From afd3b79dc16f4f38149cfb6cea4eaa545d72990f Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Sat, 25 Jul 2026 10:22:16 +0200 Subject: [PATCH] caddy,traefik: prefer non-failover nodes --- kubernetes/system/caddy/values.yaml | 70 +++++++++++++++------------ kubernetes/system/traefik/values.yaml | 53 ++++++++++++-------- 2 files changed, 72 insertions(+), 51 deletions(-) diff --git a/kubernetes/system/caddy/values.yaml b/kubernetes/system/caddy/values.yaml index 061df5f..a58adde 100644 --- a/kubernetes/system/caddy/values.yaml +++ b/kubernetes/system/caddy/values.yaml @@ -35,25 +35,25 @@ health: volumes: - name: vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:8yVGk/GzrpbiCqJ9UTw0oDc=,iv:Ohjd+HCq3MFmtKbm+pBQiKlmFNP4JkFc+AONIC/PHqs=,tag:1XODR5Iql8qUv46XYa2dqA==,type:str] - optional: ENC[AES256_GCM,data:VpA7hg==,iv:ULFkbNhBVk+PocEJuA92WHbN7FEFo9fB0gmYIFX2Z2g=,tag:wlFERzZBd+feEzFa1h5XuA==,type:bool] + secretName: ENC[AES256_GCM,data:rcgSDJ+EX9hd3A3iDgMK81o=,iv:DKDz7STKJt8SsStOWggd85qMJTRLO6/5xeUu/0fkGF0=,tag:eHDV/OIxbsTcfNs8f7wAoQ==,type:str] + optional: ENC[AES256_GCM,data:kCy1+w==,iv:9oFPPgCEq5t3iFrEzBM6wLlRcanyNY5Pk+/8jV8wj78=,tag:sFdgEa1LBcjpTzWD2QdTUg==,type:bool] - name: wildcard-vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:nQro2bZ6YsXwZrMOsy0hTuMKZIsKb6+SScs=,iv:Q2berXQ9SK+5tbieVVPlQKJXL3WyiUdeF6k6JkVELkI=,tag:yikVTPmw9bvYFL8x24ukDw==,type:str] - optional: ENC[AES256_GCM,data:89Leqg==,iv:msFKdGUVrS3JNbXrEhZVytAUP9n4Zn7vRKi+CGlAskg=,tag:EvkFKSp5IoN0wwjlVgTRdw==,type:bool] + secretName: ENC[AES256_GCM,data:b03gkJ43guNYdcbu6nxWCL0uROV2MPgv1z4=,iv:MUzHsrfyoAHvc46MG/24Z3ZD6HokySwJRmeAA3UuRoc=,tag:y1Gp32TYP0XiwBpvmbyydg==,type:str] + optional: ENC[AES256_GCM,data:ys5mYQ==,iv:b79KRokcoRcGANWcOaoP3scVilnDgxTXSanfWV956l0=,tag:jOyJgrKo+oNb4iDS5aKjXA==,type:bool] # semery.fr certs from cert-manager (OVH DNS-01) - name: semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:mPCCdQWSaNqggoUd4w==,iv:BPRWpefGUqvU3cB0EizGHU1YeDrW/hpIpoZGGVLp1J8=,tag:ha62KjKlvHLz67wS8DcMTw==,type:str] - optional: ENC[AES256_GCM,data:RSuCFA==,iv:peeRvBgETj1CF2ztAWYc2XB4Ax1mNhHORJTXALq8mPI=,tag:FdciCmDVuMRAtuTBQSPkgQ==,type:bool] + secretName: ENC[AES256_GCM,data:9PNhCQYMAZqJf0z5ig==,iv:3ccqLo3n80t1rCxQ3gympxWpKBbTWLSf/tnuXybZgnk=,tag:0aIWetuABijQkfcMFO3sfw==,type:str] + optional: ENC[AES256_GCM,data:Rtf7pw==,iv:oce12WWAkp3MSvzxcaXbDjr7SbCqqoZRAbaza1H3kS8=,tag:JT4TEsutsG6mhVNNVue+EA==,type:bool] - name: