mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-07-26 15:40:45 +00:00
failover: initial failover chain for vhaudiquet.fr
- vhaudiquet.fr, caddy, cert-manager, coredns, traefik are now tolerating failover nodes - l2 announcements policy should make vip really virtual
This commit is contained in:
@@ -17,7 +17,7 @@ data:
|
||||
Caddyfile: |
|
||||
vhaudiquet.fr {
|
||||
tls /etc/caddy/certs/vhaudiquet-fr/tls.crt /etc/caddy/certs/vhaudiquet-fr/tls.key
|
||||
reverse_proxy 10.1.2.171:80
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
*.vhaudiquet.fr {
|
||||
|
||||
@@ -35,25 +35,25 @@ health:
|
||||
volumes:
|
||||
- name: vhaudiquet-fr-tls
|
||||
secret:
|
||||
secretName: ENC[AES256_GCM,data:VQPfRq0dCtIN5nnubua5o34=,iv:TMieVEMpFldPMT4YJnEd6ecvOC9PWhpWpCe4u30Rg2E=,tag:7ZMIryVzEtGBZTzLj5a76g==,type:str]
|
||||
optional: ENC[AES256_GCM,data:EPxqBw==,iv:HYAyOFMAMMXPLFCcmgqC5XNTqenL5A/ZqK7Td/x81mg=,tag:uRdyTRPjbP1bUreP9cwj2w==,type:bool]
|
||||
secretName: ENC[AES256_GCM,data:8yVGk/GzrpbiCqJ9UTw0oDc=,iv:Ohjd+HCq3MFmtKbm+pBQiKlmFNP4JkFc+AONIC/PHqs=,tag:1XODR5Iql8qUv46XYa2dqA==,type:str]
|
||||
optional: ENC[AES256_GCM,data:VpA7hg==,iv:ULFkbNhBVk+PocEJuA92WHbN7FEFo9fB0gmYIFX2Z2g=,tag:wlFERzZBd+feEzFa1h5XuA==,type:bool]
|
||||
- name: wildcard-vhaudiquet-fr-tls
|
||||
secret:
|
||||
secretName: ENC[AES256_GCM,data:ohWn2gmc4WkRV59KTd9sRsbbHQqwiIMLpl0=,iv:hmLbftvEF7kDz2ZqrPCUhwD2QV/S34QQVcCKyYcSR0U=,tag:Ok8enop6KDGqwCpoCS+52Q==,type:str]
|
||||
optional: ENC[AES256_GCM,data:6W/i/Q==,iv:zcVzTOGfC4ki4ZfY3PkMyhNC0u1t39QG1Uoxb07QrWo=,tag:I6pcotOaeaTErrQBu8itdw==,type:bool]
|
||||
secretName: ENC[AES256_GCM,data:nQro2bZ6YsXwZrMOsy0hTuMKZIsKb6+SScs=,iv:Q2berXQ9SK+5tbieVVPlQKJXL3WyiUdeF6k6JkVELkI=,tag:yikVTPmw9bvYFL8x24ukDw==,type:str]
|
||||
optional: ENC[AES256_GCM,data:89Leqg==,iv:msFKdGUVrS3JNbXrEhZVytAUP9n4Zn7vRKi+CGlAskg=,tag:EvkFKSp5IoN0wwjlVgTRdw==,type:bool]
|
||||
# semery.fr certs from cert-manager (OVH DNS-01)
|
||||
- name: semery-fr-tls
|
||||
secret:
|
||||
secretName: ENC[AES256_GCM,data:w5YPfljvWgH0V5tkKw==,iv:atxebg81R2BztmDPORRFs/HJRNHIejvdL+wPz/NoRFU=,tag:VJynVAHGoh/yQmibnz4CDA==,type:str]
|
||||
optional: ENC[AES256_GCM,data:U+HoTA==,iv:I6lUk9k1eL5U4OYeZW96CLPdGmHZ1TJVaPGesMH623g=,tag:8IIpdcPoD65vDPy40utJIQ==,type:bool]
|
||||
secretName: ENC[AES256_GCM,data:mPCCdQWSaNqggoUd4w==,iv:BPRWpefGUqvU3cB0EizGHU1YeDrW/hpIpoZGGVLp1J8=,tag:ha62KjKlvHLz67wS8DcMTw==,type:str]
|
||||
optional: ENC[AES256_GCM,data:RSuCFA==,iv:peeRvBgETj1CF2ztAWYc2XB4Ax1mNhHORJTXALq8mPI=,tag:FdciCmDVuMRAtuTBQSPkgQ==,type:bool]
|
||||
- name: wildcard-semery-fr-tls
|
||||
secret:
|
||||
secretName: ENC[AES256_GCM,data:lD0v/r4YvzPN+Xa617BEjjwDQfZARQ==,iv:ByAUmmfli9pU1on7I3h2cbATaHqXGIEzDS79zoCxyU4=,tag:6+ZSzIwhaD2XVJbn4/iEcg==,type:str]
