feat(cloudflared): manage tunnel ingress locally via ConfigMap

The tunnel was remotely managed from the Zero Trust dashboard: the
Deployment ran 'run --token' and ignored the ConfigMap that already
existed in the tree. Switch to a locally-managed tunnel so the ingress
routing table lives in git.

- deployment: mount cloudflared-config (config.yml) and the
  cloudflared-credentials Secret; drop TUNNEL_TOKEN env
- configmap.yaml: per-hostname ingress rules to ingress-nginx via the
  CoreDNS rewrite, plus a 404 catch-all
- secret-generator: register the SOPS-encrypted credentials file
- homelab-ca: add the cloudflared namespace copy so the connector trusts
  the ingress certificate (force-ssl-redirect makes plaintext impossible)

Credentials were extracted from the live cloudflared-token Secret and
re-encrypted with SOPS; no plaintext secret is committed.

This commit is contained in:

rock

2026-10-25 19:57:37 -07:00

parent d4e9dbf350

commit 227a67a8c1

6 changed files with 168 additions and 8 deletions

									
										k8s/argocd/secrets/secret-generator.yaml
									
		+1
		
												View File
												
				@@ -11,6 +11,7 @@ files:

				    - agent-pod-ssh-key.enc.yaml

				    - authentik-secrets.enc.yaml

				    - cloudflare-secrets.enc.yaml

				    - cloudflared-credentials.enc.yaml

				    - forgejo-registry-pat-api.enc.yaml

				    - forgejo-registry-pull.enc.yaml

				    - forgejo-runner-token.enc.yaml