fix(paperclip): correct CiliumNetworkPolicy template syntax #209

Merged

aaron merged 23 commits from paperclip/HOM-7-fix-cilium-template into live 2026-06-01 04:52:10 +00:00

Conversation 0 Commits 23 Files changed 34 +147 -965

aaron commented 2026-06-01 04:52:05 +00:00

Owner

Copy link

Fix invalid YAML produced by over-templated CiliumNetworkPolicy.

Relates to HOM-7

Fix invalid YAML produced by over-templated CiliumNetworkPolicy. Relates to [HOM-7](/HOM/issues/HOM-7)

aaron added 23 commits 2026-06-01 04:52:05 +00:00

feat(infra): expand LB pool to 151 IPs + expose Temporal/PG via LoadBalancer ... 4588eacf4f

- Expand CiliumLoadBalancerIPPool from 10.10.10.220-250 (31 IPs) to
  10.10.10.100-250 (151 IPs)
- Add temporal-frontend-lb (10.10.10.109:7233) for VPN access
- Add cnpg-lab-director-lb (10.10.10.110:5432) for VPN access
- Eliminates need for kubectl port-forward from Mac

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(infra): pin LB IPs + expand pool with original range first ... 011117069e

Pool expansion must keep the original range (.220-.250) as the first
block to preserve existing IP assignments. New services pinned to the
expansion range (.100-.219) to avoid conflicts.

- Temporal LB: 10.10.10.100
- PG LB: 10.10.10.101

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(longhorn): single-replica defaults + restore salvage lever ... fc8d5e2ced

After 2026-04-30 plane recovery: 4 postgres restore attempts on a 17 GB
pg_dumpall failed with EROFS partway, on bitnami AND CNPG storage classes.
Root cause is structural: 2-replica Longhorn on top of a single ZFS
mirror doubles write I/O for zero fault tolerance gain (single Proxmox
host). Replica rebuilds during the writes saturate the SSDs and cause
guest filesystems to remount read-only.

Changes (per Longhorn specialist + architect review):
- defaultReplicaCount: 2 -> 1, persistence.defaultClassReplicaCount: 2 -> 1
  (kills phantom redundancy)
- replicaAutoBalance: best-effort -> disabled
  (rebalances trigger I/O storms; ZFS handles physical layout)
- concurrentReplicaRebuildPerNodeLimit: 2 -> 1
  (postgres can keep WAL flushed during rebuild)
- disableRevisionCounter: implicit-true -> explicit false
  (restores salvage lever lost during plane-pgdb 2026-04-29)
- engineReplicaTimeout: 8 -> 15
  (tolerates fsync stalls under SSD-mirror saturation)
- longhorn-db SC: numberOfReplicas 2 -> 1, disableRevisionCounter false

This is forward-only on Longhorn-managed defaults. Existing volumes
keep their current spec.numberOfReplicas; we'll bulk-patch them in a
follow-up step after these settings sync.

Refs HOMELAB-1003 (postmortem).

Merge pull request 'fix(longhorn): single-replica defaults + restore salvage lever' (#199) from plane/longhorn-singlerep-iac into live fe3fe36bfe

cnpg-cluster: disable WAL archiving to stay under B2 transaction cap ... 151bb46764

Continuous WAL shipping across 7+ CNPG clusters was exhausting the
Backblaze B2 free tier Class C transaction cap (2,500/day). Daily
base backups via ScheduledBackup still run — PITR is now limited
to the last base backup instead of any point in time.

cnpg-cluster: disable WAL archiving to stay under B2 transaction cap (#200) 1db331ed50

Revert "cnpg-cluster: disable WAL archiving to stay under B2 transaction cap" ... 01aaad86bb

This reverts commit 151bb46764.

Merge pull request 'Revert "cnpg-cluster: disable WAL archiving" — CNPG operator enforces archive_mode=on' (#201) from revert-wal-archive-off into live 6d2ecb0578

fix(langfuse): increase ClickHouse memory 5Gi → 8Gi ... 6e0af920c9

Dashboard queries (traces FINAL LEFT JOIN observation_stats) still OOM
after OPTIMIZE TABLE compaction. The query materializes ~4.5 GiB intermediate
results. Observations ARE being ingested successfully (verified last write
2026-05-10 20:18 UTC). Only the query needs more headroom.

