rock
fc63acbcc9
The live cluster has no Authentik workload, no DNS record and no tunnel route, but two declarations still pointed at it. controlplane.tftpl still set kube-apiserver oidc-issuer-url to https://authentik.riotpiao.com/application/o/kubernetes/ and pinned that hostname in extraHostEntries. The live API server carries zero OIDC arguments, so the template and reality had diverged: the next machine-config render would have re-added an issuer that does not resolve. management-service exported KMSVC_AUTHENTIK_ISSUER_URL and KMSVC_AUTHENTIK_AUDIENCE, both empty. Rename them to KMSVC_ZITADEL_* so the names describe the identity provider that actually exists. The CoreDNS Corefile kept one rewrite for authentik.riotpiao.com. The Terraform source file no longer contains it, so the live ConfigMap was stale; that line is removed live and the next render converges without it.
51 lines
1.4 KiB
YAML
51 lines
1.4 KiB
YAML
namespace: sqs
|
|
replicaCount: 3
|
|
|
|
image:
|
|
repository: forgejo.riotpiao.com/rock/kmsvc-manage
|
|
tag: latest
|
|
pullPolicy: Always
|
|
|
|
grpcPort: 9090
|
|
httpPort: 8080
|
|
|
|
env:
|
|
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
|
|
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
|
|
zitadelIssuerURL: ""
|
|
zitadelAudience: ""
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
|
|
# Go's GC only reacts to GOGC by default and has no idea about the cgroup
|
|
# memory limit above -- it'll happily grow heap until the kernel OOMKills it.
|
|
# Setting GOMEMLIMIT to ~90% of the container limit makes the GC self-throttle
|
|
# before that happens. Keep this in sync with resources.limits.memory.
|
|
goMemLimit: "460MiB"
|
|
|
|
hpa:
|
|
enabled: true
|
|
minReplicas: 3
|
|
maxReplicas: 9
|
|
targetCPUUtilizationPercentage: 70
|
|
targetMemoryUtilizationPercentage: 80
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
clusterIssuer: homelab-ca
|
|
host: kmsvc.riotpiao.com
|
|
tlsSecretName: kmsvc-tls
|
|
# kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default
|
|
# kmsvc.riotpiao.com:443, see kmsvc-cli's README), so raw gRPC needs an
|
|
# external path too — scoped to the gRPC service's own path prefix on the
|
|
# same host/port, rather than opening the whole host to gRPC passthrough.
|
|
grpcEnabled: true
|
|
grpcPathPrefix: /kafkamgmt.v1.QueueService/
|