fix(helm): kong-syncer KONG_ADMIN_URL -> -kong-admin:8001 - #250
Open
ciprianiacobescu wants to merge 12 commits into
Open
fix(helm): kong-syncer KONG_ADMIN_URL -> -kong-admin:8001#250ciprianiacobescu wants to merge 12 commits into
ciprianiacobescu wants to merge 12 commits into
Conversation
The -kong Service only exposes 8000 (proxy); Kong's admin API (8001) is on the separate -kong-admin Service. kong-syncer pointed at -kong:8001, which routes nowhere, so route/plugin sync (and therefore every brokered call, Via: kong) would fail on a real cluster. Point it at -kong-admin:8001.
…roperties), not CLI args
Liquibase 4.27's picocli CLI rejects '-Ddb_app_password=…' as an unknown option
('Unexpected argument'). Changelog parameters must be JVM system properties;
move them to JAVA_OPTS and drop the CLI -D args. Verified: migration applies 116 rows.
…) + RWX
The seed-job runs as a pre-install hook (weight -4) but mounts the
bootstrap-secrets PVC, which was a regular resource created only in the main
phase — so the hook hung Pending ('pvc not found'). Make the PVC a pre-install
hook (weight -6) so it exists first; RWX so admin-api/admin-ui readers can be
on any node.
…l:16 was removed from Docker Hub → ImagePullBackOff)
… deadlock) + OpenSpec seed-job's init waits for Keycloak, but as a pre-install hook it blocked Keycloak (a main StatefulSet) from ever deploying. Move seed-job to post-install,post-upgrade so Keycloak is up when it runs. Must NOT install with --wait/--atomic (would re-deadlock via admin-api readiness).
…on won't auto-generate)
…broker uses plain BROKER_DATABASE_URL (Go pgx can't parse +asyncpg)
… is post-install now; avoids destructive ArgoCD PreSync hook re-creation)
…ess.keycloak.host set (stable https iss; fixes OIDC id_token_invalid)
…E_URL) kong-syncer is Go (lib/pq) and cannot parse the SQLAlchemy postgresql+asyncpg:// DSN in DATABASE_URL; its pq.Listener failed with 'missing "=" in connection info string', so it never processed service.registered NOTIFY and never published Kong routes for newly-registered services. Point it at BROKER_DATABASE_URL (the plain postgres:// DSN the broker already uses).
kong-syncer hardcodes upstream http://proxy-plugin:8086 (yaml.go); on k8s the real Service is fullname-prefixed, so Kong returned 'name resolution failed' for every brokered call. Add a ClusterIP alias named exactly proxy-plugin selecting the proxy-plugin pods.
The chart had no way to set arbitrary env vars (e.g. OTEL_* exporter
config) on the Go services without a template/code change. Add a
mintkey.extraEnv helper (global.extraEnv + per-service <svc>.extraEnv,
list of {name, value} or {name, valueFrom}) and wire it into the env:
list of broker, proxy-plugin, kong-syncer, vault-adapter, ssh-proxy and
email-proxy. Verified via `helm template` that defaults render
unchanged and that global+per-service extraEnv values land correctly
on all six services.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
-kongService only exposes port 8000 (proxy). Kong's admin API (8001) is on the separate-kong-adminService. Butkong-syncersetsKONG_ADMIN_URL: http://<name>-kong:8001— a Service that does not forward 8001 — so route/plugin sync silently fails.Impact: on a real cluster, kong-syncer cannot program Kong, so brokered calls never get
Via: kong— the chart's own acceptance scenario fails.Fix
Point
KONG_ADMIN_URLat-kong-admin:8001(the Service that actually exposes the admin port).helm lintclean; the URL now resolves to a real Service+port. The admin Service stays ClusterIP-only (no Ingress) — intended.Found while wiring the chart onto the SpotUs DEV cluster (external CNPG DB).