unkin/argocd-apps
2
0
Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/argocd-apps:benvin/externaldns-debug-logging
Branches Tags
unkin/argocd-apps:main unkin/argocd-apps:benvin/add-encapi-deployment unkin/argocd-apps:benvin/wire-primary-service unkin/argocd-apps:benvin/dns-external-traffic-local unkin/argocd-apps:benvin/add-bind-operator unkin/argocd-apps:benvin/artifactapi-tf-signing unkin/argocd-apps:benvin/kubeconform-crd-schemas unkin/argocd-apps:fix-kanidm-replication-config unkin/argocd-apps:issue-155-open-webui-litellm unkin/argocd-apps:benvin/opa_policies unkin/argocd-apps:benvin/postfix unkin/argocd-apps:benvin/stalwart unkin/argocd-apps:benvin/externaldns-debug-logging unkin/argocd-apps:benvin/fix-externaldns-crashing unkin/argocd-apps:benvin/argocd-image-updater-deploy unkin/argocd-apps:benvin/helm_virtual unkin/argocd-apps:benvin/artifactkeeper
...
compare: unkin/argocd-apps:12b6b5e03803aafdcc81d229dcfe0fa09d576284
Branches Tags
unkin/argocd-apps:benvin/add-encapi-deployment unkin/argocd-apps:benvin/wire-primary-service unkin/argocd-apps:benvin/dns-external-traffic-local unkin/argocd-apps:main unkin/argocd-apps:benvin/add-bind-operator unkin/argocd-apps:benvin/artifactapi-tf-signing unkin/argocd-apps:benvin/kubeconform-crd-schemas unkin/argocd-apps:fix-kanidm-replication-config unkin/argocd-apps:issue-155-open-webui-litellm unkin/argocd-apps:benvin/opa_policies unkin/argocd-apps:benvin/postfix unkin/argocd-apps:benvin/stalwart unkin/argocd-apps:benvin/externaldns-debug-logging unkin/argocd-apps:benvin/fix-externaldns-crashing unkin/argocd-apps:benvin/argocd-image-updater-deploy unkin/argocd-apps:benvin/helm_virtual unkin/argocd-apps:benvin/artifactkeeper

8 Commits
benvin/externaldns-debug-logging ... 12b6b5e038

Author SHA1 Message Date
unkinben 12b6b5e038 fix: correct external-dns target IP to 198.18.200.4
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
2026-05-23 01:33:59 +10:00
unkinben e87f56d597 fix(puppet): add traefik.io/instance label to puppetdb Gateway 2026-05-23 01:33:59 +10:00
unkinben be7a195d3e feat(puppet): migrate puppetdb Ingress to Gateway API 
Replace nginx Ingress with Gateway + HTTPRoute using the traefik-internal
GatewayClass. TLS is terminated at the Gateway listener via cert-manager.
 2026-05-23 01:33:59 +10:00
unkinben 2c6d88aa6b feat(puppet): migrate puppetboard Ingress to Gateway API (#130) 
## Summary

- Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass
- TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer`
- external-dns annotations moved to the Gateway
- `ingress_puppetdb.yaml` is unchanged in this PR (separate PR)

## Test plan

- [ ] ArgoCD syncs the puppet app cleanly
- [ ] cert-manager issues the `puppetboard-tls` certificate
- [ ] external-dns creates the DNS record
- [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable

Reviewed-on: #130
 2026-05-23 01:31:28 +10:00
unkinben 58368948d9 feat(paperclip): migrate Ingress to Gateway API (#133) 
## Summary

- Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass
- TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer`
- external-dns annotations moved to the Gateway

## Test plan

- [ ] ArgoCD syncs the paperclip app cleanly
- [ ] cert-manager issues the `paperclip-tls` certificate
- [ ] external-dns creates the DNS record
- [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable

Reviewed-on: #133
 2026-05-23 01:31:03 +10:00
unkinben 4f5c3f7ea0 feat(litellm): migrate Ingress to Gateway API (#134) 
## Summary

- Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass
- TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer`
- external-dns annotations moved to the Gateway

## Test plan

- [ ] ArgoCD syncs the litellm app cleanly
- [ ] cert-manager issues the `litellm-tls` certificate
- [ ] external-dns creates the DNS record
- [ ] `https://litellm.k8s.syd1.au.unkin.net` is reachable

Reviewed-on: #134
 2026-05-23 01:29:54 +10:00
unkinben fd87cb96b5 feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs (#143) 
## Changes

- Upgrade external-dns chart from 1.19.0 → 1.21.1 (app v0.19.0 → v0.21.0)
- Remove `gateway-tcproute` source — `TCPRoute` CRD is not installed, causing crash-loop
- Add `gateway-tlsroute` source — `TLSRoute` CRD is installed (Gateway API 1.5.1)

## Why

The pod was crash-looping every minute with `failed to list *v1alpha2.TCPRoute: the server could not find the requested resource` because the TCPRoute CRD doesn't exist in this cluster. TLSRoute was previously removed but its CRD does exist.

