From cbcfae01e1231cc221c228291c023b9fa8171b5a Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Fri, 21 Aug 2026 23:06:27 -0500 Subject: [PATCH] feat(phase3): enable vpn-egress (deploy the Gluetun PIA/WireGuard gateway) PIA creds provisioned (SOPS) + wired. Enable vpn-egress in platform/kustomization.yaml to deploy the shared Gluetun gateway (PIA over WireGuard, Sweden region, kill-switch). Egress-class steering (vpn-class pods -> tunnel) still to be validated against the live tunnel next. Gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) --- platform/kustomization.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index 5ff0078..53f171a 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -17,6 +17,8 @@ resources: - cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token` - externaldns # auto DNS records — needs SOPS `cloudflare-api-token` - gateway # Gateway API listeners (ingress; replaces Traefik) + # ---- Phase 3 — Egress / VPN (PIA creds provisioned via SOPS) ---- + - vpn-egress # shared Gluetun PIA/WireGuard egress gateway + kill-switch (ADR-0013) # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ---- - monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager # ---- Later phases: enabled when their phase opens ----