wildcard-semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:Fr1/La6TFi5g2bla5K2hmkws64ERKg==,iv:z1GhdRlwhZ8sSCuErhlY0oUKjmWi6ebQVGJMrCXKpyI=,tag:FYRkF4ytPpY35MulSH4vow==,type:str] - optional: ENC[AES256_GCM,data:tk2L/g==,iv:8JRVWyg1V85cIuY5PMbbHbV/O9JchU4gQujUCuH7XP8=,tag:adjCjpsfdhO+j19eli6iQQ==,type:bool] + secretName: ENC[AES256_GCM,data:XewtG6zwJ2K/pk20sXkFQ2bpAf9/lw==,iv:Tsm/H4vfnroytVzNDSm8MBkOxE44OIZfQ7aNA8THZUw=,tag:UmXqYGbxZCe3sm2vCJJnqw==,type:str] + optional: ENC[AES256_GCM,data:bV0FLw==,iv:IBg34NAfXfXIo0CYoCI9gmmQjdTtj/wBwZwbXeb613o=,tag:5dCD5tZJLmZ2SM0PIzsz3Q==,type:bool] - name: buildpath-win-tls secret: - secretName: ENC[AES256_GCM,data:SuAPkjrpmTrLYSnzlA/XXaE=,iv:B18X9kXLBUu/z+a4Pm9PpF7KlDMDSq1D5+TiDdQqVBc=,tag:0rmiKeyMLoU2p2/AE+0g3w==,type:str] - optional: ENC[AES256_GCM,data:lbJgJA==,iv:UQaPXizf31afW+RpH6an6KrGlnzbWW4O6OOepDrlgcY=,tag:xo7k3bwTj1im5SuY/BvZlQ==,type:bool] + secretName: ENC[AES256_GCM,data:+P7wWLfGk4SxdSBa2xCvzKk=,iv:wnpvM9hd+gz89jj2yI96x/eij0aOt6rBLWZIlaOWUKQ=,tag:Ao7218HksIJuP1N2/AmPEA==,type:str] + optional: ENC[AES256_GCM,data:M7JWXg==,iv:eGXjv+2BfbbGXS9pX5Z2+d0YzmBS50GbTBAfE6lhh9g=,tag:qEbbjBVUTjDEIpRAdWHQdg==,type:bool] - name: routes configMap: name: caddy-routes @@ -92,6 +92,16 @@ config: import /etc/caddy/routes/Caddyfile affinity: + # Prefer non-failover nodes in normal operation + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + preference: + matchExpressions: + - key: ENC[AES256_GCM,data:4FH6bjD3Foh1eMKjK7u9SYKBVes=,iv:as1luIBK4tAMLlPbSrba5gP39ENPFnWy5Z2SPaoMS8k=,tag:HFJfUKnjVnYH0qjTNhF6Kg==,type:str] + operator: NotIn + values: + - "true" podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 @@ -102,35 +112,35 @@ affinity: topologyKey: kubernetes.io/hostname tolerations: # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1). - - key: ENC[AES256_GCM,data:NRDaGFsisFgI,iv:omVIeFSVOwPcw7KNWg/4QXzlAP9w4+kD5OJ8yPiYVh8=,tag:/j1a+M+fMJ+atgY/1mq5Jg==,type:str] + - key: ENC[AES256_GCM,data:ySkUzenN2JKy,iv:vjMMs+bqAt8RU4/ONcamXYzPEtzN5up6I/4dyQcczS8=,tag:3Pbg1NE6wrCxPbghmIbOtA==,type:str] operator: Equal - value: ENC[AES256_GCM,data:H1pBkT7SQIY=,iv:KJBPkp87bLZTxp77cGxIt5BDohOoQhHR1J7sJaQ5T0U=,tag:iJP0ZLD2WyomZKLfBb/6aw==,type:str] + value: ENC[AES256_GCM,data:tPKG1cGFQ1g=,iv:oWqAoALXyCqsVe06B2ZE2Nbw32qk8Uipp4OMbBeYnkQ=,tag:WQ43ga2Vim6RkByg/aXciQ==,type:str] effect: