fix(infrastructure): LAPI ServersTransport behind the Traefik CRDs (phase 1: add)

A cold rebuild stops permanently at the infrastructure Kustomization: ServersTransport/crowdsec/crowdsec-lapi dry-run failed: no matches for kind "ServersTransport" in version "traefik.io/v1alpha1" Flux dry-runs the whole apply set, so this one unknown kind rejects all of it — including the Traefik HelmRelease that installs the CRD. Measured on the Hetzner rehearsal from master: zero HelmReleases, zero CRDs. The public LAPI endpoint (2026-09-02) landed after the post-crds sweep and put a traefik.io consumer back into the layer that creates traefik.io. Phase 1 only adds the object under post-crds; crowdsec/lapi-ingress.yaml keeps its copy until infrastructure-crds has applied once, because both Kustomizations prune and a one-commit move deletes before the new owner applies. Phase 2 removes the original. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-06 23:24:46 +02:00
2 changed files with 14 additions and 0 deletions
@@ -0,0 +1,11 @@
+# traefik.io CRD consumer for the public LAPI endpoint (crowdsec/lapi-ingress.yaml
+# holds the Ingress). The CA it names is the chart's self-signed LAPI CA.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: crowdsec-lapi
+  namespace: crowdsec
+spec:
+  serverName: crowdsec-service.crowdsec.svc.cluster.local
+  rootCAs:
+    - secret: crowdsec-root-secret
@@ -31,4 +31,7 @@ resources:
  - traefik-crowdsec-middleware.yaml
  - traefik-rate-limit-middleware.yaml
  - traefik-security-headers-middleware.yaml
+  # Phase 1 of a two-Kustomization move: also still in crowdsec/lapi-ingress.yaml
+  # until this layer has applied it once, so prune never runs ahead of apply.
+  - crowdsec-lapi-serverstransport.yaml
  - ../network-policies/