refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00
parent a81b9b6169
commit 2d7330798b
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,78 @@
+# k8s/ingress/nginx-values.yaml
+# Nginx Ingress Controller — bare-metal homelab config.
+# LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
+# Access services at https://grafana.riotpiao.homelab.com (80/443 via LoadBalancer).
+
+controller:
+  kind: DaemonSet
+
+  # Single wildcard cert served for every *.riotpiao.homelab.com host.
+  # Applied by the ingress-nginx presync hook (wildcard-cert.yaml) before nginx starts.
+  # nginx hot-reloads when cert-manager renews homelab-tls — no restart needed.
+  extraArgs:
+    default-ssl-certificate: "ingress-nginx/homelab-tls"
+
+  hostPort:
+    enabled: true
+    ports:
+      http: 80
+      https: 443
+
+  # TCP proxy: forward port 2222 on every node → Forgejo SSH service.
+  # This lets `git clone [email protected]:repo` work via the
+  # same hostname as HTTPS without a separate LoadBalancer IP for SSH.
+  tcp:
+    2222: "cicd/forgejo-gitea-ssh:2222"
+
+  # Service as LoadBalancer — Cilium LB-IPAM assigns fixed IP.
+  service:
+    type: LoadBalancer
+    annotations:
+      io.cilium/lb-ipam-ips: "192.168.1.160"
+
+  # Allow the controller to land on the control-plane node.
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+  # Use the ingress-nginx IngressClass by default.
+  ingressClassResource:
+    default: true
+
+  # Required when using hostPort so DNS resolves correctly inside the pod.
+  dnsPolicy: ClusterFirstWithHostNet
+
+  # Reduce noise in a single-admin homelab.
+  admissionWebhooks:
+    enabled: false
+
+  # ── Connection timeouts to upstreams ──────────────────────────────────────────
+  # Increased to tolerate 5+ second pod-to-pod network latency spikes.
+  # Default: 60s for all — acceptable but explicitly set for clarity.
+  config:
+    upstream-connect-timeout: "60"
+    upstream-send-timeout: "60"
+    upstream-read-timeout: "60"
+    keepalive-timeout: "65"
+    keepalive-requests: "100"
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 128Mi
+
+  # RED metrics (rate/errors/duration) for every host fronted by this controller —
+  # every exposed service in the cluster goes through here, so this single block
+  # is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
+  # the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      namespace: ingress-nginx
+      interval: 30s
+      scrapeTimeout: 60s