Jeffrey
304c8e71db
Ten Gateway listeners had zero attached routes. Eight of them are in this repo and are removed here by commenting them out of the kustomization, which prunes the listener and its cert-manager Certificate. Deprecated, workloads already live in deprecated/: vaultwarden (vault.jsme.be), affine (affine.jsme.be) Superseded by minio-aistor: resume-minio (resume-minio.jsme.be), resume-minioweb (resume-minioweb.jsme.be) Written but never deployed, no namespace in the cluster: n8n (n8n.jsme.be), wikijs (wiki.jsme.be), ollama (ollama.jsme.be), openwebui (forge.jsme.be) wiki.jsme.be was one of these on the PUBLIC gateway: a listener with a valid certificate, no backend, and an allowedRoutes selector that would attach the first HTTPRoute appearing in a matching namespace. Deploying Wiki.js later expecting it to be internal would have published it. Commented rather than deleted so redeploying an app is a two line uncomment. The certificate and the gateway patch must be uncommented together. Verified with kubectl kustomize: 45 listeners render, down from 53, with all eight orphan hostnames gone and every live service still present.
388 lines
11 KiB
YAML
388 lines
11 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# ORPHANED LISTENERS, commented out 2026-08-26. Each of these had a Gateway
|
|
# listener and a TLS cert but ZERO attached routes, because the app is either in
|
|
# deprecated/ (vaultwarden, affine, resume-minio*) or written but never deployed
|
|
# (n8n, wikijs, ollama, openwebui). wiki.jsme.be was one of these on the PUBLIC
|
|
# gateway. Uncomment the pair (certificate + patch) when actually deploying the app.
|
|
|
|
resources:
|
|
- envoy-gateway-namespace.yaml
|
|
- gateway.yaml
|
|
- gateway-public.yaml
|
|
|
|
# CrowdSec ext_authz on the whole public gateway (sectionName scoping is
|
|
# unsupported on EG v1.3.2; envoyproxy-public.yaml is not needed, see its header)
|
|
- crowdsec/gateway-public-securitypolicy.yaml
|
|
|
|
# Policies
|
|
- pelican/pelican-wings-clienttrafficpolicy.yaml
|
|
- minio-aistor/minio-aistor-clienttrafficpolicy.yaml
|
|
- minio-aistor/minio-aistor-console-clienttrafficpolicy.yaml
|
|
|
|
# Certificates
|
|
- authentik/authentik-certificate.yaml
|
|
- argocd/argocd-certificate.yaml
|
|
- bentopdf/bentopdf-certificate.yaml
|
|
- gitea/gitea-certificate.yaml
|
|
- immich/immich-certificate.yaml
|
|
- infisical/infisical-certificate.yaml
|
|
- it-tools/it-tools-certificate.yaml
|
|
- jellyfin/jellyfin-certificate.yaml
|
|
- longhorn/longhorn-certificate.yaml
|
|
- monitoring/monitoring-certificate.yaml
|
|
# - n8n/n8n-certificate.yaml
|
|
- netbootxyz/netbootxyz-certificate.yaml
|
|
- passbolt/passbolt-certificate.yaml
|
|
- proxmox/proxmox-certificate.yaml
|
|
- resume/resume-certificate.yaml
|
|
# - resume/resume-minio-certificate.yaml
|
|
# - resume/resume-minio-webui-certificate.yaml
|
|
- minio-aistor/minio-aistor-api-certificate.yaml
|
|
- minio-aistor/minio-aistor-console-certificate.yaml
|
|
- technitium/technitium-certificate.yaml
|
|
- technitium/technitium-backup-certificate.yaml
|
|
- truenas/truenas-certificate.yaml
|
|
- unifi/unifi-certificate.yaml
|
|
# - wikijs/wikijs-certificate.yaml
|
|
- zipline/zipline-certificate.yaml
|
|
# - vaultwarden/vaultwarden-certificate.yaml
|
|
- databasus/databasus-certificate.yaml
|
|
- excalidraw/excalidraw-certificate.yaml
|
|
- gotify/gotify-certificate.yaml
|
|
- uptime-kuma/uptime-kuma-certificate.yaml
|
|
# - ollama/ollama-certificate.yaml
|
|
# - openwebui/openwebui-certificate.yaml
|
|
- searxng/searxng-certificate.yaml
|
|
# - affine/affine-certificate.yaml
|
|
- pelican/pelican-certificate.yaml
|
|
- pelican/pelican-wings-mc-certificate.yaml
|
|
- pelican/pelican-wings-ark-certificate.yaml
|
|
- outline/outline-certificate.yaml
|
|
- netbox/netbox-certificate.yaml
|
|
|
|
patches:
|
|
# Internal gateway patches
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: authentik/authentik-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: argocd/argocd-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: gitea/gitea-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: immich/immich-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: infisical/infisical-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: longhorn/longhorn-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: n8n/n8n-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: netbootxyz/netbootxyz-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: resume/resume-minio-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: resume/resume-minio-webui-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: technitium/technitium-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: technitium/technitium-backup-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: unifi/unifi-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: proxmox/proxmox-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: truenas/truenas-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: monitoring/monitoring-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: bentopdf/bentopdf-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: it-tools/it-tools-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: jellyfin/jellyfin-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: passbolt/passbolt-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: resume/resume-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: wikijs/wikijs-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: zipline/zipline-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: minio-aistor/minio-aistor-api-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: minio-aistor/minio-aistor-console-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: vaultwarden/vaultwarden-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: databasus/databasus-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: excalidraw/excalidraw-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: gotify/gotify-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: uptime-kuma/uptime-kuma-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: ollama/ollama-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: openwebui/openwebui-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: searxng/searxng-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: affine/affine-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: pelican/pelican-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: pelican/pelican-wings-mc-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: pelican/pelican-wings-ark-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: outline/outline-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: netbox/netbox-gateway-patch.yaml
|
|
|
|
# Public gateway patches
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: gitea/gitea-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: authentik/authentik-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: bentopdf/bentopdf-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: it-tools/it-tools-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: jellyfin/jellyfin-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: immich/immich-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: passbolt/passbolt-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: resume/resume-gateway-public-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-public
|
|
# path: wikijs/wikijs-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: zipline/zipline-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: excalidraw/excalidraw-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: gotify/gotify-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: outline/outline-gateway-public-patch.yaml
|
|
# Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-public
|
|
# path: monitoring/monitoring-grafana-gateway-public-patch.yaml
|