentalChannel: false
+    namespaces: []
+    nativeLBByDefault: false
+    labelSelector: "traefik.io/instance=internal"
+
+logs:
+  access:
+    enabled: true
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+  notAppendXForwardedFor: false
+
+service:
+  enabled: true
+  single: true
+  annotations:
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.4
+  annotationsTCP: {}
+  annotationsUDP: {}
+  labels: {}
+  spec:
+    type: LoadBalancer
+    loadBalancerIP: "198.18.200.4"
+  additionalServices: {}
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 5
+  metrics: []
+  behavior: {}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: "{{ template \"traefik.fullname\" . }}"
+
+persistence:
+  enabled: false
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
+        topologyKey: kubernetes.io/hostname
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  web:
+    port: 80
+  websecure:
+    port: 443
+
+enabled: true

argocd/applicationsets/platform.yaml

@@ -25,6 +25,7 @@ spec:
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker

argocd/projects/platform.yaml

@@ -60,6 +60,10 @@ spec:
       kind: Certificate
     - group: 'cert-manager.io'
       kind: Issuer
+    - group: 'gateway.networking.k8s.io'
+      kind: GatewayClass
+    - group: 'networking.k8s.io'
+      kind: IngressClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'