Sienna Meridian Satterwhite
cdddc334ff
Ingress: - Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder - HTTPS termination with mkcert (local) / rustls-acme (production) - Host-prefix routing with path-based sub-routing for auth virtual host: /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui - HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub - cert-manager HTTP-01 ACME challenge routing via Ingress watcher - RBAC for Ingress watcher (pingora-watcher ClusterRole) - local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict Infrastructure: - socket_vmnet shared network for host↔VM reachability (192.168.105.2) - local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution - Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods - Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25 - Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# Local dev overlay — targets Lima VM running k3s on macOS
|
|
# Deploy with: kubectl apply -k overlays/local/
|
|
#
|
|
# NOTE: base/mesh (Linkerd) is excluded here. Linkerd is bootstrapped
|
|
# separately by scripts/local-up.sh via the Linkerd CLI, which avoids
|
|
# the identity cert bootstrapping problem at kustomize render time.
|
|
#
|
|
# DOMAIN_SUFFIX substitution: local-up.sh pipes `kustomize build | sed` to
|
|
# replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
|
|
|
|
resources:
|
|
- ../../base/ingress
|
|
- ../../base/ory
|
|
- ../../base/data
|
|
- ../../base/storage
|
|
- ../../base/lasuite
|
|
- ../../base/media
|
|
- ../../base/devtools
|
|
|
|
images:
|
|
# Local dev: image is built and imported directly into k3s containerd.
|
|
# imagePullPolicy: Never is set in values-pingora.yaml so k3s never tries to pull.
|
|
# Production overlay points this at src.DOMAIN_SUFFIX/sunbeam/sunbeam-proxy:latest.
|
|
- name: sunbeam-proxy
|
|
newName: sunbeam-proxy
|
|
newTag: dev
|
|
|
|
patches:
|
|
# Add hostPort for TURN relay range on Lima VM
|
|
- path: values-pingora.yaml
|
|
target:
|
|
kind: Deployment
|
|
name: pingora
|
|
|
|
# Downgrade LiveKit TURN service from LoadBalancer → ClusterIP (klipper would take hostPort 443)
|
|
- path: values-livekit.yaml
|
|
target:
|
|
kind: Service
|
|
name: livekit-server-turn
|
|
|
|
# Apply §10.7 memory limits to all Deployments
|
|
- path: values-resources.yaml
|