From a07ef664cbd90be6856209d8afedbc1ed3d0946d Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Fri, 23 Oct 2026 21:29:37 +0200 Subject: [PATCH] docs: tick off the Envoy Gateway migration --- docs/upgrade-k8s-1.33.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/upgrade-k8s-1.33.md b/docs/upgrade-k8s-1.33.md index 0285ee8..3a6926f 100644 --- a/docs/upgrade-k8s-1.33.md +++ b/docs/upgrade-k8s-1.33.md @@ -90,7 +90,7 @@ snapshots after every step. Fresh Velero backup before starting. - [x] cert-manager 1.21.2. The chart dropped the unused tokenrequest Role and RoleBinding; Argo CD pruned them -- [ ] Envoy Gateway v1.9 instead of ingress-nginx, Longhorn behind authentik +- [x] Envoy Gateway v1.9 instead of ingress-nginx, Longhorn behind authentik OIDC - [x] Envoy Gateway v1.9.2 next to nginx. Gateway `homelab` in `envoy-gateway-system`, Envoy on host ports 10080/10443 (`gateway/`) @@ -114,9 +114,13 @@ snapshots after every step. Fresh Velero backup before starting. - [x] Switch over: `microk8s disable ingress`, Envoy on 80/443, and a `gatewayHTTPRoute` HTTP-01 solver on the ClusterIssuer. About a minute without HTTP(S) on 2026-10-23; node001's tunnel needed no change - - [ ] Replace the Ingress objects with Certificate resources (the + - [x] Replace the Ingress objects with Certificate resources (the ingress-shim Certificates go with their Ingress, and gateway-shim - can't write to the app namespaces) and drop the nginx annotations + can't write to the app namespaces) and drop the nginx annotations. + Same names and specs, so nothing was reissued except immich, which + dropped mbg.hensen.io; that reissue went through the Gateway's HTTP-01 + solver. The Ingresses were pruned with `PrunePropagationPolicy=orphan` + so the Certificates stayed. Gatus now expects a 302 from Longhorn Out of scope here but due: the immich PostgreSQL 14 cluster reaches end of life on 2026-11-12.