jakman85andClaude Opus 5.5
09f219fe7f
servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo Service, and no-plaintext-secrets requires a template's secret value to be a bare placeholder. Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
1.9 KiB
YAML
36 lines
1.9 KiB
YAML
---
|
|
# Cloudflare Tunnel connector. Reconciled by its OWN non-gating Flux Kustomization
|
|
# (clusters/base/cloudflared.yaml: dependsOn platform-config, wait:false) — NOT a line in
|
|
# platform/kustomization.yaml. See that file for why; in one line: this Deployment cannot become
|
|
# Ready until the operator enrols the tunnel, and in a gating tier that would stall every app wave.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# REQUIRED for the configMapGenerator: a generated ConfigMap inherits no namespace, and kustomize
|
|
# will not rewrite the Deployment's reference to its hashed name across a namespace boundary
|
|
# (measured on platform/vpn-ingress).
|
|
namespace: cloudflared
|
|
resources:
|
|
- namespace.yaml
|
|
- deployment.yaml # Deployment (2 replicas, hard node spread) + PodDisruptionBudget
|
|
# Namespace default-deny + the Prometheus scrape allow + the egress CiliumNetworkPolicy. Keep
|
|
# them in ONE file: a baseline without its scrape allow silently empties the TSDB.
|
|
- networkpolicy.yaml
|
|
- servicemonitor.yaml # headless metrics Service + ServiceMonitor (:2000)
|
|
- alerts.yaml
|
|
# The tunnel credentials JSON — the ONE secret here. SOPS-encrypted, decrypted per-env by the
|
|
# `cloudflared` Flux Kustomization (both overlays patch it), referenced by name only. Its
|
|
# plaintext template sibling is deliberately NOT named in this file (no-plaintext-secrets).
|
|
# Ships with REPLACE-ME placeholders; runbooks/cloudflare-tunnel.md fills it.
|
|
- cloudflared-credentials.sops.yaml
|
|
|
|
# config.yaml becomes the CONTENT-HASHED ConfigMap `cloudflared-config`, so an edit to the ingress
|
|
# rules or the tunnel UUID changes the pod template and rolls the Deployment. Do NOT set
|
|
# disableNameSuffixHash: the hash is the rollout mechanism.
|
|
configMapGenerator:
|
|
- name: cloudflared-config
|
|
files:
|
|
- config.yaml
|
|
options:
|
|
labels:
|
|
app.kubernetes.io/name: cloudflared
|