chore(k8s): harden Traefik and split offline validation from dry-run

.github/workflows/ops-ci.yml

@@ -40,7 +40,13 @@ jobs:
       - name: Terraform validate
         run: terraform -chdir=terraform validate
 
-      # À activer quand les manifests seront réels (pas des placeholders) :
-      # - name: Validate manifests (kubeconform)
-      #   run: |
-      #     find k8s -name '*.yaml' | xargs kubeconform -strict -ignore-missing-schemas -summary
+      - name: Validate Kubernetes manifests
+        run: |
+          docker run --rm \
+            -v "$PWD:/workspace" \
+            -w /workspace \
+            ghcr.io/yannh/kubeconform:v0.7.0 \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            $(find k8s -name '*.yaml' | sort)

Makefile

@@ -40,10 +40,12 @@ LB         := k8s/traefik/traefik.ingressclass.yaml k8s/traefik/traefik.rbac.yam
               k8s/traefik/traefik.deployment.yaml k8s/traefik/traefik.service.yaml
 # Couche app (placeholders) — décommenter au fil des images publiées :
 # APP      := k8s/server/ k8s/client-web/ k8s/investigation/ k8s/worker/
+READY_MANIFESTS := $(MONITORING) $(DATA) $(LB)
+K8S_MANIFESTS := $(shell find k8s -name '*.yaml' | sort)
 
 .DEFAULT_GOAL := help
 .PHONY: help all infra kubeconfig deploy db-check hosts smoke status destroy \
-        fmt fmt-check validate tf-lint \
+        fmt fmt-check validate dry-run tf-lint \
         metrics hpa pdb load harden soft-affinity hard-affinity \
         minikube minikube-up minikube-deploy minikube-hosts minikube-smoke minikube-down
 
@@ -108,9 +110,19 @@ fmt-check: ## Vérifie le formatage sans rien modifier (miroir CI)
 	npx --yes prettier --check "**/*.{yaml,yml,md,json}"
 	terraform -chdir=$(TF_DIR) fmt -check
 
-validate: ## Valide les manifests k8s (kubeconform) + terraform
-	terraform -chdir=$(TF_DIR) validate || true
-	find k8s -name '*.yaml' -print0 | xargs -0 -I{} sh -c 'kubeconform -strict -summary "{}" || true'
+validate: ## Valide les manifests k8s hors-cluster (kubeconform) + terraform
+	terraform -chdir=$(TF_DIR) init -backend=false -input=false
+	terraform -chdir=$(TF_DIR) validate
+	kubeconform -strict -ignore-missing-schemas -summary $(K8S_MANIFESTS)
+
+dry-run: ## Simule l'application réelle contre un cluster vivant (ignore placeholders)
+	@echo ">> Server-side dry-run de la couche prête (observability + data + traefik)"
+	@timeout 8s kubectl --request-timeout=3s cluster-info >/dev/null 2>/dev/null || { \
+		echo ">> Cluster Kubernetes inaccessible via KUBECONFIG=$(KUBECONFIG)."; \
+		echo ">> Lance minikube ou pointe KUBECONFIG vers DOKS, puis relance make dry-run."; \
+		exit 1; \
+	}
+	kubectl --request-timeout=10s apply --dry-run=server $(addprefix -f ,$(READY_MANIFESTS))
 
 tf-lint: ## Lint terraform (tflint)
 	cd $(TF_DIR) && tflint || true

flake.nix

@@ -20,10 +20,13 @@
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
             kubectl
+            kubeconform
             terraform
+            tflint
             k9s
             kubernetes-helm
             minikube
+            nodejs_22
           ];
 
           shellHook = ''

k8s/traefik/traefik.deployment.yaml

@@ -23,28 +23,49 @@ spec:
       serviceAccountName: traefik-ingress-controller
       affinity:
         podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - traefik
-              topologyKey: "kubernetes.io/hostname"
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app
+                      operator: In
+                      values:
+                        - traefik
+                topologyKey: kubernetes.io/hostname
       containers:
         - name: traefik
-          # Traefik v3 — the CLI flags below (api.insecure, kubernetesingress,
-          # entrypoints) are v2/v3-stable; re-validate on a live cluster when the
-          # app-service manifests stop being placeholders.
           image: traefik:v3.7
           args:
-            - --api.insecure=true
             - --providers.kubernetesingress=true
+            - --providers.kubernetesingress.ingressclass=traefik
             - --entrypoints.web.address=:80
-            - --entrypoints.traefik.address=:8080
+            - --ping=true
+            - --ping.entrypoint=web
           ports:
             - name: web
               containerPort: 80
-            - name: dashboard
-              containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: web
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: web
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 2
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
       restartPolicy: Always

k8s/traefik/traefik.pdb.yaml

@@ -1,7 +1,8 @@
 # PodDisruptionBudget — garde >=1 replica Traefik en service pendant les
 # perturbations volontaires (drain de nœud, rolling update, éviction). Traefik
 # tourne en 2 replicas avec anti-affinity required ; ce PDB protège l'entrée
-# publique du cluster.
+# publique du cluster. L'anti-affinity du Deployment est volontairement
+# "preferred" pour que les labs single-node restent déployables.
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:

k8s/traefik/traefik.rbac.yaml

@@ -20,7 +20,6 @@ rules:
       - list
       - watch
   - apiGroups:
-      - extensions
       - networking.k8s.io
     resources:
       - ingresses
@@ -30,7 +29,6 @@ rules:
       - list
       - watch
   - apiGroups:
-      - extensions
       - networking.k8s.io
     resources:
       - ingresses/status

k8s/traefik/traefik.service.yaml

@@ -14,7 +14,3 @@ spec:
       port: 80
       targetPort: 80
       nodePort: 30021
-    - name: dashboard
-      port: 8080
-      targetPort: 8080
-      nodePort: 30042