unkin-agent
b9f727bc97
## Why WatchState currently only has an internal front door (watchstate.k8s.syd1.au.unkin.net, PR #419, merged). This adds a public front door at **watchstate.unkin.net** via the external (DMZ) Traefik so the admin UI is reachable off-cluster, still fully gated by oauth2-proxy/Authentik. The internal gateway and routes are untouched; oauth2-proxy now fronts BOTH hostnames. Stacked base note: the intended base (benvin/watchstate-deploy, PR #419) merged into main before this PR opened, so this targets `main`. ## How - **DNS**: `watchstate-dns-internal` DNSRecord in `apps/base/bind-internal/authoritative/records.yaml` (unkin.net zone, bind-internal) -> `A 198.18.199.0`, the traefik-external VIP. Mirrors the `arrstack-dns-internal` precedent (external front door via bind, not external-dns). Kept in the central bind-internal location, so no AppProject destination widening is needed. - **Gateway**: new `watchstate-external` Gateway (`gatewayClassName: traefik-external`), http + https listeners on hostname `watchstate.unkin.net`. TLS terminated with the Let's Encrypt `*.unkin.net` wildcard secret `wildcard-unkin-net-tls` — so **no cert-manager and no external-dns annotations**. - **Routes**: `watchstate-external-http-redirect` (http->https 301) and `watchstate-external` (https -> `watchstate-oauth2:80`), mirroring the arrproxy/cheeztv external patterns. - **oauth2-proxy dual-host**: `OAUTH2_PROXY_REDIRECT_URL` changed from the pinned cluster callback to the **relative** `/oauth2/callback`. With `OAUTH2_PROXY_REVERSE_PROXY=true` (already set), oauth2-proxy derives scheme+host per request from `X-Forwarded-Proto/Host` (verified in oauth2-proxy v7.15.3 `getOAuthRedirectURI`: host-less redirectURL falls through to request-derived), so the callback works on both `watchstate.unkin.net` and `watchstate.k8s.syd1.au.unkin.net`. `COOKIE_DOMAINS` and `WHITELIST_DOMAINS` now list both hosts (one cookie per host; a single parent-domain cookie can't cleanly span unkin.net vs k8s.syd1.au.unkin.net). - Dropped the no-op `argocd.argoproj.io/sync-wave: "0"` annotation on the `default` VaultAuth. New resources intentionally carry no sync-wave annotations. ## Validation - `kustomize build --enable-helm` on `apps/overlays/au-syd1/watchstate` and `.../bind-internal`: OK. - kubeconform (repo CI config, k8s 1.33.7): watchstate overlay 15/15 valid (2 Gateways, 4 HTTPRoutes); bind-internal overlay 67/67 valid (incl. `watchstate-dns-internal`). ## Dependencies - **Reflector allow-list (argocd-apps PR #418)**: reflects `wildcard-unkin-net-tls` into the `watchstate` namespace. This PR references that secret as if present. - **Authentik (terraform-authentik, separate PR)**: register both `https://watchstate.unkin.net/oauth2/callback` and `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback` as redirect URIs on the watchstate provider. Reviewed-on: #420 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
165 lines
4.3 KiB
YAML
165 lines
4.3 KiB
YAML
# Individually-managed authoritative records for the unkin.net zone.
|
|
# DNSRecords must live in the same namespace as their BindZone (the operator
|
|
# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
|
|
# these sit alongside the zone in bind-internal, not in the app namespace.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
# "internal" in the name distinguishes this from the external DNS that
|
|
# Authentik will manage its own records from later.
|
|
name: identity-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: identity
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
|
|
# identity.unkin.net hostname there.
|
|
- 198.18.199.0
|
|
---
|
|
# PRODUCTION CUTOVER RECORD — intentionally commented out.
|
|
# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
|
|
# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this
|
|
# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it
|
|
# is the FINAL step of the forge migration — gated on the data migration (gitea
|
|
# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md.
|
|
# NOTE: the live git.unkin.net answer is served by the puppet DNS master today
|
|
# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only
|
|
# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live
|
|
# authority for unkin.net (or update the puppet record instead) before relying
|
|
# on this CR at cutover.
|
|
# ---
|
|
# apiVersion: bind.unkin.net/v1alpha1
|
|
# kind: DNSRecord
|
|
# metadata:
|
|
# name: git-dns-internal
|
|
# namespace: bind-internal
|
|
# spec:
|
|
# zoneRef: unkin-net
|
|
# name: git
|
|
# type: A
|
|
# ttl: 600
|
|
# values:
|
|
# # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there.
|
|
# - 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: s3-ceph-cname
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: ceph-unkin-net
|
|
name: s3
|
|
type: CNAME
|
|
ttl: 600
|
|
values:
|
|
# radosgw S3 endpoint. Points at the Consul service for now; the real
|
|
# target will be changed later.
|
|
- radosgw.service.consul.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: dashboard-ceph-cname
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: ceph-unkin-net
|
|
name: dashboard
|
|
type: CNAME
|
|
ttl: 600
|
|
values:
|
|
# Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
|
|
# cephrgw-operator) resolve dashboard.ceph.unkin.net.
|
|
- lb1.unkin.net.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: lb1-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: lb1
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
- 103.216.191.185
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: ghp-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: ghp
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
|
|
- 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: arrstack-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: arrstack
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
|
|
# arrstack.unkin.net front door (oauth2-proxy) there.
|
|
- 198.18.199.0
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: logviewer-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: logviewer
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the logviewer Gateway serves
|
|
# logviewer.unkin.net there.
|
|
- 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: cheeztv-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: cheeztv
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
|
|
# there.
|
|
- 198.18.200.4
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: watchstate-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: watchstate
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves
|
|
# the watchstate.unkin.net front door (oauth2-proxy) there.
|
|
- 198.18.199.0
|