Sienna Meridian Satterwhite
cdddc334ff
Ingress: - Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder - HTTPS termination with mkcert (local) / rustls-acme (production) - Host-prefix routing with path-based sub-routing for auth virtual host: /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui - HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub - cert-manager HTTP-01 ACME challenge routing via Ingress watcher - RBAC for Ingress watcher (pingora-watcher ClusterRole) - local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict Infrastructure: - socket_vmnet shared network for host↔VM reachability (192.168.105.2) - local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution - Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods - Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25 - Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
45 lines
1.3 KiB
YAML
45 lines
1.3 KiB
YAML
---
|
|
# ServiceAccount used by the Pingora pod.
|
|
# The watcher in sunbeam-proxy uses in-cluster credentials (this SA's token) to
|
|
# watch the pingora-tls Secret and pingora-config ConfigMap for changes.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: pingora
|
|
namespace: ingress
|
|
---
|
|
# Minimal read-only role: list+watch on the two objects that drive cert reloads.
|
|
# Scoped to the ingress namespace by the Role kind (not ClusterRole).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: pingora-watcher
|
|
namespace: ingress
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Ingresses are watched to route cert-manager HTTP-01 challenges to the
|
|
# correct per-domain solver pod (one Ingress per challenge, created by
|
|
# cert-manager with the exact token path and solver Service name).
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: pingora-watcher
|
|
namespace: ingress
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: pingora
|
|
namespace: ingress
|
|
roleRef:
|
|
kind: Role
|
|
name: pingora-watcher
|
|
apiGroup: rbac.authorization.k8s.io
|