From eb99e351dc1f95d45c37a7f962b8b8adb7f27cc7 Mon Sep 17 00:00:00 2001
From: Suriya <tenext@Suriyas-MacBook-Air.local>
Date: Mon, 20 Jul 2026 10:14:11 +0530
Subject: [PATCH] Swap webhook Ingress for a NodePort service

No new A record could be added for a dedicated webhook host, so expose
Flux's webhook-receiver directly via NodePort instead of going through
Traefik/Ingress/DNS - same approach the deliveries LoadBalancer already
uses on 30662.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 clusters/production/webhook-ingress.yaml      | 23 -------------------
 .../production/webhook-service-nodeport.yaml  | 19 +++++++++++++++
 2 files changed, 19 insertions(+), 23 deletions(-)
 delete mode 100644 clusters/production/webhook-ingress.yaml
 create mode 100644 clusters/production/webhook-service-nodeport.yaml

diff --git a/clusters/production/webhook-ingress.yaml b/clusters/production/webhook-ingress.yaml
deleted file mode 100644
index 899a7e3..0000000
--- a/clusters/production/webhook-ingress.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# Dedicated host so this never shares a routing table with
-# queue.workolik.com, which already has a Gateway + Ingress conflict history.
-# Requires a DNS A record for flux-webhook.workolik.com pointing at the same
-# LB IP the other *.workolik.com hosts use.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: flux-webhook-ingress
-  namespace: flux-system
-  annotations:
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: flux-webhook.workolik.com
-    http:
-      paths:
-      - path: /hook
-        pathType: Prefix
-        backend:
-          service:
-            name: webhook-receiver
-            port:
-              number: 80
diff --git a/clusters/production/webhook-service-nodeport.yaml b/clusters/production/webhook-service-nodeport.yaml
new file mode 100644
index 0000000..7dd87e5
--- /dev/null
+++ b/clusters/production/webhook-service-nodeport.yaml
@@ -0,0 +1,19 @@
+# Exposes Flux's webhook-receiver directly via NodePort, bypassing
+# Traefik/Ingress/DNS entirely - no A record needed. Selector matches the
+# notification-controller pod labels from Flux's own bundled manifests; if
+# `kubectl get endpoints webhook-receiver-external -n flux-system` comes up
+# empty after this applies, check the pod's real labels with
+# `kubectl get pods -n flux-system --show-labels` and fix the selector below.
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-receiver-external
+  namespace: flux-system
+spec:
+  type: NodePort
+  selector:
+    app: notification-controller
+  ports:
+  - port: 80
+    targetPort: 9292
+    protocol: TCP