mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
018eb3570f
Root cause of tonight's earlier CrowdSec/CNPG-backup workarounds: no node in the cluster had any route into the Netbird mesh CIDR (100.108.0.0/16) for pod-originated traffic. The per-namespace netbird 'router' pods are inbound-only infrastructure (external peers reaching K8s services); their own architecture has no reverse path. Fix, in two parts: 1. infrastructure/netbird/manifests/egress-daemonset.yaml - one netbird client per node, hostNetwork so its wt0 interface lives in the node's real network namespace, plus a sidecar that adds a host route sending 100.108.0.0/16 out via it. hostNetwork requires a scoped Kyverno PolicyException (infrastructure/kyverno/policies/netbird-egress-exception.yaml) to the disallow-host-namespaces STIG policy - narrowly for this one DaemonSet by name, not a namespace-wide exclusion. 2. Discovered the route alone wasn't enough for k3s NodePort traffic (vps-minio:30900): Netbird manages its own nftables ACLs independent of iptables/Kyverno, and its forward chain (netbird-rt-fwd) only permits *established* connections through a peer acting as a router - never new ones, by design, unless a Netbird 'Network Route' policy is explicitly configured (it isn't, for this VPS). Locally-terminated connections (tinyproxy) go through a separate, already-permissive ACL chain, which is why the CrowdSec proxy fix from earlier tonight worked. Replicated that working pattern for MinIO: minio-forward.service on the VPS host (systemd, socat) forwards 100.108.113.41:9000 -> MinIO's ClusterIP, avoiding the NodePort path entirely. Re-enabled everything that was disabled/suspended earlier tonight because of this gap, pointed at the new endpoint: - CrowdSec CAPI/console-enroll (removed DISABLE_ONLINE_API, restored the VPS proxy env vars) - n8n/nextcloud/authentik CNPG backup.barmanObjectStore - vault-raft-snapshot CronJob (unsuspended) - nextcloud PVC content sync CronJob endpoint vps-minio.netbird.internal is retired everywhere - it was never actually resolvable (Netbird has no DNS configured) even before today's routing fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
78 lines
2.2 KiB
YAML
78 lines
2.2 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: pg-n8n
|
|
namespace: n8n
|
|
spec:
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
instances: 2
|
|
|
|
# Resource limits to prevent OOM
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "25m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "250m"
|
|
|
|
# Spread replicas across different nodes
|
|
affinity:
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: rook-ceph-block
|
|
|
|
primaryUpdateStrategy: unsupervised
|
|
|
|
# PostgreSQL configuration for better performance
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "200"
|
|
shared_buffers: "512MB"
|
|
effective_cache_size: "1536MB"
|
|
maintenance_work_mem: "128MB"
|
|
checkpoint_completion_target: "0.9"
|
|
wal_buffers: "16MB"
|
|
default_statistics_target: "100"
|
|
random_page_cost: "1.1"
|
|
effective_io_concurrency: "200"
|
|
work_mem: "2621kB"
|
|
min_wal_size: "1GB"
|
|
max_wal_size: "4GB"
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: n8n
|
|
owner: n8n
|
|
|
|
# Backup to VPS MinIO - RE-ENABLED 2026-08-18. Real pod-egress routing to
|
|
# the VPS now exists (netbird-egress DaemonSet, hostNetwork + per-node
|
|
# route into 100.108.0.0/16 - see infrastructure/netbird/manifests/
|
|
# egress-daemonset.yaml). Endpoint changed from the NodePort
|
|
# (vps-minio.netbird.internal:30900 - never resolvable anyway, Netbird has
|
|
# no DNS configured, and separately blocked by Netbird's own ACL model,
|
|
# which only permits *established* forwarded connections through a peer,
|
|
# never new ones) to a locally-terminated socat forward on the VPS host
|
|
# itself (100.108.113.41:9000 - see minio-forward.service on the VPS),
|
|
# mirroring the pattern that already worked for the CrowdSec CAPI proxy.
|
|
backup:
|
|
barmanObjectStore:
|
|
destinationPath: s3://cnpg-backups/pg-n8n
|
|
endpointURL: http://100.108.113.41:9000
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: vps-minio-secret
|
|
key: accesskey
|
|
secretAccessKey:
|
|
name: vps-minio-secret
|
|
key: secretkey
|
|
wal:
|
|
compression: gzip
|
|
maxParallel: 2
|
|
retentionPolicy: "30d"
|
|
|
|
monitoring:
|
|
enablePodMonitor: true
|