---
id: w1/m19/t008
title: External pointers: DNS to the new Traefik LB, rotate CI kubeconfig secrets
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m19/t006]
---

## Objective

Point the world at the new cluster: DNS records to the new Traefik LB IP, and refresh every credential that referenced the old cluster.

## Context

- DNS: dashboard.bex.co + the `*.onbex.co` wildcard -> new `bex-traefik` LB public IP (find via hcloud API).
- CI secrets: deploy.yml/app-cluster.yml derive kubeconfigs dynamically (terraform state + clusterctl) - after t007's pivot, app-cluster.yml's mgmt-cluster steps are OBSOLETE: rewrite it to target the app cluster directly (kubeconfig from a sealed secret or SSH to a CP node), or fold its addon steps into deploy.yml.
- Local operator kubeconfigs: regenerate whatever infra/local/ or ~/.kube entries pointed at the old endpoints.

## Steps

1. Update DNS; rewrite the workflow's cluster-access steps for the self-managed world; verify cert-manager reissues LE certs for the domains on the new cluster.

## Files

- .github/workflows/app-cluster.yml (post-pivot access path)
- DNS provider (operational)
- docs/ADR004-deployment.md if the flow description changes

## Acceptance criteria

- [ ] https://dashboard.bex.co serves from the new cluster with a valid LE cert.
- [ ] A tenant app URL under *.onbex.co serves.
- [ ] Both workflows run green against the self-managed cluster.

## Out of scope

- New tenant onboarding flows (unchanged).
