Ten Gateway listeners had zero attached routes. Eight of them are in this repo
and are removed here by commenting them out of the kustomization, which prunes
the listener and its cert-manager Certificate.
Deprecated, workloads already live in deprecated/:
vaultwarden (vault.jsme.be), affine (affine.jsme.be)
Superseded by minio-aistor:
resume-minio (resume-minio.jsme.be), resume-minioweb (resume-minioweb.jsme.be)
Written but never deployed, no namespace in the cluster:
n8n (n8n.jsme.be), wikijs (wiki.jsme.be), ollama (ollama.jsme.be),
openwebui (forge.jsme.be)
wiki.jsme.be was one of these on the PUBLIC gateway: a listener with a valid
certificate, no backend, and an allowedRoutes selector that would attach the
first HTTPRoute appearing in a matching namespace. Deploying Wiki.js later
expecting it to be internal would have published it.
Commented rather than deleted so redeploying an app is a two line uncomment.
The certificate and the gateway patch must be uncommented together.
Verified with kubectl kustomize: 45 listeners render, down from 53, with all
eight orphan hostnames gone and every live service still present.
Jeffrey
304c8e71db