gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
88 Commits 1 Branch 0 Tags
07a59d3b345279047fad2a405fce361586021542
Commit Graph
10 Commits
Author SHA1 Message Date
Scooby HuskyandClaude Sonnet 5 bbb80687ca Fix netbird-operator namespace reference in istio mesh policies 
allow-netbird-operator-access (AuthorizationPolicy) and the netbird-operator
PeerAuthentication both targeted namespace 'netbird-operator', which has
never existed - the actual netbird-operator pod runs in the 'netbird'
namespace. This permanently blocked istio-mesh-config from going Synced
(kubectl apply failed: namespaces "netbird-operator" not found on every
sync attempt).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-17 18:20:00 -05:00
Scooby HuskyandClaude Opus 4.6 0d39bcddc9 Add ServiceEntry for wildcard host to fix Kiali KIA0104 
The global-authentik-authz AuthorizationPolicy uses *.kube.huskypup.net
as a host match, but Kiali flagged KIA0104 because the wildcard had no
matching entry in Istio's service registry. Adding a MESH_EXTERNAL
ServiceEntry with resolution NONE registers the hostname without
affecting routing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 22:35:20 -05:00
Scooby HuskyandClaude Opus 4.6 64723eb0ba Allow kube-apiserver webhook calls to netbird namespace 
The netbird-operator webhook service runs in the netbird namespace and
receives admission webhook calls from kube-apiserver using node IPs
(172.28.101.0/24). Without this, ztunnel rejects the connections with
"allow policies exist, but none allowed".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 22:09:55 -05:00
Scooby HuskyandClaude Opus 4.6 f8eea2ed45 Remove nessus from cluster configuration 
Remove all nessus references: ArgoCD project destination, Istio ambient
enrollment, waypoint gateway, authorization policies, ext-authz policy,
TLS certificate, ingress gateway host, Kyverno exclusion, and Authentik
forward-auth blueprint.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 21:02:45 -05:00
Scooby HuskyandClaude Opus 4.6 712307da14 Fix ztunnel PodMonitor port name to match actual container port 
The ztunnel container exposes metrics on port named 'ztunnel-stats' (15020),
not 'http-monitoring'. This was preventing Prometheus from scraping ztunnel
L4 metrics, causing missing traffic in Kiali.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 20:03:03 -05:00
Scooby HuskyandClaude Opus 4.6 af573c647f Switch hook jobs from bitnami/kubectl to alpine/k8s:1.32.13 
bitnami/kubectl has removed all version tags from Docker Hub,
leaving only :latest which is blocked by Kyverno disallow-latest-tag
policy. Switch to alpine/k8s:1.32.13 which has kubectl, bash, jq,
and uses proper version tags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 18:08:22 -05:00
Scooby HuskyandClaude Opus 4.6 263dd3f6cc Use bitnami/kubectl:1.29 for hook jobs 
The :1.31 tag is gone from Docker Hub and :latest is blocked by Kyverno
disallow-latest-tag policy. The 1.29 image is cached on cluster nodes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 18:00:16 -05:00
Scooby HuskyandClaude Opus 4.6 306d374ede Fix bitnami/kubectl image tag in hook jobs 
The bitnami/kubectl:1.31 tag doesn't exist on Docker Hub. Updated all
hook jobs to use bitnami/kubectl:latest.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 17:57:08 -05:00
Scooby HuskyandClaude Opus 4.6 e296400053 Add argocd-hook-sa ServiceAccount to app namespaces 
PreSync/PostSync hook Jobs reference argocd-hook-sa but it only existed
in the argocd namespace. Jobs running in app namespaces (crowdsec,
authentik, netbird, vault, istio-system) need the SA in their own
namespace.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 17:51:04 -05:00
Scooby Husky aacb8eebbe Initial commit 2026-03-09 20:21:35 -05:00