wip: more or less working argo and cilium helmfile setup

2025-05-16 15:30:01 +02:00
parent ddc95aad80
commit 223149ecdd
37 changed files with 582 additions and 100 deletions
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-spire
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-server
-  namespace: cilium-spire
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: "8081"
-              protocol: TCP
@@ -1,22 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-test
-spec:
-  egress:
-    - toEndpoints:
-        - {}
-    - toEntities:
-        - cluster
-    - toEntities:
-        - remote-node
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - cluster
-    - fromEntities:
-        - world
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-acme-solvers
-spec:
-  description: Policy for ingress for Acme Solvers.
-  endpointSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,24 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-dns
-spec:
-  description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-        - rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchExpressions:
-      - key: io.kubernetes.pod.namespace
-        operator: NotIn
-        values:
-          - kube-system
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-mariadb-operator
-spec:
-  description: allow mariadb instances to be reached by operator
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: mariadb
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: mariadb-operator
-            io.kubernetes.pod.namespace: mariadb-operator
-      toPorts:
-        - ports:
-            - port: "3306"
-              protocol: TCP
@@ -1,20 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-spec:
-  description: Policy for egress for CNPG Backups.
-  egress:
-    - toFQDNs:
-      {{- range .Values.s3.hosts }}
-        - matchName: {{ . | quote }}
-      {{- end }}
-      {{- range .Values.s3.patterns }}
-        - matchPattern: {{ . | quote }}
-      {{- end }}
-    - toCIDR:
-      {{- range .Values.s3.cidr }}
-        - {{ . | quote }}
-      {{- end }}
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: cilium-health-checks
-spec:
-  description: Health checks
-  egress:
-    - toEntities:
-        - remote-node
-  endpointSelector:
-    matchLabels:
-      reserved:health: ""
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,9 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: deny-all
-spec:
-  description: Deny all
-  egress: []
-  endpointSelector: {}
-  ingress: []
@@ -1,38 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
-spec:
-  destination:
-    namespace: argocd
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.cluster_config.manifests }}
-    targetRevision: HEAD
-    path: helmfiles/argocd
-    plugin:
-      name: helmfile
-      env:
-        - name: CLUSTER_NAME
-          value: {{ .Values.cluster_config.name }}
-        - name: HELMFILE_ENVIRONMENT
-          value: {{ .environment }}
-  {{/* - repoURL: {{ .Values.cluster_config.manifests }} */}}
-  {{/*   path: {{ .Values.cluster_config.policies }}/argocd */}}
-  {{/*   targetRevision: HEAD */}}
-  project: sys
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-    {{- if .Values.argocd.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
@@ -1,65 +0,0 @@
-{{- if .Values.cilium.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cilium
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
-spec:
-  destination:
-    namespace: kube-system
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.cluster_config.manifests }}
-    targetRevision: HEAD
-    ref: manifests
-  {{- if .Values.cilium.spire.enabled }}
-  - repoURL: {{ .Values.cluster_config.manifests }}
-    path: {{ .Values.cluster_config.policies }}/cilium-spire
-    targetRevision: HEAD
-  {{- end }}
-  - repoURL: 'https://helm.cilium.io'
-    targetRevision: {{ .Values.cilium.version }}
-    chart: cilium
-    helm:
-      valuesFiles:
-      - $manifests/values/cilium/values.yaml
-      - $manifests/values/cilium/values-{{ .Values.cluster_config.name }}.yaml
-      ignoreMissingValueFiles: true
-  project: sys
-  syncPolicy:
-    syncOptions:
-    - ServerSideApply=true
-    {{- if .Values.cilium.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
-  ignoreDifferences:
-    - group: apps
-      jqPathExpressions:
-        - .spec.volumeClaimTemplates
-      kind: StatefulSet
-      name: spire-server
-    - group: monitoring.coreos.com
-      jqPathExpressions:
-        - .spec.endpoints[]?.relabelings[]?.action
-      kind: ServiceMonitor
-    - group: ''
-      jsonPointers:
-        - /data/ca.crt
-      kind: ConfigMap
-      name: hubble-ca-cert
-    - group: ''
-      jsonPointers:
-        - /data/ca.crt
-        - /data/ca.key
-      kind: Secret
-      name: cilium-ca
-    - group: ''
-      jqPathExpressions:
-        - .spec.ports[]?.nodePort
-      kind: Service
-      name: cilium-ingress
-{{- end }}
@@ -1,23 +0,0 @@
-{{if and (.Values.cilium.enabled) (.Values.cilium.loadbalancerPool.enabled )}}
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: "loadbalancer"
-spec:
-  blocks:
-  {{- range .Values.cilium.loadbalancerPool.cidr}}
-  - cidr: {{ . }}
-  {{- end }}
---
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: policy
-spec:
-  nodeSelector:
-    matchExpressions:
-      - key: node-role.kubernetes.io/control-plane
-        operator: DoesNotExist
-  externalIPs: true
-  loadBalancerIPs: true
-{{- end}}