kubernetes deployment strategy notes

traefik/README.md

@@ -0,0 +1,3 @@
+I did rely on AI to help deploy Traefik since it had been several years since the last time I'd done so.  Traefik has a lot of "knobs to fiddle with" when deploying and I wanted the simplest, most straightforward way to handle it.  Specifically, I wanted Openshift wildcard route style ingress eg; my-app.k8s.lab.cudanet.org, vs. the other way Traefik is often configured with apps as subpaths, eg; traefik.k8s.lab.cudanet.org/my-app.  Not what I wanted.
+
+Once you meet the requirements for Traefik - ie; need a LoadBalancer provider like MetalLB.  Need CSI set up to provision PVCs, Traefik is pretty straightforward.  You do also have to create your wildcard DNS entry once your LB is provisioned though.

traefik/traefik-values.yaml

@@ -0,0 +1,43 @@
+# Enable API & Dashboard
+api:
+  dashboard: true
+  insecure: true
+
+# Define ports
+ports:
+  web:
+    port: 8000
+    exposedPort: 80
+  websecure:
+    port: 8443
+    exposedPort: 443
+
+# Enable SafeNaming and allow cross-namespace routing
+providers:
+  kubernetesCRD:
+    allowCrossNamespace: true
+
+# If you want to enable the dashboard via IngressRoute
+ingressRoute:
+  dashboard:
+    enabled: true
+
+# Traefik static arguments for HTTP->HTTPS redirect & Let's Encrypt DNS-01 (Cloudflare)
+additionalArguments:
+  - "--providers.kubernetescrd.safenaming=true"
+  - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+  - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+  - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
+  - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
+  - "--certificatesresolvers.letsencrypt.acme.email=admin@cudanet.org"
+  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
+
+env:
+  - name: CF_DNS_API_TOKEN
+    value: "<changeme>"
+
+# Match existing 128Mi size to satisfy immutability checks
+persistence:
+  enabled: true
+  path: /data
+  size: 1Gi

traefik/wildcard.yaml

@@ -0,0 +1,20 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard-wildcard
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`traefik.k8s.lab.cudanet.org`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
+      kind: Rule
+      services:
+        - name: api@internal
+          kind: TraefikService
+  tls:
+    certResolver: letsencrypt
+    domains:
+      - main: "*.k8s.lab.cudanet.org"
+        sans:
+          - "k8s.lab.cudanet.org"