bluejay/bluejay-infra
1
0
Fork 0
Code Issues Pull Requests 15 Actions Packages Projects Releases Wiki Activity

platform: preserve GX10 Traefik client source IP

Browse Source
This commit is contained in:
Andrew Stoltz
2026-06-18 16:25:46 -05:00
parent 9cef99739a
commit ac153248c2
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
gx10/platform/README.md
View File

@@ -8,7 +8,7 @@ auto-deploy them there. Once ArgoCD is stood up on the GX10, a GX10-only
ApplicationSet (`apps-gx10/*`) will own these. ApplicationSet (`apps-gx10/*`) will own these.
- `step-ca-acme.yaml` — cert-manager ClusterIssuer (ACME → noc1 step-ca, in-spec caBundle). APPLIED + Ready. - `step-ca-acme.yaml` — cert-manager ClusterIssuer (ACME → noc1 step-ca, in-spec caBundle). APPLIED + Ready.
- `traefik-helmchart.yaml` — Traefik v3.6.10 (chart 39.0.5) via the RKE2 HelmChart CRD, LoadBalancer VIP 10.0.57.202 (prod-pool; temp parallel-run VIP — canonical .200 reclaimed at cutover). APPLIED. - `traefik-helmchart.yaml` — Traefik v3.6.10 (chart 39.0.5) via the RKE2 HelmChart CRD, LoadBalancer VIP 10.0.57.202 (prod-pool; temp parallel-run VIP — canonical .200 reclaimed at cutover), with `externalTrafficPolicy: Local` so tenant IP allowlists see client source IP instead of the GX10 node hop. APPLIED.
cert-manager v1.17.2 was installed separately (upstream static manifest). See cert-manager v1.17.2 was installed separately (upstream static manifest). See
`docs/ai-agents/gx10-migration-continuation-2026-06-14.md` + memory `docs/ai-agents/gx10-migration-continuation-2026-06-14.md` + memory

2
gx10/platform/traefik-helmchart.yaml
View File

@@ -27,6 +27,8 @@ spec:
enabled: true enabled: true
service: service:
type: LoadBalancer type: LoadBalancer
spec:
externalTrafficPolicy: Local
annotations: annotations:
metallb.io/loadBalancerIPs: "10.0.57.202" metallb.io/loadBalancerIPs: "10.0.57.202"
metallb.io/address-pool: "prod-pool" metallb.io/address-pool: "prod-pool"

10
tests/bluejay-infra-lint/FleetManifestLintTests.cs
View File

@@ -249,6 +249,16 @@ public sealed class FleetManifestLintTests
violations.Should().BeEmpty(); violations.Should().BeEmpty();
} }
[Fact]
public void Gx10TraefikLoadBalancer_MustPreserveClientSourceIp()
{
var path = Path.Combine(Inventory.BluejayRoot, "gx10", "platform", "traefik-helmchart.yaml");
var manifest = File.ReadAllText(path);
manifest.Should().Contain("metallb.io/loadBalancerIPs: \"10.0.57.202\"");
manifest.Should().Contain("spec:\n externalTrafficPolicy: Local");
}
[Fact] [Fact]
public void ApiKeyProtectedDeployments_MustUseTcpSocketHealthProbes() public void ApiKeyProtectedDeployments_MustUseTcpSocketHealthProbes()
{ {