gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
54 Commits 1 Branch 0 Tags
fb0ed0071f4babfde26b9ffb83f008b135239264
Commit Graph
8 Commits
Author SHA1 Message Date
Scooby HuskyandClaude Opus 4.6 fb0ed0071f Set X-Forwarded-Proto header for Ceph dashboard SAML authentication 
Dashboard runs with ssl: false behind TLS-terminating proxy, so SAML
library sees http:// URLs and rejects responses expecting https://.
Explicitly set X-Forwarded-Proto: https on both Istio VirtualService
and Envoy Gateway HTTPRoute so the SAML ACS URL matches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 13:48:35 -05:00
Scooby HuskyandClaude Opus 4.6 7c184f9d14 Fix Ceph dashboard DestinationRule: disable TLS to match dashboard config 
Dashboard has ssl: false (plain HTTP on port 7000), but the DestinationRule
had tls.mode: SIMPLE which caused Istio to attempt TLS to the backend,
resulting in WRONG_VERSION_NUMBER errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 13:41:57 -05:00
Scooby HuskyandClaude Opus 4.6 1a8ef4347f Restore Ceph dashboard Istio VirtualService on port 7000 
The dashboard has SSL disabled and listens on port 7000. Restoring the
VirtualService with the correct port for the Istio gateway path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 00:19:11 -05:00
Scooby HuskyandClaude Opus 4.6 13ff2dafd6 Remove old Istio VirtualService for Ceph dashboard 
The dashboard now uses the Envoy edge gateway via HTTPRoute. The old
Istio VirtualService was causing DNS to point at the wrong gateway IP.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-12 23:49:32 -05:00
Scooby HuskyandClaude Opus 4.6 31113ecf16 Fix Ceph dashboard Backend to use HTTP port 7000 
The dashboard has SSL disabled and listens on port 7000, but the
Backend was configured for TLS on port 8443.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-12 22:32:09 -05:00
Scooby HuskyandClaude Opus 4.6 131cbca4a6 Fix ArgoCD ServerSideDiff permanent OutOfSync diffs 
Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 17:32:59 -05:00
Scooby HuskyandClaude Opus 4.6 7640fb895b Fix degraded ArgoCD applications 
- frigate: Remove duplicate PVCs (Helm manages them), update config size to 15Gi
- gitlab: Fix sync-admin-job secretKeyRef schema error, fetch password via kubectl
- nextcloud: Remove duplicate PVC, remove invalid pod-level securityContext
- rook-ceph: Update cephfs-smb-pvc to 50Gi, remove unsupported dashboard.config
- nessus: Add privileged PSS label for NET_ADMIN/NET_RAW capabilities
- scylla-manager: Add privileged PSS label for SYS_NICE capability
- n8n: Create missing n8n-main-persistence PVC
- projects: Add authentik namespace to applications project destinations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 00:05:29 -05:00
Scooby Husky aacb8eebbe Initial commit 2026-03-09 20:21:35 -05:00