I stopped pushing large images to Harbor because the pushes kept failing. The cause was a default in Traefik, which I had adopted only because ingress-nginx was retired.

It took me a while to see that, and the reason is the useful part. Every metric I had said the system was healthy.

The setup

The cluster is new and runs on bare metal. Only HTTP and HTTPS need to be reachable from outside. Everything else is consumed inside the private network or the cluster, where eBGP handles routing fine.

For the public side I used Cloudflare Tunnel. A tunnel needs no public IP on the cluster. Cilium's L2 announcements were still beta and send all inbound traffic for an address to a single node, so I didn't want to build the edge on them. The tunnel also removed two chores.…