- Staging cluster werkend tot op phase 6 van cluster-install.md, inclusief HTTPS, Bunny, verificatie service.

scaleway/manifests/base/applications/verification/00-configmaps.yaml

@@ -1,15 +1,3 @@
-# staging-test-setup.yaml
-# Complete test and debug setup for EveAI staging environment
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: eveai-staging
-  labels:
-    environment: staging
-    app: eveai
-
----
 # ConfigMap with HTML content for the test interface
 apiVersion: v1
 kind: ConfigMap
@@ -331,172 +319,51 @@ data:
             add_header Content-Type text/plain;
         }
         
-        # Health endpoint
+        # Handle /verify prefix paths - NEW
+        location /verify/health {
+            try_files /health.html =404;
+        }
+        
+        location /verify/info {
+            try_files /info.html =404;
+        }
+        
+        location /verify/headers {
+            try_files /headers.html =404;
+        }
+        
+        location /verify/network {
+            try_files /network.html =404;
+        }
+        
+        # /verify root - serve main interface
+        location /verify/ {
+            try_files /index.html =404;
+        }
+        
+        location /verify {
+            try_files /index.html =404;
+        }
+        
+        # Original paths (for direct access)
         location /health {
             try_files /health.html =404;
         }
         
-        # Info endpoint
         location /info {
             try_files /info.html =404;
         }
         
-        # Headers analysis
         location /headers {
             try_files /headers.html =404;
         }
         
-        # Network tests
         location /network {
             try_files /network.html =404;
         }
         
-        # Main interface - serve index.html for all other requests
+        # Main interface - serve index.html for root
         location / {
             try_files $uri $uri/ /index.html;
         }
-    }
-
----
-# Verification service deployment
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: verify-service
-  namespace: eveai-staging
-  labels:
-    app: verify-service
-    component: verification
-    environment: staging
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: verify-service
-  template:
-    metadata:
-      labels:
-        app: verify-service
-        component: verification
-    spec:
-      containers:
-      - name: nginx
-        image: nginx:alpine
-        ports:
-        - containerPort: 80
-        volumeMounts:
-        - name: html-content
-          mountPath: /usr/share/nginx/html
-        - name: nginx-config
-          mountPath: /etc/nginx/conf.d
-        resources:
-          requests:
-            memory: "32Mi"
-            cpu: "50m"
-          limits:
-            memory: "64Mi"
-            cpu: "100m"
-        livenessProbe:
-          httpGet:
-            path: /verify/health
-            port: 80
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /verify/health
-            port: 80
-          initialDelaySeconds: 5
-          periodSeconds: 5
-      volumes:
-      - name: html-content
-        configMap:
-          name: verify-content
-      - name: nginx-config
-        configMap:
-          name: verify-nginx-config
-
----
-# Service for the verification app
-apiVersion: v1
-kind: Service
-metadata:
-  name: verify-service
-  namespace: eveai-staging
-  labels:
-    app: verify-service
-spec:
-  selector:
-    app: verify-service
-  ports:
-  - port: 80
-    targetPort: 80
-    name: http
-  type: ClusterIP
-
----
-# Ingress rules with path-based routing
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: eveai-staging-ingress
-  namespace: eveai-staging
-  labels:
-    app: eveai
-    environment: staging
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: evie-staging.askeveai.com
-    http:
-      paths:
-      # Verification service paths
-      - path: /verify
-        pathType: Prefix
-        backend:
-          service:
-            name: verify-service
-            port:
-              number: 80
-
-      # Future services (commented out for now)
-      # Admin service (not deployed yet)
-      # - path: /admin
-      #   pathType: Prefix
-      #   backend:
-      #     service:
-      #       name: admin-service
-      #       port:
-      #         number: 80
-
-      # API service (not deployed yet)
-      # - path: /api
-      #   pathType: Prefix
-      #   backend:
-      #     service:
-      #       name: api-service
-      #       port:
-      #         number: 8000
-
-      # Client/Frontend service (not deployed yet)
-      # - path: /client
-      #   pathType: Prefix
-      #   backend:
-      #     service:
-      #       name: client-service
-      #       port:
-      #         number: 3000
-
-      # Default: root path to verification service
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: verify-service
-            port:
-              number: 80
+    }

