Files
homelab-v/k8s
Vegard Hagen 50dedbaee2 fix(cilium): explicitly assign appProtocol to gRPC services
This fixes NetBird agents not connecting to the manager

./caller_not_available:0:
    2025/10/12 18:16:42 WARNING: [core] [Channel #98 SubChannel #99]grpc:
    addrConn.createTransport failed to connect to
        {
            Addr: "netbird.stonegarden.dev:443",
            ServerName: "netbird.stonegarden.dev:443",
            BalancerAttributes: {
                "<%!p(pickfirstleaf.managedByPickfirstKeyType={})>": "<%!p(bool=true)>"
            }
        }.
    Err: connection error:
        desc = "transport: authentication handshake failed:
            credentials: cannot check peer: missing selected ALPN property.
            If you upgraded from a grpc-go version earlier than 1.67,
            your TLS connections may have stopped working due to ALPN enforcement.
            For more details, see: https://github.com/grpc/grpc-go/issues/434"

Related to https://github.com/cilium/cilium/issues/39484

Signed-off-by: Vegard Hagen <[email protected]>
2025-10-25 15:17:56 +02:00
..

Manual bootstrap

CRDs

Gateway API

kubectl apply -k infra/crds

Cilium

kubectl kustomize --enable-helm infra/network/cilium | kubectl apply -f -

Sealed-secrets

kustomize build --enable-helm infra/controllers/sealed-secrets | kubectl apply -f -

Proxmox CSI Plugin

kustomize build --enable-helm infra/storage/proxmox-csi | kubectl apply -f -
kubectl get csistoragecapacities -ocustom-columns=CLASS:.storageClassName,AVAIL:.capacity,ZONE:.nodeTopology.matchLabels -A

Argo CD

kustomize build --enable-helm infra/controllers/argocd | kubectl apply -f -
kubectl -n argocd get secret argocd-initial-admin-secret -ojson | jq -r ' .data.password | @base64d'
kubectl apply -k infra
kubectl apply -k sets

SBOM

  • Cilium
  • Hubble
  • Argo CD
  • Proxmox CSI Plugin
  • Cert-manager
  • Gateway
  • Authentication (Keycloak, Authentik, ...)
  • [] CNPG - Cloud Native PostGresSQL

CRDs

  • [] Gateway
  • [] Argo CD
  • [] Sealed-secrets

TODO

  • Remotely managed cloudflared tunnel
  • Keycloak
  • [] Argo CD sync-wave
commonAnnotations:
    argocd.argoproj.io/sync-wave: "-1"