jakman85andClaude Opus 4.8
1749603f87
Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
19 lines
966 B
YAML
19 lines
966 B
YAML
---
|
|
# Homepage — the apex landing dashboard (home.keithjackson.dev). Rendered by its OWN non-gating
|
|
# post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config,
|
|
# wait:false) — NOT by the gating `platform` tier, where a leaf UI's unhealth stalled the whole chain
|
|
# (DECISIONS-LOG "Headlamp gating stall"). Plain manifests (no HelmRelease): a single Deployment +
|
|
# a hand-authored config ConfigMap. The HTTPRoute travels WITH the component (the gateway.networking
|
|
# CRDs are registered by platform, Ready before this tier's platform-config dependency completes).
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: homepage
|
|
resources:
|
|
- namespace.yaml
|
|
- configmap.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
# default-deny baseline + Cilium gateway-ingress allow (DNS-only egress from the baseline).
|
|
- networkpolicy.yaml
|
|
- httproute.yaml # apex ingress (binds the Gateway `https-apex` listener)
|