mats
64abb69c26
build / build-push (push) Successful in 34s
The ingress still sent the UI and admin API to the resolver after the console split. Route both paths through the console so OIDC callbacks and Kubernetes edits reach their owner, while keeping DoH on the resolver. Include the console resources in Kustomize so GitOps deploys its configuration, permissions, workload and Service alongside the resolver.
63 lines
1.7 KiB
YAML
63 lines
1.7 KiB
YAML
# The console, the admin API and the DoH endpoint, behind TLS.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: fancy-dns
|
|
namespace: dns
|
|
labels:
|
|
app.kubernetes.io/name: fancy-dns
|
|
annotations:
|
|
k8s-helper.io/name: "fancy-dns"
|
|
k8s-helper.io/description: "Recursive DNS resolver and admin dashboard"
|
|
k8s-helper.io/group: "Infrastructure"
|
|
k8s-helper.io/icon: "network"
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: dns.k6n.net
|
|
http:
|
|
paths:
|
|
# DoH must be matched before the catch-all below, and both are
|
|
# Prefix paths on distinct roots so the order is not load-bearing.
|
|
- path: /dns-query
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: fancy-dns-web
|
|
port:
|
|
name: doh
|
|
- path: /api
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: fancy-dns-console
|
|
port:
|
|
name: http
|
|
# The console owns the UI, OIDC callback and admin API.
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: fancy-dns-console
|
|
port:
|
|
name: http
|
|
tls:
|
|
- hosts: [dns.k6n.net]
|
|
secretName: fancy-dns-tls
|
|
---
|
|
# Two replicas means one of them can always be taken away for a node drain.
|
|
apiVersion: policy/v1
|
|
kind: PodDisruptionBudget
|
|
metadata:
|
|
name: fancy-dns
|
|
namespace: dns
|
|
labels:
|
|
app.kubernetes.io/name: fancy-dns
|
|
spec:
|
|
minAvailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: fancy-dns
|