From ae37e27f140a02ebc2ecff77779d9359345384a1 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 12 Sep 2026 22:10:57 -0500 Subject: [PATCH] fix(gitops): move prod's own Git source with the apex flip MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The GitRepository url is a hardcoded literal, not templated on ${BASE_DOMAIN}, so the apex flip did not carry it. But the flip renames prod's HTTPRoute hostnames, so external-dns (policy=sync) deletes gitea.prod.home.keithjackson.dev and CoreDNS's split-horizon zone moves from prod.home. to home. — which would have severed prod from its OWN GitOps source moments after the flip reconciled. Landed in the same push as the flip deliberately: prod has not yet fetched 9161cab (still on b9c0970, all hostnames still prod.home.), so both commits arrive in one fetch and the url changes in the same apply that renames the routes. A live patch would not survive — the root Kustomization renders this very file and reverts it. Co-Authored-By: Claude Opus 5 --- clusters/prod/kustomization.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/clusters/prod/kustomization.yaml b/clusters/prod/kustomization.yaml index 9081d3f..1f22fbd 100644 --- a/clusters/prod/kustomization.yaml +++ b/clusters/prod/kustomization.yaml @@ -203,7 +203,21 @@ patches: # Verified before the switch: a throwaway pod INSIDE prod resolved this host through # in-cluster CoreDNS to the Gateway VIP and cloned over the public LE cert with no CA # supplied. The workstation being able to reach it proves nothing about pod egress. - url: https://gitea.prod.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git + # MOVED WITH THE APEX FLIP (2026-09-13) — and it had to move in the SAME fetch. + # This URL is a hardcoded literal, NOT templated on ${BASE_DOMAIN}, so the flip did not + # carry it. But the flip DOES rename prod's own HTTPRoute hostnames, so: + # - external-dns (policy=sync) deletes gitea.prod.home.keithjackson.dev, and + # - platform/coredns/coredns-custom.yaml answers the whole ${BASE_DOMAIN} zone with + # ${GATEWAY_VIP}, so in-cluster resolution moves from prod.home. to home. + # Leaving this on the old name would therefore have severed prod from its OWN GitOps + # source moments after the flip reconciled — self-reference, the same class of trap as + # patching this url live and having the root Kustomization revert it. The fix has to land + # THROUGH THE OLD SOURCE, which is why it is in the same push as the flip rather than + # after it. + # FOLLOW-UP worth doing: point this at the in-cluster Service + # (gitea-http.gitea.svc.cluster.local) so prod's GitOps stops depending on public DNS and + # on its own Gateway at all. Deferred: it needs the TLS/credential path rethought. + url: https://gitea.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git ref: branch: main - target: