infra/foundation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: infra:a63ffea58af2fa196e61999c3ff4862a29c05d9e
Branches Tags
infra:main
..
compare: infra:main
Branches Tags
infra:main

11 Commits
a63ffea58a ... main

Author SHA1 Message Date
Dreaded_X
d5e336c80b feat: Added patch for restoring database
All checks were successful
kustomization/flux-system/7f3678ff reconciliation succeeded
kustomization/lldap/7f3678ff reconciliation succeeded
kustomization/spegel/7f3678ff reconciliation succeeded
kustomization/longhorn-jobs/7f3678ff reconciliation succeeded
kustomization/cilium-config/7f3678ff reconciliation succeeded
kustomization/reflector/7f3678ff reconciliation succeeded
kustomization/alerts/7f3678ff reconciliation succeeded
kustomization/cilium/7f3678ff reconciliation succeeded
kustomization/cert-manager/7f3678ff reconciliation succeeded
kustomization/local-path-provisioner/7f3678ff reconciliation succeeded
kustomization/longhorn/7f3678ff reconciliation succeeded
kustomization/cnpg/7f3678ff reconciliation succeeded
kustomization/certificates/7f3678ff reconciliation succeeded
 2025-12-19 04:05:10 +01:00
Dreaded_X
28dab8e5f4 feat: Added lldap 2025-12-19 04:04:07 +01:00
Dreaded_X
fad4d94dc0 feat: Allow cnpg garage credentials reflection 2025-12-18 03:50:57 +01:00
Dreaded_X
bf226ea855 feat: Add reflector 2025-12-18 03:50:33 +01:00
Dreaded_X
dd873c296d feat: Redirect http to https 2025-12-18 03:50:33 +01:00
Dreaded_X
e0babc5b5f feat: Added default gateway 2025-12-18 03:50:32 +01:00
Dreaded_X
995eddb4e8 feat: Move certificates to default namespace 2025-12-18 03:50:32 +01:00
Dreaded_X
e2bd3ae33f feat: Setup cilium L2 announcements and IP pool 2025-12-18 03:50:32 +01:00
Dreaded_X
35472754c0 feat: Move spegel to apps 2025-12-18 03:50:31 +01:00
Dreaded_X
9154fafaef feat: Put ClusterIssuer under certificates 2025-12-18 03:50:31 +01:00
Dreaded_X
c0b51106f2 feat: Added barman cloud plugin 2025-12-18 03:50:19 +01:00
47 changed files with 590 additions and 13 deletions
Expand all files Collapse all files

5
apps/artifacts.yaml
View File

@@ -14,3 +14,8 @@ spec:
copy: copy:
- from: "@foundation/apps/spegel/**" - from: "@foundation/apps/spegel/**"
to: "@artifact/" to: "@artifact/"
- name: lldap
originRevision: "@foundation"
copy:
- from: "@foundation/apps/lldap/**"
to: "@artifact/"

16
apps/lldap/base/cluster-restore.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: lldap-db
spec:
bootstrap:
recovery:
source: source
externalClusters:
- name: source
plugin:
name: barman-cloud.cloudnative-pg.io
parameters:
barmanObjectName: garage-store
serverName: lldap-db
plugins: []

15
apps/lldap/base/cluster.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: db
namespace: lldap
# TODO: Add labels?
spec:
storage:
size: 8Gi
storageClass: local-path
plugins:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
barmanObjectName: garage-store

80
apps/lldap/base/deployment.yaml Normal file
View File

@@ -0,0 +1,80 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: lldap
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
spec:
selector:
matchLabels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
template:
metadata:
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
spec:
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: lldap
image: lldap/lldap:2025-12-12-alpine-rootless
env:
- name: LLDAP_LDAP_BASE_DN
value: dc=huizinga,dc=dev
- name: LLDAP_LDAP_USER_PASS
valueFrom:
secretKeyRef:
name: credentials
key: admin-pass
- name: LLDAP_KEY_SEED
valueFrom:
secretKeyRef:
name: credentials
key: key-seed
- name: LLDAP_JWT_SECRET
valueFrom:
secretKeyRef:
name: credentials
key: jwt-secret
- name: LLDAP_DATABASE_URL
valueFrom:
secretKeyRef:
name: db-app
key: uri
- name: TZ
value: CET
livenessProbe:
exec:
command:
- /app/lldap
- healthcheck
initialDelaySeconds: 5
periodSeconds: 30
ports:
- name: ldap
containerPort: 3890
- name: web
containerPort: 17170
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL

13
apps/lldap/base/http-route.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: lldap
namespace: lldap
spec:
parentRefs:
- name: gateway
namespace: default
rules:
- backendRefs:
- name: lldap
port: 17170

17
apps/lldap/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,17 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- cluster.yaml
- schedule-backup.yaml
- deployment.yaml
- service.yaml
- http-route.yaml
- secret-s3-garage.yaml
- object-store.yaml
# Uncomment to restore database from backup
# patches:
# - path: cluster-restore.yaml
# target:
# kind: Cluster

2
configs/certificates/base/namespace.yaml → apps/lldap/base/namespace.yaml
View File

@@ -1,4 +1,4 @@
apiVersion: v1 apiVersion: v1
kind: Namespace kind: Namespace
metadata: metadata:
name: certificates name: lldap

8
controllers/cnpg/staging/object-store.yaml → apps/lldap/base/object-store.yaml
View File

@@ -2,11 +2,10 @@ apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore kind: ObjectStore
metadata: metadata:
name: garage-store name: garage-store
namespace: cnpg-system namespace: lldap
spec: spec:
configuration: configuration:
destinationPath: s3://cnpg-backup/ destinationPath: s3://cnpg-backup/lldap
endpointURL: http://192.178.1.1:3900
s3Credentials: s3Credentials:
accessKeyId: accessKeyId:
name: s3-garage name: s3-garage
@@ -14,5 +13,8 @@ spec:
secretAccessKey: secretAccessKey:
name: s3-garage name: s3-garage
key: ACCESS_SECRET_KEY key: ACCESS_SECRET_KEY
region:
name: s3-garage
key: REGION
wal: wal:
compression: gzip compression: gzip

13
apps/lldap/base/schedule-backup.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
name: daily-backup
namespace: lldap
spec:
schedule: "0 0 0 * * *"
backupOwnerReference: self
method: plugin
pluginConfiguration:
name: barman-cloud.cloudnative-pg.io
cluster:
name: db

9
apps/lldap/base/secret-s3-garage.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
kind: Secret
metadata:
name: s3-garage
namespace: lldap
annotations:
reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
type: Opaque
data: {}

19
apps/lldap/base/service.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: v1
kind: Service
metadata:
name: lldap
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
spec:
selector:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
ports:
- name: ldap
port: 3890
targetPort: ldap
- name: web
port: 17170
targetPort: web

21
apps/lldap/lldap.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: lldap
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 5m
dependsOn:
- name: cnpg
sourceRef:
kind: ExternalArtifact
name: lldap
decryption:
provider: sops
secretRef:
name: sops-gpg
path: ./${cluster_env}
prune: true
wait: true

6
apps/lldap/production/cluster.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: db
spec:
instances: 2

7
apps/lldap/production/deployment.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: lldap
namespace: lldap
spec:
replicas: 2

8
apps/lldap/production/http-route.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: lldap
namespace: lldap
spec:
hostnames:
- "users.huizinga.dev"

15
apps/lldap/production/kustomization.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secret-credentials.enc.yaml
patches:
- path: deployment.yaml
target:
kind: Deployment
- path: cluster.yaml
target:
kind: Cluster
- path: http-route.yaml
target:
kind: HTTPRoute

