jakman85andClaude Opus 4.8
0437871807
Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8) as a platform component: a web panel that runs Java + Bedrock Minecraft servers as subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath). Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5 cannot do ext_authz on the shared Gateway: - oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins. - Confidential `crafty` client provisioned live via kcadm + captured in the realm import; client secret + cookie secret via SOPS/age (mirrored in realm-clients). - Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180. - Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54), starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated. - fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on the root:root Longhorn PVC (the seerr fsGroup lesson). - Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config, wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate the platform. - Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace, not app-namespace, so Kyverno does not auto-generate the baseline). make -C ci gate green; kustomize build of platform/crafty, clusters/base, clusters/dev clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
43 lines
2.1 KiB
YAML
43 lines
2.1 KiB
YAML
---
|
|
# Flux Kustomization: Crafty Controller — reconciles ./platform/crafty.
|
|
#
|
|
# POST-PLATFORM TIER (dependsOn platform-config). Crafty is a LEAF Minecraft-management UI that depends
|
|
# on Keycloak (the oauth2-proxy sidecar authenticates against it) + the trusted wildcard TLS cert +
|
|
# split-horizon DNS + the Gateway API CRDs + the Cilium L2 LoadBalancer pool (game-port VIP) — all
|
|
# brought up by `platform` (controllers) and `platform-config` (Keycloak realm/CRs, the wildcard
|
|
# Certificate, cilium L2 pool + announcement, Gateway). It therefore MUST NOT live inside the gating
|
|
# `platform` tier: a UI whose pod can crashloop (image pull, DB init, sidecar OIDC discovery during a
|
|
# cold start) would keep `platform` not-Ready, and while `platform` is not-Ready NOTHING downstream
|
|
# reconciles — the exact incident behind the headlamp/oauth2-proxy/homepage moves (DECISIONS-LOG:
|
|
# "Headlamp gating stall"). Same lesson, same fix: a leaf reconciles in its OWN post-platform tier.
|
|
#
|
|
# NON-GATING (wait:false): nothing in the graph dependsOn crafty, and its pod can be long-not-Ready
|
|
# during a cold start (Longhorn attach + Crafty DB init) while it waits on Keycloak/DNS/TLS.
|
|
# wait:false guarantees its health can NEVER gate anything, even if a future resource is (mistakenly)
|
|
# pointed dependsOn it.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: crafty
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
retryInterval: 2m
|
|
timeout: 5m
|
|
prune: true
|
|
wait: false
|
|
dependsOn:
|
|
- name: platform-config # Keycloak realm + wildcard TLS + split-horizon VIP + Gateway + L2 pool first
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
path: ./platform/crafty
|
|
# cluster-vars retained for parity with the other tiers / future overlay knobs (crafty references no
|
|
# ${VARS} today).
|
|
postBuild:
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: cluster-vars
|
|
# SOPS decryption for crafty-oauth2-proxy-credentials.sops.yaml is layered per-environment by the
|
|
# overlay (clusters/dev patches THIS Kustomization by name), identical to headlamp/oauth2-proxy.
|