rock
39310c4969
Problem: In-cluster pods (portfolio, services) couldn't resolve api.riotpiao.com because it was missing from CoreDNS rewrite rules. This broke LLM API calls from portfolio → api gateway even with valid JWT. Solution: Add rewrite rule to route api.riotpiao.com through nginx ingress (TLS termination + Host header preservation), matching pattern for other internal hostnames (authentik.riotpiao.com, minio.riotpiao.com, etc). Impact: - Portfolio pod now successfully resolves api.riotpiao.com - LLM API calls proceed to auth/permission checking - Applies to all in-cluster services needing LLM gateway
57 lines
2.7 KiB
Plaintext
57 lines
2.7 KiB
Plaintext
.:53 {
|
|
errors
|
|
health {
|
|
lameduck 5s
|
|
}
|
|
ready
|
|
log . {
|
|
class error
|
|
}
|
|
prometheus :9153
|
|
|
|
# VPN access: map api-server.cluster.local to the cluster API service.
|
|
rewrite name api-server.cluster.local kubernetes.default.svc.cluster.local
|
|
|
|
# Forgejo: route through nginx ingress (TLS on :443, /v2/ registry + web).
|
|
# Do NOT point at forgejo-gitea-http directly (port 3000 only) — image pulls
|
|
# use https/:443 and would time out. SSH stays on its own LB service.
|
|
rewrite name forgejo.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name git.riotpiao.com forgejo-gitea-ssh.cicd.svc.cluster.local
|
|
|
|
# Homelab hostnames -> nginx ingress controller so in-cluster pods hit nginx
|
|
# TLS termination (cert-manager cert) and preserve the Host header. Routing
|
|
# via nginx (not the backend service) is critical: a direct rewrite bypasses
|
|
# nginx TLS and exposes each app's own self-signed cert, trusted by nothing.
|
|
rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio-api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name argocd.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
|
|
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
|
pods insecure
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
ttl 30
|
|
}
|
|
forward . 8.8.8.8 1.1.1.1 {
|
|
max_concurrent 1000
|
|
}
|
|
cache 30 {
|
|
disable success cluster.local
|
|
disable denial cluster.local
|
|
}
|
|
loop
|
|
reload
|
|
loadbalance
|
|
}
|