unkin-agent
7db66455c9
Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app, fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern. - ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete RWO PVC at /config (sqlite + in-container cron/redis are single-writer). - oauth2-proxy fronts every path; Authentik OIDC issuer identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side (akR-global-admin only), so no oauth2-proxy group allowlist. - Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net, vault-issuer TLS leaf, external-dns to 198.18.200.4. - VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects. - Registered in the media ApplicationSet + AppProject. No VMPodScrape: WatchState exposes no /metrics endpoint.
37 lines
714 B
YAML
37 lines
714 B
YAML
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: watchstate
|
|
namespace: watchstate
|
|
spec:
|
|
internalTrafficPolicy: Cluster
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
protocol: TCP
|
|
targetPort: http
|
|
selector:
|
|
app: watchstate
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
# Front-door entry Service: the HTTPRoute for watchstate.k8s.syd1.au.unkin.net
|
|
# targets this; all traffic enters via oauth2-proxy.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: watchstate-oauth2
|
|
namespace: watchstate
|
|
spec:
|
|
internalTrafficPolicy: Cluster
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
protocol: TCP
|
|
targetPort: http
|
|
selector:
|
|
app: watchstate-oauth2
|
|
sessionAffinity: None
|
|
type: ClusterIP
|