jakman85andClaude Opus 4.8
7b7982e28d
Prepared on a feature branch for operator review — NOT merged/pushed (retiring the running fallback needs explicit approval). The node-level host OpenVPN tunnel steered by Cilium Egress Gateway is validated end-to-end and gated by green conformance (egress-class + vpn-killswitch). A Gluetun pod's tun0 was never steerable by Cilium egress gateway (the reason ADR-0015 moved the tunnel to the node), so gluetun serves no steering role. The now-unused pia-* SOPS secrets are retained pending a separate cleanup (creds are host-side in the Ansible vault). Co-Authored-By: Claude Opus 4.8 <[email protected]>
14 lines
831 B
YAML
14 lines
831 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
# gluetun-gateway.yaml RETIRED 2026-08-24 (ADR-0015): the node-level host tunnel is validated +
|
|
# conformance-green (egress-class + vpn-killswitch pass live); a Gluetun *pod* can't be a Cilium
|
|
# egress-gateway target anyway. Steering now flows through the node tun0 via egress-steering.yaml.
|
|
# NOTE: pia-credentials/pia-custom-ovpn secrets below are now UNUSED (creds are host-side in the
|
|
# Ansible vault per docs/07) — retained temporarily, pending a follow-up cleanup change.
|
|
- pia-credentials.sops.yaml
|
|
- pia-custom-ovpn.sops.yaml # (was gluetun's PIA .ovpn; superseded host-side — see note above)
|
|
- egress-steering.yaml # ADR-0015: steer egress-class=vpn pods to the node tun0 (validated 2026-08-24)
|