From 5c63cac46e27c4b66e8c4f37432526e082b1e0c1 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:40:23 -0700
Subject: [PATCH] =?UTF-8?q?fix(ingress):=20remove=20stale=20ingress-nginx-?=
 =?UTF-8?q?controller-alias=20Service=20=E2=80=94=20its=20selfHeal=20kept?=
 =?UTF-8?q?=20clobbering=20the=20helm=20LoadBalancer=20Service=20(same=20n?=
 =?UTF-8?q?ame,=20dead=20ingress-nginx-bootstrap=20selector,=200=20endpoin?=
 =?UTF-8?q?ts),=20unannouncing=20LB=20IP=20.160=20and=20taking=20down=20al?=
 =?UTF-8?q?l=20ingress?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../ingress-nginx-controller-alias.yaml       | 22 -------------------
 k8s/bootstrap/ingress/kustomization.yaml      |  8 ++++++-
 2 files changed, 7 insertions(+), 23 deletions(-)
 delete mode 100644 k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml

diff --git a/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml b/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml
deleted file mode 100644
index 47661d0..0000000
--- a/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Service alias for CoreDNS compatibility
-# CoreDNS rewrites *.riotpiao.com → ingress-nginx-controller.ingress-nginx.svc
-# But bootstrap deployed as ingress-nginx-bootstrap-controller
-# This alias makes both names work
-apiVersion: v1
-kind: Service
-metadata:
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx-bootstrap
-    app.kubernetes.io/component: controller
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
-  - name: https
-    port: 443
-    targetPort: https
diff --git a/k8s/bootstrap/ingress/kustomization.yaml b/k8s/bootstrap/ingress/kustomization.yaml
index c875a71..e499322 100644
--- a/k8s/bootstrap/ingress/kustomization.yaml
+++ b/k8s/bootstrap/ingress/kustomization.yaml
@@ -2,6 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # No top-level namespace - resources declare their own namespaces
 resources:
-  - ingress-nginx-controller-alias.yaml  # Service alias for CoreDNS compatibility
+  # ingress-nginx-controller-alias.yaml REMOVED — it was a ClusterIP Service named
+  # ingress-nginx-controller with a stale selector (instance: ingress-nginx-bootstrap,
+  # a release that no longer exists). ingress-config's selfHeal kept re-applying it
+  # over the helm release's real LoadBalancer Service of the same name, reverting it
+  # to a ClusterIP with zero endpoints -> LB IP .160 unannounced -> cluster-wide
+  # outage. CoreDNS rewrites *.riotpiao.com to ingress-nginx-controller.ingress-nginx
+  # .svc, which is the helm Service directly — no alias needed.
   - riotpiao-com-cert.yaml                # Certificate for *.riotpiao.com (ingress-nginx namespace)
   - ingress.yaml                           # Ingress rules for all services (multiple namespaces)