commit 5697907bf773e2e213d0b75c18fab11d928ad937 parent 4eb91b2382771d7e06d845194eeda2cb7f62313c Author: MTRNord <MTRNord@users.noreply.github.com> Date: Sat, 7 Mar 2026 16:03:27 +0100 fix api Signed-off-by: MTRNord <MTRNord@users.noreply.github.com> Diffstat:
| D | apps/base/matrix/connectivity-tester/config.json | | | 3 | --- |
| D | apps/base/matrix/connectivity-tester/deployment.yaml | | | 359 | ------------------------------------------------------------------------------- |
| D | apps/base/matrix/connectivity-tester/kustomization.yaml | | | 16 | ---------------- |
| D | apps/base/matrix/connectivity-tester/service.yaml | | | 23 | ----------------------- |
| D | apps/base/matrix/connectivity-tester/staging_config.json | | | 3 | --- |
| D | apps/base/matrix/connectivity-tester/staging_deployment.yaml | | | 171 | ------------------------------------------------------------------------------- |
| M | apps/talos_cluster/connectivity-tester/connectivity_tester.yaml | | | 88 | ++++++++++++++++++++++++++++++++++++++++---------------------------------------- |
| M | apps/talos_cluster/connectivity-tester/staging_config.json | | | 2 | +- |
| M | apps/talos_cluster/connectivity-tester/staging_deployment.yaml | | | 28 | ++++++++++++++++------------ |
| M | apps/talos_cluster/envoy-gateway/gateway_settings.yaml | | | 12 | ++++++++++++ |
10 files changed, 73 insertions(+), 632 deletions(-)
diff --git a/apps/base/matrix/connectivity-tester/config.json b/apps/base/matrix/connectivity-tester/config.json @@ -1,3 +0,0 @@ -{ - "api_server_url": "https://api.connectivity-tester.mtrnord.blog" -} diff --git a/apps/base/matrix/connectivity-tester/deployment.yaml b/apps/base/matrix/connectivity-tester/deployment.yaml @@ -1,359 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: connectivity-tester - namespace: matrix -spec: - progressDeadlineSeconds: 120 - strategy: - rollingUpdate: - maxUnavailable: 0 - type: RollingUpdate - selector: - matchLabels: - app: connectivity-tester - template: - metadata: - labels: - app: connectivity-tester - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - connectivity-tester - topologyKey: "kubernetes.io/hostname" - hostNetwork: false - containers: - - name: connection-checker-ui - image: ghcr.io/mtrnord/matrix-connection-tester-ui:v0.2.0 - imagePullPolicy: Always - lifecycle: - preStop: - exec: - command: - - sleep - - "10" - resources: - limits: {} - requests: - memory: "344Mi" - cpu: "252m" - ports: - - containerPort: 3000 - name: web - protocol: TCP - volumeMounts: - - name: configs - mountPath: "/usr/share/nginx/html/config.json" - subPath: config.json - readOnly: true - - mountPath: /tmp - name: tmp - livenessProbe: - httpGet: - path: / - port: web - scheme: HTTP - readinessProbe: - httpGet: - path: / - port: web - scheme: HTTP - startupProbe: - httpGet: - path: / - port: web - volumes: - - name: configs - configMap: - name: connectivity-tester-config - - name: tmp - emptyDir: - sizeLimit: 2048Mi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: connectivity-tester-api - namespace: matrix -spec: - progressDeadlineSeconds: 120 - strategy: - rollingUpdate: - maxUnavailable: 0 - type: RollingUpdate - selector: - matchLabels: - app: connectivity-tester-api - template: - metadata: - labels: - app: connectivity-tester-api - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - connectivity-tester-api - topologyKey: "kubernetes.io/hostname" - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet - containers: - - name: federation-tester-api - image: ghcr.io/mtrnord/rust-federation-tester:v0.2.2 - imagePullPolicy: IfNotPresent - resources: - limits: {} - requests: - memory: "344Mi" - cpu: "252m" - volumeMounts: - - name: api-config - mountPath: /app/config.yaml - subPath: config.yaml - readOnly: true - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - ports: - - containerPort: 8080 - name: api - protocol: TCP - readinessProbe: - httpGet: - path: /healthz - port: api - scheme: HTTP - livenessProbe: - httpGet: - path: /healthz - port: api - scheme: HTTP - startupProbe: - httpGet: - path: /healthz - port: api - volumes: - - name: api-config - secret: - secretName: connectivity-tester-config ---- -apiVersion: flagger.app/v1beta1 -kind: MetricTemplate -metadata: - name: connectivity-tester-latency - namespace: matrix -spec: - provider: - type: prometheus - address: "http://thanos-query-frontend.monitoring.svc.cluster.local:10902" - query: | - histogram_quantile(0.99, - sum( - irate( - envoy_cluster_upstream_rq_time_bucket{ - envoy_cluster_name=~".*{{ namespace }}/{{ target }}.*", - }[{{ interval }}] - ) - ) by (le) - )/1000 ---- -apiVersion: flagger.app/v1beta1 -kind: MetricTemplate -metadata: - name: connectivity-tester-error-rate - namespace: matrix -spec: - provider: - type: prometheus - address: "http://thanos-query-frontend.monitoring.svc.cluster.local:10902" - query: | - sum( - rate( - envoy_cluster_upstream_rq{ - envoy_cluster_name=~".*{{ namespace }}/{{ target }}.*", - envoy_response_code!~"5.*" - }[{{ interval }}] - ) - ) - / - sum( - rate( - envoy_cluster_upstream_rq_total{ - envoy_cluster_name=~".*{{ namespace }}/{{ target }}.*", - }[{{ interval }}] - ) - ) / 100 ---- -apiVersion: flagger.app/v1beta1 -kind: Canary -metadata: - name: connectivity-tester - namespace: matrix -spec: - # deployment reference - targetRef: - apiVersion: apps/v1 - kind: Deployment - name: connectivity-tester - # the maximum time in seconds for the canary deployment - # to make progress before it is rollback (default 600s) - progressDeadlineSeconds: 60 - # HPA reference (optional) - #autoscalerRef: - # apiVersion: autoscaling/v2 - # kind: HorizontalPodAutoscaler - # name: connectivity-tester - service: - # service port number - port: 3000 - # container port number or name (optional) - targetPort: 3000 - # Gateway API HTTPRoute host names - hosts: - - connectivity-tester.mtrnord.blog - - federationtester.mtrnord.blog - # Reference to the Gateway that the generated HTTPRoute would attach to. - gatewayRefs: - - name: envoy-gateway - namespace: