Story Crater Bot
47e7a2b1d6
- Add p1_ingress() phase to install nginx-ingress-controller - Create ingress-nginx namespace with privileged PodSecurity label - Disable ServiceMonitor during bootstrap (Prometheus CRDs not installed yet) - Add namespace.yaml with PodSecurity labels (allows hostPort) - Filter cert-manager CRD errors (will be created by ArgoCD) - Include ingress phase in bootstrap 'all' flow
90 lines
3.4 KiB
YAML
90 lines
3.4 KiB
YAML
# k8s/ingress/nginx-values.yaml
|
|
# Nginx Ingress Controller — bare-metal homelab config.
|
|
# LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
|
|
# Access services at https://grafana.riotpiao.com (80/443 via LoadBalancer).
|
|
|
|
controller:
|
|
kind: DaemonSet
|
|
|
|
# Single wildcard cert served for every *.riotpiao.com host (Let's Encrypt,
|
|
# see ../ingress/riotpiao-com-cert.yaml + ../cert-manager/letsencrypt-issuer.yaml).
|
|
# nginx hot-reloads when cert-manager renews riotpiao-com-tls — no restart needed.
|
|
extraArgs:
|
|
default-ssl-certificate: "ingress-nginx/riotpiao-com-tls"
|
|
|
|
hostPort:
|
|
enabled: true
|
|
ports:
|
|
http: 80
|
|
https: 443
|
|
|
|
# TCP proxy: forward port 2222 on every node → Forgejo SSH service.
|
|
# This lets `git clone [email protected]:repo` work via the
|
|
# same hostname as HTTPS without a separate LoadBalancer IP for SSH.
|
|
tcp:
|
|
2222: "cicd/forgejo-gitea-ssh:2222"
|
|
|
|
# Service as LoadBalancer — Cilium LB-IPAM assigns fixed IP.
|
|
service:
|
|
type: LoadBalancer
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.160"
|
|
|
|
# Allow the controller to land on the control-plane node.
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Use the ingress-nginx IngressClass by default.
|
|
ingressClassResource:
|
|
default: true
|
|
|
|
# Required when using hostPort so DNS resolves correctly inside the pod.
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
|
|
# Reduce noise in a single-admin homelab.
|
|
admissionWebhooks:
|
|
enabled: false
|
|
|
|
# ── Connection timeouts to upstreams ──────────────────────────────────────────
|
|
# Increased to tolerate 5+ second pod-to-pod network latency spikes.
|
|
# Default: 60s for all — acceptable but explicitly set for clarity.
|
|
config:
|
|
upstream-connect-timeout: "60"
|
|
upstream-send-timeout: "60"
|
|
upstream-read-timeout: "60"
|
|
keepalive-timeout: "65"
|
|
keepalive-requests: "100"
|
|
|
|
# force-ssl-redirect: our Ingress objects intentionally omit per-rule `tls:`
|
|
# blocks (single wildcard cert served via default-ssl-certificate above).
|
|
# nginx-ingress's normal `ssl-redirect` only forces HTTPS for hosts that have
|
|
# an explicit TLS block on their own Ingress resource — since none of ours do,
|
|
# plain http://*.riotpiao.com requests were being served directly instead of
|
|
# 301-redirected to https://, silently serving every client-facing console
|
|
# over plaintext HTTP. force-ssl-redirect forces the redirect globally
|
|
# regardless of per-ingress TLS block presence.
|
|
force-ssl-redirect: "true"
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
|
|
# RED metrics (rate/errors/duration) for every host fronted by this controller —
|
|
# every exposed service in the cluster goes through here, so this single block
|
|
# is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
|
|
# the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
|
|
# NOTE: ServiceMonitor disabled during bootstrap (Prometheus CRDs not installed yet)
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false # Will be enabled by ArgoCD after Prometheus CRDs are installed
|
|
namespace: ingress-nginx
|
|
interval: 30s
|
|
scrapeTimeout: 30s
|