mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
391c4f5fc9
GCE L7 Ingresses for knoe-svc-kong (svc.knoe.dev / api.knoe.dev),
supabase-kong (api.0.knoe.dev) and supabase-studio (db.0.knoe.dev) were
all stuck UNHEALTHY: the default GCE healthCheck is HTTP GET `/` on the
backend port, but Kong returns 404 on any unrouted path and Studio
returns a 301 redirect -- neither passes the default probe, so the LB
serves "Server Error" instead of reaching the pod.
Replicate the pattern already working for gitlab-webservice-default:
emit a BackendConfig CRD with a TCP healthCheck on the service port and
annotate the Service with cloud.google.com/backend-config so GCE picks
it up. TCP is sufficient for LB-level liveness -- the backend is "alive"
as long as the process is accepting connections.
- etc/init_kong.sh: new SVC_KNOE_BACKEND_CONFIG_NAME; apply BackendConfig
inside k8s/GCE branch; annotate Service post-apply.
- knoe-supabase chart: new kong/backendconfig.yaml + studio/backendconfig.yaml
(TCP on 8000 / 3000), gated on service.{kong,studio}.backendConfigName.
- knoe-supabase chart: kong/service.yaml + studio/service.yaml pick up
cloud.google.com/backend-config when backendConfigName is set.
- render_supabase.py: sets service.{kong,studio}.backendConfigName in k8s
mode so the above wires up automatically.
Separately, the chart-managed supabase-kong Ingress was being reaped
from the cluster seconds after helm install (manifest present in the
release, gone via `kubectl get`). Root cause TBD -- suspected
meta.helm.sh/* annotation ownership colliding with a GKE/Anthos audit
controller. Workaround: render_supabase.py now emits a standalone
public-ingress-kong.yaml (no helm metadata) that supabase/deploy.sh
applies alongside public-ingress-tls.yaml, and the chart template gains
an `ingress.externallyManaged` guard so it no-ops in k8s mode. Default
`false` keeps k3d/k3s behavior unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
70 lines
2.5 KiB
YAML
70 lines
2.5 KiB
YAML
{{- /*
|
|
In k8s/GKE mode the supabase-kong Ingress is owned by render_supabase.py as
|
|
a standalone manifest (supabase/k8s/public-ingress-kong.yaml) applied by
|
|
deploy.sh outside the helm chart. The chart-rendered ingress was getting
|
|
silently reaped from the cluster within seconds of install; root cause is
|
|
suspected to involve meta.helm.sh/* annotation ownership colliding with a
|
|
GKE/Anthos audit controller, but diagnosis is deferred. externallyManaged
|
|
defaults to false so `helm install` in local k3d/k3s modes (where
|
|
render_supabase.py is not in the path) keeps the historical behavior.
|
|
*/ -}}
|
|
{{- if .Values.deployment.kong.enabled -}}
|
|
{{- if .Values.ingress.enabled -}}
|
|
{{- if not (.Values.ingress.externallyManaged | default false) -}}
|
|
{{- $fullName := include "supabase.kong.fullname" . -}}
|
|
{{- $svcPort := .Values.service.kong.port -}}
|
|
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
|
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
|
|
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
|
|
{{- end }}
|
|
{{- end }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ $fullName }}
|
|
labels:
|
|
{{- include "supabase.labels" . | nindent 4 }}
|
|
{{- with .Values.ingress.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
|
ingressClassName: {{ .Values.ingress.className }}
|
|
{{- end }}
|
|
{{- if .Values.ingress.tls }}
|
|
tls:
|
|
{{- range .Values.ingress.tls }}
|
|
- hosts:
|
|
{{- range .hosts }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
secretName: {{ .secretName }}
|
|
{{- end }}
|
|
{{- end }}
|
|
rules:
|
|
{{- range .Values.ingress.hosts }}
|
|
- host: {{ .host | quote }}
|
|
http:
|
|
paths:
|
|
{{- range .paths }}
|
|
- path: {{ .path }}
|
|
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
|
|
pathType: {{ .pathType }}
|
|
{{- end }}
|
|
backend:
|
|
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
|
service:
|
|
name: {{ $fullName }}
|
|
port:
|
|
number: {{ $svcPort }}
|
|
{{- else }}
|
|
serviceName: {{ $fullName }}
|
|
servicePort: {{ $svcPort }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|