|
||||
optional: ENC[AES256_GCM,data:J5m77g==,iv:dqGRx5zVtr2IbR4fruHuJ+9lX4N2RUqDXFbFqJcL7I4=,tag:vc5pCXQzqmJxOadRa5OetQ==,type:bool]
|
||||
secretName: ENC[AES256_GCM,data:Fr1/La6TFi5g2bla5K2hmkws64ERKg==,iv:z1GhdRlwhZ8sSCuErhlY0oUKjmWi6ebQVGJMrCXKpyI=,tag:FYRkF4ytPpY35MulSH4vow==,type:str]
|
||||
optional: ENC[AES256_GCM,data:tk2L/g==,iv:8JRVWyg1V85cIuY5PMbbHbV/O9JchU4gQujUCuH7XP8=,tag:adjCjpsfdhO+j19eli6iQQ==,type:bool]
|
||||
- name: buildpath-win-tls
|
||||
secret:
|
||||
secretName: ENC[AES256_GCM,data:ylwpc1mncHCXEoucDxVJanM=,iv:+vzMspw9NPcT6LGvLJv+5CPSmKmMsUgl0usMHTAOoGo=,tag:mvdt+ty2+LdANic5Mk7avA==,type:str]
|
||||
optional: ENC[AES256_GCM,data:B/DGpQ==,iv:2h1FOz4onqxRUyDVTXdTKGphUnHNKDDEF6IPPnze24g=,tag:AINZfLh8wen4ClUeGejdxg==,type:bool]
|
||||
secretName: ENC[AES256_GCM,data:SuAPkjrpmTrLYSnzlA/XXaE=,iv:B18X9kXLBUu/z+a4Pm9PpF7KlDMDSq1D5+TiDdQqVBc=,tag:0rmiKeyMLoU2p2/AE+0g3w==,type:str]
|
||||
optional: ENC[AES256_GCM,data:lbJgJA==,iv:UQaPXizf31afW+RpH6an6KrGlnzbWW4O6OOepDrlgcY=,tag:xo7k3bwTj1im5SuY/BvZlQ==,type:bool]
|
||||
- name: routes
|
||||
configMap:
|
||||
name: caddy-routes
|
||||
@@ -101,32 +101,36 @@ affinity:
|
||||
app.kubernetes.io/name: caddy
|
||||
topologyKey: kubernetes.io/hostname
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:huw9H7nWgpK2,iv:mLMip5c1ubS8ZnipsDIBpmy6qdP5viG73Dn9dBJJbLo=,tag:MAFiUjJX/1updYbzpSCS8w==,type:str]
|
||||
# Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
|
||||
- key: ENC[AES256_GCM,data:NRDaGFsisFgI,iv:omVIeFSVOwPcw7KNWg/4QXzlAP9w4+kD5OJ8yPiYVh8=,tag:/j1a+M+fMJ+atgY/1mq5Jg==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:6ScxT0nUuKU=,iv:skaDlzXbBXGQHjk/SnKrNCvHVe3JovnWMtpA6zhqlFo=,tag:LAW6xol1cASA/tYwab7AVQ==,type:str]
|
||||
value: ENC[AES256_GCM,data:H1pBkT7SQIY=,iv:KJBPkp87bLZTxp77cGxIt5BDohOoQhHR1J7sJaQ5T0U=,tag:iJP0ZLD2WyomZKLfBb/6aw==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:F8rnzC8iAPEzW6fqpB9QPbd/TrzsbCkmMY4FNqWJlzgN74BJhw==,iv:2jF4voeRd+4ebyZGcwjGXpbPuqZWsflVDh6PQh+MR8k=,tag:jxfSUHxjo/kCA/2JVIBklA==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
sops:
|
||||
lastmodified: "2026-07-22T15:24:50Z"
|
||||
mac: ENC[AES256_GCM,data:K3c6hp9KPe9s992kaGJ60jCLN2FAvKnTLA44EQ0IG7FPHL5FFMbWNBxukQmI2q5E0U6oLzO7JlmOh4ZGRScIi2Z2gRz9td6DTYNBYvgO45kLFJrRAe7D0V5cb28WW44w1OhN+4ETw7VuU24kwKGHYergn5eBo1JtNLnty96ToLY=,iv:X2MkW15mPps4gVR4Pscx72t78wsLWlcRrxZJVKTMC1I=,tag:8ku82p8BIasJ3a/pkDSZTw==,type:str]
|
||||
lastmodified: "2026-07-25T08:12:52Z"
|
||||
mac: ENC[AES256_GCM,data:1xu02X8h8ws1W2lMyJyOchWKtz+4zuaddoyDnjkEFYdwoe6IkSBHUpEchQTocpkQHltdCyOHVG0n/MYTDcWPe5NoTTnZPZqYFKo09ppwjH8QdVQIaq4P/braXt5aWUkXpsANliphh56yH42SHwBTbsMETtgngqFwafgfhKlH7i0=,iv:oHXPqmVpnCotn3Tx6rdZZAI/ia7ullE9a8g/RRDxPWI=,tag:bSEWo8vz4ZwAwukVpJ+awQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-07-22T15:24:50Z"