scaleway/manifests/base/applications/verification/01-deployment.yaml

@@ -0,0 +1,57 @@
+# Verification service deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: verify-service
+  namespace: eveai-staging
+  labels:
+    app: verify-service
+    component: verification
+    environment: staging
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: verify-service
+  template:
+    metadata:
+      labels:
+        app: verify-service
+        component: verification
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - name: html-content
+          mountPath: /usr/share/nginx/html
+        - name: nginx-config
+          mountPath: /etc/nginx/conf.d
+        resources:
+          requests:
+            memory: "32Mi"
+            cpu: "50m"
+          limits:
+            memory: "64Mi"
+            cpu: "100m"
+        livenessProbe:
+          httpGet:
+            path: /verify/health
+            port: 80
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /verify/health
+            port: 80
+          initialDelaySeconds: 5
+          periodSeconds: 5
+      volumes:
+      - name: html-content
+        configMap:
+          name: verify-content
+      - name: nginx-config
+        configMap:
+          name: verify-nginx-config

scaleway/manifests/base/applications/verification/02-service.yaml

@@ -0,0 +1,16 @@
+# Service for the verification app
+apiVersion: v1
+kind: Service
+metadata:
+  name: verify-service
+  namespace: eveai-staging
+  labels:
+    app: verify-service
+spec:
+  selector:
+    app: verify-service
+  ports:
+  - port: 80
+    targetPort: 80
+    name: http
+  type: ClusterIP

scaleway/manifests/base/applications/verification/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- 00-configmaps.yaml
+- 01-deployment.yaml
+- 02-service.yaml
+
+labels:
+- pairs:
+    app: verify-service
+    component: verification

scaleway/manifests/base/infrastructure/00-namespaces.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eveai-staging
+  labels:
+    environment: staging
+    app: eveai
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+  labels:
+    environment: staging
+    app: monitoring

scaleway/manifests/base/infrastructure/03-cluster-issuers.yaml

@@ -0,0 +1,15 @@
+# ClusterIssuer for Let's Encrypt staging (test first)
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: pieter@askeveai.com
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+    - http01:
+        ingress:
+          class: nginx

scaleway/manifests/base/infrastructure/cert-manager-values.yaml

@@ -0,0 +1,52 @@
+# cert-manager-values.yaml
+# Global configuration
+global:
+  leaderElection:
+    namespace: "cert-manager"
+
+# Install CRDs as part of Helm release (alternative to manual install)
+# installCRDs: false  # We install manually above
+
+# Resource configuration
+resources:
+  limits:
+    cpu: 100m
+    memory: 128Mi
+  requests:
+    cpu: 10m
+    memory: 32Mi
+
+# Webhook configuration
+webhook:
+  resources:
+    limits:
+      cpu: 100m
+      memory: 128Mi
+    requests:
+      cpu: 10m
+      memory: 32Mi
+
+# CA Injector configuration
+cainjector:
+  resources:
+    limits:
+      cpu: 100m
+      memory: 128Mi
+    requests:
+      cpu: 10m
+      memory: 32Mi
+
+# Security context
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1001
+
+# Node selector (optional)
+# nodeSelector:
+#   kubernetes.io/os: linux
+
+# Prometheus monitoring (disabled - no Prometheus operator installed)
+prometheus:
+  enabled: false
+  servicemonitor:
+    enabled: false

scaleway/manifests/base/infrastructure/ingress-values.yaml

@@ -0,0 +1,46 @@
+# ingress-values.yaml
+controller:
+  # Disable admission webhook to prevent ACME challenge validation issues
+  admissionWebhooks:
+    enabled: false
+  # Service configuratie
+  service:
+    type: LoadBalancer
+    loadBalancerIP: "51.159.25.49"  # Jouw huidige IP
+    annotations:
+      # Scaleway specifieke annotaties
+      service.beta.kubernetes.io/scw-loadbalancer-use-hostname: "true"
+      service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v1: "false"
+      service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v2: "false"
+
+  # Resource limits (optioneel, maar aanbevolen)
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+
+  # Replica's voor high availability (optioneel)
+  replicaCount: 1
+
+  # Node selector (optioneel, voor specific nodes)
+  # nodeSelector:
+  #   kubernetes.io/os: linux
+
+  # Metrics (voor monitoring later)
+  metrics:
+    enabled: true
+    service:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "10254"
+
+# Default backend (optioneel)
+defaultBackend:
+  enabled: true
+  image:
+    registry: registry.k8s.io
+    image: defaultbackend-amd64
+    tag: "1.5"