59
apps/lldap/production/secret-credentials.enc.yaml Normal file
View File

@@ -0,0 +1,59 @@
apiVersion: v1
kind: Secret
metadata:
name: credentials
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
type: Opaque
data:
jwt-secret: ENC[AES256_GCM,data:yUAsoCIEXH491Ko4wEAAevSETdMFuhypNzuU2th5zlLd9hbVKqsjclvCTLDD8aW0Y9Lv70pzzAADPwFCKNH/rXx0DzaGOP139kLRYDHafz3RYeuoJjgBGw==,iv:x3EmPbbL/aj9CbwF8lleDL+nhlidPU8R3hwXygtj7D8=,tag:XD4C/pwFLFmDryBW7NqsWg==,type:str]
key-seed: ENC[AES256_GCM,data:3jWLtfny+ahtSkkmUdbg+wFbSGIcCxOv9BxVr0oNLTetXrAx+OcZ6dKp1ktj0J9aYEppqVuANUlfqyVzhIQXOT5GomQ+9jPC4uLmIz9tu1LAcfv9zuGl/w==,iv:e3aAI6JWq16YaUZqvKulkHyhLb8eWy9t2ni/jGeNFow=,tag:sZEEvxlq145klFkEMsUOuA==,type:str]
#ENC[AES256_GCM,data:AnCuvbVM6M62wuWmpUx3u/5WdaCo1T7eCvbY30okKbmWnvM0HQT2gGDTuhIaOlc=,iv:Ho+/CAvs69VJ+uwAIH8LVL344qlDaK5z3AvzWh/Jgm0=,tag:uNfN1P7lmWKBuCY7eiywDw==,type:comment]
admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
sops:
age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-----END AGE ENCRYPTED FILE-----
- recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-17T02:58:02Z"
mac: ENC[AES256_GCM,data:yxmBIqS+KMr2Dp4eKslT1oNCcq2VEnGh4g3e7mkZzWjT6xPTdBEH8bT+c2XIFMWHJSUFoI7YyhvS1p5VgRBudaDyQCOk7tzyj0nkGiepZc1uYjSVO7VQ9CnfcdiD9AZ2srUjkcUoBaRfi2u6Qh2pPUUwMd4z8ms8v0CSk1qw0FE=,iv:V2rw624TN+pSGuq+JjVqM2bKozn7hGAykHV+638wo14=,tag:cdDascdYzzG33GztMd0Fdg==,type:str]
pgp:
- created_at: "2025-12-17T00:53:29Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
/V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
/riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
=j+fd
-----END PGP MESSAGE-----
fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
encrypted_regex: ^(data|stringData)$
version: 3.11.0

6
apps/lldap/staging/cluster.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: db
spec:
instances: 1

7
apps/lldap/staging/deployment.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: lldap
namespace: lldap
spec:
replicas: 1

8
apps/lldap/staging/http-route.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: lldap
namespace: lldap
spec:
hostnames:
- "users.staging.huizinga.dev"

18
apps/lldap/staging/kustomization.yaml Normal file
View File

@@ -0,0 +1,18 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- secret-credentials.enc.yaml
patches:
- path: deployment.yaml
target:
kind: Deployment
- path: cluster.yaml
target:
kind: Cluster
- path: object-store.yaml
target:
kind: ObjectStore
- path: http-route.yaml
target:
kind: HTTPRoute

8
apps/lldap/staging/object-store.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: garage-store
namespace: lldap
spec:
configuration:
endpointURL: http://192.168.1.1:3900

58
apps/lldap/staging/secret-credentials.enc.yaml Normal file
View File

@@ -0,0 +1,58 @@
apiVersion: v1
kind: Secret
metadata:
name: credentials
namespace: lldap
labels:
app.kubernetes.io/name: lldap
app.kubernetes.io/instance: lldap
type: Opaque
data:
jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
sops:
age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-----END AGE ENCRYPTED FILE-----
- recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-17T00:53:29Z"
mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
pgp:
- created_at: "2025-12-17T00:53:29Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
/V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
/riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
=j+fd
-----END PGP MESSAGE-----
fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
encrypted_regex: ^(data|stringData)$
version: 3.11.0

3
clusters/testing/kustomization.yaml
View File

@@ -9,11 +9,14 @@ resources:
- ../../controllers/longhorn/longhorn.yaml - ../../controllers/longhorn/longhorn.yaml
- ../../controllers/local-path-provisioner/local-path-provisioner.yaml - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
- ../../controllers/cnpg/cnpg.yaml - ../../controllers/cnpg/cnpg.yaml
- ../../controllers/reflector/reflector.yaml
- ../../configs/artifacts.yaml - ../../configs/artifacts.yaml
- ../../configs/cilium-config/cilium-config.yaml
- ../../configs/certificates/certificates.yaml - ../../configs/certificates/certificates.yaml
- ../../configs/alerts/alerts.yaml - ../../configs/alerts/alerts.yaml
- ../../configs/longhorn-jobs/longhorn-jobs.yaml - ../../configs/longhorn-jobs/longhorn-jobs.yaml
- ../../apps/artifacts.yaml - ../../apps/artifacts.yaml
- ../../apps/spegel/spegel.yaml - ../../apps/spegel/spegel.yaml
- ../../apps/lldap/lldap.yaml

