jakman85andClaude Opus 4.8
ebe0371b1b
Headlamp's HelmRelease sat in the wait:true `platform` Flux tier. Its pod crashlooped (`flag provided but not defined: -session-ttl` — chart 0.40.1 renders a container arg the appVersion v0.40.1 backend lacks; upstream kubernetes-sigs/headlamp#4883), and because it gated `platform`, the whole chain stalled: platform Ready=Unknown -> platform-config, oauth2-proxy, apps-wave-0/1/2 and apps-vms all Ready=False "dependency not ready". Part A (unblock + durable lesson): a leaf UI must never gate the chain. Move all Headlamp resources into a new non-gating Flux Kustomization clusters/base/headlamp.yaml (dependsOn platform-config, wait:false, SOPS decryption patched per-env in clusters/dev) — mirroring oauth2-proxy exactly. The new Kustomization owns the whole platform/headlamp component; its HTTPRoute moves from platform-config into platform/headlamp/kustomization.yaml. Removed headlamp from platform/kustomization.yaml and its httproute from platform-config/kustomization.yaml. Now a crashlooping Headlamp can never stall platform/platform-config/apps. Part B (make it start): pin the chart to 0.41.0 (`>=0.41.0 <0.42.0`). The backend added `f.Int("session-ttl", …)` in v0.41.0 and chart 0.41.0 pins that same image (appVersion == chart version), so chart+image realign; every arg the chart renders for our values is supported. OIDC config + per-user RBAC (clusterRoleBinding.create:false) unchanged. Gate: `make -C ci gate` PASS. Co-Authored-By: Claude Opus 4.8 <[email protected]>
25 lines
1.5 KiB
YAML
25 lines
1.5 KiB
YAML
---
|
|
# Headlamp — Kubernetes dashboard with Keycloak native-OIDC login + per-user RBAC (ADR-0014).
|
|
# Rendered by its OWN post-platform Flux Kustomization (clusters/base/headlamp.yaml, dependsOn
|
|
# platform-config, wait:false) — NOT by the gating `platform` tier, where a crashlooping UI
|
|
# HelmRelease stalled the whole chain (DECISIONS-LOG "Headlamp gating stall"). This component owns
|
|
# the HelmRepository + HelmRelease (chart installs the Deployment/Service/SA), the SOPS-encrypted
|
|
# OIDC credential (decrypted per-env by the headlamp Kustomization), the default-deny + Cilium
|
|
# policies, AND the HTTPRoute. The httproute (a Gateway API CR) now travels WITH the component here
|
|
# rather than being referenced in-place from platform-config: the CRDs it needs
|
|
# (gateway.networking.k8s.io) are registered by platform, and platform is Ready before this tier's
|
|
# platform-config dependency completes, so ordering holds — same move oauth2-proxy already made.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: headlamp
|
|
resources:
|
|
- namespace.yaml
|
|
- helmrepository.yaml
|
|
- helmrelease.yaml
|
|
# OIDC client credential (envFrom'd by the chart via config.oidc.externalSecret) — SOPS-encrypted,
|
|
# referenced by name (R-IDP-04). The matching value is mirrored in keycloak-realm-clients.
|
|
- headlamp-oidc-credentials.sops.yaml
|
|
# default-deny baseline + Cilium ingress(gateway)/egress(apiserver+Keycloak) allows.
|
|
- networkpolicy.yaml
|
|
- httproute.yaml # dashboard ingress (was referenced in-place by platform-config)
|