scaleway/manifests/base/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- infrastructure/00-namespaces.yaml
+- infrastructure/01-ingress-controller.yaml
+- infrastructure/02-cert-manager.yaml
+- infrastructure/03-cluster-issuers.yaml
+- applications/verification/
+- networking/ingress-https.yaml
+- secrets/scaleway-secrets.yaml
+- monitoring/
+
+labels:
+- pairs:
+    app: eveai
+    managed-by: kustomize

scaleway/manifests/base/monitoring/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: monitoring
+
+helmCharts:
+- name: kube-prometheus-stack
+  repo: https://prometheus-community.github.io/helm-charts
+  version: "55.5.0"
+  releaseName: monitoring
+  namespace: monitoring
+  valuesFile: values-monitoring.yaml
+
+commonLabels:
+  environment: staging
+  managed-by: kustomize

scaleway/manifests/base/monitoring/prometheus-values.yaml

@@ -0,0 +1,71 @@
+# prometheus-values.yaml
+# Global settings
+fullnameOverride: "monitoring"
+
+# Prometheus configuration
+prometheus:
+  prometheusSpec:
+    retention: 15d
+    resources:
+      limits:
+        cpu: 500m
+        memory: 2Gi
+      requests:
+        cpu: 100m
+        memory: 512Mi
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 10Gi
+
+# Grafana configuration
+grafana:
+  enabled: true
+  adminPassword: "admin123"  # Change this for production
+  resources:
+    limits:
+      cpu: 200m
+      memory: 256Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  persistence:
+    enabled: true
+    size: 2Gi
+
+# AlertManager configuration
+alertmanager:
+  alertmanagerSpec:
+    resources:
+      limits:
+        cpu: 100m
+        memory: 256Mi
+      requests:
+        cpu: 10m
+        memory: 64Mi
+    storage:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 2Gi
+
+# Node Exporter
+nodeExporter:
+  enabled: true
+
+# Kube State Metrics
+kubeStateMetrics:
+  enabled: true
+
+# Disable components you might not need in staging
+kubeEtcd:
+  enabled: false
+kubeScheduler:
+  enabled: false
+kubeControllerManager:
+  enabled: false

scaleway/manifests/base/monitoring/values-monitoring.yaml

@@ -0,0 +1,131 @@
+# Prometheus Community Helm Chart Values
+# For kube-prometheus-stack
+
+# Global settings
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+# Prometheus configuration
+prometheus:
+  prometheusSpec:
+    retention: 30d
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: scw-bssd
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 50Gi
+
+    # External services monitoring (Scaleway managed services)
+    additionalScrapeConfigs:
+      - job_name: 'scaleway-redis'
+        static_configs:
+          - targets: ['redis-endpoint:6379']
+        metrics_path: /metrics
+        scrape_interval: 30s
+
+      - job_name: 'scaleway-postgresql'
+        static_configs:
+          - targets: ['postgres-endpoint:5432']
+        metrics_path: /metrics
+        scrape_interval: 30s
+
+    # Resource limits
+    resources:
+      requests:
+        memory: 2Gi
+        cpu: 500m
+      limits:
+        memory: 4Gi
+        cpu: 1000m
+
+# Grafana configuration
+grafana:
+  adminPassword: "admin123"  # Change in production
+  persistence:
+    enabled: true
+    storageClassName: scw-bssd
+    size: 10Gi
+
+  # Resource limits
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 512Mi
+      cpu: 200m
+
+  # Pre-configured dashboards
+  dashboardProviders:
+    dashboardproviders.yaml:
+      apiVersion: 1
+      providers:
+      - name: 'eveai-dashboards'
+        folder: 'EveAI'
+        type: file
+        options:
+          path: /var/lib/grafana/dashboards/eveai
+
+  # Ingress configuration (will be handled by main ingress)
+  ingress:
+    enabled: false
+
+# Pushgateway for batch jobs
+pushgateway:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+  resources:
+    requests:
+      memory: 64Mi
+      cpu: 50m
+    limits:
+      memory: 128Mi
+      cpu: 100m
+
+# AlertManager
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: scw-bssd
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 10Gi
+    resources:
+      requests:
+        memory: 128Mi
+        cpu: 50m
+      limits:
+        memory: 256Mi
+        cpu: 100m
+
+# Node Exporter
+nodeExporter:
+  enabled: true
+
+# Kube State Metrics
+kubeStateMetrics:
+  enabled: true
+
+# Disable components we don't need
+kubeApiServer:
+  enabled: false
+kubelet:
+  enabled: true
+kubeControllerManager:
+  enabled: false
+coreDns:
+  enabled: true
+kubeEtcd:
+  enabled: false
+kubeScheduler:
+  enabled: false
+kubeProxy:
+  enabled: false