NoSchedule - - key: ENC[AES256_GCM,data:F8rnzC8iAPEzW6fqpB9QPbd/TrzsbCkmMY4FNqWJlzgN74BJhw==,iv:2jF4voeRd+4ebyZGcwjGXpbPuqZWsflVDh6PQh+MR8k=,tag:jxfSUHxjo/kCA/2JVIBklA==,type:str] + - key: ENC[AES256_GCM,data:BTMlEem0728QJIYhfLFqcw+67CiszZZ4KaaOceoB0T9AFg42BQ==,iv:yIfcwyD597hc871n7gVJWPFhDEeCl4p71lgkJLJ9dhw=,tag:S471ZJdUmkv1x05fpWOwkg==,type:str] operator: Exists effect: NoSchedule sops: - lastmodified: "2026-07-25T08:12:52Z" - mac: ENC[AES256_GCM,data:1xu02X8h8ws1W2lMyJyOchWKtz+4zuaddoyDnjkEFYdwoe6IkSBHUpEchQTocpkQHltdCyOHVG0n/MYTDcWPe5NoTTnZPZqYFKo09ppwjH8QdVQIaq4P/braXt5aWUkXpsANliphh56yH42SHwBTbsMETtgngqFwafgfhKlH7i0=,iv:oHXPqmVpnCotn3Tx6rdZZAI/ia7ullE9a8g/RRDxPWI=,tag:bSEWo8vz4ZwAwukVpJ+awQ==,type:str] + lastmodified: "2026-07-25T08:22:16Z" + mac: ENC[AES256_GCM,data:Fso99yltP0D5EUI5QdJrUlDnapLvBjYTCDwggi0Ugp4bhpzBDuSBTq/illntZd+OGZhxhq3AhQuYQUS9w6qhRuSZx9H8VQZyJqaiuRVuyTPm2+qaC0KQmr8htJe2Qy2GQOsOAixEk4Ap5qhOtD24afcysQOjLQjw1jNCpaivw4U=,iv:1ZSbPqkKJkItQcsPIBZ1ss+EcRG8sVWXsbt8CUHEVxQ=,tag:Aikj6PMIoXcOZYkN9p4zyg==,type:str] pgp: - - created_at: "2026-07-25T08:12:52Z" + - created_at: "2026-07-25T08:22:16Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiARAAhdj84mRfiKoTwMUeVydsrYVo6CFtccsY2cwGlCEyU9tb - mqmh/K+TQlCvr7xpKT2txZAL5OLEuTjrKkcyXJ8JDLD8a0B5yvoHac2qNvgGdfKw - icYf+jt5WF4nzS9efhTIJ2/0X8m5X37VNP4qFZ5I1XXH+qdZQS2i/i8wNmspPW7e - 6wYVIWg88ntqRbFtM4nUNtZp3weCou9wpfvJXV7R9U+dQlP+nHYac2usyGwoE9Pw - yHEbNnVXV+ewPHy98NEjbWNfnKoneN2IyDkKbYAAR7wL0qEo2huYadH/TQY4VHD2 - m0H4JNzr6VtmlLpt7Licyi90/JDB7UYIGqfZhjBzdxEKoG0RtwK2noOJhlsjsnL/ - kNlB48NSi8Kq9Z02czLQyAJe5nyYZjS0qRVLCfUF2gHWQX7hGlRjGLZ7GaDYheai - JHY3tRxoEEq0dKGObcphF0qQIbD3kb2d/eCpz7ssKKIiXnA3aRdXiB8Ey/w8DCSA - lx8au5Tv7vSpjkwO6fx/GXATsAFS82z1yd06KaqGpiK7plyk69GPqiFQairlbX2s - Y9AoGRCtMPuB68vP7WsVfhpzt9Na8Af6XLhTIOgEpiac5qXs5N2u9Xf6tGxr+zBg - JOI2JnFPZh5K7eZjw0nB9Kdn71FkNhji5zmVU9gmvfsE1sVI0dJ1hgctKSDE6ufS - XgENHpB+cmsxQqLoWFibd0zaLC0ELNUBu15HmQx/16rpCvDFAIVXgRDUBXexfsRT - P1acwrGZv6OsoR1YQV5bDUlvrNhOvI9PEiQjVIiod465FYffz6ek0qXCV7e1Kzo= - =gG3R + hQIMA7uy4qQr71wiAQ/+PMP6p/zNkq2KLigchf4V3FvkKxGD+tpl4CL0RRliyweO + dxvH2xZS+SSgA1vaOmdstD9xD+5POLsceAKWN9SUa/xUyJEyQovtFoxRQa54K0/G + mcM4mZ7qvsEetWZzRLpjJ33x6neLPj1i6AgW3eNYGHtH6W+MRpgmPshFMOFrlgg3 + inu/MRYyG1gcOovnhOFc9tJSZtpGF7dv4R8eDzM5QDXxr1FdpNNJgMRKZyotNPLX + erOEe8+78V8zxLixCIo4qQgvUnCocJfKrA/jHF3ZdyW9t7LOqJI9KRFwiawWZ5E/ + UsB8p7uG2zCCR4mRA5GBWqST8pW8joCxuw3dB2xYLqLxUM2t7yuEIKUo4SXm9Jhe + pCNVBmsjI9DZk+COAZzC3DKtBDK1Tr998JYDQ+Qq5heXQj14mi6EaeIaQTqdOnEj + Wyn6Rpd90b+GjSpnLIWoCS0M8Vp6Mal6OY+2NWeMuw5CNAOty8wWkPAFXz4Iupin + JLyZedWQpkIfiw7Q9Gs4fY4hRYMXFo3vvkT46JFUO7WFBrLz6phaa3JBhih03qsZ + 56ZWHpC8Ag7glOwQOLDeclsQ3wT58QiPJCK7BpzpkNdkGxv5qJj5r/zW6aTuDvB5 + zJtHNjbI2cL11vnC0/4xI4EdfSe0LSphoGBgg7RpedpCfro6NU0Wr5vlIxFrLjLS + XgHppBeR7vnfI+NNtswqzZd04GvddzzcesUaud3LqyXGwOKgtBoWkdvfccEcmt71 + nC+TezwV2Aq0R+FTBDxRy529cr8FXArk0wtDUr2e/XLr61160FOqGiw+bn5/q7g= + =Yhwg -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ diff --git a/kubernetes/system/traefik/values.yaml b/kubernetes/system/traefik/values.yaml index 335261b..d0b5fec 100644 --- a/kubernetes/system/traefik/values.yaml +++ b/kubernetes/system/traefik/values.yaml @@ -11,37 +11,48 @@ ports: # caddy - 10.1.2.152/32 - 10.0.0.0/8 -# Tolerate failover nodes +# Tolerate failover node tolerations: - - key: ENC[AES256_GCM,data:XBzgW0lqiHV/,iv:aA66IUT1Y+UoRG63ELwWkEIZuE2ZDFlpEuC6S/2JER0=,tag:W24D75Nr/rmCRO9RhdRsyA==,type:str] + - key: ENC[AES256_GCM,data:730ZJScF+2rP,iv:n1QgsKA3w6rv1d2tQddG8FkmADp6tI1gj+p7FnD1uA8=,tag:wtlI+476AdFHSp8I68Qs4Q==,type:str] operator: Equal - value: ENC[AES256_GCM,data:s51W72AApTA=,iv:Jn0bbcGgRWcD59uee7jN9pukOeHkaWECjLJ60dLxjWE=,tag:6PTa0Po8vlINl9R3dXu8kw==,type:str] + value: ENC[AES256_GCM,data:uSBDyP1NASA=,iv:wFwuuUWxQKqmb8HMVvbBmMEwuWfxrCVE+soDvM0co6s=,tag:1OZ1KaTKMfMhSZhA1+/zXg==,type:str] effect: NoSchedule - - key: ENC[AES256_GCM,data:fMBfUygMTeoL0uuPduaDcXSh7rlyNYE1O+OntQGRcM2AFpS/2w==,iv:wQT+tKmDUNQq3l/9FEWJoDsEJnVNIfOM2wJzxoz/sqQ=,tag:Tp8ru1ja7MW2bAVMkxzSnA==,type:str] + - key: ENC[AES256_GCM,data:eWiYi/AytLLefqvh2WeoC557WVtWH7c5wYFZYHH0oaIPHd/UyQ==,iv:zreUmSRjGCYywVO1w7+axPmt1E6WON9k63EWhzN6L5c=,tag:zS/rA1dTwp8QMzdi8g8uLg==,type:str] operator: Exists effect: NoSchedule +# Prefer non-failover nodes in normal operation +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + preference: + matchExpressions: + - key: ENC[AES256_GCM,data:1eMq19wPgLa5uYzYlrrN783Ps5U=,iv:WU2PcuCN9YsT3k86TN9347iErqH7s5JiOKlPfiBK2oU=,tag:BWEdA34tVe8FYUjaztPTqw==,type:str] + operator: NotIn + values: + - "true" sops: - lastmodified: "2026-07-25T08:12:52Z" - mac: