From 304c8e71dbd20ad4cfefda837f747b99c5941512 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Wed, 26 Aug 2026 20:10:20 +0200 Subject: [PATCH] envoy-gateway: comment out orphaned listeners and certificates Ten Gateway listeners had zero attached routes. Eight of them are in this repo and are removed here by commenting them out of the kustomization, which prunes the listener and its cert-manager Certificate. Deprecated, workloads already live in deprecated/: vaultwarden (vault.jsme.be), affine (affine.jsme.be) Superseded by minio-aistor: resume-minio (resume-minio.jsme.be), resume-minioweb (resume-minioweb.jsme.be) Written but never deployed, no namespace in the cluster: n8n (n8n.jsme.be), wikijs (wiki.jsme.be), ollama (ollama.jsme.be), openwebui (forge.jsme.be) wiki.jsme.be was one of these on the PUBLIC gateway: a listener with a valid certificate, no backend, and an allowedRoutes selector that would attach the first HTTPRoute appearing in a matching namespace. Deploying Wiki.js later expecting it to be internal would have published it. Commented rather than deleted so redeploying an app is a two line uncomment. The certificate and the gateway patch must be uncommented together. Verified with kubectl kustomize: 45 listeners render, down from 53, with all eight orphan hostnames gone and every live service still present. --- infra/envoy-gateway/kustomization.yaml | 137 ++++++++++++++----------- 1 file changed, 75 insertions(+), 62 deletions(-) diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml index 1fd8c41..0f7accd 100644 --- a/infra/envoy-gateway/kustomization.yaml +++ b/infra/envoy-gateway/kustomization.yaml @@ -1,6 +1,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +# ORPHANED LISTENERS, commented out 2026-08-26. Each of these had a Gateway +# listener and a TLS cert but ZERO attached routes, because the app is either in +# deprecated/ (vaultwarden, affine, resume-minio*) or written but never deployed +# (n8n, wikijs, ollama, openwebui). wiki.jsme.be was one of these on the PUBLIC +# gateway. Uncomment the pair (certificate + patch) when actually deploying the app. + resources: - envoy-gateway-namespace.yaml - gateway.yaml @@ -26,34 +32,35 @@ resources: - jellyfin/jellyfin-certificate.yaml - longhorn/longhorn-certificate.yaml - monitoring/monitoring-certificate.yaml - - n8n/n8n-certificate.yaml + # - n8n/n8n-certificate.yaml - netbootxyz/netbootxyz-certificate.yaml - passbolt/passbolt-certificate.yaml - proxmox/proxmox-certificate.yaml - resume/resume-certificate.yaml - - resume/resume-minio-certificate.yaml - - resume/resume-minio-webui-certificate.yaml + # - resume/resume-minio-certificate.yaml + # - resume/resume-minio-webui-certificate.yaml - minio-aistor/minio-aistor-api-certificate.yaml - minio-aistor/minio-aistor-console-certificate.yaml - technitium/technitium-certificate.yaml - technitium/technitium-backup-certificate.yaml - truenas/truenas-certificate.yaml - unifi/unifi-certificate.yaml - - wikijs/wikijs-certificate.yaml + # - wikijs/wikijs-certificate.yaml - zipline/zipline-certificate.yaml - - vaultwarden/vaultwarden-certificate.yaml + # - vaultwarden/vaultwarden-certificate.yaml - databasus/databasus-certificate.yaml - excalidraw/excalidraw-certificate.yaml - gotify/gotify-certificate.yaml - uptime-kuma/uptime-kuma-certificate.yaml - - ollama/ollama-certificate.yaml - - openwebui/openwebui-certificate.yaml + # - ollama/ollama-certificate.yaml + # - openwebui/openwebui-certificate.yaml - searxng/searxng-certificate.yaml - - affine/affine-certificate.yaml + # - affine/affine-certificate.yaml - pelican/pelican-certificate.yaml - pelican/pelican-wings-mc-certificate.yaml - pelican/pelican-wings-ark-certificate.yaml - outline/outline-certificate.yaml + - netbox/netbox-certificate.yaml patches: # Internal gateway patches @@ -93,30 +100,30 @@ patches: kind: Gateway name: gateway-internal path: longhorn/longhorn-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: n8n/n8n-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: n8n/n8n-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 kind: Gateway name: gateway-internal path: netbootxyz/netbootxyz-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: resume/resume-minio-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: resume/resume-minio-webui-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: resume/resume-minio-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: resume/resume-minio-webui-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 @@ -183,12 +190,12 @@ patches: kind: Gateway name: gateway-internal path: resume/resume-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: wikijs/wikijs-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: wikijs/wikijs-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 @@ -207,12 +214,12 @@ patches: kind: Gateway name: gateway-internal path: minio-aistor/minio-aistor-console-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: vaultwarden/vaultwarden-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: vaultwarden/vaultwarden-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 @@ -237,30 +244,30 @@ patches: kind: Gateway name: gateway-internal path: uptime-kuma/uptime-kuma-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: ollama/ollama-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: openwebui/openwebui-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: ollama/ollama-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: openwebui/openwebui-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 kind: Gateway name: gateway-internal path: searxng/searxng-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: affine/affine-gateway-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-internal + # path: affine/affine-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 @@ -285,6 +292,12 @@ patches: kind: Gateway name: gateway-internal path: outline/outline-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: netbox/netbox-gateway-patch.yaml # Public gateway patches - target: @@ -335,12 +348,12 @@ patches: kind: Gateway name: gateway-public path: resume/resume-gateway-public-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-public - path: wikijs/wikijs-gateway-public-patch.yaml + # - target: + # group: gateway.networking.k8s.io + # version: v1 + # kind: Gateway + # name: gateway-public + # path: wikijs/wikijs-gateway-public-patch.yaml - target: group: gateway.networking.k8s.io version: v1