scaleway/manifests/base/networking/ingress-http-acme.yaml

@@ -0,0 +1,44 @@
+# Temporary HTTP-only ingress for ACME certificate challenges
+# Use this temporarily while Let's Encrypt validates domain ownership
+# Remove this file and revert to ingress-https.yaml once certificate is Ready
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: eveai-staging-ingress
+  namespace: eveai-staging
+  labels:
+    app: eveai
+    environment: staging
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - evie-staging.askeveai.com
+    secretName: evie-staging-tls
+  rules:
+  - host: evie-staging.askeveai.com
+    http:
+      paths:
+      # Verification service paths
+      - path: /verify
+        pathType: Prefix
+        backend:
+          service:
+            name: verify-service
+            port:
+              number: 80
+
+      # Default: root path to verification service
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: verify-service
+            port:
+              number: 80

scaleway/manifests/base/networking/ingress-https.yaml

@@ -0,0 +1,80 @@
+# HTTPS-only ingress with TLS configuration
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: eveai-staging-ingress
+  namespace: eveai-staging
+  labels:
+    app: eveai
+    environment: staging
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - evie-staging.askeveai.com
+    secretName: evie-staging-tls
+  rules:
+  - host: evie-staging.askeveai.com
+    http:
+      paths:
+      # Verification service paths
+      - path: /verify
+        pathType: Prefix
+        backend:
+          service:
+            name: verify-service
+            port:
+              number: 80
+      
+      # Future services (ready for deployment)
+      # Admin service
+      # - path: /admin
+      #   pathType: Prefix
+      #   backend:
+      #     service:
+      #       name: eveai-app-service
+      #       port:
+      #         number: 80
+      
+      # API service
+      # - path: /api
+      #   pathType: Prefix
+      #   backend:
+      #     service:
+      #       name: eveai-api-service
+      #       port:
+      #         number: 80
+      
+      # Client/Frontend service
+      # - path: /client
+      #   pathType: Prefix
+      #   backend:
+      #     service:
+      #       name: eveai-chat-client-service
+      #       port:
+      #         number: 80
+      
+      # Monitoring (when deployed)
+      # - path: /monitoring
+      #   pathType: Prefix
+      #   backend:
+      #     service:
+      #       name: monitoring-grafana
+      #       port:
+      #         number: 80
+      
+      # Default: root path to verification service
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: verify-service
+            port:
+              number: 80

