mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
5f52f2b36b
Part of the Authentik HA pilot (see plan doc). Home's etcd quorum member (StatefulSet, pinned to talos-cp-01 for a stable advertised address) plus a NodePort exposing pg-authentik's current primary - both reachable from the VPS/witness over the already-authenticated Netbird mesh (confirmed live: home nodes are directly reachable from Netbird peers on their real node IP, via the netbird-egress DaemonSet's route). Deliberately NOT going through UniFi/public-internet exposure - this stays entirely inside the private mesh, a materially safer path than the WAN port- forward originally considered. Needs a scoped Kyverno PolicyException (ha-failover-nodeport-exception.yaml) since disallow-nodeport-services is enforced cluster-wide - narrowly scoped to Services named ha-*, matching the existing netbird-egress- exemption.yaml precedent for exceptions.
23 lines
726 B
YAML
23 lines
726 B
YAML
---
|
|
# Exposes pg-authentik's current primary to the VPS/witness over the
|
|
# Netbird mesh for streaming replication (see the "Multi-Site Active
|
|
# Failover" plan) - same selector CNPG's own pg-authentik-rw ClusterIP
|
|
# Service uses, just NodePort instead, since CNPG doesn't manage this
|
|
# object and won't fight with it. Needs
|
|
# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
|
|
# (disallow-nodeport-services is enforced cluster-wide otherwise).
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ha-authentik-postgres
|
|
namespace: authentik
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
cnpg.io/cluster: pg-authentik
|
|
cnpg.io/instanceRole: primary
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
nodePort: 32432
|