notandClaude Opus 5
56cba9c340
`public.domain` is the whole switch. Empty — the default, and what compose, CI and a laptop cluster use — renders nothing new and leaves every manifest as it was. Set it and templates/edge.yaml adds a Caddy deployment that gets its own certificates from Let's Encrypt and proxies the five browser-facing hostnames to the ClusterIP services, so a public deployment doesn't use their NodePorts at all. Caddy rather than an ingress controller because the four portals already run caddy:2-alpine (ADR-0034, whose ceiling note called exactly this out): no new dependency, no cert-manager, no CRDs, no Ingress objects for five hostnames that never change. The Fedora host keeps only a layer-4 forward of 80/443, because the public IP is there and nothing in the cluster can claim it. KC_HOSTNAME and the portals' config.json now both come from `big.keycloakUrl`, so the issuer a token carries and the authority the BFF discovers are one string by construction (ADR-0010) rather than by two templates agreeing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
45 lines
1.7 KiB
YAML
45 lines
1.7 KiB
YAML
{{- /*
|
|
Shared env blocks — the Kubernetes equivalent of the YAML anchors in
|
|
infra/docker-compose.yml (&oz-env, &nrc-env, &objecttypen-env, &objecten-env).
|
|
A workload picks them up with `envFrom`, so the web/celery/init variants of an
|
|
upstream image stay guaranteed-identical, and `kubectl get cm oz-env -o yaml`
|
|
shows what a pod actually got.
|
|
|
|
The *file* inputs (setup_configuration data.yaml, Keycloak realms, BPMN/DMN, the
|
|
seed scripts) are NOT here: they live in the repo and are turned into ConfigMaps
|
|
by infra/helm/seed-configmaps.sh, exactly as infra/seed-config.sh streams them
|
|
into the compose config volumes. Copying them into the chart would fork them.
|
|
*/ -}}
|
|
{{- range $group, $env := .Values.envGroups }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ $group }}-env
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" (printf "%s-env" $group)) | nindent 4 }}
|
|
data:
|
|
{{- range $k, $v := $env }}
|
|
{{ $k }}: {{ tpl (toString $v) $ | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- /*
|
|
Portal OIDC config. The images bake config.json with the compose authority
|
|
(keycloak:8080), which a browser outside the cluster cannot resolve; these
|
|
ConfigMaps mount over it with the node address Keycloak's issuer is pinned to
|
|
(KC_HOSTNAME below), so the token the browser gets and the issuer the BFF
|
|
discovers are the same string. Same mechanism as infra/host-browser.yml.
|
|
*/ -}}
|
|
{{- range $realm := list "digid" "medewerker" }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: portal-config-{{ $realm }}
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" (printf "portal-config-%s" $realm)) | nindent 4 }}
|
|
data:
|
|
config.json: |
|
|
{ "authority": "{{ include "big.keycloakUrl" $ }}/realms/{{ $realm }}" }
|
|
{{- end }}
|