Skip to content

Traefik edge (WAN edge v1)

What is it?

The edge is how the platform is reached from the internet. Per ADR-0006 (WAN exception for a bounded v1 window), the two edge nodes expose the RKE2-bundled Traefik directly on their WAN IPs — no L4 load-balancing layer (VRRP+IPVS+DSR is deferred until an external-client service lands). Traefik runs in hostNetwork mode with the Gateway API provider enabled, so plain Gateway/HTTPRoute objects are the ingress programming surface.

How is it mounted?

  • Chart: rke2-traefik 40.1.009 (RKE2 addon), configured in place by the HelmChartConfig rke2-traefik in kube-system (kubernetes/edge/helmchartconfig-rke2-traefik-edge.yaml — the exact live-verified valuesContent at F2 merge, apply t_64e49873, run 239): hostNetwork: true, entryPoints web=:8000 / websecure=:8443 (hostPort = containerPort, chart contract), providers.kubernetesGateway enabled, nodeSelector + toleration pinning the DaemonSet to wetopi.io/role=edge nodes only (zero Traefik pods on CPs/platform workers).
  • Public 80/443 contract: the edge_lb Ansible role nftables policy REDIRECTs WAN+LAN 80→8000 and 443→8443 in the edge host netns. The Gateway listeners deliberately sit on 8000/8443 — declaring 80/443 there yields PortUnavailable and an un-Accepted Gateway (the live failure that shaped F2 lead decision A).
  • Gateway API objects: GatewayClass wetopi-edge (controllerName: traefik.io/gateway-controller) and Gateway kube-system/wetopi-edge — listeners web (8000, allowedRoutes from: Same) and https (8443, TLS Terminate, from: All).
  • TLS: the https listener certificateRefs (same-namespace Secrets): wetopi-edge-default-cert (90-day bootstrap self-signed, F2), argo-tls, docs-tls, vault-tls (LE PROD, issued by cert-manager — adding a ref whose Secret is missing takes down the WHOLE listener; fail-safe apply order documented per entry in gateway-wetopi-edge.yaml).
  • HTTPRoutes on the Gateway (live set): docs-site (ns docs-site), argo + argo-http-redirect (kube-system co-location, argo Basic-Auth Middleware), vault (ns vault, path-filtered deny-first), and the F3 acceptance edge-test-tls name.
  • Nodes: rke-wan01 / rke-wan02 (edge role, WAN IPs 79.137.114.193/.194; DNS-owned via tofu tfvars).

Diagram

flowchart LR
  WAN["internet (WAN 80/443)"]
  subgraph EDGE["edge nodes rke-wan01/02 (hostNetwork)"]
    NFT["nftables edge_lb: 80->8000, 443->8443"]
    TRAEF["Traefik DS (rke2-traefik 40.1.009) — entryPoints 8000/8443"]
  end
  GW["Gateway wetopi-edge (kube-system) — https TLS Terminate; certs: bootstrap + argo-tls + docs-tls + vault-tls"]
  subgraph ROUTES["HTTPRoutes"]
    RD["docs-site route (ns docs-site)"]
    RA["argo route + basic-auth (ns kube-system)"]
    RV["vault route, deny-first (ns vault)"]
  end
  BACK["backends: docs-site / argocd-server / vault-ui Services"]
  WAN --> NFT --> TRAEF --> GW --> RD & RA & RV --> BACK

How is it deployed?

Bootstrap-time, not GitOps-managed: the HelmChartConfig and the GatewayClass/Gateway objects are applied from wetopi-ops01 with kubectl after the edge nodes join (an RKE2 addon HelmChartConfig cannot be installed by the Cilium-style chart flow — the chart already exists; RKE2's packaged addon reconciler drives upgrades). Verify gates after apply: helm job Complete, DS 2/2 on edge nodes only, :8000/:8443 LISTEN in the host netns, 80/443 answered via the redirect. Gateway certificateRefs deltas (certs for new services) are reviewed declarative changes with a mandatory "Certificate Ready → THEN apply Gateway" ordering (see each Certificate header).

Dependencies

Depends on: edge nodes + the edge_lb nftables role (Ansible); the RKE2 bundled chart (version rides the RKE2 pin); cert-manager for every LE certificate on the https listener (SVC-CERT-MANAGER); DNS (tofu-owned A records) per hostname.

Depended on by: every public service of the v1 window — docs.wetopi.net (SVC-DOCS-SITE), argo.wetopi.net (SVC-ARGOCD), vault.wetopi.net (SVC-VAULT), and the F3 acceptance name edge-test.wetopi.net. Any future external-client service must land the L4 layer first (ADR-0006).

Operation

  • Health: kubectl -n kube-system get gateway wetopi-edge — Accepted=True, Programmed=True, https listener ResolvedRefs=True; ss -tlnp on each edge node shows *:8000 + *:8443; per-route HTTPRoute status Accepted=True with the parent resolved.
  • Adding a service: (1) Certificate in kube-system, wait --for=condition=Ready; (2) add the certificateRef entry to the Gateway (reviewed change on kubernetes/edge/gateway-wetopi-edge.yaml); (3) HTTPRoute + optional Basic-Auth Middleware (one htpasswd Secret per service — never shared); (4) DNS A records (tofu apply).
  • Rollback: remove the certificateRef entry (git revert of the Gateway delta) — the listener falls back to the remaining certs; the Secret stays (cert-manager keeps renewing it).
  • Runbooks: infra repo kubernetes/edge/README.md (F2 shape + gates), per-service READMEs under kubernetes/<service>/.

Estado honesto (live, 2026-08-31)

DEPLOYED. F2 applied 2026-08-30 (task t_64e49873, all gates green): Gateway Accepted+Programmed, both listeners healthy, edge_lb redirect live, three HTTPRoutes attached (docs, argo, vault) with the four certificateRefs in place. v1 window is bounded by ADR-0006 — the L4 layer remains mandatory before any external-client service.

  • Repo: platform-edge/kubernetes/edge
  • Manifests (GitHub): kubernetes/edge (GatewayClass, Gateway, HelmChartConfig), ansible/roles/edge_lb (nftables redirect)
  • Vault (https://vault.wetopi.net → project wetopi-harness): the edge currently holds no Vault-sourced material; per-service htpasswd Secrets (argo-basic-auth, docs-basic-auth) are operator-managed cluster Secrets with the Vault as the long-term home (ADR-0009).
  • Related docs: ADR-0006 (the exception + 2-layer auth posture), services index.