mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Opus 4.6
131cbca4a6
Add explicit CRD/API defaults to manifests that were causing ArgoCD's SSA dry-run to produce results different from live state: - HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs - Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations - Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults - Gateway certificateRefs: add group="" default - Guacamole Gateway: add group="" to certificateRefs Add ignoreDifferences for resources that legitimately differ: - Cilium cert Secrets (auto-generated, data always differs) - Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates) - Crowdsec LAPI Secrets (randomly generated) - ServiceMonitor/PodMonitor relabeling action defaults - StatefulSet volumeClaimTemplates apiVersion/kind defaults Persist argocd-cm ignoreDifferences config in ArgoCD Helm values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
315 lines
6.4 KiB
YAML
315 lines
6.4 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: gateway
|
|
|
|
---
|
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
|
kind: EnvoyProxy
|
|
metadata:
|
|
name: edge-proxy-config
|
|
namespace: gateway
|
|
spec:
|
|
provider:
|
|
type: Kubernetes
|
|
kubernetes:
|
|
envoyDeployment:
|
|
replicas: 1
|
|
patch:
|
|
type: StrategicMerge
|
|
value:
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: envoy
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 512Mi
|
|
- name: shutdown-manager
|
|
resources:
|
|
requests:
|
|
cpu: 5m
|
|
memory: 16Mi
|
|
limits:
|
|
memory: 64Mi
|
|
envoyHpa:
|
|
minReplicas: 1
|
|
maxReplicas: 5
|
|
metrics:
|
|
- type: Resource
|
|
resource:
|
|
name: cpu
|
|
target:
|
|
type: Utilization
|
|
averageUtilization: 60
|
|
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: edge-wildcard-kube-huskypup-net
|
|
namespace: gateway
|
|
spec:
|
|
secretName: edge-wildcard-kube-huskypup-net
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: letsencrypt-production
|
|
dnsNames:
|
|
- "*.kube.huskypup.net"
|
|
- "*.gitlab.kube.huskypup.net"
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: edge
|
|
namespace: gateway
|
|
spec:
|
|
gatewayClassName: envoy-gateway
|
|
infrastructure:
|
|
parametersRef:
|
|
group: gateway.envoyproxy.io
|
|
kind: EnvoyProxy
|
|
name: edge-proxy-config
|
|
listeners:
|
|
- name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: edge-wildcard-kube-huskypup-net
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: All
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-argocd-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: argocd
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-authentik-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: authentik
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-grafana-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: grafana
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-prometheus-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: prometheus
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-vault-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: vault
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-rook-ceph-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: rook-ceph
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-mqtt-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: mqtt
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-n8n-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: n8n
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-nextcloud-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: nextcloud
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-home-assistant-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: home-assistant
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-frigate-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: frigate
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-teslamate-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: teslamate
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-guacamole-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: guacamole
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|
|
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-gitlab-attach-edge
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: gitlab
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: edge
|