wip: try nixidy

2024-10-10 16:04:41 +02:00
parent 61379ad665
commit 11b398801d
66 changed files with 55100 additions and 0 deletions
@@ -0,0 +1,65 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
+    nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
+    # nginx.ingress.kubernetes.io/client-body-buffer-size: 64k
+    # nginx.ingress.kubernetes.io/client-header-buffer-size: 64k
+    # nginx.ingress.kubernetes.io/large-client-header-buffers: 4 64k
+    # nginx.ingress.kubernetes.io/proxy-body-size: 500m
+    # nginx.ingress.kubernetes.io/proxy-buffer-size: 64k
+    # nginx.ingress.kubernetes.io/server-snippet: |
+    #   client_header_buffer_size 100k;
+    #   large_client_header_buffers 4 100k;
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,128.39.100.131/32,158.36.88.98/32,158.36.21.21/32,192.30.252.0/22,140.82.112.0/20
+  name: hubble-ui
+  namespace: kube-system
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: hubble.adm.oceanbox.io
+    http:
+      paths:
+      - backend:
+          service:
+            name: hubble-ui
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    # nginx.ingress.kubernetes.io/client-body-buffer-size: 64k
+    # nginx.ingress.kubernetes.io/client-header-buffer-size: 64k
+    # nginx.ingress.kubernetes.io/large-client-header-buffers: 4 64k
+    # nginx.ingress.kubernetes.io/proxy-body-size: 500m
+    # nginx.ingress.kubernetes.io/proxy-buffer-size: 64k
+    # nginx.ingress.kubernetes.io/server-snippet: |
+    #   client_header_buffer_size 100k;
+    #   large_client_header_buffers 4 100k;
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,128.39.100.131/32,158.36.88.98/32,158.36.21.21/32,192.30.252.0/22,140.82.112.0/20
+  name: hubble-ui-oauth2-proxy
+  namespace: kube-system
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: hubble.adm.oceanbox.io
+    http:
+      paths:
+      - backend:
+          service:
+            name: oauth2-proxy
+            port:
+              number: 4180
+        path: /oauth2
+        pathType: Prefix
+  tls:
+  - hosts:
+    - hubble.adm.oceanbox.io
+    secretName: hubble-tls
+
@@ -0,0 +1,63 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: sync-dataprotection-keys
+  namespace: redis
+spec:
+  schedule: "0 12 14 * *" # at noon the 14th of every month
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: sync
+            image: redis
+            command: [ "/bin/sh", "/script/sync.sh" ]
+            env:
+            - name: PROD_REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: prod-redis
+                  key: redis-password
+            - name: STAGING_REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: staging-redis
+                  key: redis-password
+            volumeMounts:
+            - name: script
+              mountPath: /script
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              readOnlyRootFilesystem: false
+              runAsGroup: 0
+              runAsNonRoot: true
+              runAsUser: 1001
+              seccompProfile:
+                type: RuntimeDefault
+          securityContext:
+            fsGroup: 1001
+            fsGroupChangePolicy: Always
+          volumes:
+            - name: script
+              configMap:
+                name: sync-dataprotection-keys-script
+                defaultMode: 0500
+          restartPolicy: Never
+      backoffLimit: 4
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sync-dataprotection-keys-script
+  namespace: redis
+data:
+  sync.sh: |-
+    #!/bin/sh
+    redis-cli -h prod-redis-master -a $PROD_REDIS_PASSWORD -D "" --raw dump DataProtection-Keys |\
+    redis-cli -h staging-redis-master -a $STAGING_REDIS_PASSWORD -X keys restore DataProtection-Keys 0 keys replace
+
+
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vcluster-create-cilium-networkpolicies
+rules:
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumnetworkpolicies
+  verbs:
+  - '*'