jakman85andClaude Opus 4.8
960cab937b
oauth2-proxy is a leaf forward-auth service that depends on Keycloak + trusted wildcard TLS + split-horizon DNS. It lived in the gating `platform` Flux Kustomization (wait:true), so on a cold start it Failed until those dependencies existed, keeping the whole `platform` tier not-Ready. That in turn blocked `platform-config` — which brings up the very Keycloak instance, wildcard Certificate and L2 VIP oauth2-proxy needs (and previously carried oauth2-proxy's own httproute/servicemonitor) — from ever reconciling. A self-gating cold-start deadlock, twice-proven (DECISIONS-LOG sessions 7 & 9). Break the cycle by moving the whole oauth2-proxy component out of the `platform` tier into its own non-gating post-platform Flux Kustomization: - clusters/base/oauth2-proxy.yaml: new Kustomization -> ./platform/oauth2-proxy, dependsOn platform-config, wait:false, substituteFrom cluster-vars. - clusters/base/kustomization.yaml: reference the new Kustomization. - platform/kustomization.yaml: drop the oauth2-proxy component (no longer in the gating tier). - platform/oauth2-proxy/kustomization.yaml: pull in httproute + servicemonitor so the full component travels together. - platform-config/kustomization.yaml: drop the in-place oauth2-proxy httproute/servicemonitor refs (moved with the controller). - clusters/dev/kustomization.yaml: add the SOPS decryption patch for the new oauth2-proxy Kustomization (it now owns the encrypted credentials Secret that the `platform` Kustomization used to decrypt). Now `platform` reaches Ready without oauth2-proxy; platform-config brings up Keycloak/TLS/DNS; then oauth2-proxy reconciles against dependencies that already exist. wait:false guarantees its health can never gate anything above it. No config of oauth2-proxy itself changed — only its reconciliation tier. Co-Authored-By: Claude Opus 4.8 <[email protected]>
17 lines
937 B
YAML
17 lines
937 B
YAML
---
|
|
# oauth2-proxy component. Rendered by its OWN post-platform Flux Kustomization
|
|
# (clusters/base/oauth2-proxy.yaml, dependsOn platform-config, wait:false) — NOT by the gating
|
|
# `platform` tier. The httproute + servicemonitor (Gateway API / monitoring CRs) travel WITH the
|
|
# controller here now, rather than being referenced in-place from platform-config: the CRDs they
|
|
# need (gateway.networking.k8s.io, monitoring.coreos.com) are registered by platform and platform
|
|
# is Ready before this tier's platform-config dependency completes, so ordering holds.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- helmrepository.yaml
|
|
- helmrelease.yaml
|
|
- oauth2-proxy-credentials.sops.yaml
|
|
- httproute.yaml # forward-auth sign-in/callback ingress (was referenced in-place by platform-config)
|
|
- servicemonitor.yaml # Prometheus scrape (was referenced in-place by platform-config)
|