mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Sonnet 5
8b8549e432
Found via live test: the CoreDNS rewrite for pg-authentik.ha.huskypup.net resolves the NAME correctly to a local service, but DNS rewriting can't change the PORT a client then connects to - the app tier is configured with AUTHENTIK_POSTGRESQL__PORT=61432 (matching the external floating hostname), so the local target needs to actually listen on 61432 too, or the connection times out even though DNS resolves fine. Also repoints the rewrite target from CNPG's own pg-authentik-rw to this Service, so it resolves to a port that actually exists. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
1.5 KiB
YAML
39 lines
1.5 KiB
YAML
---
|
|
# Exposes pg-authentik's current primary to the VPS/witness over the
|
|
# Netbird mesh for streaming replication (see the "Multi-Site Active
|
|
# Failover" plan) - same selector CNPG's own pg-authentik-rw ClusterIP
|
|
# Service uses, just NodePort instead, since CNPG doesn't manage this
|
|
# object and won't fight with it. Needs
|
|
# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
|
|
# (disallow-nodeport-services is enforced cluster-wide otherwise).
|
|
#
|
|
# Second port (61432, ClusterIP only - no nodePort needed) added for the
|
|
# CoreDNS rewrite in infrastructure/coredns/manifests/: home's own pods
|
|
# resolving pg-authentik.ha.huskypup.net rewrite to THIS service (not
|
|
# CNPG's own pg-authentik-rw) specifically so they can reach it on the
|
|
# SAME port number the app tier is configured with (61432, matching the
|
|
# external floating hostname's port - see infrastructure/authentik/
|
|
# values.yaml's AUTHENTIK_POSTGRESQL__PORT) - CoreDNS rewrite only
|
|
# changes the resolved NAME, not the port the client then connects to,
|
|
# so the target service has to actually listen on that same port too, or
|
|
# the connection times out even though DNS resolves correctly (confirmed
|
|
# live 2026-08-20).
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-authentik-postgres
|
|
namespace: authentik
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
cnpg.io/cluster: pg-authentik
|
|
cnpg.io/instanceRole: primary
|
|
ports:
|
|
- name: nodeport-5432
|
|
port: 5432
|
|
targetPort: 5432
|
|
nodePort: 32432
|
|
- name: floating-port-61432
|
|
port: 61432
|
|
targetPort: 5432
|