unkin-agent
7db66455c9
Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app, fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern. - ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete RWO PVC at /config (sqlite + in-container cron/redis are single-writer). - oauth2-proxy fronts every path; Authentik OIDC issuer identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side (akR-global-admin only), so no oauth2-proxy group allowlist. - Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net, vault-issuer TLS leaf, external-dns to 198.18.200.4. - VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects. - Registered in the media ApplicationSet + AppProject. No VMPodScrape: WatchState exposes no /metrics endpoint.
50 lines
1.0 KiB
YAML
50 lines
1.0 KiB
YAML
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: watchstate-http-redirect
|
|
namespace: watchstate
|
|
spec:
|
|
hostnames:
|
|
- watchstate.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: watchstate
|
|
sectionName: http
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: watchstate
|
|
namespace: watchstate
|
|
spec:
|
|
hostnames:
|
|
- watchstate.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: watchstate
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: watchstate-oauth2
|
|
port: 80
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|