5
configs/artifacts.yaml
View File

@@ -9,6 +9,11 @@ spec:
kind: GitRepository kind: GitRepository
name: flux-system name: flux-system
artifacts: artifacts:
- name: cilium-config
originRevision: "@foundation"
copy:
- from: "@foundation/configs/cilium-config/**"
to: "@artifact/"
- name: certificates - name: certificates
originRevision: "@foundation" originRevision: "@foundation"
copy: copy:

2
configs/certificates/base/certificate-huizinga-dev.yaml
View File

@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate kind: Certificate
metadata: metadata:
name: huizinga-dev name: huizinga-dev
namespace: certificates namespace: default
spec: spec:
secretName: huizinga-dev-tls secretName: huizinga-dev-tls
issuerRef: issuerRef:

1
configs/certificates/base/kustomization.yaml
View File

@@ -1,7 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- namespace.yaml
- certificate-huizinga-dev.yaml - certificate-huizinga-dev.yaml
- secret-cloudflare-token.enc.yaml - secret-cloudflare-token.enc.yaml
- cluster-issuer.yaml - cluster-issuer.yaml

2
configs/certificates/production/certificate-huizinga-dev.yaml
View File

@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate kind: Certificate
metadata: metadata:
name: huizinga-dev name: huizinga-dev
namespace: certificates namespace: default
spec: spec:
commonName: "huizinga.dev" commonName: "huizinga.dev"
dnsNames: dnsNames:

2
configs/certificates/staging/certificate-huizinga-dev.yaml
View File

@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate kind: Certificate
metadata: metadata:
name: huizinga-dev name: huizinga-dev
namespace: certificates namespace: default
spec: spec:
commonName: "staging.huizinga.dev" commonName: "staging.huizinga.dev"
dnsNames: dnsNames:

9
configs/cilium-config/base/cilium-l2-announcement-policy.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
name: default-policy
spec:
interfaces:
- ^eth[0-9]+
externalIPs: true
loadBalancerIPs: true

24
configs/cilium-config/base/gateway.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway
namespace: default
spec:
gatewayClassName: cilium
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: Same
- name: https
protocol: HTTPS
port: 443
tls:
certificateRefs:
- kind: Secret
name: huizinga-dev-tls
allowedRoutes:
namespaces:
from: All

15
configs/cilium-config/base/http-route-http-filter-redirect.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-filter-redirect
namespace: default
spec:
parentRefs:
- name: gateway
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

6
configs/cilium-config/base/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cilium-l2-announcement-policy.yaml
- gateway.yaml
- http-route-http-filter-redirect.yaml

17
configs/cilium-config/cilium-config.yaml Normal file
View File

@@ -0,0 +1,17 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium-config
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 15m
dependsOn:
- name: cilium
sourceRef:
kind: ExternalArtifact
name: cilium-config
path: ./${cluster_env}
prune: true
wait: true

7
configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: default-pool
spec:
blocks:
- cidr: 10.0.2.100/24

5
configs/cilium-config/production/kustomization.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- cilium-load-balancer-ip-pool.yaml

8
configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: default-pool
spec:
blocks:
- start: 192.168.1.100
stop: 192.168.1.200

5
configs/cilium-config/staging/kustomization.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- cilium-load-balancer-ip-pool.yaml

5
controllers/artifacts.yaml
View File

@@ -39,3 +39,8 @@ spec:
copy: copy:
- from: "@foundation/controllers/cnpg/**" - from: "@foundation/controllers/cnpg/**"
to: "@artifact/" to: "@artifact/"
- name: reflector
originRevision: "@foundation"
copy:
- from: "@foundation/controllers/reflector/**"
to: "@artifact/"

2
controllers/cnpg/cnpg.yaml
View File

@@ -12,7 +12,7 @@ spec:
secretRef: secretRef:
name: sops-gpg name: sops-gpg
dependsOn: dependsOn:
- cert-manager - name: cert-manager
sourceRef: sourceRef:
kind: ExternalArtifact kind: ExternalArtifact
name: cnpg name: cnpg

1
controllers/cnpg/staging/kustomization.yaml
View File

@@ -3,7 +3,6 @@ kind: Kustomization
resources: resources:
- ../base - ../base
- secret-s3-garage.enc.yaml - secret-s3-garage.enc.yaml
- object-store.yaml
configMapGenerator: configMapGenerator:
- name: values-overlay - name: values-overlay

