0dee133377
- Move Keycloak off Helm to plain Crossplane Object manifests (PostgreSQL + Keycloak deployment) - Add Vaultwarden SSO/OIDC config with Keycloak, fix Recreate deployment strategy for RWO volumes - Switch routing from Helm-based Pomerium to pomerium-allinone with all service routes - Deploy Argo Workflows (controller, server, CRDs, RBAC) with KEDA queue-depth autoscaling - Add Civo cluster autoscaler with pool-scaler for zero-to-one scale-up via Civo API - Add node-labeler to auto-tag nodes by pool membership for nodeSelector scheduling - Set up mTLS container registry at registry.nge6.com (Forgejo built-in, client cert required) - Add internal registry route (registry-internal.nge6.com) for in-cluster image pulls - Fix DNS records for new Emissary LB IP (212.2.241.28) - Fix CoreDNS crash from invalid custom config - Fix Emissary apiext expired webhook CA certificate Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
71 lines
No EOL
1.9 KiB
YAML
71 lines
No EOL
1.9 KiB
YAML
# DNS and SSL for Pomerium authenticate endpoint
|
|
# SSL Certificate for authenticate.nge6.com
|
|
apiVersion: kubernetes.crossplane.io/v1alpha2
|
|
kind: Object
|
|
metadata:
|
|
name: pomerium-authenticate-certificate
|
|
namespace: crossplane-system
|
|
spec:
|
|
providerConfigRef:
|
|
name: kubernetes-provider
|
|
forProvider:
|
|
manifest:
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: pomerium-authenticate-tls
|
|
namespace: emissary
|
|
spec:
|
|
secretName: pomerium-authenticate-tls
|
|
issuerRef:
|
|
name: letsencrypt-dns
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- authenticate.nge6.com
|
|
---
|
|
# Ambassador Host for authenticate.nge6.com
|
|
apiVersion: kubernetes.crossplane.io/v1alpha2
|
|
kind: Object
|
|
metadata:
|
|
name: pomerium-authenticate-host
|
|
namespace: crossplane-system
|
|
spec:
|
|
providerConfigRef:
|
|
name: kubernetes-provider
|
|
forProvider:
|
|
manifest:
|
|
apiVersion: getambassador.io/v3alpha1
|
|
kind: Host
|
|
metadata:
|
|
name: pomerium-authenticate-host
|
|
namespace: emissary
|
|
annotations:
|
|
external-dns.ambassador-service: emissary-ingress.emissary.svc.cluster.local
|
|
external-dns.alpha.kubernetes.io/target: 212.2.241.28
|
|
spec:
|
|
hostname: authenticate.nge6.com
|
|
tlsSecret:
|
|
name: pomerium-authenticate-tls
|
|
---
|
|
# Ambassador Mapping for authenticate.nge6.com
|
|
apiVersion: kubernetes.crossplane.io/v1alpha2
|
|
kind: Object
|
|
metadata:
|
|
name: pomerium-authenticate-mapping
|
|
namespace: crossplane-system
|
|
spec:
|
|
providerConfigRef:
|
|
name: kubernetes-provider
|
|
forProvider:
|
|
manifest:
|
|
apiVersion: getambassador.io/v3alpha1
|
|
kind: Mapping
|
|
metadata:
|
|
name: pomerium-authenticate-mapping
|
|
namespace: emissary
|
|
spec:
|
|
hostname: authenticate.nge6.com
|
|
prefix: /
|
|
service: http://pomerium-allinone.pomerium:443
|
|
timeout_ms: 30000
|
|
connect_timeout_ms: 10000 |