envoy-gateway - retries: - attempts: 10 - perTryTimeout: 5s - retryOn: "gateway-error,connect-failure,refused-stream" - analysis: - # schedule interval (default 60s) - interval: 1m - # max number of failed metric checks before rollback - threshold: 5 - # max traffic percentage routed to canary - # percentage (0-100) - maxWeight: 50 - # canary increment step - # percentage (0-100) - stepWeight: 10 - metrics: - - name: error-rate - # max error rate (5xx responses) - # percentage (0-100) - templateRef: - name: connectivity-tester-error-rate - namespace: matrix - thresholdRange: - max: 2 - interval: 1m - - name: latency - templateRef: - name: connectivity-tester-latency - namespace: matrix - # seconds - thresholdRange: - max: 1 - interval: 30s - sessionAffinity: - cookieName: flagger-cookie - # testing (optional) - webhooks: - - name: smoke-test - type: pre-rollout - url: http://flagger-loadtester.flagger-system/ - timeout: 15s - metadata: - type: bash - cmd: "curl -s http://connectivity-tester-canary.matrix:3000" - - name: load-test - url: http://flagger-loadtester.flagger-system/ - timeout: 10m - metadata: - cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-canary.matrix/?serverName=mtrnord.blog" ---- -apiVersion: flagger.app/v1beta1 -kind: Canary -metadata: - name: connectivity-tester-api - namespace: matrix -spec: - # deployment reference - targetRef: - apiVersion: apps/v1 - kind: Deployment - name: connectivity-tester-api - # the maximum time in seconds for the canary deployment - # to make progress before it is rollback (default 600s) - progressDeadlineSeconds: 60 - # HPA reference (optional) - #autoscalerRef: - # apiVersion: autoscaling/v2 - # kind: HorizontalPodAutoscaler - # name: connectivity-tester - service: - # service port number - port: 8080 - # container port number or name (optional) - targetPort: 8080 - # Gateway API HTTPRoute host names - hosts: - - api.connectivity-tester.mtrnord.blog - # Reference to the Gateway that the generated HTTPRoute would attach to. - gatewayRefs: - - name: envoy-gateway - namespace: envoy-gateway - retries: - attempts: 10 - perTryTimeout: 5s - retryOn: "gateway-error,connect-failure,refused-stream" - analysis: - # schedule interval (default 60s) - interval: 1m - # max number of failed metric checks before rollback - threshold: 5 - # max traffic percentage routed to canary - # percentage (0-100) - maxWeight: 50 - # canary increment step - # percentage (0-100) - stepWeight: 10 - metrics: - - name: error-rate - # max error rate (5xx responses) - # percentage (0-100) - templateRef: - name: connectivity-tester-error-rate - namespace: matrix - thresholdRange: - max: 2 - interval: 1m - - name: latency - templateRef: - name: connectivity-tester-latency - namespace: matrix - # seconds - thresholdRange: - max: 1 - interval: 30s - sessionAffinity: - cookieName: flagger-cookie - # testing (optional) - webhooks: - - name: smoke-test - type: pre-rollout - url: http://flagger-loadtester.flagger-system/ - timeout: 15s - metadata: - type: bash - cmd: "curl -s http://connectivity-tester-api-canary.matrix:8080/healthz | grep 'ok'" - - name: load-test - url: http://flagger-loadtester.flagger-system/ - timeout: 10m - metadata: - cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-api-canary.matrix/api/federation/federation-ok?serverName=mtrnord.blog&no_cache=true" diff --git a/apps/base/matrix/connectivity-tester/kustomization.yaml b/apps/base/matrix/connectivity-tester/kustomization.yaml @@ -1,16 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: matrix -resources: - - staging_deployment.yaml - - deployment.yaml - - service.yaml -configMapGenerator: - - name: connectivity-tester-config - namespace: matrix - files: - - config.json=config.json - - name: connectivity-tester-stage-config - namespace: matrix - files: - - config.json=staging_config.json diff --git a/apps/base/matrix/connectivity-tester/service.yaml b/apps/base/matrix/connectivity-tester/service.yaml @@ -1,23 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: connectivity-tester-api-temp - namespace: matrix -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - connectivity-tester.mtrnord.blog - - federationtester.mtrnord.blog - rules: - - matches: - - path: - value: /api - type: PathPrefix - backendRefs: - - name: connectivity-tester-api-primary - port: 8080 - timeouts: - request: 240s - backendRequest: 0s diff --git a/apps/base/matrix/connectivity-tester/staging_config.json b/apps/base/matrix/connectivity-tester/staging_config.json @@ -1,3 +0,0 @@ -{ - "api_server_url": "https://stage.connectivity-tester.mtrnord.blog" -} diff --git a/apps/base/matrix/connectivity-tester/staging_deployment.yaml b/apps/base/matrix/connectivity-tester/staging_deployment.yaml @@ -1,171 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: connectivity-tester-stage - namespace: matrix -spec: - progressDeadlineSeconds: 120 - strategy: - rollingUpdate: - maxUnavailable: 0 - type: RollingUpdate - selector: - matchLabels: - app: connectivity-tester-stage - template: - metadata: - labels: - app: connectivity-tester-stage - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - connectivity-tester-stage - topologyKey: "kubernetes.io/hostname" - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - connectivity-tester-api - topologyKey: "kubernetes.io/hostname" - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet - containers: - - name: federation-tester-api - image: ghcr.io/mtrnord/rust-federation-tester:main - imagePullPolicy: Always - resources: - limits: {} - requests: - memory: "344Mi" - cpu: "252m" - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - volumeMounts: - - name: api-config - mountPath: /app/config.yaml - subPath: config.yaml - readOnly: true - ports: - - containerPort: 8080 - name: api - protocol: TCP - readinessProbe: - httpGet: - path: /healthz - port: api - scheme: HTTP - livenessProbe: - httpGet: - path: /healthz - port: api - scheme: HTTP - startupProbe: - httpGet: - path: /healthz - port: api - - name: connection-checker-ui - image: