HOMELAB-1097: fix Paperclip exec probes + add TCPRoute CRD #223

Merged

aaron merged 2 commits from plane/HOMELAB-1097-fix-db-permissions into live 2026-06-11 23:03:06 +00:00

Conversation 0 Commits 2 Files changed 4 +1494 -1

aaron commented 2026-06-11 23:01:17 +00:00

Owner

Copy link

What

Fixes two issues discovered during HOMELAB-1097 Paperclip crash-loop investigation:

1. Probes use httpGet → Paperclip returns 403: Paperclip's authenticated mode CSRF/origin validation rejects kubelet HTTP probes that use the pod IP as Host header. Switch to exec probes using curl localhost to bypass the origin check.

2. Gateway ArgoCD sync stuck on missing TCPRoute CRD: The forgejo-ssh TCPRoute can't be applied because the tcproutes.gateway.networking.k8s.io CRD was never installed. Added the upstream CRD and bumped the route to v1.

Changes

• charts/apps/paperclip/templates/deployment.yaml — add probeType: exec support
• charts/apps/paperclip/values.yaml — default probes to probeType: exec
• manifests/gateway-api-crds/tcproutes.yaml — new CRD from upstream
• manifests/gateway/routes/forgejo-ssh.yaml — bump v1alpha2 → v1

Verify

• Paperclip pod reaches Ready with exec probes
• Gateway ArgoCD app reconciles without TCPRoute errors
• kubectl get tcproute -n forgejo shows forgejo-ssh

## What Fixes two issues discovered during HOMELAB-1097 Paperclip crash-loop investigation: 1. **Probes use `httpGet` → Paperclip returns 403**: Paperclip's authenticated mode CSRF/origin validation rejects kubelet HTTP probes that use the pod IP as Host header. Switch to `exec` probes using `curl localhost` to bypass the origin check. 2. **Gateway ArgoCD sync stuck on missing TCPRoute CRD**: The `forgejo-ssh` TCPRoute can't be applied because the `tcproutes.gateway.networking.k8s.io` CRD was never installed. Added the upstream CRD and bumped the route to `v1`. ## Changes - `charts/apps/paperclip/templates/deployment.yaml` — add `probeType: exec` support - `charts/apps/paperclip/values.yaml` — default probes to `probeType: exec` - `manifests/gateway-api-crds/tcproutes.yaml` — new CRD from upstream - `manifests/gateway/routes/forgejo-ssh.yaml` — bump `v1alpha2` → `v1` ## Verify - [ ] Paperclip pod reaches Ready with exec probes - [ ] Gateway ArgoCD app reconciles without TCPRoute errors - [ ] `kubectl get tcproute -n forgejo` shows forgejo-ssh

aaron added 1 commit 2026-06-11 23:01:17 +00:00

fix(paperclip): use exec probes to avoid CSRF 403, add TCPRoute CRD ... 49031011d9

- Switch health probes from httpGet to exec (curl localhost)
  Paperclip's authenticated mode CSRF validation rejects kubelet
  HTTP probes that use pod IP as Host header → returns 403.
  exec probes using curl localhost bypass the origin check.

- Add TCPRoute CRD (gateway.networking.k8s.io)
  The forgejo-ssh TCPRoute was blocking the gateway ArgoCD sync
  because the CRD was never installed. Added tcproutes.yaml from
  upstream Gateway API experimental channel.

- Bump forgejo-ssh TCPRoute from v1alpha2 to v1
  Matches the storage version served by the CRD.

Ref: HOMELAB-1097

aaron added 1 commit 2026-06-11 23:02:27 +00:00

Merge branch 'live' into plane/HOMELAB-1097-fix-db-permissions 56219545ac

aaron merged commit 8f3792ed26 into live 2026-06-11 23:03:06 +00:00

aaron referenced this pull request from a commit 2026-06-11 23:03:07 +00:00

Merge pull request 'HOMELAB-1097: fix Paperclip exec probes + add TCPRoute CRD' (#223) from plane/HOMELAB-1097-fix-db-permissions into live

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aaron/infra-core!223

No description provided.