jakman85andClaude Opus 4.8
cc89b4b830
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
platform/cilium
Cilium — CNI, kube-proxy replacement, Gateway API ingress, Egress Gateway, and Hubble.
- Governing ADR: ADR-0002 — CNI, network policy & ingress: Cilium + Gateway API
- Spec: docs/03 — Networking, docs/09 — DNS & Ingress
- Serves: R-NET-01..07, R-DNS-01, R-SEC-02
- Owner: WS-NET (bootstrap shared with WS-INFRA)
What this stub is
A Flux HelmRelease + HelmRepository stub with placeholder values. No cluster exists (Phase 0);
this does not reconcile. Cilium replaces k3s' bundled flannel + kube-proxy + Traefik
(ADR-0001/0002).
Bootstrap vs. GitOps (important)
Per docs/02, Cilium's initial
install is done by the Ansible k3s bootstrap (Phase 1, WS-INFRA), because a cluster needs a CNI
before Flux can run. This HelmRelease manages Cilium configuration thereafter. The Helm values
here MUST stay consistent with the Ansible bootstrap values (kubeProxyReplacement, k8sServiceHost,
k8sServicePort) — otherwise Flux and the bootstrap fight. Coordinate this contract with WS-INFRA.
TODO (later phases — not Phase 0)
- Phase 1 (WS-INFRA/WS-NET): align Helm values with the Ansible bootstrap; pin chart version.
- Phase 2 (WS-NET): default-deny network baseline; Egress Gateway policies; L2 announcement IP
pool +
CiliumL2AnnouncementPolicyfor the ingress VIP; Hubble metrics → kube-prometheus-stack. - Phase 3 (WS-NET): egress-class routing integration with the VPN gateway (ADR-0013).