Refs: HOMELAB-1052

Merge pull request 'fix(langfuse): increase ClickHouse memory 5Gi → 8Gi' (#202) from plane/HOMELAB-1052-clickhouse-memory into live 1582909363

HOMELAB-1053: remove lab-director — chart, manifests, ESO, ArgoCD RBAC, OTel + dormant refs ... de38095e02

- Delete lab-director Helm chart (core/charts/apps/lab-director/)
- Delete orphan LB Service manifest (lab-director-pg-lb.yaml)
- Delete worker ExternalSecrets (es-lab-director-worker.yaml)
- Remove lab-director ExternalSecret doc from es-cnpg-b2.yaml (6 remaining namespaces)
- Remove lab-director ArgoCD RBAC policy.csv entries (4 lines)
- Remove lab-director from OTel collector span filter
- Clean dormant sandbox chart refs: LAB_DIRECTOR_API_URL, image registry, CNP egress allow
- Clean dormant dev-environment chart ref: Harbor image path

MUST be merged AFTER prod PR has merged AND ArgoCD has pruned lab-director/cnpg-cluster-lab-director.
Confirm 'argocd app list | grep lab-director' returns empty before merging.

HOMELAB-1053: amend — retire NATS chart, delete missed ExternalSecret ... 3e3031562e

- Delete core/manifests/external-secrets/es-lab-director-argocd.yaml (missed in initial scan; would cause external-secrets-config app to go Degraded after ns deletion)
- Delete core/charts/apps/nats/values.yaml (NATS retired alongside lab-director)
- Delete core/charts/platform/nats/values.yaml (duplicate NATS values overlay)

Merge pull request 'HOMELAB-1053: remove lab-director — chart, manifests, ESO, ArgoCD RBAC, OTel + dormant refs' (#203) from homelab-1053-remove-lab-director into live ... cf7421d69d

Reviewed-on: #203

feat(forgejo): enable SSH access on port 22 ... b9746f9af3

Enable Forgejo SSH service, configure SSH_DOMAIN and SSH_PORT in Helm
values, add TCP listener on port 22 to the homelab gateway, and create
a TCPRoute to route SSH traffic to the forgejo-ssh service.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge pull request 'feat(forgejo): enable SSH access on port 22' (#204) from jesus/infra-core:feat/forgejo-ssh into live ... d9209bdbd1

Reviewed-on: #204
Reviewed-by: Aaron Reynoza <aaron@reynoza.org>

HOMELAB-1056: add data_disk_discard, ignore image size drift a19cbf2551

Merge pull request 'feat(alerts): add CNPGWALArchiveFailing + remove outline exclusion' (#205) from fix/cnpg-wal-archive-alert into live d5914122a1

Merge pull request 'HOMELAB-1056: add data_disk_discard, ignore image size drift' (#206) from homelab-1056-terraform-drift into live 2987ccb57d

HOMELAB-1056: switch overwrite=false, remove ignore_changes on Talos images ... be0ec14f9c

Setting overwrite=false stops the perpetual force-replacement cycle caused
by the provider comparing compressed URL Content-Length against decompressed
datastore size. ignore_changes=[size] was ineffective (size is provider-computed).

Merge pull request 'HOMELAB-1056: switch overwrite=false, remove ignore_changes on Talos images' (#207) from homelab-1056-overwrite-false into live fb13142d7c

Merge branch 'paperclip/HOM-7-infra-prep' into live ... cf507f8ee4

Infrastructure prep for Paperclip on Homelab (HOM-7).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge branch 'live' of https://forgejo.aaron.reynoza.org/aaron/infra-core into live ecd3b9a7cf

fix(paperclip): correct CiliumNetworkPolicy template syntax (HOM-7) ... 0abd2cd0de

- Simplify template to hardcoded rules matching sandbox pattern
- Remove over-templating that produced invalid YAML
- Clean up values.yaml to match simplified template

Co-Authored-By: Paperclip <noreply@paperclip.ing>

aaron merged commit 17343433b5 into live 2026-06-01 04:52:10 +00:00

aaron referenced this pull request from a commit 2026-06-01 04:52:10 +00:00

Merge pull request 'fix(paperclip): correct CiliumNetworkPolicy template syntax' (#209) from paperclip/HOM-7-fix-cilium-template into live

aaron deleted branch paperclip/HOM-7-fix-cilium-template 2026-06-01 04:52:10 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aaron/infra-core!209

No description provided.