keyhan
4301277b48
Ingress / preview URLs: - Default the app Ingress class and ACME HTTP-01 solver to Traefik (k3s default) via a new INGRESS_CLASS env, instead of hardcoding nginx — fixes 404s on clusters without ingress-nginx. - Only put public, real-TLD hosts (custom domain + preview) in the TLS block; the internal *.apps.cloudhost.local host no longer poisons the Let's Encrypt order, so certs actually issue. - Make the per-app preview number stable across redeploys so URLs stop breaking, and let PREVIEW_BASE_DOMAIN configure the base domain. Registry pulls: - Point the k3s registries.yaml mirror endpoint at the registry NodePort on loopback so node containerd never depends on cluster DNS (image pulls survive node restarts). Builds: - Pin the Kaniko image, use IfNotPresent pull policy, drop the dead build queue/processor, and retry transient Kubernetes API errors while polling build jobs. Logs & apps list: - fluent-bit reads log files from head so startup output reaches Elasticsearch. - Order joined deployments newest-first so the apps list shows the latest deployment status. Allocation: - Reserve in-flight (pending/building) capacity and stop globally degrading the cluster on a single allocation failure, so concurrent deploys don't starve or wrongly report "no healthy cluster". Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
{{- if .Values.ingress.enabled }}
|
|
{{- $name := include "cloudhost-app.name" . -}}
|
|
{{- $ns := include "cloudhost-app.namespace" . -}}
|
|
{{- $host := printf "%s.%s" (default $name .Values.ingress.subdomain) .Values.ingress.domain -}}
|
|
{{- $previewHost := .Values.ingress.previewHost | default "" -}}
|
|
{{- $className := .Values.ingress.className | default "traefik" -}}
|
|
{{- /* Only public, real-TLD hosts (custom domain + preview) can get a managed cert.
|
|
The internal *.apps.cloudhost.local host is not a valid public suffix and would
|
|
make Let's Encrypt reject the whole order. */ -}}
|
|
{{- $tlsHosts := list -}}
|
|
{{- if .Values.ingress.customDomain }}{{- $tlsHosts = append $tlsHosts .Values.ingress.customDomain -}}{{- end -}}
|
|
{{- if $previewHost }}{{- $tlsHosts = append $tlsHosts $previewHost -}}{{- end -}}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ $name }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "cloudhost-app.labels" . | nindent 4 }}
|
|
{{- if gt (len $tlsHosts) 0 }}
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer | quote }}
|
|
{{- end }}
|
|
spec:
|
|
ingressClassName: {{ $className }}
|
|
rules:
|
|
- host: {{ $host }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: {{ $name }}
|
|
port:
|
|
number: 80
|
|
{{- if .Values.ingress.customDomain }}
|
|
- host: {{ .Values.ingress.customDomain }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: {{ $name }}
|
|
port:
|
|
number: 80
|
|
{{- end }}
|
|
{{- if $previewHost }}
|
|
- host: {{ $previewHost }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: {{ $name }}
|
|
port:
|
|
number: 80
|
|
{{- end }}
|
|
{{- if gt (len $tlsHosts) 0 }}
|
|
tls:
|
|
- hosts:
|
|
{{- range $tlsHosts }}
|
|
- {{ . }}
|
|
{{- end }}
|
|
secretName: {{ $name }}-tls
|
|
{{- end }}
|
|
{{- end }}
|