ghcr.io/mtrnord/matrix-connection-tester-ui:main - imagePullPolicy: Always - lifecycle: - preStop: - exec: - command: - - sleep - - "10" - resources: - limits: {} - requests: - memory: "344Mi" - cpu: "252m" - ports: - - containerPort: 3000 - name: web - protocol: TCP - volumeMounts: - - name: configs - mountPath: "/usr/share/nginx/html/config.json" - subPath: config.json - readOnly: true - - mountPath: /tmp - name: tmp - livenessProbe: - httpGet: - path: / - port: web - scheme: HTTP - readinessProbe: - httpGet: - path: / - port: web - scheme: HTTP - startupProbe: - httpGet: - path: / - port: web - volumes: - - name: configs - configMap: - name: connectivity-tester-stage-config - - name: tmp - emptyDir: - sizeLimit: 2048Mi - - name: api-config - secret: - secretName: connectivity-tester-stage-config ---- -apiVersion: v1 -kind: Service -metadata: - name: connectivity-tester-stage -spec: - selector: - app: connectivity-tester-stage - ports: - - name: api - port: 8080 - targetPort: 8080 - - name: web - port: 3000 - targetPort: 3000 ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: connectivity-tester-stage - namespace: matrix -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - stage.connectivity-tester.mtrnord.blog - rules: - - matches: - - path: - value: /api - type: PathPrefix - backendRefs: - - name: connectivity-tester-stage - port: 8080 - timeouts: - request: 240s - backendRequest: 0s - - matches: - - path: - value: / - type: PathPrefix - backendRefs: - - name: connectivity-tester-stage - port: 3000 - timeouts: - request: 240s - backendRequest: 0s diff --git a/apps/talos_cluster/connectivity-tester/connectivity_tester.yaml b/apps/talos_cluster/connectivity-tester/connectivity_tester.yaml @@ -1,57 +1,57 @@ apiVersion: v1 kind: Secret metadata: - name: connectivity-tester-stage-config - namespace: matrix + name: connectivity-tester-stage-config + namespace: matrix type: Opaque stringData: - config.yaml: ENC[AES256_GCM,data:ddgSAW7lFXtemFOykySQX1QSHAYqUGsLHHlxDxEPiwaCni+pWpTuuiffbTtJ/IPmhcBdMhaEMi6pAqKAaxYdpzagwtg+HMLT4ROO+RXJ1S5DUrJUwuY8k/doezslcxOC8G9g61/RI/t6EDUauOICKgERSQTxtaMksdZKCxiSXkCMWtVwWwQAbh050Oqo+ikCU4CcfMwgUNMVq1uMCzL+01EeEhsuxg/T/ytKveId7n3wRcc1Ia3vMDuvPRMrhhk1pHjVPSMbwo10uywhvJyRRkkDO0TPqc5JuZcNcUv21aySKY0Gr3kU1lbDGb0wzyetT6Suy4eJlxIfAOF0OX6ObOrZPKE9+gS3QHN5+C7tXSJdcDHdPj6++QFD92LjtfY3Ol7kyZsDH1x7Ogjg56Eol9l0Fdvx8zwG/ZMsiTvlXQjoUQBVN9u3Iv8M4Rw6Q13qmkPGcLUCkLqYJ6cI1xJsQEy1rM7KPuAk2+zgE0LJ1Ia48e2hheQJyeF2nlc9hazwP4SD8LBCXSJn/eDoi08DmlHMTtcDBVapLxupHc0FmoyoHZRbtr7hAvBb8DNQitrGBeucd3hdtIX0y/NsLMFNOIPAo+kfFkX8m7BLDtrf8uSlNgjEJ5sXPSNQDWebEiAV84jdEAQjs66dExxKvrHlalJ1Y30UnduGfacTLoNm+odJKSTRnDh6aX9BglVnq0LckesN/kGqTJDilwzcXpmbiYRNge+/msGn92kH1t/UEvIoCkruJflRj2Tfkqj5hClEAFwnObIAOmbn59TC2B6NgUvDizRs9M6gFM31ZHVjpX3dPtEvvJYvFDXcNZKebWGR8Kl1Xta9ZsThpFDelrnVpb2sglrkPdJbYGmXdWZ3gl9V6Y9eRfmyCkpVCj/71dmEZmfkPihyhMmyhGozfWHKCIC30EjQI8NsBoTqYSaoN1ebg9cBuFzCmZ7Z49gIUOfKa82AMRAInPh8toWYZWS3fKhqwjvpKvNn3yxkHnigpCDLl/uHuPdYOUJgBQDT3Xe881GYyacIIRR3OoOd4MFBj2ELHtzQkoOe/ENmRSmqm7R/zNr6rheL60HpXo0W8fRpMecnA+/OxndvSofDuDgzwggiO5QEzcPYw3jKfZF+wvbZ+v968UZ/+TCvSPXOMqKrAPhM30g7Hi2jU2GKy0bytlP/bVoqGz+WLZfgBITpN3y13OKMrIclQlzscw4r4X3eMgqRacciwzl1OQ==,iv:z3QkqeqqJo6V23C3rqB4nQ7HWZszE8Ma9NZ65pJGk8Y=,tag:Xh3FCg/OF3FWkActOneiUw==,type:str] + config.yaml: