jakman85andClaude Opus 4.8
ebe0371b1b
Headlamp's HelmRelease sat in the wait:true `platform` Flux tier. Its pod crashlooped (`flag provided but not defined: -session-ttl` — chart 0.40.1 renders a container arg the appVersion v0.40.1 backend lacks; upstream kubernetes-sigs/headlamp#4883), and because it gated `platform`, the whole chain stalled: platform Ready=Unknown -> platform-config, oauth2-proxy, apps-wave-0/1/2 and apps-vms all Ready=False "dependency not ready". Part A (unblock + durable lesson): a leaf UI must never gate the chain. Move all Headlamp resources into a new non-gating Flux Kustomization clusters/base/headlamp.yaml (dependsOn platform-config, wait:false, SOPS decryption patched per-env in clusters/dev) — mirroring oauth2-proxy exactly. The new Kustomization owns the whole platform/headlamp component; its HTTPRoute moves from platform-config into platform/headlamp/kustomization.yaml. Removed headlamp from platform/kustomization.yaml and its httproute from platform-config/kustomization.yaml. Now a crashlooping Headlamp can never stall platform/platform-config/apps. Part B (make it start): pin the chart to 0.41.0 (`>=0.41.0 <0.42.0`). The backend added `f.Int("session-ttl", …)` in v0.41.0 and chart 0.41.0 pins that same image (appVersion == chart version), so chart+image realign; every arg the chart renders for our values is supported. OIDC config + per-user RBAC (clusterRoleBinding.create:false) unchanged. Gate: `make -C ci gate` PASS. Co-Authored-By: Claude Opus 4.8 <[email protected]>
46 lines
2.5 KiB
YAML
46 lines
2.5 KiB
YAML
---
|
|
# Flux Kustomization: headlamp dashboard — reconciles ./platform/headlamp.
|
|
#
|
|
# POST-PLATFORM TIER (dependsOn platform-config). Headlamp is a LEAF Kubernetes-dashboard UI that
|
|
# depends on Keycloak (native-OIDC login) + the trusted wildcard TLS cert + split-horizon DNS + the
|
|
# Gateway API CRDs — all brought up by `platform` (controllers) and `platform-config` (Keycloak
|
|
# instance/realm CRs, the wildcard Certificate, cilium L2 VIP, Gateway). It therefore MUST NOT live
|
|
# inside the gating `platform` tier: a UI HelmRelease whose image/chart can crashloop (e.g. the
|
|
# upstream headlamp-0.40.1 `-session-ttl` chart/image desync, issue #4883) would keep `platform`
|
|
# not-Ready, and while `platform` is not-Ready NOTHING downstream reconciles — platform-config,
|
|
# oauth2-proxy, every apps-wave and apps-vms all stall on "dependency not ready". That is exactly
|
|
# how a single leaf UI stalled the whole chain (DECISIONS-LOG: "Headlamp gating stall"). This is the
|
|
# same lesson oauth2-proxy already encodes: a leaf that can be legitimately unhealthy must reconcile
|
|
# in its OWN post-platform Kustomization so its health can never gate the graph.
|
|
#
|
|
# NON-GATING (wait:false): nothing in the graph dependsOn headlamp (apps waves gate on
|
|
# platform-config, not on this), and a dashboard pod can be long-not-Ready during a cold start while
|
|
# it waits on Keycloak/DNS/TLS — same rationale as oauth2-proxy and apps-vms. wait:false guarantees
|
|
# its health can NEVER gate anything, even if a future resource is (mistakenly) pointed dependsOn it.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: headlamp
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
retryInterval: 2m
|
|
timeout: 5m
|
|
prune: true
|
|
wait: false
|
|
dependsOn:
|
|
- name: platform-config # Keycloak instance/realm + wildcard TLS + split-horizon VIP + Gateway first
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
path: ./platform/headlamp
|
|
# Same cluster-vars ConfigMap the platform tier fed it before the move (headlamp itself references
|
|
# no ${VARS} today, but the substitution is retained for parity with the other tiers/future knobs).
|
|
postBuild:
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: cluster-vars
|
|
# SOPS decryption for headlamp-oidc-credentials.sops.yaml is layered per-environment by the overlay
|
|
# (clusters/dev patches THIS Kustomization by name), identical to how it was decrypted via the
|
|
# `platform` Kustomization before the move. See clusters/dev/kustomization.yaml.
|