jakman85andClaude Opus 4.8
aafb4ca378
The in-cluster Gluetun gateway is retired; VPN egress is now a node-level host OpenVPN split-tunnel (Ansible role vpn_egress_gateway) steered by a Cilium Egress Gateway policy with a host nftables kill-switch (ADR-0015). Credentials moved host-side to the Ansible vault. Update docs/comments only: - platform/vpn-egress/README.md: rewrite for ADR-0015 (live + conformance-green); drop the resolved "option 1 not viable with Gluetun" finding to a brief history note. - platform/kustomization.yaml: Phase 3 comment -> node tunnel + Cilium steering. - platform/kyverno/.../require-egress-class-label.yaml: ADR-0013 -> ADR-0015 steering. - schemas/servicedefinition.schema.json: egress=vpn description -> node tunnel + Cilium. - clusters/base/cluster-vars.yaml: reframe PIA_REGION / CLUSTER_POD_CIDR WHY comments to ADR-0015 (Cilium excludedCIDRs); both keys retained (still referenced/documented). - platform/vpn-egress/namespace.yaml: no privileged gateway pod under ADR-0015. - pia-credentials.sops.yaml / pia-custom-ovpn.sops.yaml: comment headers only note they are now UNUSED (creds host-side), retained pending cleanup; payloads untouched. No runtime manifest behavior, alert exprs, kustomization resources, or SOPS payloads changed. No spec-repo edits. Co-Authored-By: Claude Opus 4.8 <[email protected]>
15 lines
692 B
YAML
15 lines
692 B
YAML
---
|
|
# vpn-egress — the VPN egress namespace (ADR-0015, docs/03).
|
|
# Under ADR-0015 there is NO privileged in-cluster gateway pod: the tunnel is a node-level host
|
|
# OpenVPN service (Ansible role vpn_egress_gateway). This namespace now holds only the
|
|
# CiliumEgressGatewayPolicy (egress-steering.yaml) plus the retained, now-unused pia-* secrets.
|
|
# Platform INFRA, not an application namespace, so it is deliberately NOT labeled `app-namespace=true`
|
|
# (Kyverno restrict-host-namespaces / require-*-label policies scope to app namespaces only — see
|
|
# platform/kyverno).
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: vpn-egress
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: "false"
|