|
||||
- created_at: "2026-07-25T08:12:52Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiARAAsoEMSw07cHFenSUrbW+prBls/qB4YT0vkZ4Pjpp2zyzw
|
||||
UTTASjXSYXYGutOkQgO42vtKE5HkEh+FB2qhWnLy9on4xPR/epFJox0Y+EFWPLQJ
|
||||
fu7Q+C+aG9JqoFgsBX+7JAPMHcH/afT4SGvvfOMTC3+aOLiFFyicbqZtkumw9bCr
|
||||
jD7VLRvPALTLokPdoer3cmY99bIQ9+51ms/cc1/SNXv8qxR+CKG1wnqtYBSdhUtY
|
||||
vTIuEY3uIrYfxJlKlsyCRQj1RPj6o64+IsLcwXTNV5WHuy7srrsSMf7qFsD9f4ZV
|
||||
7a17K/6JaRom62YqPn73HoyktBf71oPePwl8xeHqs3En/VS1T8MRa7dQjD7Qb4Xo
|
||||
00eLRGTOqTJlVmtMOg6ZqQiROmAS9W9X0ZOv4uxLK2fDG48WrDIcZMuBzI4OQaY+
|
||||
prSeVvkcZm9cTrNHj8ZWxgWHp04qPBFWg0tqXSyXnr0cXjLUI/cOqis5+segHeSt
|
||||
B8n8E/rLZqhvBrB58/3PaWvSRWVEAD2L1zBbNrfCleDsHIN+SgfPkPdvzEv4JYk8
|
||||
bVauG9wZh6Z3fgoT0NgzG8XtquIShviw2q5EOE3VEh1X1O90aLOpvQH4YJddgSBB
|
||||
i8VjACMnq+NPODJVIJCzqI5bHyhq1K666/HpMTR2H9eWCCmfB6HVhpJ37tdA/S/S
|
||||
XgHwqbomlaxeU6e5pkUXHaxO336ObSA6/75/UZQSdQUqwZVkFOzQDE6CADE+p/qG
|
||||
mYahltV1nQRdkLa8bNC6oLtPteeKP9DhmYV60LaB1ZYE5qE5CAypl7YLy2+Ql0Y=
|
||||
=oRLO
|
||||
hQIMA7uy4qQr71wiARAAhdj84mRfiKoTwMUeVydsrYVo6CFtccsY2cwGlCEyU9tb
|
||||
mqmh/K+TQlCvr7xpKT2txZAL5OLEuTjrKkcyXJ8JDLD8a0B5yvoHac2qNvgGdfKw
|
||||
icYf+jt5WF4nzS9efhTIJ2/0X8m5X37VNP4qFZ5I1XXH+qdZQS2i/i8wNmspPW7e
|
||||
6wYVIWg88ntqRbFtM4nUNtZp3weCou9wpfvJXV7R9U+dQlP+nHYac2usyGwoE9Pw
|
||||
yHEbNnVXV+ewPHy98NEjbWNfnKoneN2IyDkKbYAAR7wL0qEo2huYadH/TQY4VHD2
|
||||
m0H4JNzr6VtmlLpt7Licyi90/JDB7UYIGqfZhjBzdxEKoG0RtwK2noOJhlsjsnL/
|
||||
kNlB48NSi8Kq9Z02czLQyAJe5nyYZjS0qRVLCfUF2gHWQX7hGlRjGLZ7GaDYheai
|
||||
JHY3tRxoEEq0dKGObcphF0qQIbD3kb2d/eCpz7ssKKIiXnA3aRdXiB8Ey/w8DCSA
|
||||
lx8au5Tv7vSpjkwO6fx/GXATsAFS82z1yd06KaqGpiK7plyk69GPqiFQairlbX2s
|
||||
Y9AoGRCtMPuB68vP7WsVfhpzt9Na8Af6XLhTIOgEpiac5qXs5N2u9Xf6tGxr+zBg
|
||||
JOI2JnFPZh5K7eZjw0nB9Kdn71FkNhji5zmVU9gmvfsE1sVI0dJ1hgctKSDE6ufS
|
||||
XgENHpB+cmsxQqLoWFibd0zaLC0ELNUBu15HmQx/16rpCvDFAIVXgRDUBXexfsRT
|
||||
P1acwrGZv6OsoR1YQV5bDUlvrNhOvI9PEiQjVIiod465FYffz6ek0qXCV7e1Kzo=
|
||||
=gG3R
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
|
||||
|
||||
@@ -5,7 +5,7 @@ crds:
|
||||
keep: true
|
||||
# Enable DNS01 challenge providers
|
||||
extraArgs:
|
||||
- ENC[AES256_GCM,data:yzuTi9Hu7Dx95MQN+H/6gul381m64KYv5ZsHwg92BE/aUZyJzYArniIC+Nio+SygUXXb,iv:eBizFSW1T2/VvN3k8VRsEIpllHs5MA6Nr+jh9fCzZCs=,tag:sz9WBU687eTgnDXWoE02Nw==,type:str]
|
||||
- ENC[AES256_GCM,data:RcKzGzDSFXAw32vBKyvMTzMx5u0AmXKpXEY9/YRxUI0SNVy68/uUSpFhdmcB0RvmzG7y,iv:AraIcgoVYO1IVAmN3dd6pXr3v2BXaizbK8HefwsDRqE=,tag:QlOBuyxbddyk++nYLhMl6Q==,type:str]
|
||||
# Resource settings
|
||||
resources:
|
||||
requests:
|
||||
@@ -14,6 +14,15 @@ resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
