From a4db46bdf59b8e4ef582284c01a011f4a9dd9932 Mon Sep 17 00:00:00 2001 From: Gerrit Date: Wed, 19 Aug 2026 15:23:05 +0200 Subject: [PATCH 1/2] Configure Gateway API for monitoring. --- .../group_vars/control_plane/headscale.yaml | 12 +++++-- .../group_vars/control_plane/logging.yaml | 10 +++++- .../group_vars/control_plane/metal_db.yaml | 4 +-- .../group_vars/control_plane/monitoring.yaml | 34 +++++++++++++++++-- .../group_vars/control_plane/zitadel.yaml | 1 + roles/gateway/tasks/main.yml | 4 +++ 6 files changed, 57 insertions(+), 8 deletions(-) diff --git a/inventories/group_vars/control_plane/headscale.yaml b/inventories/group_vars/control_plane/headscale.yaml index acb584d8..73700c1e 100644 --- a/inventories/group_vars/control_plane/headscale.yaml +++ b/inventories/group_vars/control_plane/headscale.yaml @@ -1,6 +1,4 @@ --- -headscale_tls: no - # only hexadecimal passwords are allowed and need to be prefixed with "privkey:" # should be 64 characters long headscale_private_key: privkey:38f1186d8c9d468379f1143282ae37f4259cb617b7aa52de223d90f605983c58 @@ -11,3 +9,13 @@ headscale_db_password: a-secure-password headscale_db_resources: {} headscale_ipv6_prefix: fd7a:115c:a1e0::/48 + +headscale_ingress_enabled: false + +headscale_httproute_enabled: true +headscale_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +headscale_httproute_hostnames: + - headscale.{{ metal_control_plane_ingress_dns }} diff --git a/inventories/group_vars/control_plane/logging.yaml b/inventories/group_vars/control_plane/logging.yaml index 438cbb73..e204859b 100644 --- a/inventories/group_vars/control_plane/logging.yaml +++ b/inventories/group_vars/control_plane/logging.yaml @@ -1,5 +1,5 @@ --- -logging_ingress_loki_tls: no +logging_ingress_enabled: false logging_ingress_dns: "loki.{{ metal_control_plane_ingress_dns }}" logging_alloy_enabled: true @@ -12,3 +12,11 @@ logging_alloy_loki_write_endpoints: logging_promtail_enabled: false logging_alloy_cluster_label: "mini-lab" + +logging_httproute_enabled: true +logging_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http + +logging_ingress_loki_basic_auth_password: thisissecure789 diff --git a/inventories/group_vars/control_plane/metal_db.yaml b/inventories/group_vars/control_plane/metal_db.yaml index d3f482e4..77639ef5 100644 --- a/inventories/group_vars/control_plane/metal_db.yaml +++ b/inventories/group_vars/control_plane/metal_db.yaml @@ -1,9 +1,7 @@ --- metal_db_backup_restore_sidecar_provider: local -metal_db_expose_frontend: yes - metal_db_resources: {} metal_db_storage_size: 100Mi -metal_db_backup_restore_sidecar_object_max_keep: 10 \ No newline at end of file +metal_db_backup_restore_sidecar_object_max_keep: 10 diff --git a/inventories/group_vars/control_plane/monitoring.yaml b/inventories/group_vars/control_plane/monitoring.yaml index 0e2c0095..53a5c963 100644 --- a/inventories/group_vars/control_plane/monitoring.yaml +++ b/inventories/group_vars/control_plane/monitoring.yaml @@ -1,6 +1,4 @@ --- -monitoring_ingress_grafana_tls: no - monitoring_grafana_github_oauth: enabled: false monitoring_grafana_extra_secret_mounts: [] @@ -12,3 +10,35 @@ monitoring_thanos_receive_size: 5Gi monitoring_prometheus_core_dns_enabled: true event_exporter_enabled: false + +monitoring_prometheus_ingress_enabled: false +monitoring_grafana_ingress_enabled: false +monitoring_alertmanager_ingress_enabled: false +monitoring_thanos_receive_ingress_enabled: false + +monitoring_prometheus_httproute_enabled: true +monitoring_prometheus_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +monitoring_grafana_httproute_enabled: true +monitoring_grafana_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +monitoring_alertmanager_httproute_enabled: true +monitoring_alertmanager_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +monitoring_thanos_receive_httproute_enabled: true +monitoring_thanos_receive_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http + +monitoring_alertmanager_deploy_envoy_gateway_basic_auth: true +monitoring_alertmanager_ingress_basic_auth_password: thisissecure123 + +monitoring_thanos_deploy_envoy_gateway_basic_auth: true +monitoring_thanos_receive_ingress_basic_auth_password: thisissecure456 diff --git a/inventories/group_vars/control_plane/zitadel.yaml b/inventories/group_vars/control_plane/zitadel.yaml index d9c6a269..644bfade 100644 --- a/inventories/group_vars/control_plane/zitadel.yaml +++ b/inventories/group_vars/control_plane/zitadel.yaml @@ -6,6 +6,7 @@ zitadel_port: 8080 zitadel_skip_verify_tls: true zitadel_insecure: true +zitadel_enabled_ingress: false