sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
569 commits 1 branch 0 tags 1.5 MiB
Commit graph

38 commits

Author SHA1 Message Date
sirius0xdev
69db1cf1f2 Remove invalid Tailscale operator tags 
The tag:k8s-operator and tag:tailnet tags don't exist in tailnet ACLs,
causing 400 errors on key creation. Set tags to empty for now.
 2026-05-04 03:59:08 +00:00
sirius0xdev
f30cb6e8fb fix secret 2026-05-04 03:52:25 +00:00
sirius0xdev
189b7a73d6 Fix Tailscale operator secret name to 'operator' 2026-05-04 03:20:46 +00:00
sirius0xdev
0b80ba0068 Remove SOPS-encrypted authkey secret from Kustomize 
Flux can't decrypt SOPS files in this setup. The secret will be
created manually on the cluster and won't be garbage collected by
Flux since it's not in the Kustomization resources.
 2026-05-04 03:10:50 +00:00
sirius0xdev
904152754d Add SOPS-encrypted Tailscale operator authkey secret 
Replaces manual secret creation with a repo-managed encrypted secret.
Decrypted value contains the operator authkey for tailscale login.
 2026-05-04 03:09:16 +00:00
sirius0xdev
28fc3202a3 Fix Tailscale operator PodSecurity issues 
- Change namespace from enforce:restricted to warn:restricted to allow operator to run without PodSecurity blocking
- Remove runAsUser:0 from operator as it's no longer needed
- This allows the Tailscale operator to run with its default configuration
 2026-05-04 03:02:09 +00:00
sirius0xdev
fbf3e4a55b Fix Tailscale operator: run as root (no longer needs restricted PodSecurity) 
The Tailscale operator requires /.config and root-level paths.
Namespace 'tailscale' had its pod-security.kubernetes.io/enforce label
removed, so runAsNonRoot is no longer required.
 2026-05-04 02:54:30 +00:00
sirius0xdev
0e60fff9a6 fix secret values 2026-05-04 02:53:03 +00:00
sirius0xdev
78c354bd72 Merge branch 'master' of github.com:sirius0xdev/gcloud-lab 
hhh#
 2026-05-04 02:46:43 +00:00
sirius0xdev
eb50df5356 fix secret key values 2026-05-04 02:46:37 +00:00
sirius0xdev
035ff4d428 Fix Tailscale operator: set runAsUser/runAsGroup for non-root image 
The tailscale/k8s-operator image runs as root by default, conflicting
with runAsNonRoot=true. Set runAsUser:65532 (nobody) to satisfy both
PodSecurity and container runtime.
 2026-05-04 02:36:59 +00:00
sirius0xdev
2ab4a78825 Fix Tailscale operator: add securityContext for PodSecurity restricted policy 
The merged PR was missing securityContext/podSecurityContext values
required by the namespace's restricted:latest PodSecurity policy.
Without these, pods fail to create with FailedCreate errors.
 2026-05-04 02:26:09 +00:00
sirius0xdev
21cebbc763 fix secret name in kustomization 2026-05-04 02:05:59 +00:00
sirius0xdev
80fe227e3c add dummy secret 2026-05-04 02:03:08 +00:00
sirius0xdev
b10ca9ab7d remove secret 2026-05-04 01:54:41 +00:00
sirius0xdev
484d4f1d1f
Merge branch 'master' into fix/tailscale-timeout 2026-05-03 21:47:26 -04:00
sirius0xdev
6ca9871dfe
Merge pull request #89 from sirius0xdev/fix/age-key-encryption 
fix: re-encrypt authkey secret with correct age key
 2026-05-03 21:42:44 -04:00
sirius0xdev
116ac9ca48 Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity 
- Bump chart version 1.86.x -> 1.96.x
- Migrate operator: -> operatorConfig: (new chart structure)
- Disable OAuth/OIDC to use existing authkey secret
- Add securityContext for restricted:latest PodSecurity policy
- Add podSecurityContext.runAsNonRoot
- Drop ALL capabilities, disable privilege escalation
- Add RuntimeDefault seccomp profile
