The platform-engineer ArgoCD account was created in argocd-cm.yaml but
no argocd-rbac-cm.yaml existed, so ArgoCD's default-deny policy blocked
all API calls with 'permission denied'. This grants the account read
access to applications, clusters, repositories, and projects, plus the
ability to trigger syncs — exactly what the platform-engineer bot needs.
CronJobs were using bare image name 'myorg-assistant:latest' with
imagePullPolicy: IfNotPresent and no imagePullSecrets. K8s tried to
pull from Docker Hub → ImagePullBackOff on all 4 running CronJob pods.
Changed to git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
(matching the Deployment), imagePullPolicy: Always, and added
imagePullSecrets: gitea-registry to all 5 CronJob manifests.
Survey of dashboards that could be built from existing and not-yet-enabled
metrics across the cluster's services (traefik, coredns, metallb, cert-manager,
phoenix, litellm, gitea, postgres, etc.), with per-service enable steps and
a recommended priority order.
Minecraft Java Edition uses raw TCP on port 25565, not HTTP. The previous
ClusterIP Service + HTTP Ingress (Traefik 80/443) could not carry TCP 25565
traffic, so minecraft.rogi.casa:25565 was unreachable.
- Change Service to LoadBalancer with fixed IP 10.88.20.103 (dmz-pool),
matching the pihole-dns pattern, so port 25565 is exposed directly.
- Remove the dead HTTP ingress (it routed HTTP to a TCP game port).
HA runs with hostNetwork on roger-nucbox-evo-x2 while Traefik runs on the
raspberrypi node, so requests arrive at HA from 10.88.20.11. The previous
trusted_proxies entry (10.88.88.0/24) did not include this address, causing
HA to reject X-Forwarded-For and return 400 on every ingress request.
The ServiceMonitor CRD (monitoring.coreos.com) is not installed because this
cluster runs a standalone Prometheus deployment, not the Prometheus Operator.
The manifest itself noted 'only apply if Prometheus Operator is installed'.
Removing it unblocks the phoenix app sync.
The ingresses referenced a Cloudflare OriginIssuer 'prod-issuer' whose CRD
and controller are not installed in the cluster, so cert-manager could not
issue certs and Traefik served a default cert (invalid SSL). Switch to the
existing letsencrypt-prod ClusterIssuer with specific hostnames + per-app
secrets, matching the working ingresses (http-01 cannot issue wildcards).
