jakman85andClaude Opus 5 f252ecec25 fix(gitops): prod's source is the in-cluster Service, not a public name ...

The apex flip deadlocked prod's GitOps and this is the durable fix.

The GitRepository pointed at a public hostname. The flip renamed prod's HTTPRoute
hostnames, so that name stopped serving — but the HTTPRoute that would serve the new
name lives in a DOWNSTREAM tier which cannot reconcile while the source is broken.
Source down -> routes never rename -> source stays down. Observed live: srcReady=False,
"unable to list remote for https://gitea.home.keithjackson.dev".

Pointing at gitea.gitea.svc.cluster.local:3000 removes the cycle permanently: prod's
GitOps no longer depends on public DNS, Cloudflare, its own Gateway, or ${BASE_DOMAIN}.
No future domain change can sever prod from its own source.

Plain http is deliberate: cluster-internal traffic to a ClusterIP, TLS terminates at
the Gateway for external clients, the GitRepository has no secretRef (anonymous clone),
and all secrets are SOPS-encrypted at rest regardless of transport.

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-09-12 22:14:27 -05:00

..

kustomization.yaml

fix(gitops): prod's source is the in-cluster Service, not a public name

2026-09-12 22:14:27 -05:00

sync.yaml

fix(flux): close the substitution race — platform dependsOn root + strict substitution (P0/P1)

2026-09-01 01:45:04 -05:00