From 5d52e42887937431a7f323b93fe890af47a19801 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Mon, 7 Sep 2026 07:48:22 +0200 Subject: [PATCH] fix(infrastructure): LAPI ServersTransport behind the Traefik CRDs (phase 2: remove) Phase 1 (#802) put the ServersTransport under post-crds and infrastructure-crds has applied it. The copy in crowdsec/lapi-ingress.yaml goes; the Ingress stays (core kind). With it, the infrastructure apply set holds no traefik.io consumer any more, which is what a cold rebuild needs. Prune: infrastructure reconciles first and skips the object if the last applier label names infrastructure-crds; otherwise it deletes and infrastructure-crds recreates it seconds later. Only the public LAPI ingress used by the external bouncers is behind that transport. Co-Authored-By: Claude Fable 5.1 --- .../infrastructure/crowdsec/lapi-ingress.yaml | 16 +++------------- .../infrastructure/post-crds/kustomization.yaml | 2 -- 2 files changed, 3 insertions(+), 15 deletions(-) diff --git a/kubernetes/infrastructure/crowdsec/lapi-ingress.yaml b/kubernetes/infrastructure/crowdsec/lapi-ingress.yaml index bacc513f..b1a5fd4f 100644 --- a/kubernetes/infrastructure/crowdsec/lapi-ingress.yaml +++ b/kubernetes/infrastructure/crowdsec/lapi-ingress.yaml @@ -31,22 +31,12 @@ # serves read-only decision streams to a valid bouncer key and nothing else. # The admin surface is cscli, in-cluster. If the source address ever becomes # deterministic, an ipAllowList can be added on top. ---- +# # The LAPI serves HTTPS only once tls.enabled is set — there is no plaintext # fallback and no second port; 8080 is the TLS port. Its certificate comes # from the chart's own self-signed CA, so Traefik needs that CA to verify the -# backend. SANs include crowdsec-service.crowdsec.svc.cluster.local, which is -# what the Service resolves to. -apiVersion: traefik.io/v1alpha1 -kind: ServersTransport -metadata: - name: crowdsec-lapi - namespace: crowdsec -spec: - serverName: crowdsec-service.crowdsec.svc.cluster.local - rootCAs: - - secret: crowdsec-root-secret ---- +# backend; the ServersTransport carrying it is a traefik.io CRD consumer and +# lives in post-crds/crowdsec-lapi-serverstransport.yaml. apiVersion: networking.k8s.io/v1 kind: Ingress metadata: diff --git a/kubernetes/infrastructure/post-crds/kustomization.yaml b/kubernetes/infrastructure/post-crds/kustomization.yaml index 265ba748..a086e1bd 100644 --- a/kubernetes/infrastructure/post-crds/kustomization.yaml +++ b/kubernetes/infrastructure/post-crds/kustomization.yaml @@ -31,7 +31,5 @@ resources: - traefik-crowdsec-middleware.yaml - traefik-rate-limit-middleware.yaml - traefik-security-headers-middleware.yaml - # Phase 1 of a two-Kustomization move: also still in crowdsec/lapi-ingress.yaml - # until this layer has applied it once, so prune never runs ahead of apply. - crowdsec-lapi-serverstransport.yaml - ../network-policies/ -- 2.54.0