jakman85andClaude Opus 4.8
3a1e0e6887
In-cluster clients resolving a platform hostname over its PUBLIC name got the
off-cluster answer, so pod->keycloak.home.keithjackson.dev hit a path that does not
serve the *.home.keithjackson.dev SNI -> `tls: unrecognized name` (oauth2-proxy OIDC
discovery crash; Grafana generic_oauth would hit the same wall).
Add a GitOps-managed coredns-custom ConfigMap (kube-system) that k3s CoreDNS imports as
a `*.server` block. The template plugin answers the whole home.keithjackson.dev zone with
${GATEWAY_VIP} (the shared Gateway VIP), so pod->public-hostname traffic hairpins through
the Gateway with the correct SNI -> wildcard cert validates. CoreDNS reloads the ConfigMap
live (no pod restart). Wired into platform/kustomization.yaml (Phase 2 network core).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
10 lines
433 B
YAML
10 lines
433 B
YAML
---
|
|
# platform/coredns — in-cluster split-horizon DNS (R-DNS-01 / R-DNS-03).
|
|
# A single `coredns-custom` ConfigMap in kube-system that k3s CoreDNS imports as an extra server
|
|
# block (see coredns-custom.yaml). Rendered by the `platform` Flux Kustomization, which supplies
|
|
# ${GATEWAY_VIP} via substituteFrom cluster-vars (R-ENV-02).
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- coredns-custom.yaml
|