unkin-agent
5e2eecda6b
## Why Make `ghp.unkin.net` the primary URL that the ghp app responds to. Until now ghp has only been reachable at the internal admin name `ghp.k8s.syd1.au.unkin.net`; this promotes the apex `unkin.net` name to canonical (mirroring the gitea apex pattern) while keeping the k8s name as the admin/internal route. ## How - **`apps/base/ghp/gateway.yaml`** — add `ghp.unkin.net` as the PRIMARY http/https listeners (`http-primary`/`https-primary`) and keep `ghp.k8s.syd1.au.unkin.net` as the admin route (`http-admin`/`https-admin`), mirroring gitea. Add the cert-manager gateway annotations (`cluster-issuer: vault-issuer`, `common-name: ghp.unkin.net`, `private-key-size: "4096"`) so cert-manager mints a NEW `ghp-gateway-tls` Secret with CN `ghp.unkin.net` + a SAN per TLS listener hostname (so it also covers the k8s host). Both https listeners' `certificateRefs` point at `ghp-gateway-tls`. This is a separate Secret from `ghp-tls` (ghp's own GitHub-impersonation cert), so cert-manager never fights over it. external-dns annotation stays scoped to the k8s host only — the apex is not published by external-dns. - **`apps/base/ghp/httproute.yaml`** — add `ghp.unkin.net` to `hostnames`; update `parentRefs` to attach to the renamed `http-primary`/`http-admin`/`https-primary`/`https-admin` sections. - **`apps/base/ghp/configmap.yaml`** — set `GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net` and `GHP_SERVER_BASE_URL: https://ghp.unkin.net`, so ghp serves its mgmt UI on that Host and OAuth callbacks use the new base. - **`apps/base/bind-internal/authoritative/records.yaml`** — add a bind-operator `DNSRecord` `ghp-dns-internal` for `ghp.unkin.net` -> **A 198.18.200.4** (traefik-internal gateway VIP), mirroring the active `identity-dns-internal` record in the same file. ## ⚠️ NOTE — GitHub App OAuth callback must be updated on github.com The GitHub App's OAuth callback URL must be changed on github.com to **`https://ghp.unkin.net/auth/github/callback`**. It was set to the k8s host in the runbook; OAuth login will break until this is updated. ## Note on DNS authority The bind-operator apex `unkin.net` zone comments warn that some apex names may still be served by the puppet DNS master (records from PuppetDB), with the k8s bind cluster not yet confirmed as the live authority for `unkin.net`. This DNSRecord mirrors the already-active `identity`/`lb1` apex records in the same file, so it is consistent with them — but if the k8s bind cluster is not the live authority for `unkin.net`, `ghp.unkin.net` will not resolve from this Record alone and the puppet master record must be added instead. ## Validation `kustomize build` of the ghp and bind-internal overlays render clean; kubeconform (strict) valid; yamllint + pre-commit clean. Not applied. Reviewed-on: #360 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
105 lines
3.0 KiB
YAML
105 lines
3.0 KiB
YAML
# Individually-managed authoritative records for the unkin.net zone.
|
|
# DNSRecords must live in the same namespace as their BindZone (the operator
|
|
# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
|
|
# these sit alongside the zone in bind-internal, not in the app namespace.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
# "internal" in the name distinguishes this from the external DNS that
|
|
# Authentik will manage its own records from later.
|
|
name: identity-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: identity
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the authentik Gateway serves the
|
|
# identity.unkin.net hostname there.
|
|
- 198.18.200.4
|
|
---
|
|
# PRODUCTION CUTOVER RECORD — intentionally commented out.
|
|
# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
|
|
# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this
|
|
# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it
|
|
# is the FINAL step of the forge migration — gated on the data migration (gitea
|
|
# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md.
|
|
# NOTE: the live git.unkin.net answer is served by the puppet DNS master today
|
|
# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only
|
|
# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live
|
|
# authority for unkin.net (or update the puppet record instead) before relying
|
|
# on this CR at cutover.
|
|
# ---
|
|
# apiVersion: bind.unkin.net/v1alpha1
|
|
# kind: DNSRecord
|
|
# metadata:
|
|
# name: git-dns-internal
|
|
# namespace: bind-internal
|
|
# spec:
|
|
# zoneRef: unkin-net
|
|
# name: git
|
|
# type: A
|
|
# ttl: 600
|
|
# values:
|
|
# # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there.
|
|
# - 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: s3-ceph-cname
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: ceph-unkin-net
|
|
name: s3
|
|
type: CNAME
|
|
ttl: 600
|
|
values:
|
|
# radosgw S3 endpoint. Points at the Consul service for now; the real
|
|
# target will be changed later.
|
|
- radosgw.service.consul.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: dashboard-ceph-cname
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: ceph-unkin-net
|
|
name: dashboard
|
|
type: CNAME
|
|
ttl: 600
|
|
values:
|
|
# Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
|
|
# cephrgw-operator) resolve dashboard.ceph.unkin.net.
|
|
- lb1.unkin.net.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: lb1-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: lb1
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
- 103.216.191.185
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: ghp-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: ghp
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
|
|
- 198.18.200.4
|