home-network-k3s-impl

310 Commits 139 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 4.8	d32b5c4ec0	fix(renderer): Recreate strategy for Deployments mounting RWO PVCs Any single-replica app with a `storage:` entry mounts a ReadWriteOnce Longhorn PVC. The default RollingUpdate strategy starts the new pod before terminating the old one, but the old pod still holds the RWO volume -> the new pod hangs in ContainerCreating and the rollout deadlocks (observed on gitea's update). Emit spec.strategy.type=Recreate whenever storage is present so the old pod releases the PVC first. Non-storage apps (and VMs) keep the default (no strategy emitted). Re-rendered apps: gitea, pihole, sonarr, radarr, plex, qbittorrent, jackett now carry strategy: Recreate. Updated the egress-class L1 render goldens (storage fixture) accordingly; all L1 render checks pass. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-25 18:14:45 -05:00
jakman85	7e8ae472c9	fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01 baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex image tags (bad pins -> :latest; Renovate/update policy pins later).	2026-08-25 09:02:05 -05:00
jakman85andClaude Opus 4.8	0f12950831	Onboard arr apps (Sonarr + Radarr) via ServiceDefinition renderer Add catalog/sonarr.yaml and catalog/radarr.yaml ServiceDefinitions and their rendered apps/*.yaml manifests, wired into apps/kustomization.yaml. - exposure: internal, egress: vpn (R-NET-05/06 VPN + kill-switch, ADR-0015) - auth: forward-auth, groups: media-users (R-IDP-02/06) - dependencies -> qbittorrent:8080, jackett:9117 as explicit east-west CiliumNetworkPolicy egress allows on top of default-deny (R-NET-01/02) - config on longhorn (R-STATE-02); bulk media/downloads volume DEFERRED pending OQ-2 (bulk StorageClass is a non-provisioning stub) - observability up-SLI alert (R-OBS-01), daily-offcluster backup (R-STATE-03) Rendered with catalog/render.py --no-image-automation. Offline gates green: schema validate, kubectl kustomize apps, render.py --selftest, make -C ci gate. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-25 08:32:39 -05:00

Author

SHA1

Message

Date

jakman85andClaude Opus 4.8

d32b5c4ec0

fix(renderer): Recreate strategy for Deployments mounting RWO PVCs

Any single-replica app with a `storage:` entry mounts a ReadWriteOnce Longhorn
PVC. The default RollingUpdate strategy starts the new pod before terminating the
old one, but the old pod still holds the RWO volume -> the new pod hangs in
ContainerCreating and the rollout deadlocks (observed on gitea's update). Emit
spec.strategy.type=Recreate whenever storage is present so the old pod releases
the PVC first. Non-storage apps (and VMs) keep the default (no strategy emitted).

Re-rendered apps: gitea, pihole, sonarr, radarr, plex, qbittorrent, jackett now
carry strategy: Recreate. Updated the egress-class L1 render goldens (storage
fixture) accordingly; all L1 render checks pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-25 18:14:45 -05:00

jakman85

7e8ae472c9

fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags

Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for
R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south
egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders
broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with
toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the
PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01
baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex
image tags (bad pins -> :latest; Renovate/update policy pins later).

2026-08-25 09:02:05 -05:00

jakman85andClaude Opus 4.8

0f12950831

Onboard arr apps (Sonarr + Radarr) via ServiceDefinition renderer

Add catalog/sonarr.yaml and catalog/radarr.yaml ServiceDefinitions and their
rendered apps/*.yaml manifests, wired into apps/kustomization.yaml.

- exposure: internal, egress: vpn (R-NET-05/06 VPN + kill-switch, ADR-0015)
- auth: forward-auth, groups: media-users (R-IDP-02/06)
- dependencies -> qbittorrent:8080, jackett:9117 as explicit east-west
  CiliumNetworkPolicy egress allows on top of default-deny (R-NET-01/02)
- config on longhorn (R-STATE-02); bulk media/downloads volume DEFERRED
  pending OQ-2 (bulk StorageClass is a non-provisioning stub)
- observability up-SLI alert (R-OBS-01), daily-offcluster backup (R-STATE-03)

Rendered with catalog/render.py --no-image-automation. Offline gates green:
schema validate, kubectl kustomize apps, render.py --selftest, make -C ci gate.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-25 08:32:39 -05:00