# Tolerate failover nodes
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:WXIPFO1nBe+6,iv:t8RP3KL6niOVe84Qqu9+JKp2qNR87qnMzJOh7pUsudg=,tag:uT7gWSdOz86PPi2NZIxZeA==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:N1IHrGvrobA=,iv:QiKeIiSBFThw05b5gkU41koci4CDZ0ZxdLX1r1DD7Dc=,tag:QGWcNIYqUdEy0f0bEYC91Q==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:QMtUDj9EDXWbsUBLlQJ5yFEsQ3fksIRUqIk7tKyts1aHqNQ56A==,iv:GVEl1AcWNLAqdXqyJTMoYBPRqqvhSHGBN7fuMLWtjoY=,tag:bmCK8yCiVCXci2JJFvw/GA==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
webhook:
|
||||
resources:
|
||||
requests:
|
||||
@@ -22,6 +31,14 @@ webhook:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:QZjbo0u9rqht,iv:H3mZnC4a2abmOiW0RhoFAiAvVfaRFpGU2+XKYy8uBUQ=,tag:xwp+rkiYrSo1q+CsLdup7Q==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:UsVMCFtyl0c=,iv:ImpKIQtC1jX2NLNTSDhq4a9nq3I2HlpSr7QLUOw5gd0=,tag:xM/vf2MhasBNWbLqxkUrQg==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:31pC3NOA0AH2d0V/N10xX1U8E1OD4YL/27+xFLxElfYb1xWSDA==,iv:aaaci0Eu3Mb9og3Za0beB9js3wSjcNE7BOS5iAko3aU=,tag:h40mrm+gPTf9jCP7ax1ihQ==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
cainjector:
|
||||
resources:
|
||||
requests:
|
||||
@@ -30,6 +47,14 @@ cainjector:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:rqZTE8j9xDAy,iv:EvztWg01VbvJhdhkrVz7M0mA0EUhVW2Ty/de0D3pgmw=,tag:rGUZky1bUhewhKDp3Vo8Eg==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:fPt+n+ftbGI=,iv:xHy9IUIBgkHDQcVZ4MyA3tXPvMAy14gHhkxe2AYthR0=,tag:szam+dyODZSjfX6oxsFdSg==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:As98cp+6SvVwxRtdxx7TT+HGzejgWiacf0TYm2JU9kPqEA7ljA==,iv:dd+TS9T57NrpgyZjYgPi/aCiInfnVxh3VbO7gddkw8k=,tag:KQMA0Kn0YgE/HpAJk83pTw==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
startupapicheck:
|
||||
resources:
|
||||
requests:
|
||||
@@ -39,27 +64,27 @@ startupapicheck:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
sops:
|
||||
lastmodified: "2026-06-16T08:15:29Z"
|
||||
mac: ENC[AES256_GCM,data:ZB7igt7ciH6X0DmvDi2gzg1eA8EYXqq/VRBSbaLT9x2SUi+9ax9w0V+fcTwOTWlwCvHOtSAZ2RYgX/wKFmbnKgrwoSpskGFsRlY947oLkRTk4HbTRP5HbciAQsRw3AVB4pgkR7maVZ9n15gzNHTTkd9x1akAeGHJg9lzg9+N6rE=,iv:jqyi/ZGLjKFBe9XSj2WBBOUbn9xvV9Wf4wrYxSs4t/M=,tag:2u84qHa69IsYFtSwJ6yFqQ==,type:str]
|
||||
lastmodified: "2026-07-25T08:12:52Z"
|
||||
mac: ENC[AES256_GCM,data:yFXZxbhJi5PPVXl4j73FfOO5hurvD7ZXgWr5eZS8poE7IEg6IgZKBjwq1ITMUP5DyS6K2onR/mgZVzgj5X5I7hEwj13DAPW7wWthZql+De7oGxe5Nv74fDFEwCoqh2sTbdrQS2KyPY+rrb0ZMZD5qpdZzyw1AVGzVKeJJj9DdBY=,iv:SW7sb6mmJulekZn1Eh2pfYml1PwJ5v6z/PBdV3TL29A=,tag:5HzpRnH2G8J//J2fZhrxrQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-06-16T08:15:28Z"
|
||||
- created_at: "2026-07-25T08:12:52Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiARAAiNHNEJjBOd6AK/moP1Xw7nvOidkRtIqw+QJRmfhPDG7B
|
||||
CQy3y2armtFYzaWhDcMfiy1SkcD91kadbfxAifb5/Oit48VTv03bXZDvyrEdRwcI
|
||||
n81rt3GQuyNDCj9aSUVi1nT5GHETrvdnyJp3u1dzfc/0i7GK+FiCbGAGzSnGdN77
|
||||
+/caT5Jib+hIVskiOjhE85K3rTrh+aJMFKC6NG7Vw8GXh7N4r3EcazcX9KuJXxsn
|
||||
NRT7XyYA8y15PlZQFkhRs1QCVvqH31WDwCEt0cE4r6Qn2aGy+v8ygJkum2sYPH7g
|
||||
WZfC548mZrMrI9UNo10UfPCqGew/XpEla1/bgVByMHMdM9n961KRzCPtR349xXI4
|
||||
1APX4WClQjbL/cXR2zMs19Y+GDjL7XF6rdSRDpEgTzQXb4f1ctswutcYxftvKI3c
|
||||
EdfCGiRpVJx/wIuh82mL3SWqdi05Lekvt1zdLcG8Tx2+nF+52dWoyxNy1YMVyk0m
|
||||
RXZFMZLHKumyDooairf1P11DOXcsa8FjZrqjvn6QI2LfmEGm3PQQQUXT8Wp/10e2
|
||||
78Hr1rTGqQEzvSJu0FfDuundPws97ftPiuGcUD5hUj3rS6iGxdEp4trAPi0DCCd3
|
||||
g7m6fNX41O8n39EU0Kp2G9kfICMghGEVL5czzRA4EsLH35K8XqP0ig6ay5kVXWrS
|
||||
XgFic5jk5GdxzUL7TFjtr9AFFaWhIZkyyXwvEod3Ur3gB64Pi/ktet6OZSWU/7Wn
|
||||
eRKn9yEm+W5Xzn9eiN6TYDsCWQBY5nP80YVuj53AMSu3KbR7UGy+AbJF3T+V6lo=
|
||||
=GscV
|
||||
hQIMA7uy4qQr71wiARAArV5QxST5xu2jG+X9Fo6F4o3uxMS/Kw56ey1MMTfgkTlM
|
||||
HdV1n6lityMGXB278GiYhmZYRdZl0kAT+Dj9Y0RdaiI8BszocD7IbBKmE1tVseCr
|
||||
Xa4y7nWE58xz2Ca26KVf/I64QPHsKKus4wECGOgZrh7Hzb+KdeTJBpuMMIgnJe3l
|
||||
1C6VdfTgNlYPW+zAmX3i39ZwYO7wcz5UZ1aXozAtoOjWyjdcArEdoCH9iD2GXTOe
|
||||
0EsvgdUD1U2n4ffy+Z8mga6V8URkJQ86XTuFD6PhFF1bhBwa36MCUXAdlD9ONB6d
|
||||
jaKSAPAeia4C+0vCXTv9OYEHizSe11iwsUyPq+bmMrYCUslaiOCC+QfGtJEcCJj/
|
||||
ZeAjXMoyi5Fnmwj+y5ED+O1DKp/sDyUdvix83L1UWVfTrgNVfXFCGzHJUkcZhfUk
|
||||
Ye9KcbH+7+mj3p/lAgbQjBjVemnW6GFzGJYcL/rWwRBxw2ElLxKPnR9NQK9VY5w/
|
||||
wCmWzG4Cjr2gfLlR05A72/i68fRM9eAy4CFL5y4xTN1eYe+MCz2ZedZDd3uYTKUC
|
||||
TMPGXfjhy64W/cV8MWa/aYCyNguVlKbmUl7kZwb+8DAxrSyPqQal11DJtcsv3zFO
|
||||
BUf8GQFn4jXXYqd1LojLM7bUjAkXWZUIUbg1+jWfPGsgsTGn4R0tshtY9JOfQpfS
|
||||
XAGL6+0+DQf8wY7yzbds4DSDMNTlOH7iWoX77okayY3L5Jqc3jB0glMJbRwdmgnj
|
||||
d5JzAoqDhi1F+MQdTYGu7RQpawKr6ndWqwkT5ef5BQ86TQq3/+jZ5uuC3qnE
|
||||
=uS2O
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
|
||||
|
||||
@@ -3,3 +3,4 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- pool.yaml
|
||||
- l2-announcement.yaml
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
# Cilium L2 Announcement Policy
|
||||
#
|
||||
# This makes LoadBalancer VIPs (from the local-pool in pool.yaml) truly virtual:
|
||||
# Cilium answers ARP/NDP for the VIP from whichever node currently has healthy
|
||||
# service endpoints. Without this policy, L2 announcements are disabled even
|
||||
# though enable-l2-announcements=true in the Cilium config — the CRD policy is
|
||||
# the gate that controls which services get announced and on which interfaces.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: default-l2-announcement
|
||||
namespace: kube-system
|
||||
spec:
|
||||
# Announce IPs for LoadBalancer services and pod IPs (for external reachability).
|
||||
loadBalancerIPs: true
|
||||
# Also announce the node's own IPs (optional, useful for node-local services).
|
||||
nodeIPs: false
|
||||
# Announce externalIPs assigned to services.
|
||||
externalIPs: true
|
||||
# Which interfaces to announce on. empty = all interfaces.
|
||||
interfaces: []
|
||||
# Select which services to announce. empty selector = all services with
|
||||
# type=LoadBalancer.
|
||||
serviceSelector: {}
|
||||
@@ -80,28 +80,37 @@ extraVolumes:
|
||||
- name: zone-config
|
||||
configMap:
|
||||
name: coredns-lan-zone
|
||||
# Tolerate failover nodes
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:jLsxKqX8HEo8NbwtjeGf+8TdVzTgpba8myb09z1FOIoBsplZ9g==,iv:c+rAeZRAL8ZmQwpHDF5xv/l0ZqbWsnsdDlpFDSDfZrA=,tag:u9TfeXzHJ6W0ifaAEoPYFw==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:hPb/xXAmQrH6,iv:xo935JWcl3a3LyQ8YNIgNrjQkdqlP5aN4ZnjTnp4RM4=,tag:/rkpqOI/pHqXP47OGULnOg==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:nblSYUAjuMk=,iv:yu/IToMo3DC9kfI5DcBPvreJE3dkxdFA5x2fy6dUpjE=,tag:NGVTMBXa/STsOCD+g00yaA==,type:str]
|
||||
effect: NoSchedule
|
||||
sops:
|
||||
lastmodified: "2026-05-02T16:59:44Z"
|
||||
mac: ENC[AES256_GCM,data:H4uRid1Fqx4JzsF43TSGa7QcGjpXLAHiM0N3Kf4z7ab4eMlTy1+RXMV7xVT9BinjZzH6P+ENxo0yVOsdt0Yu467KJhGznNWlb2MC2TElPxZ9/yItJ+hdVGHGWbVGFWUL5NOUQ9fY2NPGw0CGr8qyftLr5Qkx0LO/VUgKWkq6RWM=,iv:9+V/sCBhfWAsIvr4DsWQgkeqQZQyT4Ti3Y+qCEZqU5c=,tag:JCRONb54BpXQzYhhPs7VGA==,type:str]
|
||||
lastmodified: "2026-07-25T08:12:52Z"
|
||||
mac: ENC[AES256_GCM,data:fyuCFq0hIVP0P8e8vqF/OKjBway2EzDo8HJhLpTQqhIOhOP6PsMszovi7BzG4FuqT0Hbcqo7YrjcVKY2WPGIlxoMVBuuXcUSvNB8Tdu6jv1jgq9KOoB0HNbnqX/l3TzN9ckC6Hr+QrwzLIpTYNefDlNovMCz+zBP6ALfMwADCYM=,iv:EiXUFcWr9iL1qdfzcTiL6LYLLrsShzwNNhE0eyLVYrU=,tag:JyN9WrQWSE/3wFksooRRFA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-05-02T16:59:43Z"
|
||||
- created_at: "2026-07-25T08:12:52Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ/9HzeTVqelbvPtluYa5xGvoYNeEEXg43CwrwZ1/z5yFWvx
|
||||
DoOCeyro5wFsNC6td7n2HVhtK0ULkfrMHH8OC+7L3bXbnlEnQzITmDggAUvfegCv
|
||||
b/7ohPkOdLvi6qXbr8bgqCZYFnPq+gUs3UOPh5Tl6wgzRSFXw2Hsb4YmQkvZJUNb
|
||||
PhPpLIUe/ECE4hmEjO5v9o3X0o7qZ3bahf9mZZlnJnvXT7R/DM8eeWTis/q0WSHE
|
||||
XnclhOX4GlMwXxa65sRrShuPcsV3qqX3VWOSWJFBhGx/FDtZTkhlHGQ9YhF2TzbB
|
||||
xxCrn87mH2W13NH6jQOQYPh1JTTJbgZZMZXgyPNmPDSYZE1kxTdrz4l4mcmCDND0
|
||||
hY3T8iR8ap2b3HhSNCqC1C0QN/bK217hTs8cJHWRRfa6jfh12imwk2XhJkB3zZxV
