From f252ecec250f9adc3180c7e1273b96a5351cddc1 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 12 Sep 2026 22:14:27 -0500 Subject: [PATCH] fix(gitops): prod's source is the in-cluster Service, not a public name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The apex flip deadlocked prod's GitOps and this is the durable fix. The GitRepository pointed at a public hostname. The flip renamed prod's HTTPRoute hostnames, so that name stopped serving — but the HTTPRoute that would serve the new name lives in a DOWNSTREAM tier which cannot reconcile while the source is broken. Source down -> routes never rename -> source stays down. Observed live: srcReady=False, "unable to list remote for https://gitea.home.keithjackson.dev". Pointing at gitea.gitea.svc.cluster.local:3000 removes the cycle permanently: prod's GitOps no longer depends on public DNS, Cloudflare, its own Gateway, or ${BASE_DOMAIN}. No future domain change can sever prod from its own source. Plain http is deliberate: cluster-internal traffic to a ClusterIP, TLS terminates at the Gateway for external clients, the GitRepository has no secretRef (anonymous clone), and all secrets are SOPS-encrypted at rest regardless of transport. Co-Authored-By: Claude Opus 5 --- clusters/prod/kustomization.yaml | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/clusters/prod/kustomization.yaml b/clusters/prod/kustomization.yaml index 1f22fbd..adced93 100644 --- a/clusters/prod/kustomization.yaml +++ b/clusters/prod/kustomization.yaml @@ -217,7 +217,24 @@ patches: # FOLLOW-UP worth doing: point this at the in-cluster Service # (gitea-http.gitea.svc.cluster.local) so prod's GitOps stops depending on public DNS and # on its own Gateway at all. Deferred: it needs the TLS/credential path rethought. - url: https://gitea.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git + # IN-CLUSTER SERVICE, NOT A PUBLIC HOSTNAME (2026-09-13). This is the durable fix for a + # deadlock the apex flip walked straight into, and it is worth stating precisely. + # + # The url used to be a public name. The flip renamed prod's HTTPRoute hostnames, so the + # name this GitRepository pointed at stopped serving — but the HTTPRoute that WOULD have + # served the new name lives in a DOWNSTREAM tier, which cannot reconcile while the source + # is broken. Source down -> routes never rename -> source stays down. Observed live: + # `srcReady=False`, "unable to list remote for https://gitea.home.keithjackson.dev". + # + # Pointing at the Service breaks the cycle permanently: prod's GitOps no longer depends on + # public DNS, on Cloudflare, on its own Gateway, or on ${BASE_DOMAIN} at all. A future + # domain change cannot sever prod from its own source again. + # + # Plain http is deliberate and safe here: it is cluster-internal traffic to a ClusterIP, + # TLS terminates at the Gateway for external clients only, the GitRepository has no + # secretRef (the repo is cloned anonymously), and every secret in the tree is SOPS-encrypted + # at rest regardless of transport. + url: http://gitea.gitea.svc.cluster.local:3000/Home-Network/home-network-k3s-impl.git ref: branch: main - target: