From 5ee87e8a097cacbeb43cbde1bdd3cc094e57719d Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sun, 5 Apr 2026 09:42:17 +0200 Subject: [PATCH] fix: Make CrowdSec bouncer optional for ingress-nginx startup - Add optional: true to secretKeyRef so ingress pods start without the bouncer key (CrowdSec deploys after infrastructure) - Move ingress bouncer SealedSecret to crowdsec app (creates in ingress namespace when CrowdSec deploys) - Ingress starts without CrowdSec, bouncer activates after secret appears Co-Authored-By: Claude Opus 4.6 (1M context) --- .../crowdsec/ingress-bouncer-secret.yaml} | 0 kubernetes/apps/crowdsec/kustomization.yaml | 1 + kubernetes/infrastructure/ingress-nginx/helmrelease.yaml | 1 + kubernetes/infrastructure/post-crds/kustomization.yaml | 1 - 4 files changed, 2 insertions(+), 1 deletion(-) rename kubernetes/{infrastructure/post-crds/bouncer-secret.yaml => apps/crowdsec/ingress-bouncer-secret.yaml} (100%) diff --git a/kubernetes/infrastructure/post-crds/bouncer-secret.yaml b/kubernetes/apps/crowdsec/ingress-bouncer-secret.yaml similarity index 100% rename from kubernetes/infrastructure/post-crds/bouncer-secret.yaml rename to kubernetes/apps/crowdsec/ingress-bouncer-secret.yaml diff --git a/kubernetes/apps/crowdsec/kustomization.yaml b/kubernetes/apps/crowdsec/kustomization.yaml index 34fdd033..bf93341a 100644 --- a/kubernetes/apps/crowdsec/kustomization.yaml +++ b/kubernetes/apps/crowdsec/kustomization.yaml @@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - bouncer-secret.yaml + - ingress-bouncer-secret.yaml - helmrelease.yaml diff --git a/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml b/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml index 863b8830..3ce3af56 100644 --- a/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml +++ b/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml @@ -61,6 +61,7 @@ spec: secretKeyRef: name: crowdsec-bouncer-key key: key + optional: true - name: BOUNCER_CONFIG value: "/crowdsec/crowdsec-bouncer.conf" volumeMounts: diff --git a/kubernetes/infrastructure/post-crds/kustomization.yaml b/kubernetes/infrastructure/post-crds/kustomization.yaml index a02bbf34..a980f5a4 100644 --- a/kubernetes/infrastructure/post-crds/kustomization.yaml +++ b/kubernetes/infrastructure/post-crds/kustomization.yaml @@ -3,5 +3,4 @@ kind: Kustomization resources: - clusterissuer.yaml - cloudflare-secret.yaml - - bouncer-secret.yaml - cilium-l2.yaml