jakman85andClaude Opus 4.8
9d761872ea
Phase-3 VPN config is complete + correct (OpenVPN-UDP, SE Stockholm), but the OpenVPN UDP/1197 handshake to PIA never gets a reply. Traced with tcpdump: packets leave pod→node→host→WiFi (SNAT 192.168.2.103) fine, but 0 replies return to the host, while host UDP/53 works. The 192.168.2.x home router/ISP drops OpenVPN UDP — upstream of everything in this repo. Reverted to disabled to avoid a crashloop firing false KubePodCrashLooping alerts; one-line re-enable once the network is fixed. Full trace in DECISIONS-LOG. Co-Authored-By: Claude Opus 4.8 <[email protected]>
35 lines
2.6 KiB
YAML
35 lines
2.6 KiB
YAML
---
|
|
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
|
|
# (clusters/base/platform.yaml, path: ./platform).
|
|
#
|
|
# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
|
|
# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
|
|
# the same pattern by which kyverno was previously deferred. Credentials each component needs are
|
|
# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
|
|
# component is never gated on a credential ask — only on its phase and readiness.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
# ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
|
|
- kyverno # admission enforcer FIRST — policies present before other components reconcile
|
|
- cilium # CNI (adopts the running Ansible-installed release; parity verified)
|
|
- longhorn # replicated block storage / CSI
|
|
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
|
|
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
|
|
- gateway # Gateway API listeners (ingress; replaces Traefik)
|
|
# ---- Phase 3 — Egress / VPN — config COMPLETE + CORRECT (OpenVPN-UDP, SE Stockholm), but the tunnel
|
|
# is BLOCKED by the ENVIRONMENT: gluetun's OpenVPN UDP/1197 packets to PIA leave the cluster
|
|
# correctly (pod→node→host→WiFi, SNAT 192.168.2.103) but NO replies ever return to the host,
|
|
# while host UDP/53 works — so the home router/ISP on the 192.168.2.x WiFi net drops OpenVPN
|
|
# UDP. Disabled to avoid a crashloop firing false alerts. Re-enable once the network is fixed
|
|
# (see DECISIONS-LOG "Phase 3 VPN — tunnel BLOCKED by home network"). ----
|
|
# - vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
|
|
# ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
|
|
- monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager
|
|
# ---- Later phases: enabled when their phase opens ----
|
|
# - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
|
|
# - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
|
|
# - kubevirt # Phase 5 (IaaS proof): KubeVirt + CDI
|
|
# - keycloak # Phase 6 (Catalog + C2 UI): foundational IdP — needs SOPS `keycloak-admin-credentials`
|
|
# - oauth2-proxy # Phase 6: forward-auth — needs SOPS `oauth2-proxy-credentials`
|