jakman85andClaude Opus 4.8
1749603f87
Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
43 lines
2.0 KiB
YAML
43 lines
2.0 KiB
YAML
---
|
|
# Flux Kustomization: Homepage landing dashboard — reconciles ./platform/homepage.
|
|
#
|
|
# POST-PLATFORM TIER (dependsOn platform-config). Homepage is a LEAF landing UI at the apex
|
|
# home.keithjackson.dev. It depends on the trusted wildcard TLS cert + the shared Gateway (incl. the
|
|
# `https-apex` listener) + split-horizon DNS — all brought up by `platform` (controllers) and
|
|
# `platform-config` (the wildcard Certificate, cilium L2 VIP, Gateway). It therefore MUST NOT live in
|
|
# the gating `platform` tier: a UI whose pod can be unhealthy would keep `platform` not-Ready, and
|
|
# while `platform` is not-Ready NOTHING downstream reconciles — the exact incident behind the
|
|
# headlamp/oauth2-proxy moves (DECISIONS-LOG: "Headlamp gating stall"). Same lesson, same fix: a leaf
|
|
# that can be legitimately unhealthy reconciles in its OWN post-platform Kustomization.
|
|
#
|
|
# NON-GATING (wait:false): nothing in the graph dependsOn homepage (apps waves gate on
|
|
# platform-config, not on this), and a dashboard pod can be long-not-Ready during a cold start.
|
|
# wait:false guarantees its health can NEVER gate anything, even if a future resource is (mistakenly)
|
|
# pointed dependsOn it.
|
|
#
|
|
# NO SOPS decryption stanza: this component carries no encrypted Secret (plain manifests + a config
|
|
# ConfigMap with no API keys), so — unlike headlamp/oauth2-proxy — clusters/dev does NOT patch it.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: homepage
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
retryInterval: 2m
|
|
timeout: 5m
|
|
prune: true
|
|
wait: false
|
|
dependsOn:
|
|
- name: platform-config # wildcard TLS + Gateway (incl. https-apex listener) + split-horizon VIP first
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
path: ./platform/homepage
|
|
# Homepage references no ${VARS} today; the substitution is retained for parity with the other
|
|
# tiers / future overlay knobs.
|
|
postBuild:
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: cluster-vars
|