9
controllers/cnpg/staging/secret-s3-garage.enc.yaml
View File

@@ -3,10 +3,13 @@ kind: Secret
metadata: metadata:
name: s3-garage name: s3-garage
namespace: cnpg-system namespace: cnpg-system
annotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
type: Opaque type: Opaque
stringData: stringData:
ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str] ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
SECRET_ACCESS_KEY: ENC[AES256_GCM,data:mc42T/AQ8NRi32SzvwGJA6LEq1x0Yz3Tu+CPDYPf+E2+C00zQcGRk6tACPvRoMxRzU4ZZpK346e2K/8ajU77hg==,iv:Isxe81aQEbI5xd1dRjXDKj/2Jp9eTHdv0/XVBBHoRyE=,tag:gtcmKmfUIfIy977Df11P4g==,type:str] ACCESS_SECRET_KEY: ENC[AES256_GCM,data:INipEOcpPSij6TDu+bCuMOdsGm58nEBC4UJfEGRqeMmXZ9A+EBrMiRL6z3s29uz4qdqwZ3C8E4PVz01/41bMEA==,iv:x+gku8q7efHaaMpD/dc19IrwmK2gDp04bjH8WN/xhkc=,tag:QiSF6B8IqMrCsOUCe8c0bw==,type:str]
REGION: ENC[AES256_GCM,data:WIGPWwii,iv:ZdP5uNYqa8CZxa/xyrYXxGvE9fzt95slzwpzSzRy9DY=,tag:yANYtLzJCL/1pcvBXY7X7g==,type:str]
sops: sops:
age: age:
- recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
@@ -27,8 +30,8 @@ sops:
K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9 K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A== 2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-15T03:46:42Z" lastmodified: "2025-12-18T02:50:50Z"
mac: ENC[AES256_GCM,data:UG9rSQ4ep7Ln4g5QCtvD6U90Oc8iWpni+kypMpJ+AQM8LC0TTs9zFQgcxmo2wjZn38Fp+br/5KC172SqBNG4Q1yXhlRiqiIeyx9ynrZeceRSqHaaruB1hj83/0FwahqjB/t6yutWIfnp00UC92mMKGlef48UNZ8IW17e5uHE0m4=,iv:LvR4BEkgAr6PJ8fYATFois4j8/rgztn/Jggj/mFgCIk=,tag:W38qDd1RkCdK3bVMqOVnjA==,type:str] mac: ENC[AES256_GCM,data:+kfs0EDnnZNnHMf91P6rAN52lugHFO4XcNJiKLpXt7bfTSMbiwgVbvRElXGTbLXLVSz70uZyzV/mt0ZcfEfPbwE/Pdh6SmFiWwQwLT1M50MdrxAWWYvSCS9r4h1Cow3N3K2/dXH7N/4AVHTg3ohXlP92fxVh1wL0cVnke/lcQgY=,iv:M5n9+lgq0fBx5Yg1e0N6v0obbnmarvVwIHAjCr5XmM4=,tag:NBA01MtG40T3nST7b00tiw==,type:str]
pgp: pgp:
- created_at: "2025-12-11T23:56:15Z" - created_at: "2025-12-11T23:56:15Z"
enc: |- enc: |-

23
controllers/reflector/helm-release.yaml Normal file
View File

@@ -0,0 +1,23 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: reflector
namespace: reflector
spec:
interval: 12h
install:
strategy:
name: RetryOnFailure
retryInterval: 2m
upgrade:
strategy:
name: RetryOnFailure
retryInterval: 3m
chart:
spec:
chart: reflector
version: "9.1.x"
sourceRef:
kind: HelmRepository
name: reflector
interval: 24h

9
controllers/reflector/helm-repository.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: reflector
namespace: reflector
spec:
type: "oci"
interval: 24h
url: oci://ghcr.io/emberstack/helm-charts

6
controllers/reflector/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-repository.yaml
- helm-release.yaml

4
controllers/reflector/namespace.yaml Normal file
View File

@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: reflector

15
controllers/reflector/reflector.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: reflector
namespace: flux-system
spec:
interval: 1h
retryInterval: 2m
timeout: 5m
sourceRef:
kind: ExternalArtifact
name: reflector
path: ./
prune: true
wait: true