Scott KarpandClaude Fable 5.1
d6d4475da3
The NLB forwards to the Service's NodePort and healthchecks it on the node; the cloud controller does not open that port in the security group. shorashim-external had no rule for 30923 for 26 days, so 185.19.29.180 refused connections while the pod was Ready. Rule added by the kohen 2026-10-04; the command now sits beside the manifest. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
# Shorashim Services
|
|
# Operations spec §1.1: Four access tiers
|
|
# - Pe'ah (public, no auth)
|
|
# - Machaneh Leviyah (authenticated)
|
|
# - Chatzer (full access)
|
|
# - Kodesh (operator, mTLS)
|
|
#
|
|
# All tiers go through a single Service → vav-pipeline port 4000
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: shorashim
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: shorashim
|
|
ports:
|
|
- port: 80
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
name: http
|
|
---
|
|
# External access via LoadBalancer
|
|
# For Exoscale SKS, this provisions an Exoscale NLB.
|
|
#
|
|
# The NLB forwards to this Service's NodePort and TCP-healthchecks it on
|
|
# the node. The cloud controller does NOT open that port in the node's
|
|
# security group — the operator must, or the NLB IP refuses connections
|
|
# while the pod is Ready (2026-10-04, tablet 29):
|
|
# PORT=$(kubectl -n shorashim get svc shorashim-external -o jsonpath='{.spec.ports[0].nodePort}')
|
|
# exo compute security-group rule add default --flow ingress --protocol tcp --port $PORT --network 0.0.0.0/0
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: shorashim-external
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
annotations:
|
|
# Exoscale NLB annotations
|
|
service.beta.kubernetes.io/exoscale-loadbalancer-zone: "ch-gva-2"
|
|
service.beta.kubernetes.io/exoscale-loadbalancer-name: "shorashim"
|
|
spec:
|
|
type: LoadBalancer
|
|
selector:
|
|
app.kubernetes.io/name: shorashim
|
|
ports:
|
|
- port: 80
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
name: http
|