gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
54 Commits 1 Branch 0 Tags
fb0ed0071f4babfde26b9ffb83f008b135239264
Commit Graph
12 Commits
Author SHA1 Message Date
Scooby HuskyandClaude Opus 4.6 fb0ed0071f Set X-Forwarded-Proto header for Ceph dashboard SAML authentication 
Dashboard runs with ssl: false behind TLS-terminating proxy, so SAML
library sees http:// URLs and rejects responses expecting https://.
Explicitly set X-Forwarded-Proto: https on both Istio VirtualService
and Envoy Gateway HTTPRoute so the SAML ACS URL matches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 13:48:35 -05:00
Scooby HuskyandClaude Opus 4.6 7c184f9d14 Fix Ceph dashboard DestinationRule: disable TLS to match dashboard config 
Dashboard has ssl: false (plain HTTP on port 7000), but the DestinationRule
had tls.mode: SIMPLE which caused Istio to attempt TLS to the backend,
resulting in WRONG_VERSION_NUMBER errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 13:41:57 -05:00
Scooby HuskyandClaude Opus 4.6 bc37f9d1a4 Complete OSD migration: remove temp Kyverno policy, fix talos-cp-02 device name 
All 4 OSDs successfully recreated in clean raw mode (NVMe only, no DB devices).
Fixed talos-cp-02 NVMe device path from nvme0n1 to nvme1n1 to match actual hardware.
Removed temporary fix-rook-osd-metadata-device Kyverno policy as it's no longer needed.
Operator runs normally without manual patches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 03:47:14 -05:00
Scooby HuskyandClaude Opus 4.6 1a8ef4347f Restore Ceph dashboard Istio VirtualService on port 7000 
The dashboard has SSL disabled and listens on port 7000. Restoring the
VirtualService with the correct port for the Istio gateway path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 00:19:11 -05:00
Scooby HuskyandClaude Opus 4.6 13ff2dafd6 Remove old Istio VirtualService for Ceph dashboard 
The dashboard now uses the Envoy edge gateway via HTTPRoute. The old
Istio VirtualService was causing DNS to point at the wrong gateway IP.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-12 23:49:32 -05:00
Scooby HuskyandClaude Opus 4.6 31113ecf16 Fix Ceph dashboard Backend to use HTTP port 7000 
The dashboard has SSL disabled and listens on port 7000, but the
Backend was configured for TLS on port 8443.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-12 22:32:09 -05:00
Scooby HuskyandClaude Opus 4.6 511ba55b30 Remove dedicated DB devices from Rook-Ceph OSD configuration 
Remove metadataDevice (sdb) from all 4 nodes in cluster-values.yaml
since the SATA SSDs are slower than the NVMe data drives. Add temporary
Kyverno mutate policy to protect existing OSD deployments when the
operator is re-enabled - replaces expand-bluefs with a no-op and adds
conditional block.db symlink creation based on BlueStore label detection.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 22:06:34 -05:00
Scooby HuskyandClaude Opus 4.6 131cbca4a6 Fix ArgoCD ServerSideDiff permanent OutOfSync diffs 
Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 17:32:59 -05:00
Scooby HuskyandClaude Opus 4.6 782a271e17 Revert Ceph to v19.2.0 - v19.2.3 has same expand-bluefs issue 
BlueStore has UUID inconsistency at block position 0x0 that causes
expand_devices assertion in both v19.2.0 and v19.2.3. The OSD
daemon itself runs fine; only expand-bluefs init container crashes.
Will use deployment patches with do-not-reconcile annotation instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 06:00:45 -05:00
Scooby HuskyandClaude Opus 4.6 fefa183db7 Upgrade Ceph to v19.2.3, fix netbird webhook failurePolicy 
- Ceph v19.2.0 has BlueStore::expand_devices assertion bug that
  crashes OSD expand-bluefs init containers. v19.2.3 includes fixes.
- NetBird operator webhook failurePolicy: Fail blocks all pod
  creation cluster-wide when webhook service is unreachable.
  Changed to Ignore.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 05:29:39 -05:00
Scooby HuskyandClaude Opus 4.6 7640fb895b Fix degraded ArgoCD applications 
- frigate: Remove duplicate PVCs (Helm manages them), update config size to 15Gi
- gitlab: Fix sync-admin-job secretKeyRef schema error, fetch password via kubectl
- nextcloud: Remove duplicate PVC, remove invalid pod-level securityContext
- rook-ceph: Update cephfs-smb-pvc to 50Gi, remove unsupported dashboard.config
- nessus: Add privileged PSS label for NET_ADMIN/NET_RAW capabilities
- scylla-manager: Add privileged PSS label for SYS_NICE capability
- n8n: Create missing n8n-main-persistence PVC
- projects: Add authentik namespace to applications project destinations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 00:05:29 -05:00
Scooby Husky aacb8eebbe Initial commit 2026-03-09 20:21:35 -05:00