scaleway/manifests/base/secrets/eveai-external-secrets.yaml

@@ -0,0 +1,38 @@
+# eveai-external-secrets.yaml
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: eveai-external-secrets
+  namespace: eveai-staging
+spec:
+  refreshInterval: 300s
+  secretStoreRef:
+    name: scaleway-secret-store
+    kind: SecretStore
+  target:
+    name: eveai-secrets
+    creationPolicy: Owner
+  dataFrom:
+  # Alle keys uit eveai-postgresql secret
+  - extract:
+      key: name:eveai-postgresql
+  # Alle keys uit eveai-redis secret
+  - extract:
+      key: name:eveai-redis
+  # Alle keys uit eveai-openai secret
+  - extract:
+      key: name:eveai-openai
+  # Alle keys uit eveai-mistral secret
+  - extract:
+      key: name:eveai-mistral
+  # Alle keys uit eveai-app-keys secret
+  - extract:
+      key: name:eveai-app-keys
+  # Alle keys uit eveai-object-storage secret
+  - extract:
+      key: name:eveai-object-storage
+  data:
+    # Certificaat als aparte data entry
+    - secretKey: REDIS_CERT
+      remoteRef:
+        key: name:eveai-redis-certificate

scaleway/manifests/base/secrets/scaleway-secret-store.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: scaleway-secret-store
+  namespace: eveai-staging
+spec:
+  provider:
+    scaleway:
+#      apiUrl: "https://api.scaleway.com"
+      region: "fr-par"
+      projectId: "ad7d2ed9-252b-4b2a-9f4c-daca3edc4c4b"  # Vervang met je Scaleway project ID
+      accessKey:
+        secretRef:
+          name: scaleway-credentials
+          key: access-key
+      secretKey:
+        secretRef:
+          name: scaleway-credentials
+          key: secret-key

scaleway/manifests/overlays/staging/kustomization.yaml

@@ -0,0 +1,29 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Reference base components
+resources:
+- ../../base/
+
+# Staging-specific configuration
+namePrefix: ""
+nameSuffix: ""
+
+commonLabels:
+  environment: staging
+  managed-by: kustomize
+
+# Images (can be overridden for staging-specific versions)
+images:
+- name: nginx
+  newTag: alpine
+
+# ConfigMap and Secret generators for staging-specific values
+configMapGenerator:
+- name: staging-config
+  literals:
+  - ENVIRONMENT=staging
+  - LOG_LEVEL=INFO
+  - DEBUG=false
+
+# Note: Namespace is handled per resource to avoid conflicts

scaleway/manifests/staging/cert-manager-setup.yaml

@@ -1,88 +0,0 @@
-# cert-manager-setup.yaml
-# Install cert-manager for automatic SSL certificate management
-
-# Install cert-manager CRDs first
-# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.crds.yaml
-
-# cert-manager namespace
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
-
----
-# ClusterIssuer for Let's Encrypt staging (test first)
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    email: pieter@askeveai.com  # CHANGE THIS
-    privateKeySecretRef:
-      name: letsencrypt-staging
-    solvers:
-    - http01:
-        ingress:
-          class: nginx
-
----
-# ClusterIssuer for Let's Encrypt production
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-prod
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: pieter@askeveai.com  # CHANGE THIS
-    privateKeySecretRef:
-      name: letsencrypt-prod
-    solvers:
-    - http01:
-        ingress:
-          class: nginx
-
----
-# Updated ingress with TLS configuration
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: eveai-staging-ingress-https
-  namespace: eveai-staging
-  labels:
-    app: eveai
-    environment: staging
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    # Use staging issuer first for testing
-    cert-manager.io/cluster-issuer: letsencrypt-staging
-    # After verification, switch to: letsencrypt-prod
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - evie-staging.askeveai.com
-    secretName: evie-staging-tls
-  rules:
-  - host: evie-staging.askeveai.com
-    http:
-      paths:
-      - path: /verify
-        pathType: Prefix
-        backend:
-          service:
-            name: verify-service
-            port:
-              number: 80
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: verify-service
-            port:
-              number: 80