ENC[AES256_GCM,data:hKtIzBe2CD2smT60U/5SaWmYzdcm+3cjTk/qlhqlOuBq9nD22CWNAG+0QA4GOy0bI+cloFfqU2fySI54hKLU9YOc85d/GkQtYYoAyLvhubwQIwWfWNTjCn+Q59m72jiUKRH85ymbTDgbPBAkIEUbdc1F7Hrm/0tWTx3dMU6z1Vb0Pyjo4OSB4tcpKZt/rT6crOKkcKvCjiv1iH+xsz2XWpXJI0mw/yIwNGd2gVDlSB1kbvTEYGCfsklLUIdsAYPW5VU7bpFQRQ52GL33IZ8tOM4aiKpVZugV2JSwKS7uBUH6a723yP+HvS6HWthh5tBriYmEn9Mz/h1Odoi1OVg73nEq8Z1Cp6dpNRorbqSU+aTMmlU16ykkNpY5bhyXR3OoIKTvuQi+7j6ZUFxkYjN/DL/8TA2I/7LhaFhBhnJh8TtMQ0fnY5nuy8cABAY2c5dkdtXm+/qhap0OVeb2BQCSCqXDy0m2mX8/shzn1a5pikEu33UZqeDMoFPgGFAQNj+u3YjNX8V5NIPWzPahN+aC7vJTt/V8KaDq0KDllTht/Ii7mDbfkFYg8xsKhXgYKeGW7x8MZmIiLCVmdLKZYprJMUP46SWhibXdt8VSKS2AFJXIzZGHoFgQOpPtTUbiyl8MS6UHKw1vjYovTaVMLDzDz+S1l8kePKWoxsMupRwc6mYPoRrul280YVSQYi0mTZ2B7QZh6EysDiYkC74NguaV2GexnoMJzfIohAPSvEHWqqJ5jyVj+jY3PlogdIbw4rAwQ1dEW2e6AYAuM3Uoqqg7hJy+fYPkRuMjLxxjXSbkGoZuT1sdByqIk7HEUaUynkFqWI4pYPxf7OvuX7WQIJV89wTx2HEJiRQLN+EDFb/S9bPkk/lzSIjgsyqJKF7gkRA+STrv5qaz75GBL+yIKh87XNF5gQs+ThdVwSF8wWrulUylEFFXCSBe7rZcAFDMZghOSfUPTyWnGXEb5xnpLnyHcMvLxaf0naTk+y90FY3ipsAh1ggqn1RAtgsdrk6933f1VVKqBN235Kolv7fXsdFgrbx0FGHLe9gvdV5u8RD4zFgfLd9nMUcu+nLbKZGqD7oFqzKus1mGDrFZ3pGqrx251wMvrvP7mj8HmTGgPnBqaHPQaj1Az8PP9GjqxmlofNzoZW0VamY3gyF7Y0K9h4/1Bsr0v9WIHthpC2+38vP4hJhhVcTUfyTAF8ThDqCZgY4QzcHX3oLNvIjj3GPjbvE=,iv:B8/GabqRH4vdd+xQlayk0KPdW9/TZMecRMPvEz+gLEw=,tag:0W7hGIk/ZKo9fVXshL7/Bw==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUDd3Q2ZrcWRJeXVKdmxs - UVhET0p3VW13SGZ2UGc2bE1oNUduTURNNVdjCmxkT01KZTl0QnVDek9XUjRyWjhU - N1hDTUd2ck1vL3QzcnN5SkF4Q014aTgKLS0tIDZLYm1NWXZqU1RlZ1ZrYWtieWxU - SXVDSGMyTjhqbWhvUzNQWk9CR1A4MVkKHSiUheRpdkmvhY0Y3yvsYWQHYjZJRgEs - weOy+GG0WF4Gj+r6SgwEI0tFb/dOw+ENHD+oMzwyQ1B2WHxrfNvLlw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-22T00:03:05Z" - mac: ENC[AES256_GCM,data:/xcbROrte/AVjvkd0XbDLbyx5DOCmyRfmNr9Tr07qQMjjmV86Bl16s33hogfLg8qki7Rtr98HwpQ3/AwK+u1N3hCu9xo+UiGOFZbidlyvhwJfF7I33Z0IaG6nPMDkqC1zKD91SSYRVq69ICxawaLuDWGQAms0LhFluL5V6v/FwM=,iv:xy7lUknZMFnNycRe7hMD7RLEMJkLBa6v5cM6zQ1qc64=,tag:WEm3vt3wtLCfbabSa7qQXQ==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZVkd0c29sT1R6WUpsd0dy + RkVuUnZ2djZUejZNMk05T2p2L2pmZHVaeUNVCjgrVGlJYzdRRGxNNCs1b0EydTFT + RGVsNXNTMmVJTEpuV1ViNkVXNmdTQjAKLS0tIHl0NU1icjRtQWRIeFB0TzYvQjlr + UEtrYXVURldwcks5YjVSeGMxNnFRWVUK8d3PoQR/33lJA0L3X8dwqAmIUidNx9E0 + LVnWYPcnlrgah4tKh2Qjl+beJhqTO0GrmeaRxE5QDWqUiZbxkISf+A== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-07T14:59:07Z" + mac: ENC[AES256_GCM,data:YVF/vX8tL7RjQCG+nkM41kHSwxkGvtUoWmPVTC+1M+FbIlFZS5x1mTqsQCa5IH4+xDlGUQOl9qvooLxNv4uQvgc3ZWT4CE6c0mgOdz8feqYPNclnnxSi3xP5CspdN+NJ63eowR7E4PTGGHsg21wtZ6qNFQ2bXAgRjhtHUmrZ5CI=,iv:BSmEugJm3hf/Ojt7u11Ri/sGa0HSlUxLpJ+Xwo0E+DU=,tag:9Bj911JB+A7DdFKNXwwKJQ==,type:str] + pgp: [] + encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 --- apiVersion: v1 kind: Secret metadata: - name: connectivity-tester-config - namespace: matrix + name: connectivity-tester-config + namespace: matrix type: Opaque stringData: - config.yaml: ENC[AES256_GCM,data:Q0bigRJfrb27G61qgdP3LI7mzbLcTHRqwNAfgWk6qW3wU4VwxDZRRHolEsMj+OA6pos/IlJemUQbs8Yb3ilSOOz076VpwXwuPeX1hIIFJ4DhYftmLt5PJ52M5CuYBtHRxdbV2l0IqmSfuGcrelqBnUOLRdYQ4eBB+DTGmzsOr1KzrFg2tmgLEN6lrlhrhphX56l+zCayf+XYxffRNSNueG7rIyqc8EBNNxmOn3uv82CVSCwUjoIV9TGsn3IZzuoT5PNpTdimj7rHXHz3K24PvOOekTuVWEmwM6IJRSCarv9NT2CRR1u4Y9K2HoIq2zknM/CdpNc3xWfkndNzgEew1tOc7tTwzMtWXM+IYICEr1NRKDwbendShLqIlSKQbjMb2PMYwKELZKPNk3RaedsY/lGAbAvOPIKZMWFKpzOp4TpCxhu0DBDyvkXIooCDscBrhf9qdI9CPyZqpO5IJF82SKl3AVIGGU9F7BrHXVsonHZMjJ5gFQilsFmEmH+bYo2QW6Dx5BRwLGUB+8eYXTI2KlahRs39Wmu1SaFpS7aVgNNupWGBSCEnvYlxX4LMv1Ck7CpgOskuiBTiMzHNKsumtwW8oD3tm7aWbztRUVWi5gPJwkytev03LSD9GvX0vOyp6j0RdaLV5O1BA5YfVz6aC64WUmThBIM6dJhRgWA8xD5fJZ/sTb3KXcPDgTu+/jPiJxp564G8g/7LmhB4VflgNGRQKdjvMhM+LvzlZsaC3rKvokhHFgHa8lvpLuw3rc4pL4pZWMG1TYLtvOJNAjnFDWk6nIN6QjLm5hU3tcvcGzHIl41S5SntKbzGxKyRn+DIvH4llm7uQAeXbCJrXe+XxTM5ClfzbIXkibjSHbUe5CTJAJyJmp9vzbmGLu6OqxxD0mu0OQmzkF9BaD5fgpUDviAewKoilF+EwQ1IvPvpodxisV5tVdek0SguGxcf0kJUwFqWTyWXzhr8H+xUXAo6XRWD7f3SpTx4CEDPnNC8bDkMi6hxIqDj5J8pom2lVuKAW3nTm0iExpjiLbMJV9a1LGjW3RoDlaVvgH461TntMbudcEYDy2XETp57Qj5f2fsPHw0O7pAuhm3ZTr1rCwyZt/oiyqYJvPHHQJdcULef6SrN3NyAUPi5hEhgVOcgYVz1RTHVhBVKwJCMc0UG/DDyvclM1gC2XvtNu99GO6QACkbCXVPPxZKP,iv:q9rqVBQ8yjjTGHyu2u8f3x74ztCEi3bwKkAuwgbAXWI=,tag:YtXb3IOJq7ZnPFX5CJdjdQ==,type:str] + config.yaml: ENC[AES256_GCM,data:ECgY4aHxs2smuvZNMVa2Meq0HSACCRiCnrcqK3p31+cDp13icX/0ZB2SYMIax5u/2RbpZnxst7LxllnPBGWCsLhq2lzwAEc8nDauD88wKQIgDCdOGzFzVV1sD24PzVF9L7Umqx+DiPB+o+dSjxSMs0vSFd1LbiIJ9Dob5+o45xYN4DW87rhJNr9KIvK28FE4MFAx4bu+IlwbQAdF7S01jZfxLt4F5gDnUuhUIU/BD4fy6+oFZS7mKTXiiIdThEwc0wIAZvygwCuJDKTP+EXA4CHDrrE9TxS8xqai18y1pe4WwH/fAqWNVXn+fHH0Bbyws0Bl3coGhfu5nG8WrozFUsnCuTFZB3FPiuq0tRka8EoJd+9FqTM9vAkR5+Z8j0HL+oJs4y+e7qxCGEziqBK1Nsqc/481JGlmEX+mEQs79oJGlVdXNdcAYjLQXnjx4fT1OCqOxWdn9ljSdB5czI86wg26TxIeEbM/xshg1EN0POEfBI9pYwHD6UtVCYvWrE7QjbD0MQuMrXfNxjvRjfXRG6YpkP64RPeq8W4OvemgZN8CWZnOqE/o5FY2uLOYL7flz7nufU+VzD94C1qdRryuMn4ybJ+D15ieeo1FsUVgKX5YLu2RcXhQo4WiGGgr3f/Xp/fOVSZt+6VKYNCko/OA9m6JrGLEaYO7SdckbidDry//6WtzSFd5pjvaVeKaCVeR81Iz0lrkZQpN3QO4mK79XLpsHU8JxxRB5GSe0Fhn82fmtRgc+g7csfD4sdNoOrRLtyGVBMQ53vRTtuvSZG1q0T21VmaYMRHrYUyxUP8Qvl3unnbOBMIEorzi2EKkBROtV7w7BlQduxgC+92t1yt8QrAoOd3WS7wiWb9Npnb6K30fVOTN4AQtXV75poAVzvkWQYLyYEcOTbkanQOhdrzZhWXODbTtN/vh7VeadElN6m8Zd2G2OQGfeDvLl5LbtXU9/CjdN95MSzOISZyTq2X6gmxCMXmVRiZc5cgPPsZT4R1jx7lMM4VCowz3iDVKU2YXdKbQ5jVG9sUpoODrBOBVdYnLCYeCi1Nhn6/hLHVRDHMJ3Dpm/ZRwcbVhFNao8xSgLwYJBUcj0MrCTUljy4yOgB+HrI9/aXFimFm5D1kt1RK/uKcNFr8J1Mrm6eVjFyKsqOg+4Zd//4xYy/1kYc5ckN9G4r8yQBui4c0Va5rvjpQEynVTGBip,iv:SrO+njwRP++nZlRzGWPXpk4/MG+H2W6s3RvtqotHccQ=,tag:iFxzBo1qGdowghc7Z+EKZQ==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUDd3Q2ZrcWRJeXVKdmxs - UVhET0p3VW13SGZ2UGc2bE1oNUduTURNNVdjCmxkT01KZTl0QnVDek9XUjRyWjhU - N1hDTUd2ck1vL3QzcnN5SkF4Q014aTgKLS0tIDZLYm1NWXZqU1RlZ1ZrYWtieWxU - SXVDSGMyTjhqbWhvUzNQWk9CR1A4MVkKHSiUheRpdkmvhY0Y3yvsYWQHYjZJRgEs - weOy+GG0WF4Gj+r6SgwEI0tFb/dOw+ENHD+oMzwyQ1B2WHxrfNvLlw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-22T00:03:05Z" - mac: ENC[AES256_GCM,data:/xcbROrte/AVjvkd0XbDLbyx5DOCmyRfmNr9Tr07qQMjjmV86Bl16s33hogfLg8qki7Rtr98HwpQ3/AwK+u1N3hCu9xo+UiGOFZbidlyvhwJfF7I33Z0IaG6nPMDkqC1zKD91SSYRVq69ICxawaLuDWGQAms0LhFluL5V6v/FwM=,iv:xy7lUknZMFnNycRe7hMD7RLEMJkLBa6v5cM6zQ1qc64=,tag:WEm3vt3wtLCfbabSa7qQXQ==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZVkd0c29sT1R6WUpsd0dy + RkVuUnZ2djZUejZNMk05T2p2L2pmZHVaeUNVCjgrVGlJYzdRRGxNNCs1b0EydTFT + RGVsNXNTMmVJTEpuV1ViNkVXNmdTQjAKLS0tIHl0NU1icjRtQWRIeFB0TzYvQjlr + UEtrYXVURldwcks5YjVSeGMxNnFRWVUK8d3PoQR/33lJA0L3X8dwqAmIUidNx9E0 + LVnWYPcnlrgah4tKh2Qjl+beJhqTO0GrmeaRxE5QDWqUiZbxkISf+A== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-07T14:59:07Z" + mac: ENC[AES256_GCM,data:YVF/vX8tL7RjQCG+nkM41kHSwxkGvtUoWmPVTC+1M+FbIlFZS5x1mTqsQCa5IH4+xDlGUQOl9qvooLxNv4uQvgc3ZWT4CE6c0mgOdz8feqYPNclnnxSi3xP5CspdN+NJ63eowR7E4PTGGHsg21wtZ6qNFQ2bXAgRjhtHUmrZ5CI=,iv:BSmEugJm3hf/Ojt7u11Ri/sGa0HSlUxLpJ+Xwo0E+DU=,tag:9Bj911JB+A7DdFKNXwwKJQ==,type:str] + pgp: [] + encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 diff --git a/apps/talos_cluster/connectivity-tester/staging_config.json b/apps/talos_cluster/connectivity-tester/staging_config.json @@ -1,4 +1,4 @@ { - "api_server_url": "https://stage.connectivity-tester.mtrnord.blog", + "api_server_url": "https://api.stage.connectivity-tester.mtrnord.blog", "oauth2_client_id": "connectivity-tester-frontend" } diff --git a/apps/talos_cluster/connectivity-tester/staging_deployment.yaml b/apps/talos_cluster/connectivity-tester/staging_deployment.yaml @@ -234,30 +234,34 @@ spec: rules: - matches: - path: - value: /api - type: PathPrefix - - path: - value: /api-docs - type: PathPrefix - - path: - value: /oauth2 - type: PathPrefix - - path: - value: /metrics + value: / type: PathPrefix backendRefs: - name: connectivity-tester-stage - port: 8080 + port: 8000 timeouts: request: 240s backendRequest: 0s +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: connectivity-tester-stage-api + namespace: matrix +spec: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway + hostnames: + - api.stage.connectivity-tester.mtrnord.blog + rules: - matches: - path: value: / type: PathPrefix backendRefs: - name: connectivity-tester-stage - port: 8000 + port: 8080 timeouts: request: 240s backendRequest: 0s diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml @@ -389,6 +389,18 @@ spec: certificateRefs: - kind: Secret name: api.connectivity-tester.mtrnord.blog-tls + - name: https-api-stage-connectivity-tester-mtrnord-blog + protocol: HTTPS + hostname: "api.stage.connectivity-tester.mtrnord.blog" + port: 443 + allowedRoutes: + namespaces: + from: "All" + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: api.stage.connectivity-tester.mtrnord.blog-tls - name: https-stage-connectivity-tester-mtrnord-blog protocol: HTTPS hostname: "stage.connectivity-tester.mtrnord.blog"