|
||||
O1oSb6eiP0ba0CgXu31shmfXuTAeVbTm6E50heYorjQKR5djjnOVwQUdmis1Awae
|
||||
AQTiWtBBbOgfX5WA5b6wInFr0WEsshG+YuqfB7FhJpo2SHyeFhgk47ssHWSeBpPv
|
||||
wa4OAGaMkdGoePQhApZFrBCZHslEhPE+XQlDdyOtXCmxBOcLwe59ikWLV75j0DzS
|
||||
NRUNOBYQ8Q1Y6Su/sJWW7TykQkmDirU+oIYxAngZyIyJSWvARPd6fJJvkqqg013S
|
||||
XgH1+LQJWNEJzIaLKCWbkZXnMstsOYrs4ynV4f/QZKU+Md5CgVbjy9KIC/trfNhj
|
||||
1t9kkyVVOEO7UmRhMyl8pK2gQDiOBrkhUJ5tSNFEfxM1llZ4GZRV+SUuMC3UzVA=
|
||||
=l7Wo
|
||||
hQIMA7uy4qQr71wiAQ//efLh++Dcra+LFtcgz/BRXdLyE+RhWXpQjABE2PzgOJpQ
|
||||
xubJJDmIV7BtUFyJS2lEjuZ2Be8uYxs2WtWILDktz2IwNQ882NVCWNCQTPuzEpoK
|
||||
DWqwi7/L6iQldx1aeE/VUocyIxYsqS8ZUHqOM8Z95xlQ0/fmhB7reTCXvuEOiRy6
|
||||
Aapvb2yW9nm7PwBVhJiWQQLGVGUkgPE7HIK1ar3ODl+b4T0FCYqjUzeB78mG2D5i
|
||||
RI0SRt56w+g9XVWk1tijKL9wx11U9KOBbmbdBuE9fkHuenns5omAzKIK0iwdHQkV
|
||||
cl3rr6m79OAqJglDYLFf8LOgHxuVcnlVxOYgmiHXjG4hlJlt7rGE96+UlRHCemhD
|
||||
bgyc7kDR3h4XMagI0OcLzjyvwsymCtZFiE5PLRVLkSCQuyrp5B3QL7Z5hbRZFiKF
|
||||
UlOziOw8sPOcvjOOJpPYF2IqWAGLSYwo5S0nI0O0bwOiM+T+ehZ5q8p47NzFp04q
|
||||
l6JpHtWdjsxVS38nDb9AWqvoHyf8EtFbJYmKeowmbN1/toPQ1q80at/NtUZIzn/3
|
||||
+VhxDP9u38u+lAAuhaBdIolitOi9CWwHqrnRXFa3V4fpQfJqXUc9You5bw/+EABV
|
||||
jTjMpcN7cPWE7SC9R1ZZjvxrMKK0qxdKO5cvXtP/hBd4zOnBqhsQBzr/QB3DycPS
|
||||
XAExosGRaKVumsUVYqEnh7ACVtMHGDLvupj1mqSa8oxRJLVDXNFLpEllFqLpoxjD
|
||||
qbCMib+JeL9/Aq83Apk3HQ48WX+4hvtkKIJ7gzeIPC/IvIVJHk0shd49kxBN
|
||||
=Xsas
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
|
||||
|
||||
@@ -11,28 +11,37 @@ ports:
|
||||
# caddy
|
||||
- 10.1.2.152/32
|
||||
- 10.0.0.0/8
|
||||
# Tolerate failover nodes
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:XBzgW0lqiHV/,iv:aA66IUT1Y+UoRG63ELwWkEIZuE2ZDFlpEuC6S/2JER0=,tag:W24D75Nr/rmCRO9RhdRsyA==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:s51W72AApTA=,iv:Jn0bbcGgRWcD59uee7jN9pukOeHkaWECjLJ60dLxjWE=,tag:6PTa0Po8vlINl9R3dXu8kw==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:fMBfUygMTeoL0uuPduaDcXSh7rlyNYE1O+OntQGRcM2AFpS/2w==,iv:wQT+tKmDUNQq3l/9FEWJoDsEJnVNIfOM2wJzxoz/sqQ=,tag:Tp8ru1ja7MW2bAVMkxzSnA==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
sops:
|
||||
lastmodified: "2026-05-26T11:18:08Z"
|
||||
mac: ENC[AES256_GCM,data:mA5hLNB0rwSiGhnyi24AhZIPJsLpZ6PpbXDyoxZ0q6YjitrClxBEnn2dHtEl2MD6dSLmNMVxnnGyGtl7j4ahfqhuct+oPSepeWT1QX8Xj/mJ2Yrt8UZfGQ1R0Ye+rKGFybluMguCRufioGQpU3TLs2TxB6RxUAiGMI1GyT3JBDY=,iv:Pf617ZQBgYbGEsF7AOtyZBCPUycQ7U/D+Sdl+MCF4y0=,tag:tleTblRukBO0V+zfL05fQw==,type:str]
