Retire gluetun gateway Deployment (ADR-0015: node tunnel validated + conformance-green)

Prepared on a feature branch for operator review — NOT merged/pushed (retiring the running fallback needs explicit approval). The node-level host OpenVPN tunnel steered by Cilium Egress Gateway is validated end-to-end and gated by green conformance (egress-class + vpn-killswitch). A Gluetun pod's tun0 was never steerable by Cilium egress gateway (the reason ADR-0015 moved the tunnel to the node), so gluetun serves no steering role. The now-unused pia-* SOPS secrets are retained pending a separate cleanup (creds are host-side in the Ansible vault). Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-24 14:21:59 -05:00
1 parent 0753b2ac96
commit 7b7982e28d
@@ -3,7 +3,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
-  - gluetun-gateway.yaml
+  # gluetun-gateway.yaml RETIRED 2026-08-24 (ADR-0015): the node-level host tunnel is validated +
+  # conformance-green (egress-class + vpn-killswitch pass live); a Gluetun *pod* can't be a Cilium
+  # egress-gateway target anyway. Steering now flows through the node tun0 via egress-steering.yaml.
+  # NOTE: pia-credentials/pia-custom-ovpn secrets below are now UNUSED (creds are host-side in the
+  # Ansible vault per docs/07) — retained temporarily, pending a follow-up cleanup change.
  - pia-credentials.sops.yaml
-  - pia-custom-ovpn.sops.yaml   # operator-provisioned: the PIA .ovpn (custom-provider mode). See README.
-  - egress-steering.yaml        # ADR-0015: steer egress-class=vpn pods to the node tun0 (host tunnel validated 2026-08-24)
+  - pia-custom-ovpn.sops.yaml   # (was gluetun's PIA .ovpn; superseded host-side — see note above)
+  - egress-steering.yaml        # ADR-0015: steer egress-class=vpn pods to the node tun0 (validated 2026-08-24)