jakman85andClaude Opus 4.8
1749603f87
Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
17 lines
944 B
YAML
17 lines
944 B
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: homepage
|
|
labels:
|
|
# Expose Homepage at the APEX home.keithjackson.dev via the shared Gateway (docs/09). The apex is
|
|
# a SAN on the *.home.keithjackson.dev wildcard cert, and the Gateway carries a dedicated
|
|
# `https-apex` listener for it (platform/gateway/gateway.yaml). This label opts the namespace in
|
|
# to attach HTTPRoutes to the shared Gateway (httproute.yaml).
|
|
gateway-access: "shared"
|
|
# NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true. Homepage is a PLATFORM
|
|
# landing UI (like Grafana in `monitoring` / Headlamp in `headlamp`), so Kyverno does not generate
|
|
# the app default-deny baseline here and the app-scoped auth-mode / egress-class policies do not
|
|
# apply. We still ship an explicit default-deny NetworkPolicy + a CiliumNetworkPolicy
|
|
# (networkpolicy.yaml) as defense-in-depth: Gateway-only ingress, DNS-only egress.
|