Sienna Meridian Satterwhite
cdddc334ff
Ingress: - Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder - HTTPS termination with mkcert (local) / rustls-acme (production) - Host-prefix routing with path-based sub-routing for auth virtual host: /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui - HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub - cert-manager HTTP-01 ACME challenge routing via Ingress watcher - RBAC for Ingress watcher (pingora-watcher ClusterRole) - local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict Infrastructure: - socket_vmnet shared network for host↔VM reachability (192.168.105.2) - local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution - Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods - Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25 - Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
58 lines
1.6 KiB
YAML
58 lines
1.6 KiB
YAML
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: pingora
|
||
namespace: ingress
|
||
spec:
|
||
replicas: 1
|
||
# Recreate avoids rolling-update conflicts (single-node; hostPorts in local overlay)
|
||
strategy:
|
||
type: Recreate
|
||
selector:
|
||
matchLabels:
|
||
app: pingora
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: pingora
|
||
annotations:
|
||
# Pingora terminates TLS at the mesh boundary; sidecar injection is disabled here
|
||
linkerd.io/inject: disabled
|
||
spec:
|
||
serviceAccountName: pingora
|
||
containers:
|
||
- name: pingora
|
||
image: sunbeam-proxy:latest # overridden per overlay via kustomize images:
|
||
ports:
|
||
- name: http
|
||
containerPort: 80
|
||
protocol: TCP
|
||
- name: https
|
||
containerPort: 443
|
||
protocol: TCP
|
||
- name: turn-udp
|
||
containerPort: 3478
|
||
protocol: UDP
|
||
# TURN relay range 49152–49252 exposed via hostPort in local overlay
|
||
volumeMounts:
|
||
- name: config
|
||
mountPath: /etc/pingora
|
||
readOnly: true
|
||
# /etc/tls is an emptyDir written by the proxy via the K8s API on
|
||
# startup and on cert renewal, so Pingora always reads a fresh cert
|
||
# without depending on kubelet volume-sync timing.
|
||
- name: tls
|
||
mountPath: /etc/tls
|
||
resources:
|
||
limits:
|
||
memory: 256Mi
|
||
requests:
|
||
memory: 128Mi
|
||
cpu: 100m
|
||
volumes:
|
||
- name: config
|
||
configMap:
|
||
name: pingora-config
|
||
- name: tls
|
||
emptyDir: {}
|