Switch to authelia-controller

infra/kyverno-policies/generate-authelia-acl.yaml

@@ -1,71 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: generate-authelia-acl
-  annotations:
-    policies.kyverno.io/title: Generate Authelia ACL
-    policies.kyverno.io/category: Other
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Secret
-    kyverno.io/kyverno-version: 1.7.0
-    policies.kyverno.io/minversion: 1.7.0
-    kyverno.io/kubernetes-version: "1.23"
-spec:
-  rules:
-    - name: update-from-base
-      match:
-        any:
-          - resources:
-              kinds:
-                - Secret
-              names:
-                - authelia-acl
-              namespaces:
-                - authelia
-      context:
-        - name: rules
-          apiCall:
-            urlPath: "/api/v1/configmaps"
-            jmesPath: 'join('''', items[?metadata.annotations."config.huizinga.dev/fragment"==''authelia-acl''].data.rules)'
-      mutate:
-        patchStrategicMerge:
-          stringData:
-            "configuration.acl.yaml": |
-              access_control:
-                rules:
-                  {{ replace_all(base64_decode(request.object.data.rules || ''), '
-              ', '
-                  ') }}{{ replace_all(rules, '
-              ', '
-                  ') }}
-
-    - name: update-from-fragment
-      match:
-        any:
-          - resources:
-              kinds:
-                - ConfigMap
-              annotations:
-                config.huizinga.dev/fragment: authelia-acl
-      context:
-        - name: rules
-          apiCall:
-            urlPath: "/api/v1/configmaps"
-            jmesPath: 'join('''', items[?metadata.annotations."config.huizinga.dev/fragment"==''authelia-acl''].data.rules)'
-      mutate:
-        mutateExistingOnPolicyUpdate: true
-        targets:
-          - apiVersion: v1
-            kind: Secret
-            name: authelia-acl
-            namespace: authelia
-        patchStrategicMerge:
-          stringData:
-            "configuration.acl.yaml": |
-              access_control:
-                rules:
-                  {{ replace_all(base64_decode(target.data.rules || ''), '
-              ', '
-                  ') }}{{ replace_all(rules, '
-              ', '
-                  ') }}

infra/kyverno-policies/kustomization.yaml

@@ -2,5 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./kube-vip-network-adapter.yaml
-  - ./generate-authelia-acl.yaml
-  - ./restart-on-secret-change.yaml

infra/kyverno-policies/restart-on-secret-change.yaml

@@ -1,43 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: restart-deployment-on-secret-change
-  annotations:
-    policies.kyverno.io/title: Restart Deployment On Secret Change
-    policies.kyverno.io/category: Other
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Deployment
-    kyverno.io/kyverno-version: 1.7.0
-    policies.kyverno.io/minversion: 1.7.0
-    kyverno.io/kubernetes-version: "1.23"
-spec:
-  mutateExistingOnPolicyUpdate: false
-  rules:
-    - name: update-secret
-      skipBackgroundRequests: false
-      match:
-        any:
-          - resources:
-              kinds:
-                - Secret
-              names:
-                - authelia-acl
-              namespaces:
-                - authelia
-      preconditions:
-        all:
-          - key: "{{request.operation || 'BACKGROUND'}}"
-            operator: Equals
-            value: UPDATE
-      mutate:
-        targets:
-          - apiVersion: apps/v1
-            kind: Deployment
-            name: authelia
-            namespace: authelia
-        patchStrategicMerge:
-          spec:
-            template:
-              metadata:
-                annotations:
-                  config.huizinga.dev/triggerRestart: "{{request.object.metadata.resourceVersion}}"