scaleway/manifests/staging/ingress-controller-setup.yaml

@@ -1,285 +0,0 @@
-# ingress-controller-setup.yaml
-# NGINX Ingress Controller voor gebruik met externe LoadBalancer
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-
----
-# Ingress Controller Deployment
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/part-of: ingress-nginx
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/part-of: ingress-nginx
-    spec:
-      serviceAccountName: ingress-nginx
-      containers:
-      - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.8.2
-        lifecycle:
-          preStop:
-            exec:
-              command:
-              - /wait-shutdown
-        args:
-        - /nginx-ingress-controller
-        - --election-id=ingress-controller-leader
-        - --controller-class=k8s.io/ingress-nginx
-        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
-        - --validating-webhook=:8443
-        - --validating-webhook-certificate=/usr/local/certificates/cert
-        - --validating-webhook-key=/usr/local/certificates/key
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-            add:
-            - NET_BIND_SERVICE
-          runAsUser: 101
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: LD_PRELOAD
-          value: /usr/local/lib/libmimalloc.so
-        ports:
-        - name: http
-          containerPort: 80
-          protocol: TCP
-        - name: https
-          containerPort: 443
-          protocol: TCP
-        - name: webhook
-          containerPort: 8443
-          protocol: TCP
-        livenessProbe:
-          failureThreshold: 5
-          httpGet:
-            path: /healthz
-            port: 10254
-            scheme: HTTP
-          initialDelaySeconds: 10
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /healthz
-            port: 10254
-            scheme: HTTP
-          initialDelaySeconds: 10
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        resources:
-          requests:
-            cpu: 100m
-            memory: 90Mi
-        volumeMounts:
-        - mountPath: /usr/local/certificates/
-          name: webhook-cert
-          readOnly: true
-      volumes:
-      - name: webhook-cert
-        secret:
-          secretName: ingress-nginx-admission
-
----
-# NodePort Service - Dit is waar je LoadBalancer naar wijst!
-apiVersion: v1
-kind: Service
-metadata:
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-spec:
-  type: NodePort
-  ports:
-  - port: 80
-    targetPort: 80
-    protocol: TCP
-    name: http
-    nodePort: 30080  # Externe LoadBalancer wijst naar dit poort op elke node
-  - port: 443
-    targetPort: 443
-    protocol: TCP
-    name: https
-    nodePort: 30443  # Voor HTTPS traffic
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-
----
-# ServiceAccount en RBAC
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ingress-nginx
-  namespace: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-rules:
-- apiGroups: [""]
-  resources: ["configmaps", "endpoints", "nodes", "pods", "secrets", "namespaces"]
-  verbs: ["list", "watch"]
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["list", "watch"]
-- apiGroups: [""]
-  resources: ["nodes"]
-  verbs: ["get"]
-- apiGroups: [""]
-  resources: ["services"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["networking.k8s.io"]
-  resources: ["ingresses"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [""]
-  resources: ["events"]
-  resourceNames: ["ingress-nginx-controller"]
-  verbs: ["get", "list", "watch", "create", "update", "patch"]
-- apiGroups: ["networking.k8s.io"]
-  resources: ["ingresses/status"]
-  verbs: ["update"]
-- apiGroups: ["networking.k8s.io"]
-  resources: ["ingressclasses"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["discovery.k8s.io"]
-  resources: ["endpointslices"]
-  verbs: ["list", "watch", "get"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ingress-nginx
-  namespace: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-rules:
-- apiGroups: [""]
-  resources: ["namespaces"]
-  verbs: ["get"]
-- apiGroups: [""]
-  resources: ["configmaps", "pods", "secrets", "endpoints"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [""]
-  resources: ["services"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["networking.k8s.io"]
-  resources: ["ingresses"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["networking.k8s.io"]
-  resources: ["ingressclasses"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  resourceNames: ["ingress-controller-leader"]
-  verbs: ["get", "update"]
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["create"]
-- apiGroups: [""]
-  resources: ["events"]
-  verbs: ["create", "patch"]
-- apiGroups: ["discovery.k8s.io"]
-  resources: ["endpointslices"]
-  verbs: ["list", "watch", "get"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ingress-nginx
-  namespace: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ingress-nginx
-subjects:
-- kind: ServiceAccount
-  name: ingress-nginx
-  namespace: ingress-nginx
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ingress-nginx
-subjects:
-- kind: ServiceAccount
-  name: ingress-nginx
-  namespace: ingress-nginx
-
----
-# ConfigMap voor Ingress Controller configuratie
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-data:
-  allow-snippet-annotations: "true"
-
----
-# IngressClass definitie
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  name: nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-spec:
-  controller: k8s.io/ingress-nginx