From 23aaf5ab26c5db3a0796d3067d0c96da075d3f52 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Fri, 23 Oct 2026 21:02:10 +0200 Subject: [PATCH] docs: tick off the routes and note what the switch-over needs --- docs/upgrade-k8s-1.33.md | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/docs/upgrade-k8s-1.33.md b/docs/upgrade-k8s-1.33.md index e9780a5..f9778b0 100644 --- a/docs/upgrade-k8s-1.33.md +++ b/docs/upgrade-k8s-1.33.md @@ -94,15 +94,24 @@ snapshots after every step. Fresh Velero backup before starting. OIDC - [x] Envoy Gateway v1.9.2 next to nginx. Gateway `homelab` in `envoy-gateway-system`, Envoy on host ports 10080/10443 (`gateway/`) - - [ ] One app (gatus, s2.rubenhensen.nl) on an HTTPRoute, reusing its + - [x] One app (gatus, s2.rubenhensen.nl) on an HTTPRoute, reusing its existing certificate through a ReferenceGrant; test with `curl --resolve :10443:192.168.1.204` - - [ ] Longhorn behind authentik OIDC with a SecurityPolicy - - [ ] The other apps. Envoy cuts requests off after 15s by default, so - uploads and streams need `timeouts.request: 0s` - - [ ] Switch over: `microk8s disable ingress`, Envoy on 80/443, cert-manager - `enableGatewayAPI` and an HTTP-01 solver on the Gateway - - [ ] Remove the Ingress objects and nginx annotations + - [ ] Longhorn behind authentik OIDC with a SecurityPolicy. Ready on the + local branch `longhorn-oidc`; needs `client_secret` in Vault at + `kv/longhorn-oidc` first, or authentik's pods won't start + - [x] The other apps. Envoy cuts requests off after 15s by default, so the + routes set `timeouts.request: 0s`. All hosts answer the same through + Envoy as through nginx; WordPress only redirects on the test port + because the Host header carries `:10443` + - [x] Argo CD on `server.insecure`, so both nginx and Envoy talk plain + HTTP to argocd-server + - [x] cert-manager `config.gatewayAPI.enabled` + - [ ] Switch over: `microk8s disable ingress`, Envoy on 80/443, and a + `gatewayHTTPRoute` HTTP-01 solver on the ClusterIssuer + - [ ] Replace the Ingress objects with Certificate resources (the + ingress-shim Certificates go with their Ingress, and gateway-shim + can't write to the app namespaces) and drop the nginx annotations Out of scope here but due: the immich PostgreSQL 14 cluster reaches end of life on 2026-11-12.