zitadel_httproute_enabled: true zitadel_httproute_parent_refs: - name: metal-control-plane diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml index d0f1a4d3..ad203ba6 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/gateway/tasks/main.yml @@ -11,10 +11,12 @@ - name: Deploy Envoy GatewayClass kubernetes.core.k8s: definition: "{{ lookup('file', 'gatewayclass.yaml') | from_yaml }}" + apply: true - name: Deploy metal-control-plane EnvoyProxy kubernetes.core.k8s: definition: "{{ lookup('template', 'envoyproxy.yaml') | from_yaml }}" + apply: true - name: Deploy metal-api certificate secret kubernetes.core.k8s: @@ -28,7 +30,9 @@ data: tls.crt: "{{ lookup('file', 'certs/metal-api/server.pem') | b64encode }}" tls.key: "{{ lookup('file', 'certs/metal-api/server-key.pem') | b64encode }}" + apply: true - name: Deploy metal-control-plane Gateway kubernetes.core.k8s: definition: "{{ lookup('template', 'gateway.yaml') | from_yaml }}" + apply: true From 60443e28ae9734ebb5e9cb342e95ff5d49545d4f Mon Sep 17 00:00:00 2001 From: Sven-Ric Date: Fri, 28 Aug 2026 17:11:33 +0200 Subject: [PATCH 2/2] Point services at the new Gateway API endpoints. --- inventories/group_vars/control_plane/headscale.yaml | 2 +- inventories/group_vars/control_plane/logging.yaml | 5 ++++- inventories/group_vars/control_plane/monitoring.yaml | 1 - inventories/group_vars/partition/alloy.yaml | 5 ++++- inventories/group_vars/partition/prometheus.yaml | 5 ++++- 5 files changed, 13 insertions(+), 5 deletions(-) diff --git a/inventories/group_vars/control_plane/headscale.yaml b/inventories/group_vars/control_plane/headscale.yaml index 73700c1e..6e226b45 100644 --- a/inventories/group_vars/control_plane/headscale.yaml +++ b/inventories/group_vars/control_plane/headscale.yaml @@ -18,4 +18,4 @@ headscale_httproute_parent_refs: namespace: "{{ metal_control_plane_namespace }}" sectionName: http headscale_httproute_hostnames: - - headscale.{{ metal_control_plane_ingress_dns }} + - headscale.{{ metal_control_plane_gateway_dns }} diff --git a/inventories/group_vars/control_plane/logging.yaml b/inventories/group_vars/control_plane/logging.yaml index e204859b..d61537d9 100644 --- a/inventories/group_vars/control_plane/logging.yaml +++ b/inventories/group_vars/control_plane/logging.yaml @@ -7,7 +7,10 @@ logging_alloy_enabled: true logging_alloy_service_monitor_enabled: false logging_alloy_loki_write_endpoints: - - url: "http://{{ logging_ingress_dns }}:8080/loki/api/v1/push" + - url: "http://loki.{{ metal_control_plane_gateway_dns }}/loki/api/v1/push" + basic_auth: + username: promtail + password: "{{ logging_ingress_loki_basic_auth_password }}" logging_promtail_enabled: false diff --git a/inventories/group_vars/control_plane/monitoring.yaml b/inventories/group_vars/control_plane/monitoring.yaml index 53a5c963..a49648ec 100644 --- a/inventories/group_vars/control_plane/monitoring.yaml +++ b/inventories/group_vars/control_plane/monitoring.yaml @@ -4,7 +4,6 @@ monitoring_grafana_github_oauth: monitoring_grafana_extra_secret_mounts: [] monitoring_thanos_receive_enabled: true -monitoring_thanos_receive_ingress_enabled: true monitoring_thanos_receive_size: 5Gi monitoring_prometheus_core_dns_enabled: true diff --git a/inventories/group_vars/partition/alloy.yaml b/inventories/group_vars/partition/alloy.yaml index bd8dba8e..2ce91308 100644 --- a/inventories/group_vars/partition/alloy.yaml +++ b/inventories/group_vars/partition/alloy.yaml @@ -1,2 +1,5 @@ alloy_loki_write_endpoints: - - url: "http://loki.{{ metal_control_plane_ingress_dns }}:8080/loki/api/v1/push" + - url: "http://loki.{{ metal_control_plane_gateway_dns }}/loki/api/v1/push" + basic_auth: + username: promtail + password: thisissecure789 diff --git a/inventories/group_vars/partition/prometheus.yaml b/inventories/group_vars/partition/prometheus.yaml index 8c39ce1d..550ef4e9 100644 --- a/inventories/group_vars/partition/prometheus.yaml +++ b/inventories/group_vars/partition/prometheus.yaml @@ -20,7 +20,10 @@ prometheus_ipmi_exporter_targets: prometheus_blackbox_exporter_metal_api_probe_url: "{{ metal_partition_metal_api_protocol }}://{{ metal_partition_metal_api_addr }}:{{ metal_partition_metal_api_port }}{{ metal_partition_metal_api_basepath }}v1/version" prometheus_remote_write: - - url: "http://thanos-receive.{{ metal_control_plane_ingress_dns }}:8080/api/v1/receive" + - url: "http://thanos-receive.{{ metal_control_plane_gateway_dns }}/api/v1/receive" + basic_auth: + username: thanos-receive + password: thisissecure456 prometheus_hosts_content: | 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4