 2026-05-04 01:41:50 +00:00
sirius0xdev
b40ffc68cb update release 2026-05-04 01:17:40 +00:00
sirius0xdev
dc400a364d fix tsproxy issue 2026-05-04 01:09:48 +00:00
sirius0xdev
896ecc8c51 Merge branch 'master' of github.com:sirius0xdev/gcloud-lab 
i am the captain #
 2026-05-04 01:07:18 +00:00
sirius0xdev
3874014c85 fix kustomizations 2026-05-04 01:07:09 +00:00
sirius0xdev
503e8c4813
Merge branch 'master' into fix/age-key-encryption 2026-05-03 20:53:40 -04:00
sirius0xdev
bf4a2b260f fix: increase tailscale-operator HelmRelease timeout to 15m 2026-05-04 00:50:43 +00:00
sirius0xdev
2b6225c4e8 fix: increase tailscale-operator HelmRelease timeout to 10m (install was timing out) 2026-05-04 00:48:09 +00:00
sirius0xdev
852d2c76c1 fix: update tailscale operator authkey with fresh single-use key 2026-05-04 00:43:59 +00:00
sirius0xdev
caf08571c1 fix: re-encrypt authkey secret with correct age key 2026-05-04 00:41:27 +00:00
sirius0xdev
83b70951c6 fix(tailnet): move TsProxy to separate Kustomization that depends on operator 
- Remove TsProxy from infrastructure-controllers to avoid CRD timing issue
- Create infrastructure/tailnet/ Kustomization for TsProxy resources
- Add infrastructure-tailnet Flux Kustomization with dependsOn
- Add dependsOn to customer1 Kustomization for trade-dashboard TsProxy
 2026-05-04 00:06:51 +00:00
sirius0xdev
5f9b55af55 feat(tailscale): add operator authkey secret and rtx6000-brain TsProxy 
- Add SOPS-encrypted tailscale-operator-authkey secret for operator auth
- Add TsProxy to expose rtx6000-brain-service on tailnet (port 8000)
- Enable trade-dashboard TsProxy (was waiting for operator install)
 2026-05-03 23:30:28 +00:00
sirius0xdev
bd760287a8 fix(rtx6000): enable scale-to-zero with 20min cooldown + wake-up route 
- Set replicas.min: 0 for scale-to-zero when idle
- Add config.cooldownPeriod: 1200 to KEDA HTTP add-on HelmRelease
  (20 min buffer before scaling down from 1 replica)
- Add external HTTPRoute at brain.siriusdevops.com for manual wake-up
  via curl from Hermes/Telegram
 2026-04-29 16:01:03 +00:00
Hermes Agent
6183159974 feat: add Prometheus, Grafana, and Tailscale monitoring stack 
- Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress)
- Deploy Tailscale Operator for secure VPN access to internal services
- Add CNPG/PostgreSQL monitoring dashboards
- Add vLLM inference monitoring dashboards (tokens, latency, GPU)
- Add Cilium networking dashboards (policy, traffic, drops)
- Update infra-controllers staging kustomization to include all controllers
- Add monitoring-configs Flux sync for dashboard deployment
- Update README with monitoring architecture and access instructions
- Remove broken stale monitoring files (Azure Key Vault refs, wrong domains)

Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
 2026-04-26 02:31:53 +00:00
sirius0xdev
7a3126caff working on certmanager and promethus stack 2026-04-23 01:19:56 +00:00
Sirius Claw
4fb80d3157 fix: update KEDA Helm controllers to Flux v2 APIs 2026-04-20 04:00:10 +00:00
Sirius Claw
e736d5f874 feat: Add KEDA and KEDA HTTP Add-on controllers 2026-04-20 03:36:34 +00:00
sirius0xdev
b6d93886bf fix infra kustomization.yaml 2026-02-02 23:28:51 +00:00
sirius0xdev
995baa64cb added service account for db backups and changed terraform to include bucket and service accounts 2026-02-02 23:20:46 +00:00
sirius0xdev
b0eb3c2e8c fix release.yaml 2026-01-06 01:54:18 +00:00
sirius0xdev
521ea092af fix dir structure 2026-01-06 01:30:10 +00:00