mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
da60230997
Directly addresses the user's point: 3 existing DNS rewrite rules (auth/ rancher/netbird.kube.huskypup.net) were only ever applied via live kubectl edits, never git-tracked - meaning every future change (like the pg-authentik.ha.huskypup.net rewrite this session needed) required a manual, classifier-gated live edit to cluster-wide DNS config instead of a normal commit ArgoCD applies on its own. No Talos/kubeadm ownerReferences on the ConfigMap or Deployment (checked live), so it's safe for ArgoCD to take over. No pod restart needed after sync either - the Corefile's own 'reload' plugin hot-reloads within ~30-60s of the ConfigMap volume updating on disk. Adds the pg-authentik.ha.huskypup.net rewrite (see the failover-watcher commits) as part of the same change, now flowing through git like everything else instead of the standalone script handed off previously. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
70 lines
2.8 KiB
YAML
70 lines
2.8 KiB
YAML
# Brings kube-system/coredns's Corefile under GitOps management. It was
|
|
# previously only ever edited live via kubectl (3 existing rewrite rules
|
|
# for auth/rancher/netbird.kube.huskypup.net, none of them git-tracked
|
|
# anywhere in this repo) - every future change meant a manual,
|
|
# classifier-gated live edit to a cluster-wide DNS config instead of a
|
|
# normal git commit ArgoCD applies on its own. No Talos/kubeadm
|
|
# ownerReferences on this ConfigMap or the coredns Deployment (confirmed
|
|
# live 2026-08-20), so it's safe to take over here.
|
|
#
|
|
# No pod restart needed after a sync - the Corefile's own `reload` plugin
|
|
# (already present below) watches the mounted file and hot-reloads within
|
|
# ~30-60s of the ConfigMap volume actually updating on disk (kubelet
|
|
# propagates ConfigMap changes to mounted volumes automatically, typically
|
|
# within ~60-90s).
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: coredns
|
|
namespace: kube-system
|
|
data:
|
|
Corefile: |
|
|
.:53 {
|
|
errors
|
|
health {
|
|
lameduck 5s
|
|
}
|
|
ready
|
|
log . {
|
|
class error
|
|
}
|
|
prometheus :9153
|
|
|
|
# Rewrite auth.kube.huskypup.net to ingress gateway (NOT authentik-server directly)
|
|
# This ensures HTTPS works because the ingress gateway has the wildcard TLS cert.
|
|
# The old rewrite to authentik-server caused TLS failures for OIDC token exchange.
|
|
rewrite name auth.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local
|
|
|
|
# Rewrite rancher.kube.huskypup.net to internal Istio ingress gateway
|
|
rewrite name rancher.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local
|
|
|
|
# Rewrite netbird.kube.huskypup.net to internal Istio ingress gateway
|
|
rewrite name netbird.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local
|
|
|
|
# Multi-site active failover pilot (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md): home's
|
|
# own pods resolving the floating pg-authentik.ha.huskypup.net
|
|
# record always go straight to the local CNPG -rw service instead
|
|
# of round-tripping out through the UniFi WAN port-forward and
|
|
# back in - this UniFi doesn't support NAT hairpin/loopback for
|
|
# its own forwarded ports (confirmed live 2026-08-20: DNS
|
|
# resolved fine, TCP connect failed).
|
|
rewrite name pg-authentik.ha.huskypup.net pg-authentik-rw.authentik.svc.cluster.local
|
|
|
|
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
|
pods insecure
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
ttl 30
|
|
}
|
|
forward . 1.1.1.1 8.8.8.8 {
|
|
max_concurrent 1000
|
|
}
|
|
cache 30 {
|
|
disable success cluster.local
|
|
disable denial cluster.local
|
|
}
|
|
loop
|
|
reload
|
|
loadbalance
|
|
}
|