fix(infrastructure): LAPI ServersTransport behind the Traefik CRDs (phase 2: remove)

Phase 1 (#802) put the ServersTransport under post-crds and infrastructure-crds has applied it. The copy in crowdsec/lapi-ingress.yaml goes; the Ingress stays (core kind). With it, the infrastructure apply set holds no traefik.io consumer any more, which is what a cold rebuild needs. Prune: infrastructure reconciles first and skips the object if the last applier label names infrastructure-crds; otherwise it deletes and infrastructure-crds recreates it seconds later. Only the public LAPI ingress used by the external bouncers is behind that transport. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-07 07:48:22 +02:00
2 changed files with 3 additions and 15 deletions
@@ -31,22 +31,12 @@
 # serves read-only decision streams to a valid bouncer key and nothing else.
 # The admin surface is cscli, in-cluster. If the source address ever becomes
 # deterministic, an ipAllowList can be added on top.
---
+#
 # The LAPI serves HTTPS only once tls.enabled is set — there is no plaintext
 # fallback and no second port; 8080 is the TLS port. Its certificate comes
 # from the chart's own self-signed CA, so Traefik needs that CA to verify the
-# backend. SANs include crowdsec-service.crowdsec.svc.cluster.local, which is
-# what the Service resolves to.
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: crowdsec-lapi
-  namespace: crowdsec
-spec:
-  serverName: crowdsec-service.crowdsec.svc.cluster.local
-  rootCAs:
-    - secret: crowdsec-root-secret
---
+# backend; the ServersTransport carrying it is a traefik.io CRD consumer and
+# lives in post-crds/crowdsec-lapi-serverstransport.yaml.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -31,7 +31,5 @@ resources:
  - traefik-crowdsec-middleware.yaml
  - traefik-rate-limit-middleware.yaml
  - traefik-security-headers-middleware.yaml
-  # Phase 1 of a two-Kustomization move: also still in crowdsec/lapi-ingress.yaml
-  # until this layer has applied it once, so prune never runs ahead of apply.
  - crowdsec-lapi-serverstransport.yaml
  - ../network-policies/