|
||||
lastmodified: "2026-07-25T08:12:52Z"
|
||||
mac: ENC[AES256_GCM,data:LQhAxwv5QTKL1GvJMSEMd7q1/UwM5XkAg8h2k34er995VYFujVW4/K1sA/6PKHs4sFAeZ+XL4lLVnaCmjjKoUcOQjJpU8n5N+0RfpjV08khOpz+mz9Ze+LQaklMGgPZRUbX6TESzn4EAX78htyGuIHCZGmlet/P1o3rBSd52cxQ=,iv:XPangrjD9BUM0jz3De14yox3ReKvdaNXFzSeGpyHumw=,tag:RrWqIGnUMZF5U6PMcLzZhg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-05-26T11:18:08Z"
|
||||
- created_at: "2026-07-25T08:12:52Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ/+PJv3xyn1nqVN4ENsKv1GgMaCrmD+F1bpyCEM6quoOe1V
|
||||
Q3jnfTrHNKQySQFS+56KdWkpvf54jUtl2N+v+mAT+02FkdH+fkFQc0rSfqfpwE7H
|
||||
8peu9wY5+nVRp3sUEacJjCgu44dzzIu0MzO9aHZw/JMr1Z+OF3mMeZ1vVEp43i6E
|
||||
ZwCd3HYBQVJ8DaSdkrT/a3r69dJZKYq3mL9XLYzc/6C4JFAF3oOO5Xzkx4BAQKrM
|
||||
CDyVCJ6RihOyysiexRFGu72wIbiE1gSVqLAYzl8XDJyCcVOX8ZRuMh2ImGyuCXtI
|
||||
8dANf39gf57Z3qM9ljNHgtUkFqcpeE66SdNCSeLK7pDl/02k6dPJr98+e0VtZPfv
|
||||
xt/sFUnAppi5dI4I4AZ1upqFWH3zpud+3G+5CYnfn0yqSgysuJyqzSYv7rjJVStY
|
||||
oMdKprkLGcdLc9FJm3yaPluCnTGpPCaBpvx1bUlQSCIHcrbNj98kHjnuSDcUjgBc
|
||||
xpcWmknbsZ0SFnU8fhe/p80Ud7h2Ya5Hp+GY+FPV2YDeQf03YKLGXujsVhm0scpo
|
||||
KtAALuJo8uP3vniAaY6E1eQVZ09psqR3lFHgaRIyLVbOGkvOoE/sMVcS/odcKhgw
|
||||
Gr6bb2iQ9b0seITxk09HV84uRirzgR+R2A2bxD38ASRzbYwDyA0UnJMSJK+ZttfS
|
||||
XgERXIWVWlTL77IVifpdu+7EU+ElyCzlTLHIb0uqywVS2o/LzE+OgR+1tSj0SVl0
|
||||
+NvGYouZlrecytaBj8MG9thv9kK/vNShrl0QeAWNch3Qza7Xb8eLOhumqZVFI9U=
|
||||
=JbZl
|
||||
hQIMA7uy4qQr71wiARAAi7huBzAAuXjAmwizoqYnwVZ9hlvg0B2Sv/Z1P6argnaV
|
||||
UU/iIis34xUq+N8aa9HazzqlJIJO0xc+zqTh6VtFpKcU/CT23oeJzK/z+FRu48MY
|
||||
+kc/kJnLuQipQsBXW2S4JVcOdSXnSy3oIzL10mxgVVzmR0pLmmi0eSdM1rnHjhlW
|
||||
yyJBvrxlxsSv95naffkiOWmSPxPitlTxPHwqiUcqyHAMP9VDIO85tSQfZvrbG+pF
|
||||
DNG0sSQprRQoOtp0sxAofQPG2TzqkX4NPgV+mtX4itGDjVf+72l4ObH02oXIhW8g
|
||||
qTrAqhNkaIkhq2KwORUteUTBOG5fEg6R/hQgM0DS3Y6Ipdg2EVvoHg7zeMkECG5w
|
||||
lACZKAxxMWvjU7J9n8HNMDvwHfmw4/A9GPLIsMXVafwsOj93z8QMYbnPX2ufAyGr
|
||||
ohz9BBtSGOapqLmmAHONFJYOMP9zAsUuFeoFezSlM2KhbRCRGxNuH2JujAC5FRU/
|
||||
5qcKpAhKu+UaOA7sEH3Hx8AM2KQTSm/1zd+5BUUgAYE6bhnAKMHua1JhyMaUzmNO
|
||||
OcLPqKyhnOe+Vem3ygEPD6X5pnpDK0Cv9IAlWMMyAdQDXRDcNkMiqLkG7WnbJ7Jt
|
||||
z1d0f1+MIFn87xBIHMtjQOnfKSzTxzKit5vMco72/R67yS8W8kProTTzIx6kIrXS
|
||||
XgEAwpUXFtJQg/wl5SIzfRHkHBKVhqmxOF9CiHWRR68+ZdZMDv3vNY0BdirV47pg
|
||||
qHBdEwODV/tiZ0pkFYkJgspYKRyMpmIf+iavS9pSjEIKR9gAx1CRtG1Xfq5ML3E=
|
||||
=nKR+
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
|
||||
|
||||
Reference in New Issue
Block a user