Story Crater Bot
32cb01388c
- minio console ingress: minio-console -> minio-cluster-console:9090 (service renamed by operator)
- minio-api ingress: point to minio:9000 (restored once requestAutoCert disabled)
- minio tenant: requestAutoCert: false (MinIO was TLS-only internally, breaking
plain-HTTP clients like Vault's S3 backend - this was the real cause of the
Vault S3 hang)
- argocd ingress: moved from namespace cicd -> argocd (service lives in argocd
namespace; ingress in wrong namespace can never route, was returning 503)
- removed duplicate kmsvc ingress (sqs namespace already has management-service
ingress with proper TLS block for same host/backend)
Audit method: cross-checked every ingress backend.service.{name,port} against
actual Service objects in cluster. Found 3 broken backends out of 15 ingresses.
298 lines
9.1 KiB
YAML
298 lines
9.1 KiB
YAML
# k8s/ingress/ingress.yaml
|
|
# Ingress rules for all homelab services.
|
|
# TLS is handled centrally: nginx serves the wildcard-tls cert (*.riotpiao.com)
|
|
# as its default-ssl-certificate. No per-rule tls: blocks or cert-manager annotations
|
|
# are needed — cert-manager manages one cert, nginx uses it for all hosts.
|
|
#
|
|
# DNS: *.riotpiao.com must resolve to 10.6.0.1 (WireGuard) or 192.168.1.160 (LAN).
|
|
|
|
# ── Grafana ───────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: grafana
|
|
namespace: logging
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: grafana.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: grafana
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Loki (API access for external tools) ─────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: loki
|
|
namespace: logging
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: loki.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: loki
|
|
port:
|
|
number: 3100
|
|
|
|
---
|
|
# ── Authentik ─────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: authentik
|
|
namespace: iam
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: authentik.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: authentik-server
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Vault ─────────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: vault
|
|
namespace: iam
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: vault.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: vault
|
|
port:
|
|
number: 8200
|
|
|
|
---
|
|
# ── MinIO console (storage namespace) ────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: minio
|
|
namespace: storage
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
nginx.ingress.kubernetes.io/affinity: "cookie"
|
|
nginx.ingress.kubernetes.io/session-cookie-name: "minio-console-affinity"
|
|
nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: minio.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: minio-cluster-console
|
|
port:
|
|
number: 9090
|
|
|
|
---
|
|
# ── MinIO S3 API ──────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: minio-api
|
|
namespace: storage
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: minio-api.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: minio
|
|
port:
|
|
number: 9000
|
|
|
|
---
|
|
# ── Prometheus ────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: prometheus
|
|
namespace: monitoring
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: prometheus.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: prometheus-kube-prometheus-prometheus
|
|
port:
|
|
number: 9090
|
|
|
|
---
|
|
# ── Portainer ─────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: portainer
|
|
namespace: dashboard
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: portainer.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: portainer
|
|
port:
|
|
number: 9000
|
|
|
|
---
|
|
# ── Forgejo (git forge + OCI registry UI) ────────────────────────────────────
|
|
# nginx terminates TLS using the wildcard cert, then proxies plain HTTP to
|
|
# Forgejo on port 3000. ROOT_URL stays https:// so Forgejo generates correct URLs.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: forgejo
|
|
namespace: cicd
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: forgejo.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: forgejo-gitea-http
|
|
port:
|
|
number: 3000
|
|
|
|
---
|
|
# ── Argo CD (cicd namespace) ──────────────────────────────────────────────────
|
|
# argocd-server runs HTTPS internally — nginx proxies via backend-protocol: HTTPS.
|
|
# proxy-ssl-verify: off because argocd-server's pod cert is self-signed (not homelab-ca).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: argocd
|
|
namespace: argocd
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
nginx.ingress.kubernetes.io/proxy-ssl-verify: "off"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: argocd.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: argocd-server
|
|
port:
|
|
number: 443
|
|
|
|
---
|
|
# ── Longhorn UI ───────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: longhorn
|
|
namespace: longhorn-system
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: longhorn.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: longhorn-frontend
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Temporal Web UI ────────────────────────────────────────────────────────────
|
|
# Temporal workflow orchestration Web UI
|
|
# TLS: wildcard cert managed by cert-manager, served by nginx default-ssl-certificate
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: temporal
|
|
namespace: temporal
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: temporal.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: temporal-web
|
|
port:
|
|
number: 8080
|