ENC[AES256_GCM,data:LQhAxwv5QTKL1GvJMSEMd7q1/UwM5XkAg8h2k34er995VYFujVW4/K1sA/6PKHs4sFAeZ+XL4lLVnaCmjjKoUcOQjJpU8n5N+0RfpjV08khOpz+mz9Ze+LQaklMGgPZRUbX6TESzn4EAX78htyGuIHCZGmlet/P1o3rBSd52cxQ=,iv:XPangrjD9BUM0jz3De14yox3ReKvdaNXFzSeGpyHumw=,tag:RrWqIGnUMZF5U6PMcLzZhg==,type:str] + lastmodified: "2026-07-25T08:22:16Z" + mac: ENC[AES256_GCM,data:3L2sGcpCY1DbFib+13cTJ382EB3DgDJyT5nrE6Pz2gJEqDoF867vDYFvl7qxmT0VXaX6a9g/Q0j97EBbq+oiko0t+sYU0dCRRvcnmgbZaY6TA6WhwMzB6STqZW0XhUc6o5mgvIh7YCgCpPl1yFI4Oeffkrd7EQnx66FPxZYtNzg=,iv:PBZSXeYx8ywDR3wsahldquUfUDTNgC+znYdVcV9SDuw=,tag:d48/XYEaIC5I6cZXCRW/kg==,type:str] pgp: - - created_at: "2026-07-25T08:12:52Z" + - created_at: "2026-07-25T08:22:16Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiARAAi7huBzAAuXjAmwizoqYnwVZ9hlvg0B2Sv/Z1P6argnaV - UU/iIis34xUq+N8aa9HazzqlJIJO0xc+zqTh6VtFpKcU/CT23oeJzK/z+FRu48MY - +kc/kJnLuQipQsBXW2S4JVcOdSXnSy3oIzL10mxgVVzmR0pLmmi0eSdM1rnHjhlW - yyJBvrxlxsSv95naffkiOWmSPxPitlTxPHwqiUcqyHAMP9VDIO85tSQfZvrbG+pF - DNG0sSQprRQoOtp0sxAofQPG2TzqkX4NPgV+mtX4itGDjVf+72l4ObH02oXIhW8g - qTrAqhNkaIkhq2KwORUteUTBOG5fEg6R/hQgM0DS3Y6Ipdg2EVvoHg7zeMkECG5w - lACZKAxxMWvjU7J9n8HNMDvwHfmw4/A9GPLIsMXVafwsOj93z8QMYbnPX2ufAyGr - ohz9BBtSGOapqLmmAHONFJYOMP9zAsUuFeoFezSlM2KhbRCRGxNuH2JujAC5FRU/ - 5qcKpAhKu+UaOA7sEH3Hx8AM2KQTSm/1zd+5BUUgAYE6bhnAKMHua1JhyMaUzmNO - OcLPqKyhnOe+Vem3ygEPD6X5pnpDK0Cv9IAlWMMyAdQDXRDcNkMiqLkG7WnbJ7Jt - z1d0f1+MIFn87xBIHMtjQOnfKSzTxzKit5vMco72/R67yS8W8kProTTzIx6kIrXS - XgEAwpUXFtJQg/wl5SIzfRHkHBKVhqmxOF9CiHWRR68+ZdZMDv3vNY0BdirV47pg - qHBdEwODV/tiZ0pkFYkJgspYKRyMpmIf+iavS9pSjEIKR9gAx1CRtG1Xfq5ML3E= - =nKR+ + hQIMA7uy4qQr71wiARAAxFUgi7EmKbvClLsuCBT3H40QeXdnEoTYmpVJHhoUp9ex + vw8K49rg1UueJ7E3jenOhsFw7XiuH3JfCu/CjRW4kMdhBm9G7vGQLdoUub0gvW6Q + OgJLJcpoYaIkTowZLHxyQOVYv23FFHCfoEWHUEidHnDswy6ngtljS9U3aQFq67oR + REbqMcaotkAUg921ZA60BrctJFvm5DKt33LbgrI6NQ7ku4cDHnRsJLxW0X5F0srl + vuHfez7wTk/az7H07aPGlNcBc3MiXmpC9EpRj3ZCgi8RsWm58MFO4ErNAF1DGd1A + flfpDRyoDxichpKGnNs1vrWOI3ceXj5241HsQne7dqBPO2sn0QhY0tN9imjKteab + bn3C3QSh/jePSJYoBE1tIr0b3+7NIUKeEHBZuS250KL3nZGAGHmYRGZubvrLag9u + pnEWZw1yGI2glR/aXFgOk4eHqGfNkBSCQTN/7vErYe1FmUbsaiiJBLpzmNDPrWGy + d77Zv/GVCQ5Tod0sD714IyEj5j2ZH9nBGXW60VY/indmMoFpWlUzvii5x3g8Ig6G + R0cG20g/x/Q2IgEQuisVfZBq28hJ9SDQNequ+XjARWeO4Bg6VbQvYSiPMamEd1U4 + IBBWy+Q/MWMaMXN/igfEptvC89ttqK4ckPjgiN8dQyG97jy+xs0kll7JGvydyK/S + XAGFitVH3lGXSmsDfijXKVP9/dUixM4Z38lxOwlb6cUyyREH6rRjWyqJcM9tTUVo + ArLybrpWYkZ/eVWi2/EXQ7I9nWLoivzrilf80Gh4VPBesuisZdATZUwUY0EG + =L8ob -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$