Reviewed-on: #143
 2026-05-23 01:28:20 +10:00
unkinben d619f9195e benvin/externaldns_compatability (#142) 
Reviewed-on: #142
 2026-05-23 01:17:20 +10:00
17 changed files with 225 additions and 135 deletions
Expand all files Collapse all files
apps/base/litellm/gateway.yaml
+29
View File
@@ -0,0 +1,29 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: litellm
namespace: litellm
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: litellm.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- kind: Secret
name: litellm-tls
mode: Terminate
apps/base/litellm/httproute.yaml
+20
View File
@@ -0,0 +1,20 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: litellm
namespace: litellm
spec:
hostnames:
- litellm.k8s.syd1.au.unkin.net
parentRefs:
- name: litellm
sectionName: https
rules:
- backendRefs:
- name: litellm
port: 4000
matches:
- path:
type: PathPrefix
value: /
apps/base/litellm/ingress.yaml
-29
View File
@@ -1,29 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.0
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
name: litellm
namespace: litellm
spec:
rules:
- host: litellm.k8s.syd1.au.unkin.net
http:
paths:
- backend:
service:
name: litellm
port:
number: 4000
path: /
pathType: Prefix
tls:
- hosts:
- litellm.k8s.syd1.au.unkin.net
secretName: litellm-tls
apps/base/litellm/kustomization.yaml
+2 -1
View File
@@ -7,7 +7,8 @@ resources:
- cnpg_pooler.yaml - cnpg_pooler.yaml
- deployment.yaml - deployment.yaml
- hpa.yaml - hpa.yaml
- ingress.yaml - gateway.yaml
- httproute.yaml
- namespace.yaml - namespace.yaml
- redis-deployment.yaml - redis-deployment.yaml
- redis-pvc.yaml - redis-pvc.yaml
apps/base/paperclip/gateway.yaml
+29
View File
@@ -0,0 +1,29 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
labels:
traefik.io/instance: internal
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
name: paperclip
namespace: paperclip
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: paperclip.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- kind: Secret
name: paperclip-tls
mode: Terminate
apps/base/paperclip/httproute.yaml
+20
View File
@@ -0,0 +1,20 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: paperclip
namespace: paperclip
spec:
hostnames:
- paperclip.k8s.syd1.au.unkin.net
parentRefs:
- name: paperclip
sectionName: https
rules:
- backendRefs:
- name: paperclip
port: 3100
matches:
- path:
type: PathPrefix
value: /
apps/base/paperclip/ingress.yaml
-29
View File
@@ -1,29 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.0
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
name: paperclip
namespace: paperclip
spec:
rules:
- host: paperclip.k8s.syd1.au.unkin.net
http:
paths:
- backend:
service:
name: paperclip
port:
number: 3100
path: /
pathType: Prefix
tls:
- hosts:
- paperclip.k8s.syd1.au.unkin.net
secretName: paperclip-tls
apps/base/paperclip/kustomization.yaml
+2 -1
View File
@@ -6,7 +6,8 @@ resources:
- cnpg_cluster.yaml - cnpg_cluster.yaml
- cnpg_pooler.yaml - cnpg_pooler.yaml
- deployment.yaml - deployment.yaml
- ingress.yaml - gateway.yaml
- httproute.yaml
- namespace.yaml - namespace.yaml
- services.yaml - services.yaml
- vaultauth.yaml - vaultauth.yaml
apps/base/puppet/gateway_puppetboard.yaml
+33
View File
@@ -0,0 +1,33 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
labels:
traefik.io/instance: internal
app.kubernetes.io/component: puppetboard
app.kubernetes.io/instance: puppetserver
app.kubernetes.io/name: puppetserver
app.kubernetes.io/version: 8.8.0
name: puppetboard
namespace: puppet
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: puppetboard.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- kind: Secret
name: puppetboard-tls
mode: Terminate
apps/base/puppet/gateway_puppetdb.yaml
+33
View File
@@ -0,0 +1,33 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
annotations:
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.4
labels:
traefik.io/instance: internal
app.kubernetes.io/component: puppetdb
app.kubernetes.io/instance: puppetserver
app.kubernetes.io/name: puppetserver
app.kubernetes.io/version: 8.8.0
name: puppetdb
namespace: puppet
spec:
gatewayClassName: traefik-internal
listeners:
- allowedRoutes:
namespaces:
from: Same
