From d617983e834048d7a50362914dae41cab252a1eb Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 12 Sep 2026 22:46:14 -0500 Subject: [PATCH] =?UTF-8?q?feat(gitea):=20render=20gitea-allow-flux-ingres?= =?UTF-8?q?s=20=E2=80=94=20prod's=20GitOps=20source,=20in=20git=20at=20las?= =?UTF-8?q?t?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CNP that lets flux-system's source-controller clone from the in-cluster Gitea Service was APPLIED LIVE on prod on 2026-09-13 and existed nowhere in this repo. It carried a provenance annotation saying so. Until now it could not be authored: the gitea CNPs are GENERATED from the catalog entry, and the contract had no field for "also admit this in-cluster client" (fixed in the previous commit). Why it matters more than a missing allow normally would. prod's GitRepository points at the Service, not a public name (clusters/prod/kustomization.yaml: `url: http://gitea.gitea.svc.cluster.local:3000/Home-Network/home-network-k3s-impl.git`), deliberately, so prod's GitOps depends on neither public DNS, Cloudflare, prod's own Gateway nor ${BASE_DOMAIN}. But gitea-allow-gateway-ingress admits only `fromEntities: [ingress]`, so source-controller's clone was dropped — and the HTTPRoute that would have served the post-apex-flip public name instead lives in a DOWNSTREAM tier that cannot apply while the source is down. Source down -> routes never rename -> source stays down. Every `kubectl delete cnp` and every cluster rebuild re-armed that deadlock, and it would have been extremely hard to diagnose cold. The rendered object is EQUIVALENT to the live one — same apiVersion/kind, same name/namespace/labels, and a byte-identical spec (endpointSelector app.kubernetes.io/name=gitea; fromEndpoints matchLabels k8s:io.kubernetes.pod.namespace=flux-system; toPorts 3000/TCP), verified against `kubectl --context k3s-prod -n gitea get cnp gitea-allow-flux-ingress -o json`. The name matches, so Flux ADOPTS the live object in place: no spec change, so no policy recompute and no flap on prod's own source. The only difference is that the rendered object carries no `homelab.keithjackson.dev/provenance` annotation — the reasoning now lives where the object is authored, in catalog/gitea.yaml, next to the field that generates it. Golden re-rendered with the canonical command; the whole apps/ diff is the one new document. Co-Authored-By: Claude Opus 5 --- apps/wave-0/gitea.yaml | 21 +++++++++++++++++++++ catalog/gitea.yaml | 28 ++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/apps/wave-0/gitea.yaml b/apps/wave-0/gitea.yaml index dac5a59..d79b97b 100644 --- a/apps/wave-0/gitea.yaml +++ b/apps/wave-0/gitea.yaml @@ -170,6 +170,27 @@ spec: - port: '3000' protocol: TCP --- +# CiliumNetworkPolicy in-cluster client ingress allow (R-NET-02): gitea-allow-flux-ingress +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: gitea-allow-flux-ingress + namespace: gitea + labels: + app.kubernetes.io/name: gitea +spec: + endpointSelector: + matchLabels: + app.kubernetes.io/name: gitea + ingress: + - fromEndpoints: + - matchLabels: + k8s:io.kubernetes.pod.namespace: flux-system + toPorts: + - ports: + - port: '3000' + protocol: TCP +--- # CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): gitea-allow-internet-egress apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy diff --git a/catalog/gitea.yaml b/catalog/gitea.yaml index 36d76ae..9729275 100644 --- a/catalog/gitea.yaml +++ b/catalog/gitea.yaml @@ -180,6 +180,34 @@ dependencies: [] # default-deny: reaches only DNS; git clients re ingressRoutes: - host: gitea.${BASE_DOMAIN} port: 3000 # Gitea HTTP web/API; TLS terminates at the shared Gateway (docs/08, docs/09) +# THIS IS WHAT KEEPS PROD'S GITOPS OUT OF A DEADLOCK — it is not an incidental allowance. Remove it +# and prod cannot reconcile AT ALL, in a way that is very hard to diagnose from cold. +# +# Prod's Flux source is THIS SERVICE, not a public hostname: +# clusters/prod/kustomization.yaml -> GitRepository.spec.url = +# http://gitea.gitea.svc.cluster.local:3000/Home-Network/home-network-k3s-impl.git +# chosen deliberately so prod's GitOps depends on NEITHER public DNS, Cloudflare, prod's own +# Gateway, NOR ${BASE_DOMAIN} — a future domain change cannot sever prod from its own source. That +# file documents the other half of this pair at length; the two must be read together. +# +# The only other ingress this entry renders is gitea-allow-gateway-ingress, which admits +# `fromEntities: [ingress]` — the shared Gateway's Envoy proxy — and nothing else. Flux's +# source-controller dials the ClusterIP DIRECTLY, so under the namespace default-deny (R-NET-01) its +# clone was DROPPED (`wget` from source-controller timed out; srcReady=False, "unable to list +# remote"). The deadlock that made this urgent: the HTTPRoute that would have served the new public +# name after the 2026-09-13 apex flip lives in a DOWNSTREAM tier, which cannot apply while the +# source is down — source down -> routes never rename -> source stays down. It was broken on +# 2026-09-13 with a live `kubectl apply` of a hand-written gitea-allow-flux-ingress, i.e. with a +# cluster object that existed OUTSIDE git. This declaration renders that object, so one +# `kubectl delete` or one cluster rebuild can no longer put prod back in the deadlock. +inClusterClients: + # `name` is pinned to `flux` (rather than defaulting to the namespace) so the rendered policy name + # equals the live object's, `gitea-allow-flux-ingress`, and Flux ADOPTS it in place: no + # near-duplicate policy beside it, and no window in which prod's own source has no allow. + - name: flux + namespace: flux-system # matched by NAMESPACE alone — the flux controllers' pod labels belong + # to upstream's manifests, not to this platform's contract + port: 3000 # ONLY the Gitea HTTP port — the same single port the Gateway allow opens auth: mode: oidc # native Keycloak OIDC client (docs/13 SSO row, docs/15 "Native OIDC" set; R-IDP-02) groups: