External Urls

External URLs Skill

Quick reference for all external URLs and endpoints in Hypera's multi-cluster GitOps infrastructure.

Quick URL Lookup

Application URLs by Environment

Hub (Shared Services)

Development

Production

Cluster API Endpoints

All clusters use Azure Private Link (VPN required):

Repository URLs

Git Repositories (Azure DevOps)

Helm Repositories

Domain Reference

Certificate & DNS

• Certificate Issuer: Let's Encrypt
• DNS Provider: Cloudflare
• ClusterIssuers: letsencrypt-prod, letsencrypt-staging
• Contact: juliano.barbosa@hypera.com.br

SMTP Services

Quick Commands

Check Application URL Health

# Check ArgoCD
curl -sI https://argocd.cafehyna.com.br | head -1

# Check all hub services
for url in argocd.cafehyna.com.br sentry-hub.cafehyna.hypera.com.br sonarqube-hub.cafehyna.com.br dba.cafehyna.com.br; do
  echo -n "$url: "; curl -sI "https://$url" -o /dev/null -w "%{http_code}\n" --connect-timeout 5 2>/dev/null || echo "FAILED"
done

Check Cluster Connectivity

# Test cluster API (requires VPN)
curl -sk https://aks-cafehyna-default-b2ie56p8.5bbf1042-d320-432c-bd11-cea99f009c29.privatelink.eastus.azmk8s.io:443/healthz

# Using kubectl
kubectl --kubeconfig ~/.kube/aks-rg-hypera-cafehyna-hub-config cluster-info

Check Helm Repository

# Add and update
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update ingress-nginx

# Search charts
helm search repo ingress-nginx

Configuration File Locations

URLs are defined in these configuration files:

Troubleshooting

Scripts

• scripts/check-urls.sh - Health check all application URLs
• scripts/list-urls.sh - List URLs by environment or category

Detailed Reference

For complete URL inventory with source file locations:

• references/urls-detail.md - Complete URL reference
• docs/external-urls-reference.md - Full documentation

Gotchas

• Private Link API endpoints require VPN, not just kubeconfig: All privatelink.eastus.azmk8s.io URLs resolve only inside the corporate network. kubectl will hang for 30s then time out — not produce a clear DNS error — when VPN is dropped.
• cafehyna.com.br and cafehyna.hypera.com.br are different zones: Records added to the wrong zone propagate fine and resolve fine in browsers, but cert-manager DNS-01 challenges fail because the ACME validator queries the apex zone's NS records. Verify the zone with dig NS <domain> before adding records.
• adocyl.com.br is the dev-only domain — don't reuse for hub: Cross-environment hostname reuse breaks Let's Encrypt staging vs prod issuer scoping, and SonarQube/Sentry session cookies leak across envs if they share the apex.
• Azure DevOps Git URLs need URL-encoded project names: Cafehyna%20-%20Desenvolvimento%20Web must keep the encoding — raw spaces break git clone with a cryptic 404. The Azure DevOps UI hides this; copy from the SSH tab or use the encoded form.
• smtp.office365.com requires modern auth (OAuth2) since Oct 2022: Basic auth on port 587 is disabled tenant-wide. Apps still configured with username/password silently fail with 535 5.7.139. Use SendGrid or app passwords with MFA bypass.
• East US vs East US 2 cluster mix breaks cross-region pod traffic: painelclientes (EUS2) and cafehyna (EUS) clusters can't share private DNS zones without explicit VNet peering — ingress hostnames resolve but pod-to-pod fails. Check the region column before assuming connectivity.