claude-botandClaude Fable 5
239151b6b4
*.k.renner.uno was a temporary migration namespace and is banned (owner directive 2026-07-14, documented in openbao/ingress.yaml) — it was never the live naming. Removes the .k. hosts/SANs from ical-proxy, loki, grafana and the mosquitto cert, renames syslog.k.renner.uno to syslog.renner.uno (cert + external-dns annotation; any syslog sender still configured with the k. name must be repointed), fixes the stale comments, updates e2e-test.sh probes to the real names, and drops k.renner.uno from the external-dns domainFilters so leftover k. records get garbage-collected by policy: sync. The migration script's historical docstring reference stays — it documents what the migration did. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014S5CLfizEtzHS51kxJFQgc
33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: loki
|
|
namespace: monitoring
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
|
# nginx's auth-type/auth-secret/auth-realm annotation triple becomes
|
|
# a Traefik BasicAuth Middleware (loki-basic-auth-middleware.yaml).
|
|
# Same Secret, with the same htpasswd duplicated under both `auth`
|
|
# (nginx-convention) and `users` (Traefik-convention) keys.
|
|
traefik.ingress.kubernetes.io/router.middlewares: monitoring-loki-basic-auth@kubernetescrd
|
|
# proxy-body-size 32m for Promtail pushes — Traefik streams without
|
|
# a body cap by default. proxy-read-timeout 300s — covered by the
|
|
# 3600s websecure entrypoint timeout we set globally.
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: loki.renner.uno
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: loki
|
|
port:
|
|
number: 3100
|
|
tls:
|
|
- hosts:
|
|
- loki.renner.uno
|
|
secretName: loki-ingress-tls
|