hostname: puppetdb.k8s.syd1.au.unkin.net
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- kind: Secret
name: puppetdb-tls
mode: Terminate
apps/base/puppet/httproute_puppetboard.yaml
+25
View File
@@ -0,0 +1,25 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
labels:
app.kubernetes.io/component: puppetboard
app.kubernetes.io/instance: puppetserver
app.kubernetes.io/name: puppetserver
app.kubernetes.io/version: 8.8.0
name: puppetboard
namespace: puppet
spec:
hostnames:
- puppetboard.k8s.syd1.au.unkin.net
parentRefs:
- name: puppetboard
sectionName: https
rules:
- backendRefs:
- name: puppetboard
port: 80
matches:
- path:
type: PathPrefix
value: /
apps/base/puppet/httproute_puppetdb.yaml
+25
View File
@@ -0,0 +1,25 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
labels:
app.kubernetes.io/component: puppetdb
app.kubernetes.io/instance: puppetserver
app.kubernetes.io/name: puppetserver
app.kubernetes.io/version: 8.8.0
name: puppetdb
namespace: puppet
spec:
hostnames:
- puppetdb.k8s.syd1.au.unkin.net
parentRefs:
- name: puppetdb
sectionName: https
rules:
- backendRefs:
- name: puppetdb
port: 8080
matches:
- path:
type: PathPrefix
value: /
apps/base/puppet/ingress_puppetboard.yaml
-34
View File
@@ -1,34 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.0
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
labels:
app.kubernetes.io/component: puppetboard
app.kubernetes.io/instance: puppetserver
app.kubernetes.io/name: puppetserver
app.kubernetes.io/version: 8.8.0
name: puppetboard
namespace: puppet
spec:
rules:
- host: puppetboard.k8s.syd1.au.unkin.net
http:
paths:
- backend:
service:
name: puppetboard
port:
number: 80
path: /
pathType: Prefix
tls:
- hosts:
- puppetboard.k8s.syd1.au.unkin.net
secretName: puppetboard-tls
apps/base/puppet/ingress_puppetdb.yaml
-34
View File
@@ -1,34 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
external-dns.alpha.kubernetes.io/target: 198.18.200.0
cert-manager.io/cluster-issuer: vault-issuer
cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
cert-manager.io/private-key-size: "4096"
labels:
app.kubernetes.io/component: puppetdb
app.kubernetes.io/instance: puppetserver
app.kubernetes.io/name: puppetserver
app.kubernetes.io/version: 8.8.0
name: puppetdb
namespace: puppet
spec:
rules:
- host: puppetdb.k8s.syd1.au.unkin.net
http:
paths:
- backend:
service:
name: puppetdb
port:
number: 8080
path: /
pathType: Prefix
tls:
- hosts:
- puppetdb.k8s.syd1.au.unkin.net
secretName: puppetdb-tls
apps/base/puppet/kustomization.yaml
+4 -2
View File
@@ -25,8 +25,10 @@ resources:
- horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
- horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
- horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
- ingress_puppetboard.yaml - gateway_puppetboard.yaml
- ingress_puppetdb.yaml - httproute_puppetboard.yaml
- gateway_puppetdb.yaml
- httproute_puppetdb.yaml
- service_puppetserver-agents-to-puppet.yaml - service_puppetserver-agents-to-puppet.yaml
- service_puppet-headless.yaml - service_puppet-headless.yaml
- service_puppet.yaml - service_puppet.yaml
apps/overlays/au-syd1/externaldns/kustomization.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ resources:
helmCharts: helmCharts:
- name: external-dns - name: external-dns
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
version: "1.19.0" version: "1.21.1"
releaseName: externaldns releaseName: externaldns
namespace: externaldns namespace: externaldns
valuesFile: values.yaml valuesFile: values.yaml
apps/overlays/au-syd1/externaldns/values.yaml
+2 -4
View File
@@ -25,10 +25,7 @@ sources:
- service - service
- ingress - ingress
- gateway-httproute - gateway-httproute
- gateway-tlsroute
- gateway-grpcroute - gateway-grpcroute
- gateway-tcproute
- gateway-udproute
# Environment variables for TSIG secret and algorithm from Vault # Environment variables for TSIG secret and algorithm from Vault
env: env:
@@ -54,4 +51,5 @@ extraArgs:
- --rfc2136-tsig-axfr - --rfc2136-tsig-axfr
- --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET) - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
- --ingress-class=nginx - --ingress-class=nginx
- --log-level=debug
logLevel: debug