bigbang-tracer · phase c sentinel
You hit test.orc.hemble.com.
If you're reading this with a green padlock in the address bar, the full TLS + DNS + ingress chain is up.
Host: test.orc.hemble.com
What had to work for this page to render
- DNS resolutionRoute53
test.orc.hemble.comALIAS, written by external-dns, pointing at the Foundation-managed NLB. - NLB reachabilityInternet-facing NLB (
modules/ingress/aws_nlb) forwarding:443 → :30443on the RKE2 nodes. - NodePortServer-node SG opened on
30443bymodules/ingress/node_sg_rules. - L7 routingingress-nginx (DaemonSet,
externalTrafficPolicy: Local) routing byHostheader to the test-app Service. - TLSReal Let's Encrypt cert issued by cert-manager via DNS-01 against Route53, stored in Secret
test-app-tls. - GitOps reconciliationFoundation pushed the gitops repo to the in-cluster gitea, flux pulled the tag, applied this Deployment + Ingress.