284313f908
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz Source: /opt/alga-psa on psa.joliet.tech
helm template sebastian sebastian_helm
helm install sebastian . --create-namespace --kubeconfig ~/.kube/config-hv-dev -n msp
helm list
helm upgrade sebastian --kubeconfig ~/.kube/config-dev . -n msp
sudo helm template sebastian helm -f values.draft.yaml > deployment.yaml
Istio/Vault networking
- The chart sets
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"by default when you enable Vault annotations, so Vault Agent can reach Vault without Envoy during init. - You can fine-tune via values:
istio.sidecar.excludeOutboundPorts(list, default ["8200"]) – bypass Envoy for these ports.istio.sidecar.excludeOutboundIPRanges(string CIDRs) – optionally bypass by IP ranges.istio.sidecar.includeOutboundIPRanges(string CIDRs) – optionally restrict Envoy egress ranges.
Upgrade example
helm upgrade sebastian . -n msp -f values.yaml
Istio Gateway + VirtualService (optional)
Enable Istio-managed ingress when you terminate TLS upstream (e.g., Cloudflare) and send HTTP to the cluster.
-
Label the namespace for injection:
- kubectl label ns msp istio-injection=enabled --overwrite
- or: kubectl label ns msp istio.io/rev=default --overwrite
-
Enable the templates and set hosts:
helm upgrade --install sebastian . -n msp
--set istio.enabled=true
--set istio.gateway.selector.istio=ingress
--set istio.hosts={sebastian.9minds.ai,green-sebastian.9minds.ai,blue-sebastian.9minds.ai,istio.9minds.ai}
--set istio.routes.default.service=sebastian-green
--set istio.routes.default.port=3000
--set istio.routes.green.host=green-sebastian.9minds.ai
--set istio.routes.green.service=sebastian-green
--set istio.routes.green.port=3000
--set istio.routes.blue.host=blue-sebastian.9minds.ai
--set istio.routes.blue.service=sebastian-blue
--set istio.routes.blue.port=3000
Notes:
- Only HTTP (port 80) is exposed by the Gateway. Terminate TLS at your reverse proxy (e.g., Cloudflare) and target the origin URL: http://istio-ingress.istio-system.svc.cluster.local:80
- The default apex host routes to green. Adjust to your needs.