Paul Payne
4d983819c9
feat(synapse): update ingress to use traefik ingress class and bump version feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration fix(taiga): update liveness and readiness probes to use tcpSocket for health checks fix(taiga): change PVC access mode to ReadWriteMany for media and static storage feat(traefik): add icon and ignore rules for traefik service docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments feat(ushahidi): implement dedicated Redis deployment for Ushahidi fix(vllm): update deployment strategy and readiness/liveness probes for improved stability fix(writefreely): pin writefreely image version to v0.15.1 for consistency docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior
1.9 KiB
Traefik
"No available server" after redeploy [WC-SEL]
If a Deployment was originally created without kustomize labels in its selector, re-deploying cannot fix it — spec.selector is immutable once set. The Service selector updates (it's mutable) but pods won't match it, leaving the Service with no endpoints.
Symptom: Traefik returns "No available server" even though pods are Running.
Diagnosis:
kubectl get endpoints <app> -n <namespace>
# shows <none> — pods aren't matching the service
kubectl get pods -n <namespace> --show-labels
# pod labels don't include app: <name> / managedBy: kustomize / partOf: wild-cloud
Fix: delete the Deployment and re-deploy:
kubectl delete deployment <name> -n <ns>
wild app deploy <app>
Same-origin iframes
The global Traefik security-headers middleware sets X-Frame-Options: SAMEORIGIN. Apps that embed their own sub-pages in iframes (e.g. Etherpad's pad editor) work correctly with this setting.
DENY was the previous setting and broke same-origin iframes. If you see:
Blocked a frame with origin "https://..." from accessing a cross-origin frame
the app is likely creating a same-origin iframe that a stale DENY header is blocking. Verify the cluster's Traefik middleware is using SAMEORIGIN.
Note: route-level Traefik middlewares run before entrypoint middlewares on the response path. A per-app middleware cannot override the global one.
TLS-terminating reverse proxy (DISABLE_HTTPS)
Some apps (e.g. Zulip) redirect port 80 → HTTPS internally. When Traefik terminates TLS and forwards plain HTTP, this causes an infinite redirect loop.
Set these env vars to disable the internal redirect and trust the forwarded proto:
- name: DISABLE_HTTPS
value: "true"
- name: LOADBALANCER_IPS
value: "10.244.0.0/16" # Kubernetes pod CIDR (Flannel default)
Also update liveness/readiness probes from HTTPS port 443 to HTTP port 80.