Moved traefik-ai to kube-system-custom, fixed lan-play ingress

2026-08-05 13:44:30 +01:00
parent f038016d46
commit d41171955b
4 changed files with 68 additions and 7 deletions
@@ -10,7 +10,6 @@ resources:
  - postgres.yaml
  - storage.yaml
  - storage-prep.yaml
-  - traefik-ai.yaml
  - network-policy.yaml

 helmCharts:
@@ -1,175 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  name: traefik-ai
-spec:
-  controller: traefik.io/ingress-controller
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik-ai
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: traefik-ai
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - secrets
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: traefik-ai
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: traefik-ai
-subjects:
-  - kind: ServiceAccount
-    name: traefik-ai
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: firefly-traefik-ai
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: firefly-traefik-ai
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: firefly-traefik-ai
-subjects:
-  - kind: ServiceAccount
-    name: traefik-ai
-    namespace: firefly-iii
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: traefik-ai
-  labels:
-    app.kubernetes.io/name: traefik-ai
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: traefik-ai
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: traefik-ai
-    spec:
-      serviceAccountName: traefik-ai
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      nodeSelector:
-        kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
-      containers:
-        - name: traefik
-          image: rancher/mirrored-library-traefik:3.6.13
-          imagePullPolicy: IfNotPresent
-          args:
-            - --entrypoints.web.address=192.168.1.117:80
-            - --providers.kubernetesingress=true
-            - --providers.kubernetesingress.namespaces=firefly-iii
-            - --providers.kubernetesingress.ingressclass=traefik-ai
-            - --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
-            - --providers.kubernetescrd=false
-            - --api.dashboard=false
-            - --log.level=INFO
-          ports:
-            - name: web
-              containerPort: 80
-              hostPort: 80
-              hostIP: 192.168.1.117
-              protocol: TCP
-          readinessProbe:
-            tcpSocket:
-              host: 192.168.1.117
-              port: web
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              host: 192.168.1.117
-              port: web
-            periodSeconds: 30
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - NET_BIND_SERVICE
-            readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
-            runAsGroup: 0
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault
@@ -45,8 +45,11 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: lan-play-local
+  labels:
+    firefly.hexor.cy/private-ai: "true"
+  annotations:
+    kubernetes.io/ingress.class: traefik-ai
 spec:
-  ingressClassName: traefik
  rules:
    - host: video.lan
      http: